Guangning Yu's Blog
Home
Code
Data
Setup
Industry
MachineLearning
Archive
AWS Solution Architect Professional Notes
2021-06-04 16:30:48
# S3 - Maximum object size is 5TB; largest object in a single PUT is 5GB. - Recommended to use multi-part uploads if larger than 100MB. - Security: IAM policies -> Bucket policy -> Object ACL -  - Versioning cannot be enabled at the object level. It's a bucket-level feature. # Amazon Neptune -  # Amazon Redshift -  -  -  -  -  -  # Amazon Athena -  -  # Amazon Quantum Ledger Database -  # Amazon Managed Blockchain -  # Amazon Timestream Database -  # Amazon DocumentDB -  # Amazon ElasticSearch -  # Databases -  # S3 Select vs Athena vs Redshift Spectrum S3 Select is focused on retrieving data from S3 using SQL: > S3 Select, enables applications to retrieve only a subset of data from an object by using simple SQL expressions. By using S3 Select to retrieve only the data needed by your application, you can achieve drastic performance increases – in many cases you can get as much as a 400% improvement compared with classic S3 retrieval. Redshift Spectrum enable quering S3 data directly from your AWS Redshift Cluster: > Amazon Redshift Spectrum enables you to run Amazon Redshift SQL queries against exabytes of data in Amazon S3. With Redshift Spectrum, you can extend the analytic power of Amazon Redshift beyond data stored on local disks in your data warehouse to query vast amounts of unstructured data in your Amazon S3 “data lake” Athena is focused on extract, transform and load (ETL) data from S3 and has a good integration with AWS Glue: > Athena is easy to use. Simply point to your data in Amazon S3, define the schema, and start querying using standard SQL. Most results are delivered within seconds. With Athena, there’s no need for complex ETL jobs to prepare your data for analysis. This makes it easy for anyone with SQL skills to quickly analyze large-scale datasets. > Data storage in S3, data transformation in Glue and then data visualisation via Athena & QuickSight. # AWS Glue -  # Kinesis -  -  -  -  -  -  -  - Kinesis Stream (KS) vs Kinesis Firehose (FH) - KS is real time, while FH is near-real time. - KS requires manual scaling and setup of its provisioning (shards) , while FH is basically serverless. - KS records are immutable (they persist in stream for its retention period - default 24h), while records in FH are gone from FH the moment they are delivered to destination. -  -  -  -  # SNS vs SQS - SNS is a distributed publish-subscribe system. Messages are **pushed** to subscribers as and when they are sent by publishers to SNS. SNS supports several end points such as email, SMS, HTTP end point and SQS. If you want unknown number and type of subscribers to receive messages, you need SNS.  - SQS is distributed queuing system. Messages are not pushed to receivers. Receivers have to **poll or pull** messages from SQS. Messages can't be received by multiple receivers at the same time. Any one receiver can receive a message, process and delete it. Other receivers do not receive the same message later. Messages can be stored in SQS for a short duration of time (maximum **14 days**). -  -  -  -  -  # AWS Serverless Application Model -  -  -  # Amazon EventBridge -  # AWS SWF -  -  # AWS Step Functions -  -  # AWS Batch -  -  # EBS - Tied to single AZ - EBS Snapshot can be used to migrate a system to a new AZ or region -  -  -  # EFS - Multi-AZ metadata and data storage -  -  - Use Amazon DataSync with EFS  -  # Amazon Storage Gateway - Provides local storage resources backed by AWS S3 and Glacier - Using Storage Gateway would require you to first move data over from the current volume to the volumes hosted under Storage Gateway. - Types  -  -  # Amazon RDS -  -  -  -  -  -  -  -  -  -  # Aurora -  -  -  - With Amazon Aurora, it’s very simple to scale up or down; you just stop the instance and restart it on a larger or smaller instance type. -  # Amazon DynamoDB - Managed, multi-AZ NoSQL data store with cross-region replication option -  -  - Defaults to eventual consistency reads but can request strongly consistent read via SDK parameter - Priced on throughput, rather than compute - Provision read and write capacity in anticipation of need - Achieve ACID compliance with DynamoDB Transactions -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  # CloudFront - Integrated with Amazon Certificate Manager and supports SNI (Server Name Indication (SNI) is an extension to the Transport Layer Security (TLS) computer networking protocol by which a client indicates which hostname it is attempting to connect to at the start of the handshaking process.[1] This allows a server to present multiple certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites (or any other service over TLS) to be served by the same IP address without requiring all those sites to use the same certificate. ) -  -  -  -  -  -  -  -  -  # Elastic Load Balancer - ELBs currently can only be set up for EC2 instances spread across AZ's, **not cross regions**. -  -  -  -  -  -  -  -  # Virtual Private Gateway vs Customer Gateway - Virtual Private Gateway (VPG) are VPN concentrator on AWS side of the VPN connection between the two networks. - Customer Gateway (CGW) represents a physical device or a software application on the customer’s side of the VPN connection. -  # VPC - Multicast and Broadcast aren't supported in VPCs. - VPCs support IPv4 netmasks range from `/16` to `/28`. - /16 = 255.255.0.0 = 65536 addresses - /28 = 255.255.255.240 = 16 addresses - e.g.`172.31.4.2/15` is invalid. -  -  - You can use `DHCP Option Sets` to configure which DNS is issued via DHCP to instances. This can be any DNS address. So long as it's reachable from the VPC, instances can use it to resolve. -  - **VPC endpoint** enables you to connect to certain AWS services without the data travelling over the Internet. "API Gateway", "Kinesis Data Streams" and "DynamoDB" are all services that can be connected to via VPC endpoints. ("Amazon MQ" is currently not supported.) -  -  # Network to VPC connectivity -  -  -  -  -  -  # VPC to VPC connectivity -  -  -  # Networking -  -  -  -  -  # Security Group vs Network Access Control Lists -  -  # AWS Global Accelerator - AWS Global Accelerator is a networking service that improves the performance of your users’ traffic by up to 60% using Amazon Web Services’ global network infrastructure. - With Global Accelerator, you are provided two global static public IPs (**a fault-isolating design**) that act as a fixed entry point to your application, improving availability. On the back end, add or remove your AWS application endpoints, such as Application Load Balancers, Network Load Balancers, EC2 Instances, and Elastic IPs without making user facing changes. Global Accelerator automatically re-routes your traffic to your nearest healthy available endpoint to mitigate endpoint failure. # Route 53 - Currently supports 13 different DNS record types including: AAAA, CNAME and SPF (Sender Policy Framework). - DNSSEC is supported since Dec, 2020. -  -  -  -  # Direct Connect - Direct Connect requires BGP routing. - Direct Connect connections consist of a single connection between your network and AWS with no inherent redundancy. - Traffic from on-prem via Direct Connect connect is restricted from internet access. # SAML vs OAuth vs OpenID -  -  -  # Multi-Account Management -  -  -  -  # AWS Organizations -  -  -  -  -  -  -  -  -  -  # AWS Config -  -  -  -  # AWS Artifact - AWS Artifact is your go-to, central resource for compliance-related information that matters to you. It provides on-demand access to AWS’ security and compliance reports and select online agreements. # AWS Service Catalog - AWS Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS. These IT services can include everything from virtual machine images, servers, software, and databases to complete multi-tier application architectures. AWS Service Catalog allows you to centrally manage deployed IT services and your applications, resources, and metadata. -  -  -  -  -  # AWS Resource Access Manager - AWS Resource Access Manager (RAM) is a service that enables you to easily and securely share AWS resources with any AWS account or within your AWS Organization. - You can share AWS Transit Gateways, Subnets, AWS License Manager configurations, and Amazon Route 53 Resolver rules resources with RAM. -  # Directory Services -  -  - Simple AD does not support trust relationships with other domains. -  -  # AWS Secrets Manager vs Key Management Service -  -  -  # AWS WAF vs AWS Firewall Manager vs AWS Shield -  -  # CloudWatch vs CloudTrail -  -  -  -  -  -  -  -  # IPS (Intruder Prevention System) vs IDS (Intrusion Detection System) - IPS differs from IDS in that it can automatically take action on intrusions, like blacklist an offending IP address. # Amazon GuardDuty - Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3. - The service uses machine learning, anomaly detection, and integrated threat intelligence to identify and prioritize potential threats. - GuardDuty analyzes tens of billions of events across multiple AWS data sources, such as AWS CloudTrail event logs, Amazon VPC Flow Logs, and DNS logs. - By integrating with Amazon CloudWatch Events, GuardDuty alerts are actionable, easy to aggregate across multiple accounts, and straightforward to push into existing event management and workflow systems. -  # Hybrid Architectures -  -  -  # Migration Tools -  -  -  -  -  -  -  -  -  -  -  # Scaling -  -  -  -  -  -  -  -  -  -  -  -  -  -  # Amazon Elasticache -  -  -  -  -  -  - 直写策略是同步把数据写入 Redis 和后台的数据库，都写完之后才返回。相对来说两者的写入速度差不多（都是直接写数据库），但是读写缓存的**直写策略对于频繁读的应用更友好一点**（没有缓存失效的问题）。 # Internet Gateway -  -  -  -  -  # Routing -  -  -  -  -  -  # HA -  -  -  -  -  -  -  -  -  -  # HA Approaches for Databases -  # Deployments -  -  -  -  -  -  -  -  - **AWS CodeCommit**: Managed Source Control Service - **AWS CodeBuild**: Fully Managed Build Service - **AWS CodeDeploy**: Automated Software Deployment - **AWS CodePipeline**: fully managed continuous delivery service that helps you automate your release pipelines for fast and reliable application and infrastructure updates - **AWS X-Ray**: Distributed Tracing System - **AWS CodeStar**: Quickly develop, build, and deploy applications on AWS; Start new software projects on AWS in minutes using templates for web applications, web services and more. -  -  -  -  -  -  -  -  -  -  -  -  -  # CloudFormation -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  # ECS vs EKS -  -  -  -  -  # API Gateway -  # AWS OpsWorks -  -  # AWS System Manager -  -  -  -  -  -  # Enterprise Apps -  -  -  -  # Reserved Instances -  -  -  -  -  -  -  -  -  -  # Cost Management Tools -  -  -  -  -  -  -  -  -  -  -  -  -  -  # Amazon Certificate Manager -  # Elastic Beanstalk -  -  # Amazon AppStream 2.0 -  -  # AWS Transit Gateway -  - 
Previous:
Notes | AZ-900 Microsoft Azure Fundamentals
Next:
SQL Server Queries
