AWS Associate Solutions Architect Notes

These are the notes I have prepared while doing 2 online courses, namely AWS Associate Solutions Architect on
Udemy(2015-2017) taught by Ryan Kroonenburg, and
AWS Certified Solutions Architect - Associate 2019 by DolfinEd, taught by
Eissa A. Sherif

Please note, I do not take any credit for this work, this is just to help people make use of these notes solely
for study purposes. I would recommend registering for the courses online, as content might have changed from the time I
took notes. All the best!

What do I need for doing these course(s):

AWS account Free tier
Domain name(optional)
A Laptop with internet connection

AWS Solutions Architect-Introduction

AWS SAA-C03 Example Guide

Concepts and Components
IAM
S3
CloudFront
- CloudFront Exam Tips
Storage Gateway
Snowball
Import/Export
Elastic Cloud Compute EC2
DNS
- Route53 Routing policies
- DNS Exam Tips
Databses 101
- RDS
- RDS Backup
- DynamoDB
- Redshift
- Elasticache
- Aurora
Virtual Private Cloud
NAT
Application Services
Overview of Security Processes
Addtional Exam Tips
Other Helpful Resources- A must read!!

Concepts and Components:

AWS Global Infrastructure:

1. Regions: A place where AWS resources exists a geographical area, there are 15 regions (as of 2015).  
   Each region consists of multiple availability zones, currently 49 in total(as of 2017).  
   An Availability Zone(AZ) is simply a data center.

2. Edge location: This is a CDN(Content-Delivery Network) endpoint. Edge locations are used by CloudFront   
   to cache files near the user where they access them.

3. CDN: A content delivery network (CDN) is a system of distributed servers that deliver webpages,  
   and other web content to a user based on the geographic locations of the user,  
   the origin of the webpage and a content delivery server.

 There are many more edge locations than there are regions. Currently 52 edge locations around the world

Networking:

1. Route 53: Amazon’s DNS service, basically allows you to host your domain name with Amazon.   
   53 is the DNS port. When you open up DNS world you do this on port 53

2. Direct connect: Allows you to connect directly to where your Virtual Private Cloud(VPC) is located  
   using connection links to Amazon data center into your VPC, and you don't need internet to access it

3. Virtual Private Cloud: A virtual data center as a collection of AWS resources, such as EC2 instances,   
   EBS instances, and Load Balancers

4. CloudFront: Part of the CDN, consisting of edge locations to cache your assets, like videos, large media  
   files etc.

Compute Elements:

1. EC2: Known as Elastic Cloud Compute, allowing one to provision instances inside your VPC, these are  
   just virtual machines in the cloud that run on AWS

2. EC2 Container Service: highly scalable, high performance container management service, supporting Docker  
   containers, allowing you to run applications on a managed cluster of EC2 instances, eliminating the need  
   to install, operate and scale your own cluster management infrastructure

3. Elastic Beanstalk: An easy to use service for developing and scaling web apps developed in   
   Java, Dot Net etc., we can simply upload the code and EB will automatically handle the deployment from   
   capacity provisioning, load balancing, autoscaling, app health and monitoring.

4. Lambda: Is Serverless. Upload your code to respond to events.

5. Lightsail: A completely brand new service introduced in 2016. Allows anyone who does not understand AWS   
   to deploy a site in a few seconds

Storage: 1. S3(Simple Storage Service): S3 is a file-based storage or object based storage.
Allows us to store files in the cloud of sizes ranging from 1 byte to 5 terabytes

2. Glacier: Is an archiving service. Allows us to archive all our data in the Amazon cloud,  
   not immediately accessible but take 3-5 hours to restore a file from Glacier,hence used for long-term storage

3. EFS(Elastic File service): File based storage and you can share it, you can install databases, applications.

4. Storage gateway: A service that connects on-premise software appliance with cloud based storage   
   to provide seamless and secure integration between organizations on premise IT equipment and AWS storage infrastructure.

Databases:

1. RDS(Relational Database Services): Consists of elements such as SQLServer by MS, Oracle, PostgreSQL, MySQL,   
   and Amazon’s own database engine known as Aurora completely MySQL compatible db but designed to run specifically   
   on the AWS platform.

2. DynamoDB: For NoSQL

3. RedShift: A fast, fully-managed petabyte scaled datawarehousing solution,  
   that makes it simple and cost-effective to efficiently analyze your data using your existing BI tools.   
   It is designed from the infrastructure layer upwards to maximize performance and minimize cost.

4. Elastic Cache: Allows/offers an in-memory caching service for the AWS platform.

Migration
Snowball: This is a data transport solution that uses secure appliances to transfer large amounts of data,
into and out of AWS. It addresses common challenges with large-scale data transfers such as high network costs,
long transfer times, and security concerns.
```
2. DMS(Database Migration services): This allows migration of on-premise databases to AWS cloud  
  
3. SMS(Server Migration Service): does same work as the DMS but targets virtual machines,  
    to replicate vms to aws cloud  
```
Analytics:
1. Athena: SQL queries on S3.
2. Kinesis:
  - Is a fully-managed service for real-time processing of streaming data at massive scale.
  - Can continuously change and store terabytes of data per hour from several sources such as
    website clickstreams, social media, location tracking event.
  - With Kinesis client library ACL, we can build Amazon Kinesis apps,
    and use streaming data to power real time dashboards, generate alerts, implement dynamic pricing and
    advertising or more
  - We can emit data from Kinesis to other AWS services such as S3, redShift, Elastic MapReduce, and lambda
3. ElasticMapReduce(EMR):
  - A web service that makes it easy to quickly and cost-effectively process vast amounts of data.
  - Uses Hadoop, an open source framework to distribute your data and process across a resizeable cluster of
    Amazon EC2 instances.
  - It can also run other distributed framework such as Spark and Presto.
  - EMR is used in a variety of applications including log analysis, web-indexing, data warehousing,
    machine learning, financial analysis, scientific simulation, and Bioinformatics,
    customers launch millions of Amazon’s EMR clusters each year
  - Allows you root access(i.e. login via SSH)
4. Cloud Search / Elastic Search:
  - Search engine for your website or your application,
  - Cloud search is fully managed service provided by AWS, Elastic search uses open source framework
5. Data Pipeline: Allows to move data from one place to another
6. Quick Sight: used for creating visualizations, dashboards for BI/Analytics
Security and Identity:

1. IAM(Identity Access Management):
    - Enables you to securely control access to AWS services and resources for your users
    - We can create and manage AWS users and groups and use permissions to allow and  
      deny their access to AWS resources

2. Inspector: An agent to install on vms to inspect and does security reporting on whats going on

3. Certificate Manager: Gives free SSL certificates for your domain names.

4. Directory Service: A way of using active directory which you use with Microsoft with AWS.

5. WAF(Web application Firewalls): Application level protection to your website .

Application Services:

1. Step Functions: A way of visualizing what's going on inside your application.

2. API Gateway: Acts as a door to create, publish, monitor, maintain, and secure API at scale using AWS.

3. AppStream: Streaming desktop applications to your users.

4. SWF(Simple Work Flow Service): Helps developers to build, run, and scale background jobs that have parallel   
   or sequential steps.

6. Elastic Transcoder:
    - A media transcoding service in the cloud.
    - Designed to be highly-scalable, easy to use in a cost-effective way for developers and businesses to  
      convert or transcode media files from their source formats to version that will play on devices like  
      smartphones, tablets etc.

Deployment and Management:
1. CloudWatch:
  - A monitoring service for AWS Cloud resources and the apps you run on AWS
  - Used for collecting and tracking metrics, collect and monitor log files, and set alarms
  - It can monitor AWS resources, such as EC2 instances, DynamoDB tables, and RDS DB instances,
    as well as custom metrics generated by your apps and services, and log any files your app generates
  - We can use it to gain system-wide visibility into resource utilization, app performance,
    and operational health.
2. CloudTrail:
  - A logging, and auditing service, a web service that records API call for your account
    and deliver log files to you.
  - We can get history of AWS API calls for your account, including calls made by AWS management console,
    SDKs, Command line tools, and high level AWS services such as AWS cloud formation
3. Cloud Formation:
  - Gives developers, and sys admins an easy way to create and manage a collection of related AWS resources,
    provisioning and updating them in an orderly and predictable fashion.
4. OpsWorks: Automating deployments using chef.
5. Config Manager: proactively monitor changes to your environment.
6. Service Catalog:
  - Allows you as an enterprise to build out what it is that you authorize within your organization.
7. Trusted Advisor: tips on cost optimization, performance optimization, security fixes etc.
Developer Tools: 1. CodeCommit: GitHub's way of storing your code in the cloud. 2. CodeBuild: way of compiling code. 3. CodeDeploy: deploying code to your Ec2 instances. 4. CodePipeline: keeping track of different versions of your code.
Mobile Services: 1. Mobile Hub: Add, configure features for your mobile apps. It is its own console for mobile apps. 2. Cognito: Makes easy for singup and sign into your apps. 3. Device Farm: Improve quality of ios, aos, fireos, by quickly, and securely testing on 100 smartphones. 4. Mobile analytics: allows to simply and cost effectively analyze app usage data. 5. Pinpoint: Google analytics for your mobile apps.
Business Productivity: 1. WorkDocs: Securely storing work documents in the cloud. 2. WorkMail: Exchange for AWS, sending, receiving emails.
Internet Of Things:
Keeping track of thousands, millions or billions of devices out there
Desktop & AppStreaming: 1. WorkSpaces: Basically a VDI. Desktop in the cloud. 2. AppStream 2.0: Streaming desktop apps to your users.
Artificial Intelligence: 1. Alexa: Voice service in the cloud. 2. Lex: No longer need echo to communicate. 3. Polly: Text to voice service. 4. Machine Learning: 5. Rekognition
Messaging: 1. SNS(Simple Notification Service):
- A fast, flexible, fully-managed push messaging service, makes it simple and cost-effective to push
  notifications to all mobile devices including Apple, Google, FireOS, and Windows devices,
  and Android devices as well 2. SQS(Simple Queue Service):
- A fast reliable, scalable and fully-managed messaging queueing service.
- SQS makes it simple and cost-effective to decouple the components of a cloud application.
- We can use SQS to transmit any volume of data at any level of throughput, without losing messages or
  other services to be available. 3. SES(Simple Email Service):
- A cost-effective outbound only email sending service.
- We can send transactional emails,marketing messages etc, and get to pay for what we use.
- Along with high-deliverability SES provides, easy, real-time access to your sending statistics,
  and built-in notifications for bounces, complaints, and deliveries to help you find tune your
  cloud-based email sending strategy

After AWS resources are deployed we can update or modify in a controlled manner,
and predictable way in effect applying version control to your AWS infrastructure.
Amazon Web Services offer 3 different levels of support, namely Enterprise Business, and Developer
Back to Table of Contents

IAM(Identity and Access Management)

Allows us to manage users and their level of access to the AWS console.

Features of IAM:

Centralized control of your AWS account
Integrated with existing active directory account and allows single sign on
Has fine grained access to the AWS resource
Access available on user/group/roles
Allows Multifactor authentication
Provides temporary access for users,and devices and services where necessary
Allows us to set up password rotation policy
Integrates with many other aws services
supports compliance
A universally available service, not restricted to a particular region

IAM Elements:

Principal: who is going to do the action, admin IAM is your first principal
Request: eg: create user, create EC2 instance, start or stop an EC2 instance
Authentication
Authorization
Actions
Resources: entity thats exists within a service

High Level Concept:

Access IAM via:
- AWS Console
- Programmatic access through SDKs, HTTPS API, and CLI(require Access Key and Secret)
User: An end user
Group: A collection of users under one set of permissions, makes it easier to manage permissions for users. 300 groups
can be created at any given time, nesting of groups is not allowed. A user can be a member of upto 10 groups
Roles: Similar to a group, but you can assign both users and AWS resources(EC2). No password or access key is assigned
It is an identity with permission policies that determine what the identity can and cannot do in AWS. An IAM user
can assume a role to temporarily take on different permissions. An IAM Role can be assigned to a Federated user who
signs by using an external identity
Policies: document defining 1 or more permissions

Each Role has a policy template.

Administrator Access: Full access to AWS services and resources
Power User Access: Full access except for management of users and groups
Read Only Access: Read only access to the resources

More granular access depending on the resources required such as S3 access.

Configure IAM:

root account gives you unlimited access to do things in the cloud
AWS provides a number of authentication mechanisms including a console, account Ids and secret keys,
X.509 certificates, and MFA devices
Console authentication is the most appropriate for administrative or manual activities
Account IDs and secret keys for accessing REST-based interfaces or tools
X.509 certificates for SOAP-based interfaces and tools
Multifactor authentication: Is simply where you have a second means to verify yourself when signing in.
Since passwords can be compromised, with multi factor authentication is basically a second way of authenticating you.

Creating a role:
A secure way to grant permissions to entities that you trust
Eg:

IAM users in another account
Application code running on EC2 instances needs access to other AWS services

Identity Federation:

If your account users already have a way to be authenticated, such as through your corporate network
- you can federate those user identities in AWS
- A user logged in to the corporate network using their corporate identity
  - corporate can replace their existing identity with a temporary identity in your AWS account
  - this user can work in the AWS console
  - similarly the application the user is working on can make programmatic requests using permissions that you
    define
When to use identity federation
1. Your users already have identities in a corporate directory
  - If your corporate directory is SAML 2.0 compatible, you can configure your corporate directory to provide
    Single-Sign on(SSO) to access teh AWS management console
  - If your corporate directory is not compatible with SAML 2.0, you can create an identity broker application, to
    provide SSO access to the AWS management console
  - If your corporate directory is Microsoft Active directory, you can use AWS directory service to establish
    trust between your corporate directory and AWS account
2. Your users already have internet identities
  - If your mobile app or web-based app can let users identify themselves through an identity provider like
    Amazon, Facebook, or Google, or any OpenID Connect(OIDC) compatible identity provider, the app can use
    web federation to access AWS
  - AWS recommends using AWS Cognito

IAM users and Single Sign-on(SSO):

IAM users in your account have access only to the AWS resources that you specify in the policy that is attached to the
user or to an IAM group that the user belongs to, for working in the console users must have permissions to perform
the actions that the console performs, such as listing and creating AWS resources

IAM-Access Management:

Helps you to define what a user or other entity is allowed to do in account, called as authorization
Permissions are granted through policies that are created and then attached to users, groups, or roles
By default a user cannot access anything
Users or groups can have multiple policies attached to them that grant different permissions
You can assign a role to a federated user
Resource based policy:
- You can assign a policy to a resource(eg: S3) in addition to attaching to a user or group, this is called as
  resource-based policy, you specify what actions are permitted and hat resource is affected
- include the principal who is granted the permission

IAM Users:

When you first create an AWS account, you first create an account(root user) which you use to sign in to AWS
You have complete unrestricted access to all the resources in your AWS account
Not possible to restrict the permissions that are granted to the AWS account
Create an IAM user for yourself and then assign yourself admin permissions for your account
IAM user with admin permissions is not the same thing as the AWS account root user
An IAM user is an entity that you create in AWS
IAM users are global entities, no region is required to be specified when you define user permissions
Each IAM user is associated with one and only one AWS account
A brand new IAM user has no permissions to do anything
You can grant user permissions by attaching IAM policies to them directly, or making them members of IAM groups
IAM user for a service that needs credentials to make requests to AWS is known as "service account"
You can have 5000 users, for more users make use of STS
When you create a user, you can identify them by either their names or ARN(arn:aws:iam::account-id-without-hyphens:user/Bob)
Create credentials or the user, depending on the type of access the user requires, i.e. programmatic or management console
When you create access key, IAM returns the access key ID and secret access key
You can give permissions to users to list, rotate and manage their own keys using an IAM policy

IAM Roles:

a set of permissions that grants access to actions and resources in AWS
does not have a long term credentials associated with it
roles can be assumed by any one of the following:
- IAM user in the same account
- IAM user in a different account
- web service offered by AWS such as EC2
- federated user
Resource based policies
specifies who can access the resource
cross-account access with a resource-based policy has an advantage over a role, i.e. a user continues to have
access in the trusted account, and does not need to give their permissions in place of the role
not all services support resource-based policies
IAM Service Roles
A role that service assumes to perform actions on your behalf
Must define a role for the service to assume
Vary from service to service, but many allow you to choose your permissions
Create, modify, and delete a service role from within IAM
IAM Role for EC2 instance
when you launch an EC2 instance you can specify a role as a launch parameter
IAM automatically provides temporary security credentials that are attached to the role, and then makes them
available for the EC2 instance to use on behalf of its applications
the temporary security credentials are available on the instance and are rotated 5 minutes before the expiration
for cases other than EC2 roles you need to request temporary credentials first
Instance profile is required to assign an AWS role and its associated permissions to an EC2 instance, it contains
the role and can provide temporary credentials to an app that runs on the instance
- only 1 role can be assigned to an EC2 instance, and all the app on that instance share the same role and
  permissions
** Although a role is usually assigned to an EC2 instance when you launch it, a role can also be attached to an
EC2 instance that is already running**
IAM Role Delegation
is granting of permission to someone to allow access to resources that you control
this involves setting up trust between the account that owns the resource(trusting account), and the account that
contains the users that need to access the resource(the trusted account)
the accounts can be either be the same account, 2 accounts under the same org, 2 accounts owned by different orgs
to delegate permission to access a resource, you can create an IAM role that has 2 policies attached
- Permission policy
Where the actions and resources the role can use are defined
- It grants the user of the role the needed permissions to carry out the intended tasks on the resource
- Trust policy
Specifies which trusted accounts are allowed to grant its users permissions to assume the role,
- The trusted entity is included in the policy as principal element in the document
- You cannot specify a wildcard(*) as a principal
- The trust policy on the role in the trusting account is 1 half of the permissions, the other half is a
  permissions policy attached to the user in the trusted account that allows the user to switch to, or
  assume the role
IAM Role for Cross-Account Access
To grant users access to resources from 1 account to another do not share credentials, access keys, instead use
IAM roles
You can define a role in trusting account, that specifies what permissions the IAM users in the other accounts are
allowed
In some web services you can attach a policy directly to a resource called as resource-based policies
A user in 1 account can switch to a role in the same or different account
- While using the role the user can perform only the actions and access only the resources permitted by the
  role; their original user permissions are suspended
- When the user exists the role, the original user permissions are restored
- Services that support resource-based policies are S3, SNS, SQS, Glacier vaults
When to use IAM users vs IAM Roles
- Use IAM user when:
  - You created an AWS account and you are the only person who works in your account
  - Other people in your group need to work in your AWS account, and your group is using no other identity
    mechanism
  - You want to use the AWS CLI
- Use IAM Role when:
  - You are creating an app that runs on EC2 instances and that app makes requests to AWS
  - You are creating an app that runs on a mobile phone and that makes requests to AWS
  - Users in your company are authenticated in your corporate network and want to be able to use AWS without
    having to sign in again
Logging sign-in details in CloudTrail
If you enable CloudTrail to log sign-in events to your log, you need to be aware of how CloudTrail chooses where
to log the events
Users are redirected to either global or a regional sign-in endpoint, based on whether the selected service
console supports regions
You can manually request a certain regional sign-in endpoint by signing in to the region-enabled main console home
page using a URL syntax like: https://alias.signin.aws.amazon.com/console?region=ap-southeast-1, AWS redirects
you to ap-southeast-1 regional sign-in endpoint
IAM Best practices

Lock away your AWS account Root user access keys
Create individual IAM users
Use AWS defined policies to assign permissions whenever possible
Use groups to assign permissions to IAM users
Grant least privilege
Use access levels to review IAM permissions(AWS categorizes each service action into one of four access levels
based on what each action does: List, Read, Write, or Permissions management)
Configure a strong password policy
Enable MFA for privileged users
Use roles for applications that run on AWS EC2 instances
Delegate by using roles instead of sharing credentials
Rotate credentials regularly
Remove unnecessary credentials
Use policy conditions for Extra security
Monitor Activity in your AWS account

Summary:

IAM consists of the following:

Users
Groups(group users and apply policies to them)
Roles
Policy documents
Root account has complete admin access when you first set up your AWS account
AWS strongly recommends that you do not use root user for your everyday tasks, even administrative ones
IAM does not apply to any region at this time
New users have no permissions, they have AccessKeyId, and secret access keys when they are first created
Access key ids and secret keys cannot be used as passwords to login to the console, we use them to access AWS via API or CLI
Set up MFA on root account, always
Create and customize your own password rotation policies
Power user access allows access to all AWS resources except for mgmt of groups and users within IAM
Secure access to AWS resources for applications that run on EC2
Identity federation - users already having passwords get temporary access to your AWS account
Identity information for assurance - AWS CloudTrail provides information about who made requests for your resources
Payment Card Industry(PCI) Data Security Standard(DSS) compliance
Eventually consistent - achieves high availability by replicating data across multiple servers, but a change
committed must be replicated across IAM might take some time to be reflected
eg: creating or updating users, groups, roles or policies
Free to use, you will be only charged for the use of other AWS resources by your IAM users
Checks each policy that matches your context of request
By default it is an implicit deny(all requests are denied), explicit deny overrule any allows,
explicit allows overrides this default
Identity-based policies is not the way to provide cross-account access

Name		Name	Last commit message	Last commit date
Latest commit History 45 Commits
.gitignore		.gitignore
README.md		README.md

Family	Speciality	Use Cases
T2	Lowest Cost, General Purpose	Web Servers/Small DBs
G2	Graphics/General Purpose GPU	Video Encoding, Machine Learning, 3D Application Streaming
I2	High Speed Storage	NoSQL DBs, Data Warehousing etc.
F1	Field programmable gate array	hardware acceleration for your code
D2	Dense storage	File Servers/Data Warehousing/Hadoop
P2	Graphics/General Purpose GPU	Machine Learning bitcoin mining etc.
X1	Memory Optimized	SAP HANA/Apache Spark etc.

Apjo/AWSAssociateSolutionsArchitectNotes

Folders and files

Latest commit

History

Repository files navigation

AWS Associate Solutions Architect Notes

What do I need for doing these course(s):

AWS Solutions Architect-Introduction

Table of Contents

Concepts and Components:

IAM(Identity and Access Management)

Active Directory Integration:

How is it done?

AWS Object Storage and CDN - S3, Glacier and CloudFront

S3 transfer acceleration

S3 static websites

Q. What is the correct format for a static website hosting?

CloudFront:

Storage Gateway:

Snowball:

Import/Export:

EC2(Elastic Compute Cloud)

EC2 Instance Types:

How to remember?

Elastic Block Storage(EBS)

EBS Volume Types:

EBS Volumes vs Snapshot Lab

Security Groups Basics

RAID, Volumes and Snapshots:

Encrypted Root device Volumes & Snapshots - Lab

Creating an Amazon Machine Image(AMI):

AMI types(EBS vs Instance Store)

EBS vs Instance Store - Exam Tips

Load Balancers and Health Checks

CloudWatch EC2:

Using IAM roles with EC2 Lab

EC2 Instance Metadata

AutoScaling 101

Launch Configurations & Auto Scaling Groups

EC2 Placement Groups

EFS(Elastic File System):

Lambda Concepts

Route53

Route53 routing policies

Databases

Launching an RDS Instance - Lab

RDS - Backups, Multi-AZ & Read replicas

DynamoDB

Redshift

Elasticache

Aurora

Virtual Private Cloud(VPC)

VPC Types

Components of a VPC

IPv6 Addressing

AWS Reserved IP's in each subnet

NAT Instances - Security Group configuration

NAT Gateways - is an AWS managed service

Network Access Control Lists vs Security Groups - Your vpc comes with a default network ACL, and by default allows all inbound and outbound traffic

Application Load Balancer

VPC Wizard

VPC Peering

VPC Flow Logs

VPC Virtual Private Networks

AWS Direct Connect(DX)

NAT vs Bastion

Application Services

Simple Queue Service(SQS)

Simple Workflow Service(SWF)

Simple Notification Service(SNS) - A web service to send notifications from the cloud

Elastic Transcoder

API Gateway

Kinesis

Overview of Security Processes

Additional Exam Tips

Consolidated Billing

Cross Account Access

Resource Groups and Tagging

Tags

Resource Groups

Packages