SQS

•    Simple Queue Service

•    Standard Queue

•    Best effort ordering

•    Send, Receive, Delete

•    Unlimited API call

•    FIFO Queue

•    Message Order, not duplicated

•    3K request per second per message group

•    Feature

•    Retention Periods, Delivery Delay, Receive Message Wait time, Visibility  timeout(prevent dup), dead-letter

https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/welcome.html https://sabarada.tistory.com/119

SNS

•    Simple Notification Service

•    Publish/subscribe model

•    Service to Service communication

•    Subscriber

•    Message protocol • Endpoint

https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/welcome.html https://sabarada.tistory.com/119

Kinesis

•    Streaming data • Unbounded

•    Kinesis

•    Collect, process, store, transmit

•    Kinesis Video Streams

•    Kinesis Data Streams

•    Kinesis Data Firehose

•    Kinesis Data Analytic

https://docs.aws.amazon.com/streams/latest/dev/introduction.html https://aws.amazon.com/streaming-data/ https://btcd.tistory.com/65

QnA

 

저작자표시 (새창열림)

'AWS > AWS Ceritified Solutions Architect' 카테고리의 다른 글

09. DNS, S3, CloudFront  (0) 2023.08.21
08. CloudTrail, CloudWatch, Config  (0) 2023.08.21
07. IAM  (0) 2023.08.21
06. Database  (0) 2023.07.22
05. VPC  (0) 2023.07.21

DNS

  • Domain Name System
  • Mapping domain name and IP
  • AWS Route53
  • Namespace
  • Resolver = Recursive DNS Server
  • = Local Server = Recursor

https://susoterran.github.io/other/dns/

http://wiki.kldp.org/KoreanDoc/html/PoweredByDNS-KLDP/namespace.html

https://hanamon.kr/dns%EB%9E%80-%EB%8F%84%EB%A9%94%EC%9D%B8-%EB%84%A4%EC%9E%84-%EC%8B%9C%EC%8A%A4%ED%85%9C%EA%B0%9C%EB%85%90%EB%B6%80%ED%84%B0-%EC%9E%91%EB%8F%99-%EB%B0%A9%EC%8B%9D%EA%B9%8C%EC%A7%80/ https://inpa.tistory.com/entry/AWS-%F0%9F%93%9A-Route-53-%EA%B0%9C%EB%85%90-%EC%9B%90%EB%A6%AC-%EC%82%AC%EC%9A%A9%EC%84%B8%ED%8C%85-%F0%9F%92%AF-%EC%A0%95%EB%A6%AC

Route53 Hosted Zone / DNS Record Type

• Hosted Zone : domain.name + private/public • DNS Record Type

 

 

https://docs.aws.amazon.com/ko_kr/Route53/latest/DeveloperGuide/resource-record-sets-values-basic.html https://www.joinc.co.kr/w/route_53_cheatsheets https://jenakim47.tistory.com/29

https://www.thousandeyes.com/blog/guide-to-dns-record-types

Route53

•    Domain Registration

•    Domain Management

•    Hosted Zone • Routing Policy

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/Welcome.html

Routing Policy

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html

https://m.blog.naver.com/PostView.naver?isHttpsRedirect=true&blogId=techtrip&logNo=221866566632

Traffic Flow

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/traffic-flow.html

Route53 Resolver

•    recursively to DNS queries

•    from AWS resources

•    for public records

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html

CloudFront

•    CDN : Content Delivery Network

•    speeds up distribution

•    static and dynamic web content

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html

https://aws.amazon.com/cloudfront/features/?whats-new-cloudfront.sort-by=item.additionalFields.postDateTime&whats-new-cloudfront.sortorder=desc#Global_Edge_Network

QnA

 

저작자표시 (새창열림)

'AWS > AWS Ceritified Solutions Architect' 카테고리의 다른 글

10. SQS, Kinesis  (1) 2023.08.21
08. CloudTrail, CloudWatch, Config  (0) 2023.08.21
07. IAM  (0) 2023.08.21
06. Database  (0) 2023.07.22
05. VPC  (0) 2023.07.21

CloudTrail, CloudWatch, Config

•    성능모니터링

•    애플리케이션문제점감지

•    보안문제점감지

•    로그이벤트모니터링

•    Aws 리소스인벤토리관리

•    Cloudtrail : aws 리소스와관련된모든읽기쓰기기록

•    Cloudwatch : 숫자형성능지표및메트릭수집 : threshold – alert

•    Config : 리소스의환경변경설정내역시간에따라어떻게

변화했는지, 비교및기준넘어가면 alert

https://aws.amazon.com/products/storage/

CloudTrail

•    Visibility into your AWS account activity is a key aspect of security and operational best practices

•    CloudTrail uses the following file name format for the log file objects that it delivers to your Amazon S3 bucket

https://docs.aws.amazon.com/ko_kr/awscloudtrail/latest/userguide/cloudtrail-user-guide.html https://tech.cloud.nongshim.co.kr/2018/10/15/2-%EB%84%A4%ED%8A%B8%EC%9B%8C%ED%81%AC-

%EA%B5%AC%EC%B6%95%ED%95%98%EA%B8%B0-3-cloudtrail-%EC%83%9D%EC%84%B1%ED%95%98%EA%B8%B0/

CloudWatch

• monitors your Amazon Web Services (AWS) resources and the applications

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html

Config

• provides a detailed view of the configuration of AWS resources

https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html

QnA

저작자표시 (새창열림)

'AWS > AWS Ceritified Solutions Architect' 카테고리의 다른 글

10. SQS, Kinesis  (1) 2023.08.21
09. DNS, S3, CloudFront  (0) 2023.08.21
07. IAM  (0) 2023.08.21
06. Database  (0) 2023.07.22
05. VPC  (0) 2023.07.21

 IAM

•    IAM : Identity and Access Management

•    a web service that helps you securely control access to AWS resources

•    authenticated (signed in) and authorized (has permissions)

•    AWS account root user

•    don't use the root user for your everyday tasks

https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html

https://docs.aws.amazon.com/ko_kr/IAM/latest/UserGuide/id_roles_terms-and-concepts.html

IAM Features

•    Shared access to your AWS account

•    Granular permissions

•    Secure access to AWS resources for applications that run on EC2

•    Multi-factor authentication (MFA) • FIDO ( FastID Online)

•    Identity federation

•    Identity information for assurance • Integrated with many AWS services

https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html https://en.wikipedia.org/wiki/FIDO_Alliance

Term

•    User : user/application

•    Group : group of user

•    Roles : temp deligate permission • Policy : group of permission • Permission :

https://docs.aws.amazon.com/IAM/latest/UserGuide/id.html

 

https://www.okta.com/kr/identity-101/role-based-access-control-vs-attribute-based-access-

control/#:~:text=RBAC%EC%99%80%20ABAC%EC%9D%98%20%EA%B0%80%EC%9E%A5,%EA%B6%8C%ED%95%9C%EC%9D%84%20%EA%B2%B0 %EC%A0%95%ED%95%A0%20%EC%88%98%20%EC%9E%88%EC%8A%B5%EB%8B%88%EB%8B%A4.

https://www.okta.com/identity-101/what-is-role-based-access-control-rbac/

 

What Is Role-Based Access Control (RBAC)? | Okta

Want to learn more about how your organization can effectively control access for employees and third parties?

www.okta.com

 

Policies

•    AWS Managed Policy

•    Customer Managed Policy

•    Inline Policy

https://aws.amazon.com/products/storage/

Role / Policy / Permission

 

https://whchoi98.gitbook.io/aws-iam/iam-policy

Policy Type

https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html

 

Policies and permissions in IAM - AWS Identity and Access Management

Policies and permissions in IAM You manage access in AWS by creating policies and attaching them to IAM identities (users, groups of users, or roles) or AWS resources. A policy is an object in AWS that, when associated with an identity or resource, defines

docs.aws.amazon.com

Policy Evaluation Logic

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html

 

Policy evaluation logic - AWS Identity and Access Management

Policy evaluation logic When a principal tries to use the AWS Management Console, the AWS API, or the AWS CLI, that principal sends a request to AWS. When an AWS service receives the request, AWS completes several steps to determine whether to allow or den

docs.aws.amazon.com

 

 

QnA

 

 

저작자표시 (새창열림)

'AWS > AWS Ceritified Solutions Architect' 카테고리의 다른 글

09. DNS, S3, CloudFront  (0) 2023.08.21
08. CloudTrail, CloudWatch, Config  (0) 2023.08.21
06. Database  (0) 2023.07.22
05. VPC  (0) 2023.07.21
04. Storage  (0) 2023.07.21

Database

•     RDBMS

•     RDS

•     Aurora

•     Redshift

•     NoSQL

•     DynamoDB

•     ElastiCache

•     DocumentDB

•     Neptune

•     QLDB

•     Keyspace

•     Timestream

https://aws.amazon.com/products/storage/

RDS

•    Relational Database Services

•    DB Engine

•    Aurora Mysql, Aurora PostgreSQL compatitable

•    Oracle, SQL Server, MySQL, PostgreSQL, MariaDB

•    Compared to EC2 hosting • manual install, management

•    RDS hosting

•    Install, DB Upgrade, Backup/Recovery

•    Availability, scalability

•    Can not access to OS, no env change • Can not get db superuser

https://towardsdatascience.com/running-mysql-databases-on-aws-ec2-a-tutorial-for-beginners-4301faa0c247?gi=475061565578

RDS



https://towardsdatascience.com/running-mysql-databases-on-aws-ec2-a-tutorial-for-beginners-4301faa0c247?gi=475061565578

High Availability

•    24x7

•    Up and Running and Accessible

•    <> SPOF

•    Backup/Recovery > Up/Run/Access

•    How to reduce time

•    Redundant

•    Single Master, Active/Standby, Master/Slave ( cf, multi master )

•    Failover with Failover Detection ( Not Active ) • Performance Test > Load Test

https://medium.com/awesome-cloud/aws-difference-between-multi-az-and-read-replicas-in-amazon-rds-60fe848ef53a https://aws.amazon.com/premiumsupport/knowledge-center/rds-fail-over/

RDS HA

https://aws.amazon.com/rds/ha/ https://aws.amazon.com/rds/features/multi-az/

RDS HA

https://medium.com/awesome-cloud/aws-difference-between-multi-az-and-read-replicas-in-amazon-rds-60fe848ef53a

Database HA Failover/SwitchOver

•    FailOver

•    Availability Zone failures

•    Primary DB instance compute node failures

•    Networking issues with the primary DB instance

•    Storage or Amazon Elastic Block Store (Amazon EBS) volume issues

•    Cluster Endpoint

•    FailOver Time • Min 30-60s • Binlog

•    Sync/Async

•    Format : STATEMENT/ROW/MIX

https://docs.aws.amazon.com/ko_kr/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html#Concepts.MultiAZ.Failover https://aws.amazon.com/premiumsupport/knowledge-center/rds-fail-over/ https://severalnines.com/blog/introduction-failover-mysql-replication-101-blog/

https://severalnines.com/blog/database-switchover-and-failover-drupal-websites-using-mysql-or-postgresql/

RDS Backup/Restore

•    Backup

•    Daily Backup, 35 days keep on S3

•    Snapshot

•    User defined

•    Restore ( cf. recovery )

•    From backup

•    From instance

•    Recovery

•    Checkpoint

•    Redolog

•    Point In Time Recovery

•    Last 5 min

https://aws.amazon.com/rds/features/backup/

https://learn.microsoft.com/en-us/answers/questions/214377/recovery-vs-restore

RDS Monitoring

•    CloudTrail, CloudWatch

•    Standard

•    Ehhanced

•    Event Notification

https://docs.aws.amazon.com/ko_kr/vpc/latest/userguide/what-is-amazon-vpc.html https://aws.amazon.com/blogs/architecture/one-to-many-evolving-vpc-design/

RDS Security/Encryption

•    Data In transit

•    Data at rest

•    Encryption

•    Storage

•    Automated Backup

•    Read Replica

•    Standby Replica

•    Snapshot

•    Encryption Key

•    TDE

https://aws.amazon.com/rds/features/backup/

Aurora

•    RDS Use EBS

•    Auror use distibuted storage fleet

•    Share Storage, Cluster Volume, Single Virtual Volume

•    Instance Node <> Data Storage

•    Add storage by 10GB unit

•    Storage Replication

https://www.youtube.com/watch?v=0IeLKyBl3CM

https://www.lastweekinaws.com/blog/aurora-vs-rds-an-engineers-guide-to-choosing-a-database/

https://assets.amazon.science/dc/2b/4ef2b89649f9a393d37d3e042f4e/amazon-aurora-design-considerations-for-high-throughput-cloud-nativerelational-databases.pdf

Cluster Volume


https://aws.amazon.com/blogs/database/amazon-aurora-as-an-alternative-to-oracle-rac/ https://aws.amazon.com/ko/blogs/korea/amazon-aurora-under-the-hood-quorum-and-correlated-failure/

RDS Mysql vs Aurora Mysql


https://medium.com/awesome-cloud/aws-difference-between-amazon-aurora-and-amazon-rds-comparison-aws-aurora-vs-aws-rds-databases-

60a69dbec41f

https://d1.awsstatic.com/events/reinvent/2019/REPEAT_Amazon_Aurora_storage_demystified_How_it_all_works_DAT309-R.pdf

ACID / BASE

•    ACID

•    Atomicity

•    Consistency

•    Isolation

•    Durability

•    BASE

•    Basically Available

•    Soft State

•    Eventually Consistent

https://www.geeksforgeeks.org/acid-model-vs-base-model-for-database/

CAP Theorem / PIE

•    CAP

•    Consistency

•    Availability

•    Partition Tolerence

•    PIE

•    Pattern Flexibility

•    Infinite Scale • Efficiency

https://chbussler.medium.com/database-theorems-444f27f911c6 https://en.wikipedia.org/wiki/CAP_theorem http://eincs.com/2013/07/misleading-and-truth-of-cap-<span s

Distribution

•    Partition : key

•    Split into

•    Sharding : key

•    Split into, manual rebalancing

•    Isolation : model • Gather into

•    Cluster : block

•    Gather into, auto rebalancing

https://chbussler.medium.com/database-theorems-444f27f911c6 https://en.wikipedia.org/wiki/CAP_theorem http://eincs.com/2013/07/misleading-and-truth-of-cap-theorem/ https://learning-notes.kovacevic.dev/Databases/Theory/PIE-Theorem

Redshift

•    DataWarehouse

•    Based on PostgreSQL

•    Columnar Storage

•    Multiple Compute Node • Dense, Leader

•    Data Distributed in Compute Node • EVEN, KEY, ALL

•    Redshift Spectrum

•    Read from S3

https://docs.aws.amazon.com/ko_kr/vpc/latest/userguide/what-is-amazon-vpc.html https://aws.amazon.com/blogs/architecture/one-to-many-evolving-vpc-design/

DynamoDB

•       NoSQL, key-value

•       Collections – Table

•       Atrribute – Column (key-value pair)

•       Item – Row – one or more attribute

•       Partition

•       PrimaryKey, datatype

•       PartitionKey, Hashkey : Primary Key One Partition : Simple Primary Key

•       Sort Key, Range Key = Composite Primary Key

•       Partition Key = Not Unique, Partition Key + Sort Key : Unique

•       Scan, Query

•       Secondary index

•       Global secondary index

•       Local Secondary Index

•       Base table, projected attributes

•       DAX : DynamoDB Accelerator : memory caching https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Introduction.html

DocumentDB

•    NoSQL

•    Managed service

•    Compatible with MongoDB

•    3 AZ, 6 Replica = 99.99 Availability

•    PITR : Point In Time Recovery, Saved in S3 • Ecryption Support

https://docs.aws.amazon.com/documentdb/latest/developerguide/what-is.html

ElastiCache

•     Caching

•     Mananged Service

•     Redis, Memcached

•     Unser 1 ms

•     Shard = cluster node

•     Every node has same type, same size

•     SSSN : 1 node, no shard

•     SSMN : 1 shard, 6 node ( rw 1node, max 5 read node ) • MSMN : M shard, max 6 node per shard, softlimit 90 node • Multi shard :

https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.html

Neptune

•    Managed Service

•    Graph Database, Germlin, RDF, SPARQL

•   

3 AZ, 6 replica : 99.99 Availability • Eg : social network

 

 

https://docs.aws.amazon.com/neptune/latest/userguide/intro.html https://jiwonny.github.io/projects/aws-neptune-1/

https://aws.amazon.com/blogs/database/populating-your-graph-in-amazon-neptune-from-a-relational-database-using-aws-database-migrationservice-dms-part-2-designing-the-property-graph-model/

QLDB

•    Quantum Ledger

•    Journal

•    Blockchain

•    Amazon Ion

•    PartiQL

https://docs.aws.amazon.com/qldb/latest/developerguide/what-is.html https://docs.aws.amazon.com/qldb/latest/developerguide/ledger-structure.html https://amazon-ion.github.io/ion-docs/ https://partiql.org/

Keyspace ( for Apache Cassandra)

•    Managed service

•    Compatible with Apache Cassandra

•    Performance at scale

•    Region service

https://docs.aws.amazon.com/keyspaces/latest/devguide/what-is-keyspaces.html https://www.youtube.com/watch?v=bwGPdj1nLwg

https://www.youtube.com/watch?v=4ZnlZCbbN_A&list=PLORxAVAC5fUVMfzfZSJmroZvnaZWVb1QT&index=9

 

 

Timestream

•    Time series Database

https://docs.aws.amazon.com/timestream/latest/developerguide/what-is-timestream.html

 


QnA

저작자표시 (새창열림)

'AWS > AWS Ceritified Solutions Architect' 카테고리의 다른 글

08. CloudTrail, CloudWatch, Config  (0) 2023.08.21
07. IAM  (0) 2023.08.21
05. VPC  (0) 2023.07.21
04. Storage  (0) 2023.07.21
03. EC2 and EBS  (0) 2023.07.08

Network

•      VPC

•      CIDR

•      Subnet

•      Route Table

•      Internet GW

•      NAT Device

•      ENI

•      Elastic IP

•      Security Group

•      Network ACL

•      VPC Peering

•      VPC End point

•      Transit GW

https://aws.amazon.com/products/storage/

VPC

•    Virtual Private Cloud

•    Network Isolation

•    IP Range by CIDR

•    Region Service, Multi AZ

•    Divided by Subnet

•    Min /28 = 16 IP addresses

•    Max /64 = 2^16

https://docs.aws.amazon.com/ko_kr/vpc/latest/userguide/what-is-amazon-vpc.html https://aws.amazon.com/blogs/architecture/one-to-many-evolving-vpc-design/

Real World VPC

https://aws.amazon.com/blogs/awsforsap/vpc-subnet-zoning-patterns-for-sap-on-aws/

CIDR

•                 Classless Inter Domain Routing

•                 Method for allocating IP addresses and for IP routing

•                 A.B.C.D/E

•                 192.168.0.0/24

•                 256 ip addresses

•                 192.168.0.0 ~ 192.168.0.255 • Reserved IP

https://docs.aws.amazon.com/vpc/latest/userguide/subnet-cidr-reservation.html https://namu.wiki/w/CIDR

https://en.wikipedia.org/wiki/Classful_network

Subnet

•    Sub network

•    Network isolated by Subnet

•    Private/Public/VPNOnly

•    Assigned to only one AZ

•    3 AZ > 3 Subnet

•    Definded by CIDR

•    Min /28 : 16 IP addresses

•    Reserved IP

https://docs.aws.amazon.com/vpc/latest/userguide/configure-subnets.html /

Reserved IP

•    Subnet with CIDR block 10.0.0.0/24

•    Five IP addresses are reserved • 10.0.0.0: Network address

•    10.0.0.1: the VPC router.

•    10.0.0.2: the DNS server • 10.0.0.3: AWS for future use.

•    10.0.0.255: Network broadcast address. We do not support broadcast in a VPC, therefore we reserve this address.

https://aws.amazon.com/vpc/faqshttps://docs.aws.amazon.com/vpc/latest/userguide/configur/     e-subnets.html

Default VPC / Non default VPC

•     Default VPC in each AWS RegionCIDR

•     Public subnet in each Availability Zone

•     an internet gateway

•     enable DNS resolution

•     Start launching EC2 into a default VPC

•     Nondefault VPC

•     create your own VPC

•     configure it as you need

https://docs.aws.amazon.com/vpc/latest/userguide/default-vpc.html

https://docs.aws.amazon.com/vpc/latest/userguide/how-it-works.html#what-is-default-nondefault

VPC Modification

•    Name

•    IP Range

•    Deletion then New Creation

•    Related VPC routing change

https://aws.amazon.com/vpc/faqs/

https://docs.aws.amazon.com/vpc/latest/userguide/configure-subnets.html

Route Table

•    Subnet has route table

•    if not, use VPC main router table

•    Has Destination, Target

•    Target

•    local, pcx, igw, eigw, nat

https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html

Destination Target
0.0.0.0/0 igw-id

IGW

•    Internet Gateway

•    Connect to internet

•    Use by adding igw to route table

•    Destination Target

•    10.0.0.0/16 local

•    0.0.0.0/0 igw-xxxx

https://docs.aws.amazon.com/vpc/latest/userguide/route-table-options.html https://dev.to/aws-builders/cloud-networking-fundamentals-4b48

Destination Target
10.0.1.0/16 local
0.0.0.0/0 igw-id

NAT Device

Destination Target
10.0.0.0/16 local
0.0.0.0/0 nat-id

•     Network Address Translator

•     Translate Private address to public address

•     IPv4

•     Stateful

•     private subnets to connect to the internet

•     Type • NAT Instance

•     Private db > nat instance > igw > internet

•     NAT Gateway

•     Managed service of NAT instance

•     Add nat gateway to private subnet route table

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat.html https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html https://kim-dragon.tistory.com/18

Egress-only Internet Gateway

•    EGW

•    Similar with NAT Gateway

•    IPv6

•    Stateful

•    Outbound Traffic Only

https://medium.com/awesome-cloud/aws-vpc-route-table-overview-intro-getting-started-guide-5b5d65ec875f

ENI

•    Elastic Network Interface

•    A logical networking component

•    A virtual network card

•    Add to instance

•    Attributes

•    MAC Address

•    IP

•    Security Group

https://www.whizlabs.com/blog/elastic-network-interface/

https://docs.aws.amazon.com/AmazonECS/latest/bestpracticesguide/networking-networkmode-awsvpc.html

EIP

•    Elastic IP

•    Assigned from Amazon's pool of public IPv4 addresses

•    Different from Public IP on EC2 instance • Can be changed in case of restart

•    Attached to EC2 or ENI   

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html https://www.looklinux.com/what-is-difference-between-aws-elastic-ip-and-public-ip/ https://documentation.elasticpath.com/cloudops-aws/docs/faq/deployments.html

Security Group

•    Control traffic on instance level

•    Stateful

•    Different from NACL ( Stateless )

•    Assign one or more security group on instance , maximum 5

•    Defined on IP, port, IB/OB traffic ( default OB allow ) • 0.0.0.0/0, All Protocol, All Port

•    Defined by allow only

•    Consider all rules

https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html https://www.checkpoint.com/cyber-hub/cloud-security/what-is-aws-security-groups https://docs.aws.amazon.com/quicksight/latest/user/vpc-security-groups.html https://aws.amazon.com/ko/blogs/korea/new-descriptions-for-security-group-rules/

Network ACL

•    Allows or denies At the subnet level • specific inbound or outbound traffic

•    Stateless

•    Private VPC, custom NACL default all IB/OB traffic denied

•    priority BY rule number • Match rule, no consider others

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

VPC Peering

•    a networking connection between two VPCs

•    can be in different Regions • inter-Region VPC peering connection

•    1:1 mapping

•    A > B, B > C then A > C ? No • Need to make explicit A > C

https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html https://twwip.com/2020/01/26/how-to-setup-vpc-peering-in-aws/

VPC End Point

•    PrivateLink

•    Interface Endpoint

•    Gateway LB Endpoint

•    Gateway Endpoint

•    S3, DynamoDB

•    Not use privatelink and VPC endpoint

https://docs.aws.amazon.com/vpc/latest/privatelink/concepts.html https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html https://blog.nuricloud.com/aws-vpc-endpoint-using-for-s3-ec2-secure-transfer/

Transit Gateway

•     Interconnect between VPCs • Can connect on-premises networks

•     Use DX and VPN

•     Examples

•     Centralized router

•     Isolated VPCs but connect to on-premises

•     Isolated VPCs with shared services like LDAP

•     Peering between VPCs

•     Multicast between VPCS

•     Centralized outbound routing

•     Security Appliance VPC in shared VPCs

•     Blackhole route

https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html https://docs.aws.amazon.com/vpc/latest/tgw/TGW_Scenarios.html

QnA

 

저작자표시 (새창열림)

'AWS > AWS Ceritified Solutions Architect' 카테고리의 다른 글

07. IAM  (0) 2023.08.21
06. Database  (0) 2023.07.22
04. Storage  (0) 2023.07.21
03. EC2 and EBS  (0) 2023.07.08
02. AWS Services  (0) 2023.07.08

 

Storage Services

•     AMI

•     Instance Store Volume

•     S3

•     Glacier

•     EBS

•     EFS

•     FSx :

•     Storage Gateway

•     Snowball • Datasync

https://aws.amazon.com/products/storage/

AMI

•    Includes OS/env/application server/application

•    Instance store-backed AMI : backup from S3

•    EBS-backed AMI

•    Instance Root device • Instance Root Volume:

•    Booting image

•    OS/env/application server

•    custom application • Block device mapping

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ComponentsAMIs.html

https://medium.com/awesome-cloud/aws-difference-between-ebs-and-instance-store-f030c4407387

Instance Store / EBS

•    Direct connected block device storage to EC2

•    Ephemeral

•    Instance Stop Not supported

•    Local Storage

•    No Snapshopt

•    No Persistent

•    SSD, HDD

https://aws.amazon.com/ko/premiumsupport/knowledge-center/instance-store-vs-ebs/

 

EBS-backed

 

File/Block/Object Storage

•                    File

•                    FAT32, LFS, NFS

•                    path, metadata

•                    hierarchical. linkedlist

•                    Scale : adding system

•                    Block :

•                    SAN

•                    Devide by block

•                    Map

•                    Data : distributed by block • Object :

•                    AWS S3

https://ubuntu.com/blog/what-are-the-different-types-of-storage-block-object-and-file/

S3

•     2006 Launched

•     11 9s availability

•     Region Service

•     3 tier backup / at least 3+ AZ

•     Namespace + Block Storage

•     Encryption Supported

•     CloudFront

•     Data Repository For DataLake

•     Object : Data + Metadata

•     Write Once Read Many

•     Versionining

https://aws.amazon.com/s3/ https://aws.amazon.com/s3/features

S3 Concept

•    Global unique • Bucket +  Object Name( key )

•    Region only, Cross-region replication

•    API access

•    Eventually consistent

•    Partition by Prefix

•    Hex hash prefix

https://www.slideshare.net/AmazonWebServices/amazon-s3-masterclass

S3 Storage Class

•     S3 Standard

•     S3 Intelligent Tiering • Automated realloation

•     S3 Standard Infrequency Access

•     Lifecycle rule management • S3 One Zone Infrequent Access • One zone :

•     S3 Reduced Redundancy Storage • deprecated

•     S3 Glacier

•     Lifecycle Rule Management

•     Operated by S3 lifecycle, CLI, S3 console, SDK

https://aws.amazon.com/ko/s3/storage-classes/ https://blog.bespinglobal.com/post/aws-amazon-s3-life-cycle-rule/

S3 Glacier

•    Storage Limit : 40TB

•    Default : encrypted

•    S3 Glacier Instant Retrieval • Millisecond retrieval

•    S3 Glacier Flexible Retrieval

•    Min to 12 hours retrieval

•    S3 Glacier Deep Archive • 12-48 hours retrieval

•    Vault : directory

•    Archive : stored data unit

https://docs.aws.amazon.com/ko_kr/amazonglacier/latest/dev/introduction.html

•    Tape backup = 3 tier

EBS

•     Persistent Storage

•     One AZ Available

•     Block Storage

•     99.999 Availability

•     Encryption Supported

•     SDD, HDD

•     SSD

•     General Purpose, Provisioned IOPS : gp3, gp2 ( 100-10,000 IOPS)

•     HDD

•     Throughput optimized, cold hdd

https://aws.amazon.com/ko/ebs/volume-types/

EFS

•    Network shared

•    Standard OS interface

•    Region VPC service

•    Mount target

•    VPC NFS v4 end point

•    Storage class

•    Standard

•    Infrequent Access

https://docs.aws.amazon.com/ko_kr/efs/latest/ug/whatisefs.html https://docs.aws.amazon.com/efs/latest/ug/storage-classes.html

Amazon FSx

•    FSx

•    3rd party rich-feature, high performance / Lustre, Window FSx

•    FSx for Lustre • 100G +

•    FSx for Window File server • Support Active Directory

https://docs.aws.amazon.com/ko_kr/fsx/latest/WindowsGuide/what-is.html

Storage Gateway

•    Connect on-premises storage to aws cloud storage

•    File Gateway

•    Volume Gateway

•    Tape Gateway

https://blog.bespinglobal.com/post/aws-storage-gateway-%EC%9D%B4%ED%95%B4%ED%95%98%EA%B8%B0/ https://ltlkodae.tistory.com/21

Snowball

•    Snowball

•    21kg, 50TB, 80TB, external encrypted external storage

•    Snowball Edge

•    Snowball + computing

•    Snowball Mobile

•    Network Attached Data Store

https://docs.aws.amazon.com/snowball/latest/ug/device-differences.html

DataSync

•    Sync between

•    on-premises and cloud

•    cloud and cloud

•    Copy between file systems

•    Connect to S3, EFS, FSx

https://www.slideshare.net/AmazonWebServices/amazon-s3-masterclass

QnA

 

 

저작자표시 (새창열림)

'AWS > AWS Ceritified Solutions Architect' 카테고리의 다른 글

06. Database  (0) 2023.07.22
05. VPC  (0) 2023.07.21
03. EC2 and EBS  (0) 2023.07.08
02. AWS Services  (0) 2023.07.08
01. Cloud Computing and AWS Overview  (0) 2023.07.08

AWS Solutions Architect

                                                                                                                                                                              

    Colin Kang

EC2 Launch

•    AMI : OS / architecture (x86/Arm)

•    Instance Type : t2.micro ( 1vcpu/1GB ) – x2iden.32xlarge (

128vcpu/4098GB)

•    Keypair

•    Network : VPC/subnet/securitygroup

•    Storage : root + new

•    Advanced

•    IAM/PlacementGroup/Tenancy (shared/dedicated)/Tag

https://docs.aws.amazon.com/efs/latest/ug/gs-step-one-create-ec2-resources.html/

EC2 Launch with Template

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-templates.html/

EC2 AMI

 

Amazon Machine Image

•    Quick Start AMI : Linux/Mac..

•    Marketplace AMI

•    Vendor provide

•    Community AMI

•    Private AMI

•    User defined

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html

EC2 Instance ( vcpu/mem/bandwidh

•    Geneal Purpose : T3, T2, T5, M6, M5, M4, M3

•    Compute Optimize : C5, C4, C3

•    Memory Optimze : X1e, X1, R4, R3

•    Accelerated Computing : GPU : P3, P2, G3, F1

•    Storage Optimized : H1, I3, D2

•    HPC Optimized : High Performance Compuing : Hpc6id, Hpc6a

https://aws.amazon.com/ec2/instance-types/

 

Network

 

VPC : • Isolated Network

•    Subnet :

•    VPC sub network

https://en.wikipedia.org/wiki/CAP_theorem

https://www.geeksforgeeks.org/difference-between-shared-nothing-architecture-and-shared-disk-architecture/

PlacementGroup

•    Default : distributed

•    Placement group : interdependent instances

•    Cluster : packs instances close together inside an Availability Zone

•    Partition : spreads one partition do not share the underlying hardware, eg Hadoop

•    Spread : strictly places distinct underlying hardward

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html

Storage

 

EBS volume : SSD, HDD / IOPS

•     Attach multiple EBS storage volume

•     snapshot

•     Instance Store Volume :

•     Ephemeral

•     Speed : Instance Store Volume > EBS

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Storage.html/

Security

 

VPC ACL

•    SecurityGroup

•    IAM role

•    Keypare

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security.html https://aws.amazon.com/blogs/security/category/compute/amazon-ec2/page/2/

https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/

Auto Scale

 

Launch Configuration

•    Launch Template

https://docs.aws.amazon.com/autoscaling/ec2/userguide/what-is-amazon-ec2-auto-scaling.html

 

QnA

 

 

저작자표시 (새창열림)

'AWS > AWS Ceritified Solutions Architect' 카테고리의 다른 글

05. VPC  (0) 2023.07.21
04. Storage  (0) 2023.07.21
02. AWS Services  (0) 2023.07.08
01. Cloud Computing and AWS Overview  (0) 2023.07.08
AWS 가 더 좋은 서비스인 이유  (0) 2023.01.30

AWS Solutions Architect Certification

                                                                                                                                                                              

    Colin Kang

AWS Products and Services

https://www.cloudz.co.kr/services/multi-cloud-partners/aws/

Compute

•     EC2 : Elastic Compute Cloud, AMI, Virtualized Machine, VCPU/Mem

•     EC2 Auto Scaling : High Available Architecture, Elastic On-demand, LaunchTemplate, UserData(script)

•     Lambda : run code, function or application, event triggering

•     ECS : EC2 Container Service : Docker Service, ELB, EBS integrated

•     Beanstalk : run web app, provisioning manage

•     Lightsail : VPS : os + app( wordpress, node.js ): storage, network,

computing, dns, ssd, data send, static IP, all in one

•     Batch : serverless batch execute based on docker container image

•     AWS Outpost : on-premises, fully managed and suppored,

https://velog.io/@koo8624/AWS-%EB%B0%B1%EC%84%9C-Computing-Lightsail-Batch-Beanstalk-Lambda

 

Network & Content Delivery

•      VPC : Virtual Private Cloud

•      Subnet : CIDR

•      Route Table

•      NAT Gateway

•      VPC endpoint

•      VPC Peering

•      Transit Gateway

•      Site to Site VPN

•      Direct Connect : direct secured line network

•      Route 53 : DNS

•      ELB : Elastic Load Balancing : L4, L7

•      EIP : Elastic IP

•      Cloudfront : CDN

Security, Identity, & Compliance

•      IAM : Identity and Access Management

•      Inspector : find vulnerability

•     

Cetificate Manager : manage ssl/tsl certification

•      Directory Service : LDAP, Active Directory

•      WAF : Web Application Firewall : filter web traffic

•      Shield : Ddos protection

•      Cognito : identity management

•      Detective : investigate potential risk

•      Guardduty : threat detection

•      Inspector : vulunarity

•      Macie : sensitive data

•      Cloud HSM : hardware security module

•      Key Management Service

https://julie-tech.tistory.com/125

https://aws.amazon.com/blogs/aws/aws-heroes-putting-aws-security-services-to-work-for-you/

Storage

•    S3 : Simple Shared Storage, eleven nine

•    Glacier : tape backup

•    EBS : Elastic Block Store : for EC2, magnetic or SSD

•    EFS : Elastic File System : NAS

•    Storage Gateway

•    Snowball : import/export service petabytes

•    FSx : fully managed 3p file system : feature rich, high performance

•    Netapp/ZFS/WindowsFS/Lustre

 

Database

•    RDS : mysql, Oracle, SQL, PostgreSQL, MariaDB : managed

•    Dynamo : NoSQL

•    Redshift : DW : Columnar

•    ElastiCache : Redis, Memcached

•    Aurora : Mysql, PostgreSQL

•    Snowball : import/export service / petabytes

Analytic

•    Athena : serverles SQL – S3

•    EMR : Hadoop, Spark • Elasticsearch :

•    CloudSearch : domain search

•    Data Pipeline : orchestration data pipeline ( N/A Seoul Region)

•    Kinesis : realtime streaming data

•    QuickSight : business analytic

Application

•    API Gateway

•    Step Functions

•    Simple Workflow Service

•    Elastic Transcoder : media transcoding

Developer

•    Code Commit

•    Code Pipeline

•    Code Build

•    Code Deploy

Management

•    CloudFormation : manage resource with templates • Alb target group

•    Service Catalog

•    CloudWatch : monitor resource and application

•    Config : track resource inventory

•    CloudTrail : track user activity and api usage

Messaging

•    SNS : Simple Notification Service : pub/sub

•    SES : Simple Email Service :

•    SQS : Simple Queue Service : queue

Migration

•    Application Discovery Service

•    Database Migration Service

•    Snowball

•    Server Migration

Artificial Intelligence

•    Lex : voice and text chatbot

•    Polly : turn text into speech

•    Rekognition : search and analyze image

•    Machine Learning : N/A

•    Segemaker : build/train/deploy machine learning model

Internet of Things

•    IoT Core : device connect

•    IoT Greengrass : run code on devices

•    IoT Event : detect event from devices

References

•    https://julie-tech.tistory.com/128

•    https://www.examtopics.com/exams/amazon/aws-certifiedsolutions-architect-associate-saa-c03/

 

QnA

 

 

저작자표시 (새창열림)

'AWS > AWS Ceritified Solutions Architect' 카테고리의 다른 글

04. Storage  (0) 2023.07.21
03. EC2 and EBS  (0) 2023.07.08
01. Cloud Computing and AWS Overview  (0) 2023.07.08
AWS 가 더 좋은 서비스인 이유  (0) 2023.01.30
AWS Public Documentations  (0) 2023.01.30

AWS Solutions Architect Certification

                                                                                                                                                                              

   Colin Kang

Before we start : What we learn from AWS

•    Architecture

•    Service Design

•    Service Pros/Cons

•    Terminology

•    Invisible Hardware

•    Software/hardware integration

•    Trade off

•    Design Thinking

AWS Benefits

•    Easy to Use : What is mean by easy? API ? CLI ? SDK? Console?

•    Design Principle : Consistency, Reasonable

•    SRP : Single Responsibility Principle : GSSD : Gather for Same, Separate for Different

•    Flexible : Composite, Loose Coupled, various work-around

•    Cost-Effective : On-Demand/Option

•    Reliable : Availability/Backup/Recovery/Managed

•    Scalable and high-performance : Autoscale

•    Secure : enterprise-level proof : Network

https://en.wikipedia.org/wiki/Single-responsibility_principle

Scalability

•    Scale Up/Down : Vertical Limit

•    Scale Out/In : Horizental Expansion • CAP theorem : Consistency/Availability/Partition Tolerence

•    Shared Everything

•    Expensive, High Performance

•    Clusterware

•    Shared Nothing

•    Easy to implement, hard to shard

https://en.wikipedia.org/wiki/CAP_theorem

https://www.geeksforgeeks.org/difference-between-shared-nothing-architecture-and-shared-disk-architecture/

Virtualization

•     Emulation/Simulation

•     Emulator : Game

•     Flight Simulator

•     Emulation/Virtualization

•     Virtual Memory

•     Java Virtual Machine : Emulator : Interpreter

•     Virtual Hardware : Virtual Machine : Image

•     Bare Metal/Hypervisor/Hosting

•     Hypervisor

•     Virtual Machine Supervisor

•     KVM/Xen/MS Hyper-V

•     Full Virtualization / Para-virtualization • Container : Later

https://www.baeldung.com/cs/simulation-vs-emulation

https://velog.io/@skynet/가상화-입문-에뮬레이션-가상머신-컨테이너

Disruptive Technology

•    Human cost > Hardware cost

•    More cost effective than optimization

•    Speed > Cost

•    Winner takes it all

•    Immutable

•    Shared Nothing Win

Cloud Computing

• IaaS, Paas, Saas     

• Public, Hybrid, On-premises(private, IDC)

 SHAPE  \* MERGEFORMAT

https://www.redhat.com/en/topics/cloud-computing/iaas-vs-paas-vs-saas

https://www.researchgate.net/figure/Comparison-among-Public-Private-Hybrid-and-Community-Cloud_tbl1_270958592

Security

•    Network Isolation

•    VPC

•    NAT

•    Whitelist model

•    VPN

•    AAA/IDM/IAM

•    Role/Priviliges

•    Security Group

•    AWS Organizations

AWS Services

Network VPC, Route53, ELB, DX, ..
Storage S3, EBS, EFS, FSX, Glacier, Snowball, ..
Compute EC2, Autoscaling, Lambda, ECS, EKS, Beantalk, ..
Database RDS, DynamoDB, Redshift, Elasticache, Aurora ..
Messaging SNS, SQS, SES, ..
Analytic Athena, EMR, Elasticsearch, Cloudsearch, Kinesis, ..
Security IDM, Inspector, CM, DS, WAF, Shield
AI Lex, Polly, Recognition, ML
Mobile Cognito, MobileHub, DeviceFarm, ..
Private AWS Outposts
Manage CloudFormation, Cloudwatch, Cloudtrail, OptsWorks, ..
Develop CodeCommit, CodePipeline, CodeBuild, CodeDeploy, ..

https://colinkang.tistory.com/89

AWS Region / Service Type

•     Global/Region/AZ/VPC

•     Total Region :  29 ( 2023 Jan)

•     Seoul Region (launched 2016) : 4 AZ

ServiceType Network Compute Storage Database Gateway Security
AZ Subnet, ENI EC2 instance EBS volume      
Region VPC,  EIP, ELB, ASG ECS, EKS ESB snapshot RDS, DynamoDB TransitGW, StorageGW SecurityGro up, IDM, EC2 Keypair
Global Route53, CloudFront,
DX		   S3(data region) DynamoDB Global Table User, WAF

https://aws.amazon.com/ko/blogs/korea/now-open-fourth-availability-zone-in-the-aws-asia-pacific-seoul-region/ https://aws.amazon.com/about-aws/global-infrastructure/regions_az/

 

Service Endpoint

•     the URL of the entry point for an AWS web service

•     Regional Endpoint • protocol://service-code.region-code.amazonaws.com

•     Dynamo US West Region Service Endpoint • https://dynamodb.us-west-2.amazonaws.com

•     Single Global Endpoint • organizations.us-east-1.amazonaws.com

•     FIPS endpoint

•     US Federal Information Standard : eg, encryption

•     https://appstream2-fips.us-west-2.amazonaws.com

•     Dual stack endpoint • HTTP / HTTPS

https://docs.aws.amazon.com/general/latest/gr/rande.html

ARNs

•     Amazon Resource Names

•     Use API/CLI/SDK call

•     Format

•     arn:partition:service:region:account-id:resource-type/resource-id

•     arn:partition:service:region:account-id:resource-type:resource-id

•     Example

•     arn:aws:s3:::bucket_name/key_name

•     arn:aws:s3:::examplebucket/developers/design_info.doc

•     arn:aws:s3:::examplebucket/*

•     arn:aws:s3:::*

•     arn:aws:s3:::example?bucket/*

https://docs.aws.amazon.com/ko_kr/general/latest/gr/aws-arns-and-namespaces.html https://colinkang.tistory.com/93

CLI

•    Command Line Interface

 

•    Example

•    aws s3 cp /tmp/sample.txt s3://mybucket

•   

aws help • aws shell

https://docs.aws.amazon.com/ko_kr/general/latest/gr/aws-arns-and-namespaces.html https://colinkang.tistory.com/93

 

AWS Shared Responsibility Model

https://aws.amazon.com/ko/compliance/shared-responsibility-model/

AWS Support Plan

•    Type

•    Basic

•    Developer

•    Business

•    Enterprise On-Ramp

•    Enterprise

•    Support Query

•    Bug

•    Incident

•    Config error

https://aws.amazon.com/premiumsupport/plans/

QnA

•    Scale in이 Elastic관점에서무엇이다른가요?

•    VPC, VPN 의 다른점

•    AWS 가 해킹된사례가 있나요?

•    데이터를 global service에올려도되나요?

•    EBS 블록이 AZ 존서비스인가요?

•    Aurora vs instance + mysql 가어떤점이다른가요?

 
저작자표시 (새창열림)

'AWS > AWS Ceritified Solutions Architect' 카테고리의 다른 글

04. Storage  (0) 2023.07.21
03. EC2 and EBS  (0) 2023.07.08
02. AWS Services  (0) 2023.07.08
AWS 가 더 좋은 서비스인 이유  (0) 2023.01.30
AWS Public Documentations  (0) 2023.01.30
Benefits  
   
   
   
   

 

 

https://aws.amazon.com/application-hosting/benefits/

 

혜택

AWS에서는 운영 체제, 프로그래밍 언어, 웹 애플리케이션 플랫폼, 데이터베이스 및 기타 서비스를 필요에 따라 선택할 수 있습니다. 그리고 AWS가 제공하는 가상 환경에서 애플리케이션에 필요한

aws.amazon.com

 

저작자표시 (새창열림)

'AWS > AWS Ceritified Solutions Architect' 카테고리의 다른 글

04. Storage  (0) 2023.07.21
03. EC2 and EBS  (0) 2023.07.08
02. AWS Services  (0) 2023.07.08
01. Cloud Computing and AWS Overview  (0) 2023.07.08
AWS Public Documentations  (0) 2023.01.30

AWS Well-Architected Framework :

https://docs.aws.amazon.com/pdfs/wellarchitected/latest/framework/wellarchitected-framework.pdf#welcome

 

 

 

저작자표시 (새창열림)

'AWS > AWS Ceritified Solutions Architect' 카테고리의 다른 글

04. Storage  (0) 2023.07.21
03. EC2 and EBS  (0) 2023.07.08
02. AWS Services  (0) 2023.07.08
01. Cloud Computing and AWS Overview  (0) 2023.07.08
AWS 가 더 좋은 서비스인 이유  (0) 2023.01.30

+ Recent posts

티스토리툴바