{"componentChunkName":"component---src-templates-blog-post-js","path":"/aws-training/","result":{"data":{"site":{"siteMetadata":{"title":"Nans' blogs"}},"markdownRemark":{"id":"db91becb-2893-5bd7-8e80-05a775989624","excerpt":"AWS Essentials https://learning.oreilly.com/videos/amazon-web-services/9780134702186/9780134702186-awsa_01_01  1.1 Cloud Computing On-demand\nResource pooling…","html":"

AWS Essentials

\n

https://learning.oreilly.com/videos/amazon-web-services/9780134702186/9780134702186-awsa_01_01

\n

 1.1 Cloud Computing

\n

On-demand\nResource pooling (shared servers, shared buildings)\nRapid Elasticity => growing when we need to grow\nMeasured service => Pay as you go

\n

 1.2 Regions

\n

Primary building block.\nVM, Storage, … You pick a region.\nCost in AWS is determined by the region.\nYou can choose multiple regions (for multiple audiences), or also to spread risk

\n

1.3 Availability zones

\n

Availability zones are a collection of datacenters. Connected with private fiber.\nus-west-2a us-west-2b us-west-2c …\nThey are key to fault tolerance.\nSystem that’s resilient on the machine, but also resilient on the datacenter.\nWhat happens when a datacenter becomes unreachable.

\n

 1.4 Edge locations

\n

Edge location\nCaching\nAmazon route 53 => DNS query as quickly as possible.\nEdge location serve Amazon CloudFront and they serve Amazon route 53

\n

1.5 Scope of services

\n

Global

\n

AWS IAM\nAWS CloudFront\nAWS Route53

\n

 Regional

\n

Dynamo DB …

\n

 Availability

\n

Elastic block store\nElastic compute cloud

\n

 1.6 Service overview

\n

AWS console.\ntop right => choose region.

\n

Compute, Storage, Database, Networking, Analytics, Security, Management Tools, Developer tools, Internet of Things, Game development, Mobile services, …\nRich environment.

\n

 2. Security in AWS

\n

 2.1 AWS Identity and Access Management

\n

AWS IAM\nAuthent Autho Users Group, Password Policy, Multi factor authentication => Smth you know combined with smth you have (phone (have), user/password (know))\nAuthenticating and Authorizing against AWS API.

\n

Creating a user and group

\n

 Create a User

\n

autogenerate a password AND require to create a new password at next sign in\ngive the password to the person over an encrypted connection of some kind.

\n

Create a group

\n

Create a group, create permissions, and add user to the group

\n

2.3 access keys

\n

jane.doe\npassword.\nShe wants sdk, CLI, … Create Access Key for Jane.doe.\nAccess ID, Secret Accesss key.

\n

 Permissions and Policies

\n

Permissions are granted via policies\nPolicies are written in JSON

\n

We can genetare policies thanks to a tool created by Amazon.

\n

All policies start with a default implicit deny.

\n

We need an explicit allow to have permissions.\nAmazon Resource Name :\nFromat pattern to find in the docs.\narn:aws:iam:…:user/jdoe\narn:aws:s3:\narn:aws:\nsmth can be let blank :::::

\n

implicit deny => explicit deny => explicit allow

\n

Statements specify :\nPrincipal (resource based policies)\nActions

\n\n

2.5 Creating and attaching policies

\n

Generator creates the appropriate syntax.\nAllow\nEC2\nRunIntances, … (actions that are authorized).\nARN : * (all)

\n

And then you can attach a policy to a group.\nDevelopers => run EC2 instances.

\n

2.6 Understanding Roles

\n

Rotate credentials regularly.\nCredentials should never be shared, in the code or in environment variables\nRoles enable us to use temporary credentials that are cached by the cli or the sdk.\nhigh level of security

\n

2.7 Creating roles

\n

IAM => Role section\ncreate new role\nRole Name => Name of application. myApplication\nRole type (S3 stuff)\nattach policy

\n

every application will be able to read from S3

\n

2.8 Federated Users

\n

We can create Single Sign on\nLDAP, Active directory.

\n

We can federate applications so that they can all use the same S3 bucket.\nThis way we can bypass backend APIs. Allow mobile apps to access directly s3 services.

\n

User authenticate against our app\nIdentity broker will make a acall to aws security token service.\nThe service will return temporary credentials.

\n

C’est pour gérer les devs je crois (?)

\n

2.9 managing an MFA device

\n

Multi factor authentication\nHardware MFA device (to be ordered from Amazon :o )\nVirtual MFA device\nQR code or show secret key.\nScan.\nAdd authentication code\nwait\nadd second authentication code

\n

have jane come over to my desk.

\n

in case you can’t call jane to you desk

\n

2.10 Resource Policies

\n

Apply permission to aws permissions.\npolicies that are not applied to users or group, but to resources.\nMake an s3 bucket publicly readable for example.

\n

2.11 Applying resource policy

\n

S3 service\nadd bucket policy\nclick policy generator\nallow\ngetObject, listObjects …\narn:aws:s3:::nameofthebucket/*

\n

add statement

\n

2.12 Using roles for cross account access

\n

Payer Account (initial account)\n(pays the bill)

\n

Development account - Production Account

\n

you can leverage roles.\nYou can allow a user in one account to access ressources from another account.

\n

2.13 Best Practices

\n

Leverage groups : give only ENOUGH rights. Not more.

\n\n

master account

\n\n

Networking AWS

\n

Amazon virtual private cloud : VPC\nSegment networks\nCreate a VPC in a particular region.\nChoose a particular address range\nWe can create subnets.

\n

3.2 Creating a VPC

\n

from the aws console\nVPCs are specific to a region\nWe have a default VPC from Amazon.\n10.2.0.0 => the widest range of ip addresses

\n

a vpc has a route table\nACL => Allow incoming or outcoming traffic

\n

3.3 adding subnets

\n

Create a subnet below a VPC, and specify an availability zone\nWe can assign a CIDR block (I really have to learn more about CIDR ranges !!)\n/24 => allows 256 IP addresses. The 1st 4, and the last one IP address are not usable (used by AWS)

\n

3.4 Routing

\n

ELB => load balancer\nEC2 application server\nDatabase\n\n \n \n \n \n \nRoute tables that enable to hide EC2 and database from the internet.\nOn premises network (what’s that ?)

\n

 3.5 demo

\n

Routing subnets to the internet.\nvpc dashboard => route table

\n

Route tables associated\ncreate internet gateway\nattach internet gateway to vpc

\n

auto-assign public IP\n=> do that to enable EC2 instances

\n

3.6 public private and hybrid subnets

\n

\n \n \n \n \n

\n

3.7 Network Access Control Lists

\n

tool to use within VPC that are stateless\nlike a firewall arround a subnet

\n

 3.8 Security Groups

\n

firewall that applies to an EC2 instance.\nit is Stateful.

\n

3.9 creating an NACL

\n

web traffic acl\nassociated to vpc

\n

inbound =>\nrule #100 HTTP 80 TCP 80 0.0.0.0/0 ALLOW\nrule #101 HTTPs 443 TCP 80 0.0.0.0/0 ALLOW

\n

outbound =>\nrule #100 TCP 1080-65535 ALLOW (send to the internet)

\n

3.10 Creating a security group

\n

web-server\nweb application security\ninbound rules accept http and https from anywhere\nNACL => subnet can receive traffic\nSecurity group => Instance can receive traffic\nso this is not double work

\n

3.11 VPC peering

\n

It is a way to pair 2 VPCs.\nIP ranges must not overlap\nPeering connection PCX\nrouting traffic from one range to another range

\n

 3.15 Aws direct connect

\n

dedicated private connection\n1Gbps or 10 Gbps options.

\n

 4 Computing in AWS

\n

4.1 EC2

\n

Elastic compute cloud (EC2)\nVirtual machine\nbased on Xen hypervisor\nVarious combinations of cpu, memory, disk, IO\none VM called an instance

\n

4.2 AMazon Machine Image

\n

bit for bit copy of root volume\nyou launch a machine from a machine image

\n

4.3 Launching a linux instance

\n

Amazon images\nAmazon Linux\n64 bits\n.ebs => Elastic block

\n

t2 micro\nauto assign public IP\ntag instance to keep your environment organized\nName : Linux-demo\nEnvironment : dev\nApplication : xxx

\n

security group !!!

\n

download a private keypair to to access the instance\npublic IP and private IP are associated to that instance\nadd security group to give shell access\ngo back to the instance, change security groups, add ssh security group\nport 22 in ssh should be opened

\n

ssh -i azez.pem ex2-user@public.ip.of.instance

\n

4.4 Key pairs

\n

public and private keys.\nWay of login into the operating system.\n2048 ssh2 rsa keypairs

\n

4.5 Instance metadata service

\n

retrieve information about an EC2 instance\nservice within an instance to get information about itself\nuse this instance with scripts to bootstrap stuff.\nThe script gets information about the instance to configure software.

\n

169,254,169,254/latest/meta-data

\n

4.6 Demo instance Metadata Service

\n

curl http://169.254.169.254/latest/meta-data\nget the instance id :\nexport instanceId= curl http://169.254.169.254/latest/meta-data/instance-id\nshell scripts that could access that variable.

\n

4.7 bootstraping with userdata

\n

it’s the key to maintain a self healing environment

\n

4.8 Launching a windows instance

\n

Meh windows

\n

4.9 Stopping and terminating instances

\n

Stop => can restart later\nterminate => throw away

\n

4.10 Billing options

\n

on demand vs reserved instances\navailability is not guaranteed on reserved instances

\n

reserved instance have a commitment (1 year, 1 or 3 year)

\n

4.11 highly available web application

\n

\n \n \n \n \n

\n

3 tier architecture in amazon ec2

\n

4.12 => 4.14 Introduction to AWS Lambda

\n

Mobile Application could access Amazon Simple Storage Service.\nAmazon cognito => Federated user retrieves temporary credentials

\n

upload directly to S3.\nFire event to lambda function.\n\n \n \n \n \n

\n

highly available and fault tolerant\nSpeed time to market

\n

5. Storage options

\n

5.1 overview of aws storage options

\n

EC2 => Instance store\nblock storage that are built in to the EC2 instance\nstorage there is EPHEMERAL.\ncannot take snapshots\n\n \n \n \n \n

\n

EBS => not resilient to the loss of a data center.\nIndependant\nSnapshots\npay per gb per month

\n

Amazon S3\nwrite once, read many\nstorage for the internet\nfor things that need to be retrieved from users

\n

AWS Storage gateway\nvirtual machine that is designed to be run on-premises\nit exposes a device

\n

5.2 Amazon simple storage service

\n

object storage.\nhighly available and fault tolerant.\nno filesystem\nBucket => Object\nupload limit of 5 gb\nobjects can be multi part up to 5 TB

\n

object storage vs block storage

\n

5.3 Demo creating buckets and object

\n

host static website on s3 :o :o :o

\n

5.4 Bucket Security with resource policies

\n

5.5 Introduction to Amazon Glacier

\n

Write once, read rarely\nglacier is cold storage\n3-5 hours to get the files

\n

5.7 Demo: Adding life cycle Rules

\n

5.8 Instance Store Volumes

\n

they are build-in and ephemeral

\n

5.9 Elastic block stock EBS

\n

it is not a NAS\npay for provisioned storage\ndata is independent from instance, and is connected over network\ncan detach and attach to another

\n

5.11 Creating an EBS volume in the aws dashboard

\n

volume type (HDD, SSD)

\n

6. Databases

\n

6.1 Options

\n

Amazon RDS => for sql stuff, mariadb\nAmazon ElastiCache => Memcached, redis\nDynamoDB => NoSQL, Event-driven.\nRedshift => Encryption

\n

 6.2 Amazon RDS

\n

Snapshots, backups and patches\nRead replicas for when we have read heavy traffic

\n

 6.3 Data Durability

\n

Multi AZ deployments\nPrimary instance with secondary standby in a different availability zone

\n

6.4 Launch an Amazon RDS instance

\n

subnet group => several subnets\npublicly accessible => NO

\n

6.5 Amazon DynamoDB

\n

NoSQL Data store\neasy noSQL service\nPartition vs primary key

\n

6.7 Scan and query operations

\n

interface pour faire des query\nhttps://learning.oreilly.com/videos/amazon-web-services/9780134702186/9780134702186-awsa_06_07

\n

6.8 Amazon ElastiCache

\n

Redis => in memory database, backed to disk\nMemcached => in memory key-value store, not backed to disk

\n

6.9 Amazon redshift

\n

SQL compliant.\nIt is a clustered service\nparallel queries across the nodes.\nIdeal for OLAP and BI apps\npedabyte scale data wharehouse

\n

6.10 database for e-commerce

\n

Elastic load balancer => 3 EC 2 instances

\n

\n \n \n \n \n

\n

Read replica(s)\nMulti-AZ => Amazon handles the primary and secondary thing

\n

ElastiCache => Category pages, related products

\n

copies to redshift in order to run BI stuff\nuse redshift to understand conversion rates

\n

7 Analytics in AWS

\n

7.1 Real time stream processing => Amazon Kinesis

\n

“SOAP” and old school technologies from back in the 90s.\nUse case : warn users of the lifecycle of a pizza before it is delivered to them.

\n

Kinesis

\n

7.2 Real time stream processing

\n

It divides large amount of data into usable shards.\n(terabytes per hour)

\n

1 shard => 1000 PUTs per second

\n

Kinesis stream should be handled by Apps that have ONE SINGLE PURPOSE\nIt can be Aggregation, Sliding Window analysis,

\n

 7.3 Big data with amazon elastic MapReduce

\n

yet another “amazing” service.

\n

Managed Hadoop framework (or spark, presto, hbase)\nprovision single or thousands of instance.

\n

for data intensive applications.\nData mining, log analysis, scientific simulation, genomics.\ncan read data from anywhere.

\n

7.4 AWS Data Pipeline

\n

Transform data from one data type to another datatype.\nHelps move data between data sources.\nIt uses EC2 or EMR to transform Data.\nCan Execute SQL queries, or custom applications.

\n

7.5 Video Subscription Service Business Intelligence

\n

\n \n \n \n \n \n\n \n \n \n \n

\n

10.7 Creating an auto scaling group

\n
    \n
  1. create a launch configuration\nyum install -y httpd\nto be added in create launch configuration
    2. \n
  2. Create auto scaling group\nselect the right vpc\nconfigure scaling policies
    3. \n
\n

11 Course Wrap up

\n

11.1 The ideal

\n\n

 11.2 Best Practices

\n\n

11.3 The exam

\n

80 minutes\n55 questions\nArchitect a solution that is technically appropriate, and cost effective.\n\n \n \n \n \n

","frontmatter":{"title":"Formation AWS 09-10/03/2020","date":"March 10, 2020","description":"Notes taken during AWS training"}}},"pageContext":{"slug":"/aws-training/","previous":{"fields":{"slug":"/beyond-asset/beyond-asset/"},"frontmatter":{"title":"Beyond Asset","tags":["article","react"]}},"next":{"fields":{"slug":"/lambda-training/"},"frontmatter":{"title":"Lambda training","tags":["training","AWS"]}}}},"staticQueryHashes":["2841359383","3145232782"]}