Showing posts with label E. AWS TUTORIAL. Show all posts
Showing posts with label E. AWS TUTORIAL. Show all posts
AWS - CLOUD PRACTIONER NOTES - CHAPTER 6.SECURITY
Shared responsibility model:
The shared responsibility model divides into customer responsibilities (commonly referred to as “security in the cloud”) and AWS responsibilities (commonly referred to as “security of the cloud”)
Customers: Security in the cloud
Customers are responsible for the security of everything that they create and put in the AWS Cloud.
The security steps that you take will depend on factors such as the services that you use, the complexity of your systems, and your company’s specific operational and security needs. Steps include selecting, configuring, and patching the operating systems that will run on Amazon EC2 instances, configuring security groups, and managing user accounts.
When using AWS services, you, the customer, maintain complete control over your content. You are responsible for managing security requirements for your content, including which content you choose to store on AWS, which AWS services you use, and who has access to that content. You also control how access rights are granted, managed, and revoked.
AWS: Security of the cloud
AWS is responsible for security of the cloud.
AWS operates, manages, and controls the components at all layers of infrastructure. This includes areas such as the host operating system, the virtualization layer, and even the physical security of the data centers from which services operate.
AWS is responsible for protecting the global infrastructure that runs all of the services offered in the AWS Cloud. This infrastructure includes AWS Regions, Availability Zones, and edge locations.
AWS manages the security of the cloud, specifically the physical infrastructure that hosts your resources, which include:
Physical security of data centers
Hardware and software infrastructure
Network infrastructure
Virtualization infrastructure
Although you cannot visit AWS data centers to see this protection firsthand, AWS provides several reports from third-party auditors. These auditors have verified its compliance with a variety of computer security standards and regulations.
User permissions and access
AWS Identity and Access Management (IAM)
AWS Identity and Access Management (IAM) is a web service for securely controlling access to AWS services. You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources.
AWS account root user :
When you first create an AWS account, you begin with an identity known as the root user. The root user is accessed by signing in with the email address and password that you used to create your AWS account. Do not use the root user for everyday tasks.
Instead, use the root user to create your first IAM user and assign it permissions to create other users.
IAM users
An IAM user is an identity that you create in AWS. It represents the person or application that interacts with AWS services n resources. It consists of a name and credentials.
By default, when you create a new IAM user in AWS, it has no permissions associated with it. To allow the IAM user to perform specific actions in AWS, such as launching an Amazon EC2 instance or creating an Amazon S3 bucket, you must grant the IAM user the necessary permissions.
We recommend that you create individual IAM users for each person who needs to access AWS.
Even if you have multiple employees who require the same level of access, you should create individual IAM users for each of them. This provides additional security by allowing each IAM user to have a unique set of security credentials.
IAM policies
An IAM policy is a document that allows or denies permissions to AWS services and resources.
IAM policies enable you to customize users’ levels of access to resources. For example, you can allow users to access all of the Amazon S3 buckets within your AWS account, or only a specific bucket.
Follow the security principle of least privilege when granting permissions.
By following this principle, you help to prevent users or roles from having more permissions than needed to perform their tasks.
For example, if an employee needs access to only a specific bucket, specify the bucket in the IAM policy. Do this instead of granting the employee access to all of the buckets in your AWS account.
IAM groups
An IAM group is a collection of IAM users. When you assign an IAM policy to a group, all users in the group are granted permissions specified by the policy.
Assigning IAM policies at the group level also makes it easier to adjust permissions when an employee transfers to a different job. For example, if a cashier becomes an inventory specialist, the coffee shop owner removes them from the “Cashiers” IAM group and adds them into the “Inventory Specialists” IAM group. This ensures that employees have only the permissions that are required for their current role
IAM Roles
When the employee needs to switch to a different task, they give up their access to one workstation and gain access to the next workstation. The employee can easily switch between workstations, but at any given point in time, they can have access to only a single workstation. This same concept exists in AWS with IAM roles.
An IAM role is an identity that you can assume to gain temporary access to permissions.
Before an IAM user, application, or service can assume an IAM role, they must be granted permissions to switch to the role. When someone assumes an IAM role, they abandon all previous permissions that they had under a previous role and assume the permissions of the new role.
IAM roles are ideal for situations in which access to services or resources needs to be granted temporarily, instead of long-term.
Multi-factor authentication
Have you ever signed in to a website that required you to provide multiple pieces of information to verify your identity? You might have needed to provide your password and then a second form of authentication, such as a random code sent to your phone. This is an example of multi factor authentication.
In IAM, multi-factor authentication (MFA) provides an extra layer of security for your AWS account.
AWS Organizations
Suppose that your company has multiple AWS accounts. You can use AWS Organization to consolidate and manage multiple AWS accounts within a central location.
When you create an organization, AWS Organizations automatically creates a root, which is the parent container for all the accounts in your organization.
In AWS Organizations, you can centrally control permissions for the accounts in your organization by using services control policies. SCPs enable you to place restrictions on the AWS services, resources, and individual API actions that users and roles in each account can access.Consolidated billing is another feature of AWS Organizations.
Organizational units
In AWS Organizations, you can group accounts into organizational units (OUs) to make it easier to manage accounts with similar business or security requirements. When you apply a policy to an OU, all the accounts in the OU automatically inherit the permissions specified in the policy.
By organizing separate accounts into OUs, you can more easily isolate workloads or applications that have specific security requirements. For instance, if your company has accounts that can access only the AWS services that meet certain regulatory requirements, you can put these accounts into one OU. Then, you can attach a policy to the OU that blocks access to all other AWS services that do not meet the regulatory requirements.
Service control policies(SCP)
In AWS Organizations, you can apply service control policies (SCPs) to the organization root, an individual member account, or an OU. An SCP affects all IAM users, groups, and roles within an account, including the AWS account root user.
Compliance
AWS Artifact
Depending on your company’s industry, you may need to uphold specific standards. An audit or inspection will ensure that the company has met those standards.
Aws artifact is a service that provides on-demand access to AWS security and compliance reports and select online agreements.
AWS Artifact consists of two main sections: AWS Artifact Agreements and AWS Artifact Reports.
AWS Artifact agreements : Suppose that your company needs to sign an agreement with AWS regarding your use of certain types of information throughout AWS services. You can do this through AWS Artifact Agreements. In AWS Artifact Agreements, you can review, accept, and manage agreements for an individual account and for all your accounts in AWS Organizations. Different types of agreements are offered to address the needs of customers who are subject to specific regulations, such as the Health Insurance Portability and Accountability Act (HIPAA).
AWS Artifact reports : Next, suppose that a member of your company’s development team is building an application and needs more information about their responsibility for complying with certain regulatory standards. You can advise them to access this information in AWS Artifact Reports. AWS Artifact Reports provide compliance reports from third-party auditors. These auditors have tested and verified that AWS is compliant with a variety of global, regional, and industry-specific security standards and regulations. AWS Artifact Reports remains up to date with the latest reports released. You can provide the AWS audit artifacts to your auditors or regulators as evidence of AWS security controls.
Customer Compliance Center
The Customer Compliance Center contains resources to help you learn more about AWS compliance. In the Customer Compliance Center, you can read customer compliance stories to discover how companies in regulated industries have solved various compliance, governance, and audit challenges. You can also access compliance whitepapers and documentation on topics such as: AWS answers to key compliance questions An overview of AWS risk and compliance An auditing security checklist Additionally, the Customer Compliance Center includes an auditor learning path. This learning path is designed for individuals in auditing, compliance, and legal roles who want to learn more about how their internal operations can demonstrate compliance using the AWS Cloud.
Denial of Service attacks
In a distributed denial-of-service (DDoS) attack, multiple sources are used to start an attack that aims to make a website or application unavailable. This can come from a group of attackers, or even a single attacker. The single attacker can use multiple infected computers (also known as “bots”) to send excessive traffic to a website or application.
To help minimize the effect of DoS and DDoS attacks on your applications, you can use AWS sheild.
AWS Shield
AWS Shield is a service that protects applications against DDoS attacks. AWS Shield provides two levels of protection: Standard and Advanced.
AWS Shield Standard : Automatically protects all AWS customers at no cost. It protects your AWS resources from the most common, frequently occurring types of DDoS attacks.
As network traffic comes into your applications, AWS Shield Standard uses a variety of analysis techniques to detect malicious traffic in real time and automatically mitigates it.
AWS Shield Advanced : is a paid service that provides detailed attack diagnostics and the ability to detect and mitigate sophisticated DDoS attacks.
It also integrates with other services such as Amazon CloudFront, Amazon Route 53, and Elastic Load Balancing. Additionally, you can integrate AWS Shield with AWS WAF by writing custom rules to mitigate complex DDoS attacks.
AWS Key Management Service (AWS KMS)
you must ensure that your applications’ data is secure while in storage (encryption at rest) and while it is transmitted, known as encryption in transit.
AWS key management service ( AWS KMS) enables you to perform encryption operations through the use of cryptographic keys. A cryptographic key is random string of digitits used to encrypt(locking) and decrypt(unlocking) the data. you can use AWS KMS to create manage and use the cryptographic keys.
You can also control the use of keys across a wide range of services and in your applications.
With AWS KMS, you can choose the specific levels of access control that you need for your keys. For example, you can specify which IAM users and roles are able to manage keys. Alternatively, you can temporarily disable keys so that they are no longer in use by anyone. Your keys never leave AWS KMS, and you are always in control of them.
AWS WAF - Web application firewall
AWS WAF is is a web application firewall that lets you monitor network requests that come into your web applications.
AWS WAF works together with Amazon CloudFront and an Application Load Balancer.
AWS WAF works in a similar way to block or allow traffic. However, it does this by using a Web access control list(ACL) to protect your AWS resources.
Suppose that your application has been receiving malicious network requests from several IP addresses. You want to prevent these requests from continuing to access your application, but you also want to ensure that legitimate users can still access it. You configure the web ACL to allow all requests except those from the IP addresses that you have specified.
When a request comes into AWS WAF, it checks against the list of rules that you have configured in the web ACL. If a request did not come from one of the blocked IP addresses, it allows access to the application.
However, if a request came from one of the blocked IP addresses that you have specified in the web ACL, it is denied access.
Amazon inspector
It perform automated security assessments. Amazon Inspector helps to improve the security and compliance of applications by running automated security assessments. It checks applications for security vulnerabilities and deviations from security best practices, such as open access to Amazon EC2 instances and installations of vulnerable software versions.
After Amazon Inspector has performed an assessment, it provides you with a list of security findings. The list prioritizes by severity level, including a detailed description of each security issue and a recommendation for how to fix it. However, AWS does not guarantee that following the provided recommendations resolves every potential security issue. Under the shared responsibility model, customers are responsible for the security of their applications, processes, and tools that run on AWS services.
Amazon GuardDuty
Amazon Guard duty is a service that provides intelligent threat detection for your AWS infrastructure and resources. It identifies threats by continuously monitoring the network activity and account behavior within your AWS environment.
After you have enabled GuardDuty for your AWS account, GuardDuty begins monitoring your network and account activity. You do not have to deploy or manage any additional security software. GuardDuty then continuously analyzes data from multiple AWS sources, including VPC Flow Logs and DNS logs.
If GuardDuty detects any threats, you can review detailed findings about them from the AWS Management Console. Findings include recommended steps for remediation. You can also configure AWS Lambda functions to take remediation steps automatically in response to GuardDuty’s security findings.
AWS - CLOUD PRACTIONER NOTES - CHAPTER 2 . EC2 N COMPUTE
Amazon elastic compute cloud (Amazon EC2) provides secure, resizable compute capacity in the cloud as Amazon EC2 instances.
with an Amazon EC2 instance you can use a virtual server to run applications in the AWS Cloud.
- You can provision and launch an Amazon EC2 instance within minutes.
- You can stop using it when you have finished running a workload.
- You pay only for the compute time you use when an instance is running, not when it is stopped or terminated.
- You can save costs by paying only for server capacity that you need or want.
Amazon EC2 instance types
Amazon EC2 instance types are optimized for different tasks. When selecting an instance type,
consider the specific needs of your workloads and applications. This
might include requirements for compute, memory, or storage capabilities.
1.General purpose instances
General purpose instances provide a balance of compute,
memory and networking resources, and can be used for a variety of
diverse workloads. These instances are ideal for applications that use
these resources in equal proportions such as web servers and code
repositories.
- application servers
- gaming servers
- backend servers for enterprise applications
- small and medium databases
2.Compute optimized instancesCompute Optimized instances are ideal for compute bound applications
that benefit from high performance processors. Instances belonging to
this family are well suited for batch processing workloads, media
transcoding, high performance web servers, high performance computing
(HPC), scientific modeling, dedicated gaming servers and ad server
engines, machine learning inference and other compute intensive
applications.
High performance computing (HPC), batch processing, ad serving, video
encoding, gaming, scientific modelling, distributed analytics, and
CPU-based machine learning inference.
3.Memory optimized instancesMemory optimized instances are designed to deliver fast performance for workloads that process large data sets in memory. Memory optimized instances enable you to run workloads with high memory needs and receive great performance
Memory-intensive applications such as open-source databases, in-memory caches, and real time big data analytics
4.Accelerated computing instances
Accelerated computing instances use hardware accelerators, or
co-processors, to perform functions, such as floating point number
calculations, graphics processing, or data pattern matching, more
efficiently than is possible in software running on CPUs.
Machine learning, high performance computing, computational fluid
dynamics, computational finance, seismic analysis, speech recognition,
autonomous vehicles, and drug discovery.
5.Storage optimized instancesStorage optimized instances are designed for workloads that require
high, sequential read and write access to very large data sets on local
storage. They are optimized to deliver tens of thousands of low-latency,
random I/O operations per second (IOPS) to applications.
These instances maximize the number of transactions processed per second
(TPS) for I/O intensive and business-critical workloads which have
medium size data sets and can benefit from high compute performance and
high network throughput such as relational databases (MySQL, MariaDB,
and PostgreSQL), and NoSQL databases (KeyDB, ScyllaDB, and Cassandra).
They are also an ideal fit for workloads that require very fast access
to medium size data sets on local storage such as search engines and
data analytics workloads.
Amazon EC2 instance types
Amazon EC2 instance types are optimized for different tasks. When selecting an instance type, consider the specific needs of your workloads and applications. This might include requirements for compute, memory, or storage capabilities.
1.General purpose instances
- application servers
- gaming servers
- backend servers for enterprise applications
- small and medium databases
General purpose instances provide a balance of compute, memory and networking resources, and can be used for a variety of diverse workloads. These instances are ideal for applications that use these resources in equal proportions such as web servers and code repositories.
2.Compute optimized instances
Compute Optimized instances are ideal for compute bound applications that benefit from high performance processors. Instances belonging to this family are well suited for batch processing workloads, media transcoding, high performance web servers, high performance computing (HPC), scientific modeling, dedicated gaming servers and ad server engines, machine learning inference and other compute intensive applications.
High performance computing (HPC), batch processing, ad serving, video encoding, gaming, scientific modelling, distributed analytics, and CPU-based machine learning inference.
3.Memory optimized instances
Memory optimized instances are designed to deliver fast performance for workloads that process large data sets in memory. Memory optimized instances enable you to run workloads with high memory needs and receive great performance
Memory-intensive applications such as open-source databases, in-memory caches, and real time big data analytics
4.Accelerated computing instances
Accelerated computing instances use hardware accelerators, or co-processors, to perform functions, such as floating point number calculations, graphics processing, or data pattern matching, more efficiently than is possible in software running on CPUs.
Machine learning, high performance computing, computational fluid dynamics, computational finance, seismic analysis, speech recognition, autonomous vehicles, and drug discovery.
5.Storage optimized instances
Storage optimized instances are designed for workloads that require high, sequential read and write access to very large data sets on local storage. They are optimized to deliver tens of thousands of low-latency, random I/O operations per second (IOPS) to applications.
These instances maximize the number of transactions processed per second (TPS) for I/O intensive and business-critical workloads which have medium size data sets and can benefit from high compute performance and high network throughput such as relational databases (MySQL, MariaDB, and PostgreSQL), and NoSQL databases (KeyDB, ScyllaDB, and Cassandra). They are also an ideal fit for workloads that require very fast access to medium size data sets on local storage such as search engines and data analytics workloads.
Amazon EC2 pricing
Amazon EC2 pricing
With
Amazon EC2, you pay only for the compute time that you use.
1.On-Demand
With on-demand instance, you pay for the compute capacity by second with no long term commitment. You have complete control over instance life cycle when to start stop or terminate
- no upfront fee- charged by hour or sec- no commitment,- ideal for short term needs or - unpredicatable workloads
2. Reserved Instances
- full upfront, partial upfront, no upfront- one-three year commitment- once expired automatically on demand price
Reserved instances are not physical instances rather billing discount applied to on demand instance.. on-Demand instances must match critieria to which determines price/billing discount.
Reserved instance billing criteria:
-Instance type - ex m4.large - m4(instance family, large-instance size-region - which region instance is purchased-tenancy - shared or single tenant hardware.-platform - windows or linux
Types of reserved instance:
Standard - This provides significant discount. Cannot be exchanged but can be modified.
Convertible - Provides lower discount, but can be exchanged for reserved instance with different attribute. can also be modified.
3. Savings plan
- no upfront , partial upfront or all upfront- reduce cost by commiting 1-3 year- saves 66% over on demand
Types of savings plan
Compute savings plan :
provides more flexibility and 66% of demand rates. These plans automatically apply to your ec2 instance regardless of instance size, instance family, region , operating system, or tenancy. Also applies to Fargate n lambda usage.
EC2 instance savings plan:
Provides savings upto 72% in exchange for commitment to Specific instance family in a chosen region, regardless of size, tenancy, OS
AWS Cost Explorer : a tool that enables you to visualize, understand, and manage your AWS costs and usage over time.
If you are considering your options for Savings Plans, AWS Cost Explorer can analyze your Amazon EC2 usage over the past 7, 30, or 60 days.
AWS Cost Explorer also provides customized recommendations for Savings Plans. These recommendations estimate how much you could save on your monthly Amazon EC2 costs, based on previous Amazon EC2 usage and the hourly commitment amount in a 1-year or 3-year plan.
4. Spot Instances
Spot instance uses spare ec2 capacity which is available for less than on demand price. spot instance enable you to request unused EC2 instance at huge discount. Charged by hour. This is suitable for workloads that can be interrupted.
5. Dedicated hosts
An amazon ec2 host is a physical server with ec2 instance capacity fully dedicated to your use. Dedicated hosts allow you to use your exisiting per-socket, per-core, per vm software licenses.
6. Dedicated instances
Dedicated Instances are Amazon EC2 instances that run in a virtual private cloud (VPC)
on hardware that's
dedicated to a single customer.
“An important difference between a Dedicated Host and a
Dedicated Instance is that a Dedicated Host gives you additional
visibility and control over how instances are placed on a physical
server, and you can consistently deploy your instances to the same
physical server over time.”
With Amazon EC2, you pay only for the compute time that you use.
1.On-Demand
With on-demand instance, you pay for the compute capacity by second with no long term commitment. You have complete control over instance life cycle when to start stop or terminate
- no upfront fee
- charged by hour or sec
- no commitment,
- ideal for short term needs or
- unpredicatable workloads
2. Reserved Instances
- full upfront, partial upfront, no upfront
- one-three year commitment
- once expired automatically on demand price
Reserved instances are not physical instances rather billing discount applied to on demand instance.. on-Demand instances must match critieria to which determines price/billing discount.
Reserved instance billing criteria:
-Instance type - ex m4.large - m4(instance family, large-instance size
-region - which region instance is purchased
-tenancy - shared or single tenant hardware.
-platform - windows or linux
Types of reserved instance:
Standard - This provides significant discount. Cannot be exchanged but can be modified.
Convertible - Provides lower discount, but can be exchanged for reserved instance with different attribute. can also be modified.
3. Savings plan
- no upfront , partial upfront or all upfront
- reduce cost by commiting 1-3 year
- saves 66% over on demand
Types of savings plan
Compute savings plan :
provides more flexibility and 66% of demand rates. These plans automatically apply to your ec2 instance regardless of instance size, instance family, region , operating system, or tenancy. Also applies to Fargate n lambda usage.
EC2 instance savings plan:
Provides savings upto 72% in exchange for commitment to Specific instance family in a chosen region, regardless of size, tenancy, OS
AWS Cost Explorer : a tool that enables you to visualize, understand, and manage your AWS costs and usage over time.
If you are considering your options for Savings Plans, AWS Cost Explorer can analyze your Amazon EC2 usage over the past 7, 30, or 60 days.
AWS Cost Explorer also provides customized recommendations for Savings Plans. These recommendations estimate how much you could save on your monthly Amazon EC2 costs, based on previous Amazon EC2 usage and the hourly commitment amount in a 1-year or 3-year plan.
4. Spot Instances
Spot instance uses spare ec2 capacity which is available for less than on demand price. spot instance enable you to request unused EC2 instance at huge discount. Charged by hour. This is suitable for workloads that can be interrupted.
5. Dedicated hosts
An amazon ec2 host is a physical server with ec2 instance capacity fully dedicated to your use. Dedicated hosts allow you to use your exisiting per-socket, per-core, per vm software licenses.
6. Dedicated instances
Dedicated Instances are Amazon EC2 instances that run in a virtual private cloud (VPC) on hardware that's dedicated to a single customer.
“An important difference between a Dedicated Host and a Dedicated Instance is that a Dedicated Host gives you additional visibility and control over how instances are placed on a physical server, and you can consistently deploy your instances to the same physical server over time.”
Scalability
Scalability
involves beginning with only the resources you need and designing your
architecture to automatically respond to changing demand by scaling out
or in. As a result, you pay for only the resources you use. You don’t
have to worry about a lack of computing capacity to meet your customers’
needs.
Scalability
Scalability involves beginning with only the resources you need and designing your architecture to automatically respond to changing demand by scaling out or in. As a result, you pay for only the resources you use. You don’t have to worry about a lack of computing capacity to meet your customers’ needs.
Amazon EC2 Auto Scaling
-minimum size
-maximum size
-desired capacity
Amazon EC2 Auto Scaling helps you ensure that you have the correct number of Amazon
EC2 instances available to
handle the load for your application. You create collections of EC2 instances, called
Auto Scaling groups.
You can specify the minimum number of instances in
each Auto Scaling group, and Amazon EC2 Auto Scaling ensures that your group never
goes below this size.
You can
specify the maximum number of instances in each Auto Scaling group, and Amazon EC2
Auto Scaling ensures that your
group never goes above this size.
If you specify the desired capacity, either when
you
create the group or at any time thereafter, Amazon EC2 Auto Scaling ensures that
your group has this many
instances.
If you specify scaling policies, then Amazon EC2 Auto Scaling can launch
or terminate instances
as demand on your application increases or decreases.
Within Amazon EC2 Auto Scaling, you can use two approaches: dynamic scaling and predictive scaling.
Dynamic scaling: responds to changing demand.
Predictive scaling: automatically schedules the right number of Amazon EC2 instances based on predicted demand.
To scale faster, you can use dynamic scaling and predictive scaling together.
Adding Amazon EC2 Auto Scaling to your application architecture is one way to maximize
the benefits
of the AWS Cloud. When you use Amazon EC2 Auto Scaling, your applications gain
the following
benefits:
-
Better fault tolerance.
Amazon EC2 Auto Scaling can detect when an instance is unhealthy,
terminate it, and
launch an instance to replace it. You can also configure
Amazon EC2 Auto
Scaling to use multiple Availability Zones. If one Availability
Zone becomes
unavailable, Amazon
EC2 Auto Scaling can launch instances in another one to compensate.
-
Better availability. Amazon EC2 Auto Scaling helps ensure that your application always
has
the right amount of capacity to handle the current traffic demand.
-
Better cost management.
Amazon EC2 Auto Scaling can dynamically increase and decrease
capacity as needed.
Because you pay for the EC2 instances you use, you save
money by launching
instances when they are needed and terminating them when they
aren't.
Amazon EC2 Auto Scaling
-minimum size
-maximum size
-desired capacity
Amazon EC2 Auto Scaling helps you ensure that you have the correct number of Amazon EC2 instances available to handle the load for your application. You create collections of EC2 instances, called Auto Scaling groups.
You can specify the minimum number of instances in each Auto Scaling group, and Amazon EC2 Auto Scaling ensures that your group never goes below this size.
You can specify the maximum number of instances in each Auto Scaling group, and Amazon EC2 Auto Scaling ensures that your group never goes above this size.
If you specify the desired capacity, either when you create the group or at any time thereafter, Amazon EC2 Auto Scaling ensures that your group has this many instances.
If you specify scaling policies, then Amazon EC2 Auto Scaling can launch or terminate instances as demand on your application increases or decreases.
Within Amazon EC2 Auto Scaling, you can use two approaches: dynamic scaling and predictive scaling.
Dynamic scaling: responds to changing demand.
Predictive scaling: automatically schedules the right number of Amazon EC2 instances based on predicted demand.
To scale faster, you can use dynamic scaling and predictive scaling together.
Adding Amazon EC2 Auto Scaling to your application architecture is one way to maximize the benefits of the AWS Cloud. When you use Amazon EC2 Auto Scaling, your applications gain the following benefits:
-
Better fault tolerance. Amazon EC2 Auto Scaling can detect when an instance is unhealthy, terminate it, and launch an instance to replace it. You can also configure Amazon EC2 Auto Scaling to use multiple Availability Zones. If one Availability Zone becomes unavailable, Amazon EC2 Auto Scaling can launch instances in another one to compensate.
-
Better availability. Amazon EC2 Auto Scaling helps ensure that your application always has the right amount of capacity to handle the current traffic demand.
-
Better cost management. Amazon EC2 Auto Scaling can dynamically increase and decrease capacity as needed. Because you pay for the EC2 instances you use, you save money by launching instances when they are needed and terminating them when they aren't.
Elastic Load Balancing
Elastic Load Balancing automatically distributes your incoming traffic across multiple
targets, such as
EC2 instances, containers, and IP addresses, in one or more Availability Zones. It
monitors the health of its registered targets, and routes traffic only to the healthy
targets. Elastic Load Balancing scales your load balancer as your incoming traffic
changes over time. It can
automatically scale to the vast majority of workloads.
Elastic Load Balancing
Elastic Load Balancing automatically distributes your incoming traffic across multiple targets, such as EC2 instances, containers, and IP addresses, in one or more Availability Zones. It monitors the health of its registered targets, and routes traffic only to the healthy targets. Elastic Load Balancing scales your load balancer as your incoming traffic changes over time. It can automatically scale to the vast majority of workloads.
Load balancer benefits
A load balancer distributes workloads across multiple compute resources, such as
virtual servers. Using a load balancer increases the availability and fault tolerance
of your applications.
You can add and remove compute resources from your load balancer as your needs
change, without disrupting the overall flow of requests to your applications.
You can configure health checks, which monitor the health of the compute resources,
so
that the load balancer sends requests only to the healthy ones. You can also offload
the
work of encryption and decryption to your load balancer so that your compute resources
can focus on their main work.
Elastic Load Balancing supports the following load balancers: Application Load Balancers,
Network Load Balancers, Gateway Load Balancers, and Classic Load Balancers.
Monolithic applications and microservices
In a microservices approach, application components are loosely
coupled. In this case, if a single component fails, the other components
continue to work because they are communicating with each other. The
loose coupling prevents the entire application from failing.
When
designing applications on AWS, you can take a microservices approach
with services and components that fulfill different functions. Two
services facilitate application integration: Amazon Simple Notification
Service (Amazon SNS) and Amazon Simple Queue Service (Amazon SQS)
A load balancer distributes workloads across multiple compute resources, such as virtual servers. Using a load balancer increases the availability and fault tolerance of your applications.
You can add and remove compute resources from your load balancer as your needs change, without disrupting the overall flow of requests to your applications.
You can configure health checks, which monitor the health of the compute resources, so that the load balancer sends requests only to the healthy ones. You can also offload the work of encryption and decryption to your load balancer so that your compute resources can focus on their main work.
Elastic Load Balancing supports the following load balancers: Application Load Balancers, Network Load Balancers, Gateway Load Balancers, and Classic Load Balancers.
Monolithic applications and microservices
In a microservices approach, application components are loosely coupled. In this case, if a single component fails, the other components continue to work because they are communicating with each other. The loose coupling prevents the entire application from failing.
When designing applications on AWS, you can take a microservices approach with services and components that fulfill different functions. Two services facilitate application integration: Amazon Simple Notification Service (Amazon SNS) and Amazon Simple Queue Service (Amazon SQS)
Amazon Simple Notification Service (Amazon SNS)
Amazon Simple Notification Service (Amazon SNS) is
a publish/subscribe service. Using Amazon SNS topics, a publisher
publishes messages to subscribers. This is similar to the coffee shop;
the cashier provides coffee orders to the barista who makes the drinks.
In Amazon SNS, subscribers can be web servers, email addresses, AWS Lambda functions, or several other options.
Amazon Simple Notification Service (Amazon SNS)
Amazon Simple Notification Service (Amazon SNS) is a publish/subscribe service. Using Amazon SNS topics, a publisher publishes messages to subscribers. This is similar to the coffee shop; the cashier provides coffee orders to the barista who makes the drinks.
In Amazon SNS, subscribers can be web servers, email addresses, AWS Lambda functions, or several other options.
Amazon Simple Queue Service (Amazon SQS)
Amazon Simple Queue Service (Amazon SQS) is a message queuing service.
Using
Amazon SQS, you can send, store, and receive messages between software
components, without losing messages or requiring other services to be
available. In Amazon SQS, an application sends messages into a queue. A
user or service retrieves a message from the queue, processes it, and
then deletes it from the queue.
Serverless computing
Earlier
in this module, you learned about Amazon EC2, a service that lets you
run virtual servers in the cloud. If you have applications that you want
to run in Amazon EC2, you must do the following:
Provision instances (virtual servers).
Upload your code.
Continue to manage the instances while your application is running.
The
term “serverless” means that your code runs on servers, but you do not
need to provision or manage these servers. With serverless computing,
you can focus more on innovating new products and features instead of
maintaining servers.
Another benefit of serverless computing is
the flexibility to scale serverless applications automatically.
Serverless computing can adjust the applications' capacity by modifying
the units of consumptions, such as throughput and memory.
An AWS service for serverless computing is AWS Lambda.
Amazon Simple Queue Service (Amazon SQS)
Amazon Simple Queue Service (Amazon SQS) is a message queuing service.
Using Amazon SQS, you can send, store, and receive messages between software components, without losing messages or requiring other services to be available. In Amazon SQS, an application sends messages into a queue. A user or service retrieves a message from the queue, processes it, and then deletes it from the queue.
Serverless computing
Earlier in this module, you learned about Amazon EC2, a service that lets you run virtual servers in the cloud. If you have applications that you want to run in Amazon EC2, you must do the following:
Provision instances (virtual servers).
Upload your code.
Continue to manage the instances while your application is running.
The term “serverless” means that your code runs on servers, but you do not need to provision or manage these servers. With serverless computing, you can focus more on innovating new products and features instead of maintaining servers.
Another benefit of serverless computing is the flexibility to scale serverless applications automatically. Serverless computing can adjust the applications' capacity by modifying the units of consumptions, such as throughput and memory.
An AWS service for serverless computing is AWS Lambda.
AWS Lambda
AWS Lambda is a service that lets you run code without needing to provision or manage servers.
While
using AWS Lambda, you pay only for the compute time that you consume.
Charges apply only when your code is running. You can also run code for
virtually any type of application or backend service, all with zero
administration.
For example, a simple Lambda function might
involve automatically resizing uploaded images to the AWS Cloud. In this
case, the function triggers when uploading a new image
You upload your code to Lambda.
You set your code to trigger from an event source, such as AWS services, mobile applications, or HTTP endpoints.
Lambda runs your code only when triggered.
You
pay only for the compute time that you use. In the previous example of
resizing images, you would pay only for the compute time that you use
when uploading new images. Uploading the images triggers Lambda to run
code for the image resizing function.
In AWS, you can also build and run containerized applications
AWS Lambda
AWS Lambda is a service that lets you run code without needing to provision or manage servers.
While using AWS Lambda, you pay only for the compute time that you consume. Charges apply only when your code is running. You can also run code for virtually any type of application or backend service, all with zero administration.
For example, a simple Lambda function might involve automatically resizing uploaded images to the AWS Cloud. In this case, the function triggers when uploading a new image
You upload your code to Lambda.
You set your code to trigger from an event source, such as AWS services, mobile applications, or HTTP endpoints.
Lambda runs your code only when triggered.
You pay only for the compute time that you use. In the previous example of resizing images, you would pay only for the compute time that you use when uploading new images. Uploading the images triggers Lambda to run code for the image resizing function.
In AWS, you can also build and run containerized applications
Containers
Containers
provide you with a standard way to package your application's code and
dependencies into a single object. You can also use containers for
processes and workflows in which there are essential requirements for
security, reliability, and scalability.
Containers
Containers provide you with a standard way to package your application's code and dependencies into a single object. You can also use containers for processes and workflows in which there are essential requirements for security, reliability, and scalability.
Amazon Elastic Container Service (Amazon ECS)
Amazon Elastic Container Service (Amazon ECS)
* highly scalable
* high-performance container management system that enables you to run and scale the containerized applications on AWS.
* Amazon ECS supports Docker containers.
*With Amazon ECS, you can use API calls tolaunch n stop Docker-enabledapplications
Docker is a software platform that enables you to build, test, and deploy applications quickly.
AWS supports the use of open-source Docker Community Edition and subscription-based Docker Enterprise Edition.
* highly scalable
* high-performance container management system that enables you to run and scale the containerized applications on AWS.
* Amazon ECS supports Docker containers.
*With Amazon ECS, you can use API calls tolaunch n stop Docker-enabledapplications
Docker is a software platform that enables you to build, test, and deploy applications quickly.
AWS supports the use of open-source Docker Community Edition and subscription-based Docker Enterprise Edition.
Amazon Elastic Kubernetes Service (Amazon EKS)
Amazon Elastic Kubernetes Service (Amazon EKS) is a fully managed service that you can use to run Kubernetes on AWS. kubernetes is open-source software that enables you to deploy and manage
containerized applications at scale. A large community of volunteers
maintains Kubernetes, and AWS actively works together with the
Kubernetes community. As new features and functionalities release for
Kubernetes applications, you can easily apply these updates to your
applications managed by Amazon EKS.
Amazon Elastic Kubernetes Service (Amazon EKS)
Amazon Elastic Kubernetes Service (Amazon EKS) is a fully managed service that you can use to run Kubernetes on AWS. kubernetes is open-source software that enables you to deploy and manage containerized applications at scale. A large community of volunteers maintains Kubernetes, and AWS actively works together with the Kubernetes community. As new features and functionalities release for Kubernetes applications, you can easily apply these updates to your applications managed by Amazon EKS.
AWS Fargate
AWS Fargate
AWS Fargate is a serverless compute engine for containers. It works with both Amazon ECS and Amazon EKS.
AWS Fargate is a serverless compute engine for containers. It works with both Amazon ECS and Amazon EKS.
When
using AWS Fargate, you do not need to provision or manage servers. AWS
Fargate manages your server infrastructure for you. You can focus more
on innovating and developing your applications, and you pay only for the
resources that are required to run your containers.
When using AWS Fargate, you do not need to provision or manage servers. AWS Fargate manages your server infrastructure for you. You can focus more on innovating and developing your applications, and you pay only for the resources that are required to run your containers.
AWS - CLOUD PRACTIONER NOTES - CHAPTER 7. MONITORING N ANALYTICS
Amazon CloudWatch
Monitor your AWS infrastructure and resources in real time
View metrics and graphs to monitor the performance of resources
Configure automatic actions and alerts in response to metrics
Amazon cloud watch is a web service that enables you to monitor and manage various metrics and configure alarm actions based on data from those metrics.
CloudWatch uses metrics to represent the data points for your resources. AWS services send metrics to CloudWatch. CloudWatch then uses these metrics to create graphs automatically that show how performance has changed over time.
Monitor your resources’ utilization and performance
Access metrics from a single dashboard
Amazon CloudWatch
Monitor your AWS infrastructure and resources in real time
View metrics and graphs to monitor the performance of resources
Configure automatic actions and alerts in response to metrics
Amazon cloud watch is a web service that enables you to monitor and manage various metrics and configure alarm actions based on data from those metrics.
CloudWatch uses metrics to represent the data points for your resources. AWS services send metrics to CloudWatch. CloudWatch then uses these metrics to create graphs automatically that show how performance has changed over time.
Monitor your resources’ utilization and performance
Access metrics from a single dashboard
CloudWatch alarms
CloudWatch alarms
With CloudWatch, you can create alarms that automatically perform actions if the value of your metric has gone above or below a predefined threshold.
For example, suppose that your company’s developers use Amazon EC2 instances for application development or testing purposes. If the developers occasionally forget to stop the instances, the instances will continue to run and incur charges.
In this scenario, you could create a CloudWatch alarm that automatically stops an Amazon EC2 instance when the CPU utilization percentage has remained below a certain threshold for a specified period. When configuring the alarm, you can specify to receive a notification whenever this alarm is triggered.
With CloudWatch, you can create alarms that automatically perform actions if the value of your metric has gone above or below a predefined threshold.
For example, suppose that your company’s developers use Amazon EC2 instances for application development or testing purposes. If the developers occasionally forget to stop the instances, the instances will continue to run and incur charges.
In this scenario, you could create a CloudWatch alarm that automatically stops an Amazon EC2 instance when the CPU utilization percentage has remained below a certain threshold for a specified period. When configuring the alarm, you can specify to receive a notification whenever this alarm is triggered.
CloudWatch dashboard
The CloudWatch dashboard feature enables you to access all the metrics for your resources from a single location. For example, you can use a CloudWatch dashboard to monitor the CPU utilization of an Amazon EC2 instance, the total number of requests made to an Amazon S3 bucket, and more. You can even customize separate dashboards for different business purposes, applications, or resources.
CloudWatch dashboard
The CloudWatch dashboard feature enables you to access all the metrics for your resources from a single location. For example, you can use a CloudWatch dashboard to monitor the CPU utilization of an Amazon EC2 instance, the total number of requests made to an Amazon S3 bucket, and more. You can even customize separate dashboards for different business purposes, applications, or resources.
AWS CloudTrail
AWS cloud trail records API calls for your account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, and more. You can think of CloudTrail as a “trail” of breadcrumbs (or a log of actions) that someone has left behind them.
Recall that you can use API calls to provision, manage, and configure your AWS resources. With CloudTrail, you can view a complete history of user activity and API calls for your applications and resources.
Events are typically updated in CloudTrail within 15 minutes after an API call. You can filter events by specifying the time and date that an API call occurred, the user who requested the action, the type of resource that was involved in the API call, and more.
cloud trail tasks:
Track user activities and API requests throughout your AWS infrastructure
Filter logs to assist with operational analysis and troubleshooting
AWS CloudTrail
AWS cloud trail records API calls for your account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, and more. You can think of CloudTrail as a “trail” of breadcrumbs (or a log of actions) that someone has left behind them.
Recall that you can use API calls to provision, manage, and configure your AWS resources. With CloudTrail, you can view a complete history of user activity and API calls for your applications and resources.
Events are typically updated in CloudTrail within 15 minutes after an API call. You can filter events by specifying the time and date that an API call occurred, the user who requested the action, the type of resource that was involved in the API call, and more.
cloud trail tasks:
Track user activities and API requests throughout your AWS infrastructureFilter logs to assist with operational analysis and troubleshooting
CloudTrail Insights
Within CloudTrail, you can also enable cloud trail insights. This optional feature allows CloudTrail to automatically detect unusual API activities in your AWS account.
For example, CloudTrail Insights might detect that a higher number of Amazon EC2 instances than usual have recently launched in your account. You can then review the full event details to determine which actions you need to take next.
AWS Trusted Advisor
Within CloudTrail, you can also enable cloud trail insights. This optional feature allows CloudTrail to automatically detect unusual API activities in your AWS account.
For example, CloudTrail Insights might detect that a higher number of Amazon EC2 instances than usual have recently launched in your account. You can then review the full event details to determine which actions you need to take next.
AWS Trusted Advisor
AWS trusted advisor is a web service that inspects your AWS environment and provides real-time recommendations in accordance with AWS best practices.
Trusted Advisor compares its findings to AWS best practices in five categories: cost optimization, performance, security, fault tolerance, and service limits.
For the checks in each category, Trusted Advisor offers a list of recommended actions and additional resources to learn more about AWS best practices.
The guidance provided by AWS Trusted Advisor can benefit your company at all stages of deployment. For example, you can use AWS Trusted Advisor to assist you while you are creating new workflows and developing new applications. Or you can use it while you are making ongoing improvements to existing applications and resources.
AWS trusted advisor is a web service that inspects your AWS environment and provides real-time recommendations in accordance with AWS best practices.
Trusted Advisor compares its findings to AWS best practices in five categories: cost optimization, performance, security, fault tolerance, and service limits.
For the checks in each category, Trusted Advisor offers a list of recommended actions and additional resources to learn more about AWS best practices.
The guidance provided by AWS Trusted Advisor can benefit your company at all stages of deployment. For example, you can use AWS Trusted Advisor to assist you while you are creating new workflows and developing new applications. Or you can use it while you are making ongoing improvements to existing applications and resources.
AWS advisor trusted dashboard
When you access the Trusted Advisor dashboard on the AWS Management Console, you can review completed checks for cost optimization, performance, security, fault tolerance, and service limits.
For each category:
The green check indicates the number of items for which it detected no problems.
The orange triangle represents the number of recommended investigations.
The red circle represents the number of recommended actions.
AWS advisor trusted dashboard
When you access the Trusted Advisor dashboard on the AWS Management Console, you can review completed checks for cost optimization, performance, security, fault tolerance, and service limits.
For each category:
The green check indicates the number of items for which it detected no problems.
The orange triangle represents the number of recommended investigations.
The red circle represents the number of recommended actions.
Subscribe to:
Posts (Atom)