MODULE – 4

What is Amazon RDS?

Amazon Relational Database Service (RDS) is a fully managed cloud service designed to make it
simple to set up, operate, and scale a relational database.

Instead of manually buying server hardware, installing operating systems, and managing database
software, RDS handles the "heavy lifting" for you. It automates tedious administrative tasks like
hardware provisioning, software patching, backups, recovery, failure detection, and repair.

Supported Database Engines

RDS allows you to choose from six popular industry-standard relational database engines:

 Amazon Aurora (AWS's custom-built, high-performance engine)

 PostgreSQL

 MySQL

 MariaDB

 Oracle Database

 Microsoft SQL Server

Core Architecture: Multi-AZ vs. Read Replicas

Understanding the difference between High Availability and Scalability is crucial when architecting
with RDS.

Feature Multi-AZ Deployment Read Replicas

High Availability & Disaster Recovery Scalability & Performance

Primary Goal
(DR). enhancement.

Creates a standby replica in a different Creates a read-only copy of your

How it Works Availability Zone. Data replicates database. Data replicates
synchronously. asynchronously.

Traffic Access The standby is idle; it cannot accept Actively accepts read traffic to
Feature Multi-AZ Deployment Read Replicas

offload work (like analytics or

read or write traffic until a failure
reporting) from the primary
occurs.
database.

If the primary fails, RDS automatically

Can be promoted to a standalone,
Failover/Promotion fails over to the standby without
independent database if needed.
changing the connection endpoint.

The Shared Responsibility Model

Managing security and operations in RDS is a shared partnership between you and AWS.

What AWS Handles (Security OF the Cloud):

 Physical security of the data centers.

 Managing the underlying host infrastructure (EC2 servers and EBS storage).

 Patching the operating system and the database engine software.

 Running automated backups and snapshots.

What You Handle (Security IN the Cloud):

 Data: Managing the actual data stored inside the database.

 Encryption: Enabling encryption at rest (using AWS KMS) and in transit (using SSL).

 Network: Configuring Security Groups to act as firewalls (e.g., only allowing your app server
to connect on specific ports).

 Access Control: Managing AWS IAM permissions for the service API, and managing internal
database users/permissions.

Note: Even though RDS is "fully managed," you are still fundamentally responsible for securing who
can access your database and ensuring your data is properly encrypted.

Advanced RDS Features

RDS includes several powerful features to help modernize and protect your applications:

 RDS Proxy: This is highly beneficial for serverless applications (like AWS Lambda) that might
rapidly open thousands of connections. The proxy sits between your app and the database,
pooling and sharing connections so the database doesn't crash from sudden connection
surges.
  Blue/Green Deployments: This makes updating your database schema or engine version
safe. It creates a staging clone ("Green") of your live production database ("Blue"). You can
test upgrades on the Green environment, then seamlessly switch live traffic over in under a
minute with zero data loss.

 Storage Auto-Scaling: This eliminates the need to over-provision or guess your storage
capacity. If your database starts running out of space, RDS automatically detects it and
increases your volume size with zero downtime.

Regions and Availability Zones (AZs)

To make features like Multi-AZ work, AWS organizes its infrastructure geographically:

 AWS Regions: These are distinct, geographically isolated locations around the world. When
you create an RDS instance, choosing a region dictates where your database physically lives.

 Availability Zones (AZs): These are multiple independent, physically distinct data centers
located within a single Region. Because they have separate power, cooling, and networking,
RDS can safely deploy standby databases across different AZs to ensure your database stays
online even if one specific data center goes down.

Amazon DynamoDB -
Amazon DynamoDB is essentially a "database in the cloud" that never gets full and never slows
down, no matter how many people use your app. Unlike traditional databases that run on a single
"server" (computer), Amazon handles all the background work. You don't have to worry about
buying hard drives, updating software, or fixing broken parts. It also automatically encrypts your data
to keep it safe.

Here is a simple breakdown of how it works based on the text you provided.

1. The Basics: How Data is Organized

Think of DynamoDB like a massive, infinitely expanding digital filing cabinet.

 Table: The entire filing cabinet (e.g., a "Users" table).

 Item: A single folder inside that cabinet (e.g., "User: John Doe"). In a traditional database,
this is called a Row.

 Attribute: The specific pieces of information inside the folder (e.g., John’s email, age, or
phone number). In a traditional database, this is a Column.

2. The "Key" to Finding Things (Primary Keys)

Because this filing cabinet can get massive, you need a highly organized way to find folders instantly.
This is called the Primary Key, and you have two ways to set it up:
  Partition Key (Simple Key): You use just one label to find a folder, like a UserID.

o How it works: Amazon uses this key to figure out exactly which physical hard drive
holds your data.

o The Catch: You must know the exact ID to find the folder. You can't say "find all users
starting with J."

 Partition Key + Sort Key (Composite Key): You use two labels. For example, the Artist Name
(Partition Key) and the Song Title (Sort Key).

o How it works: Amazon groups all songs by the same Artist in the same physical spot,
and then organizes them alphabetically by Song Title.

o The Power: This lets you do smarter searches, like: "Find all songs by Taylor Swift
(Partition) where the song title starts with the letter 'L' (Sort)."

3. Alternative Ways to Search (Secondary Indexes)

What if your main key is UserID, but a customer calls in and only knows their Email? Normally,
DynamoDB would force you to check every single folder to find that email, which is slow and
expensive. To fix this, you create a Secondary Index—think of it as a separate library card catalog.

 Local Secondary Index (LSI): This is an older, limited method. You must set it up when you
first create the table. It lets you search differently, but only within a single Partition Key (e.g.,
looking up a specific user's orders by date instead of order ID).

 Global Secondary Index (GSI): This is the modern, preferred method. You can create or
delete these anytime. It allows you to search the entire table using a completely different
attribute, like searching the whole database just by Email.

4. How You Pay for It (Capacity Modes)

DynamoDB offers two ways to pay for the speed and power you need:

 On-Demand Mode: Like a taxi meter. You only pay for the exact number of requests your
database handles. It scales up instantly if your app goes viral. Best for: New apps or
unpredictable traffic.

 Provisioned Mode: Like an unlimited monthly Metro card. You tell Amazon exactly how
many reads and writes you expect per second, and you pay a flat rate. Best for: Established
apps with steady, predictable traffic where you want to save money.

5. Cool Advanced Features

 DynamoDB Streams: Imagine a security camera watching your filing cabinet. Every time a
folder is added, changed, or deleted, the Stream records it. You can use this log to trigger
automatic actions (like sending a "Welcome" email the second a new User folder is created).
  Global Tables: If you have users in New York and London, you can have a table in the US and
a copy in Europe. If someone updates the US table, Amazon automatically updates the
Europe table in less than a second. This keeps your app lightning-fast for everyone,
everywhere.

 DAX (DynamoDB Accelerator): A super-fast memory cache. If thousands of people are

requesting the exact same data at the same time (like a live gaming leaderboard), DAX stores
that data right on top of the desk so it can be handed out in microseconds instead of
milliseconds.

6. DynamoDB vs. Traditional Databases (RDBMS)

 Flexibility: Traditional databases are strict—every row must have the exact same columns.
DynamoDB is flexible; one item can have 2 attributes, and the next item can have 50.

 Scaling: Traditional databases scale by buying a bigger, more expensive computer (Vertical).
DynamoDB scales by linking thousands of smaller computers together (Horizontal), meaning
it basically has unlimited storage.

 Searching: Traditional databases are great at linking different tables together (using "JOINs").
DynamoDB cannot do JOINs; it is purely built to grab specific items as fast as possible.

7. The Limitations (The Catch)

While powerful, DynamoDB has some strict rules:

 Speed limits: A single "read" unit gives you 4KB of data per second. A single "write" unit
gives you 1KB per second.

 Table limits: You can store unlimited data, but by default, an AWS account is limited to 256
actual tables (you can ask Amazon to raise this).

 Index limits: You are only allowed 5 LSIs and 20 GSIs per table by default.

 No naming rules: It doesn't stop you from naming an attribute using a "reserved" system
word, which can cause coding headaches later.

Amazon CloudWatch -
Amazon CloudWatch is essentially the "health monitor and control room" for your entire Amazon
Web Services (AWS) environment. If you imagine your cloud infrastructure as a busy factory,
CloudWatch is the system of sensors and dials that tells you how well the machines are running,
alerts you if something is breaking, and can even automatically fix problems.

Here is a detailed but simple breakdown based on the text provided:

1. The Core Features of CloudWatch

  Metrics (The Vitals): CloudWatch constantly collects data points called "metrics." Think of
these as vital signs—things like how much CPU (brain power) your servers are using, how
much data is being written to a disk, or how much network traffic is happening.

 Dashboards (The Display): By default, CloudWatch gives you a home page that shows the
vitals for every AWS service you use. If you want something specific, you can build custom
dashboards to group together the exact metrics you care about for your specific apps.

 Alarms (The Automated Guards): You don't have to stare at the dashboards all day. You can
set up "Alarms" with specific rules (thresholds). For example, you can tell CloudWatch: "If
server CPU usage goes over 80% for 5 minutes, do something about it." It can then send you
an alert or trigger an automated fix.

2. How CloudWatch Teams Up with Other AWS Services

CloudWatch rarely works alone. It integrates seamlessly with other tools to automate your cloud
environment:

 Amazon SNS (The Messenger): When a CloudWatch alarm goes off, it uses Simple
Notification Service (SNS) to deliver the message. This is how you get an email or a text
message alerting you that a threshold was crossed.

 Amazon EC2 Auto Scaling (The Muscle): This is where CloudWatch becomes incredibly
powerful. If an alarm notices your servers are overwhelmed with traffic, it can tell Auto
Scaling to automatically launch new servers to handle the load. Conversely, if traffic drops, it
can turn off extra servers to save you money.

 AWS CloudTrail (The Security Camera): CloudTrail monitors and logs every single time
someone (or something) interacts with CloudWatch. It saves these log files into an S3 storage
bucket, giving you a safe audit trail of who changed your alarms or viewed your metrics.

 AWS IAM (The Bouncer): Identity and Access Management (IAM) acts as the security guard
for CloudWatch. It allows you to strictly control who in your organization is allowed to look at
your metrics (authentication) and what they are allowed to do with them, like creating or
deleting alarms (authorization).

3. How You Access It

You can interact with CloudWatch in several ways, depending on whether you prefer clicking buttons
or writing code:

 Amazon CloudWatch Console: The visual, web-based control panel (through your browser).

 AWS CLI: A tool to interact with CloudWatch by typing text commands in your computer's
terminal.

 CloudWatch API: Allows your own applications to talk directly to CloudWatch over the web.

 AWS SDKs: Software development kits that make it easy for programmers to build
CloudWatch features right into their code.

In short, CloudWatch gives you system-wide visibility so you always know exactly how your apps are
performing, how healthy your resources are, and how much you are utilizing them.
AWS CloudTrail -
AWS CloudTrail is essentially the "un-erasable master logbook" or "security camera" for your entire
AWS account. Whenever anyone (or any automated system) clicks a button, types a command, or
uses code to interact with your AWS setup, CloudWatch records exactly what happened.

This is critical for security, auditing, and figuring out what went wrong if something breaks, because it
answers the essential questions: Who did it, what did they do, when did it happen, and which
resources were affected.

Here is a simple breakdown of how it works based on the text you provided.

1. The Three Ways to Keep Records

CloudTrail gives you three different ways to store and look at these event logs, depending on your
needs and budget:

 Event History (The Short-Term Memory):

o What it is: This is turned on automatically for everyone. It is a secure, unchangeable

record of everything that happened in your account over the last 90 days.

o Cost: Completely free to view and search.

o Best for: Quick, day-to-day troubleshooting to see who just changed a setting.

 CloudTrail Lake (The Massive Database):

o What it is: A powerful "data lake" built specifically for intense security audits. It takes
your logs, converts them into a special format (Apache ORC) that makes searching
lightning-fast, and stores them for 7 to 10 years.

o Features: You can merge logs from multiple AWS accounts, import old logs, and view
visual dashboards of your account's activity trends.

o Cost: You pay for the data you store and the amount of data you scan when you run
a search.

 Trails (The Delivery Service):

o What it is: Instead of keeping the logs inside CloudTrail, a "Trail" packs up the logs
and delivers them straight into your own digital storage boxes (Amazon S3 buckets).

o Features: You can send these logs to other security tools, search them with tools like
Amazon Athena, or use "Insights" to automatically detect weird, anomalous behavior
(like a sudden spike in errors).

o Cost: Delivering the first copy of the logs is free, but you do have to pay for the
Amazon S3 storage space they take up.

2. Why It Matters
Having total visibility into your account is a fundamental rule of cloud security. CloudTrail lets you:

 Track down exactly who deleted a server or changed a password.

 Prove to auditors that your systems are secure and compliant with regulations.

 Set up automated tools that read the logs and instantly respond if they see malicious activity.

3. How You Access It

Just like other AWS services, you have several ways to interact with CloudTrail:

 CloudTrail Console: The standard web browser interface. You use this to visually point-and-
click your way through recent events, download files, set up your "Trails," or run complex
searches in CloudTrail Lake.

 AWS CLI (Command Line Interface): A tool for interacting with CloudTrail by typing text
commands into your computer's terminal.

 CloudTrail APIs: The backend web connections that allow your own custom applications to
talk directly to CloudTrail.

 AWS SDKs: Code libraries that make it easy for developers to build CloudTrail commands
directly into their software using languages like Python, Java, or [Link].

What is Elastic Load Balancing (ELB)?

Think of an Elastic Load Balancer as a super-efficient traffic cop for your application.

 It automatically distributes your incoming traffic across multiple targets, such as EC2
instances, containers, and IP addresses.

 It spreads this traffic across one or more Availability Zones to help increase the availability of
your application.

 It constantly monitors the health of its registered targets and ensures that traffic is only
routed to the healthy targets.

 AWS offers four types of load balancers: Application Load Balancers, Network Load
Balancers, Gateway Load Balancers, and Classic Load Balancers.

Application Load Balancer (ALB) Components

An Application Load Balancer acts as the single point of contact for clients. It operates using three
main components:

 Listeners: A listener checks for incoming connection requests from clients based on the
protocol and port you configure.

 Rules: You define rules for your listeners to determine exactly how requests should be
routed. Each rule consists of a priority, conditions, and actions. When a condition is met, the
 action is performed. You must define a default rule for each listener, and you can add extra
rules if needed.

 Target Groups: Each target group routes requests to registered targets using the protocol
and port number you specify. You can set up health checks on a per-target-group basis to
monitor the health of your services independently.

How Auto Scaling Works with ELB

The text highlights two ways scaling works within this ecosystem:

 The Load Balancer Scales Itself: As your incoming traffic changes over time, Elastic Load
Balancing will automatically scale the load balancer itself to handle the vast majority of
workloads.

 Scaling Your Services: You can attach a target group to an Auto Scaling group. Because
CloudWatch metrics and health checks are reported at the target group level, this allows you
to automatically and dynamically scale each individual service based on demand.

Why Choose an ALB over a Classic Load Balancer?

Migrating from an older Classic Load Balancer to an Application Load Balancer unlocks several
advanced features:

 Advanced Routing: You can route requests based on URL paths, Host domain names, HTTP
headers, query parameters, or source IP addresses.

 Better Resource Usage: You can register multiple applications on a single EC2 instance by
placing them in different target groups on different ports. It also efficiently supports
containerized applications, allowing Amazon ECS to dynamically select unused ports when
scheduling tasks.

 Modern Targets: You can register targets outside your VPC via IP address, or even register
Lambda functions as targets.

 Security & Control: The ALB can authenticate users through social or corporate identities
before allowing their requests through. It also supports URL redirects and returning custom
HTTP responses.

 Better Visibility: It provides improved overall performance and features detailed,

compressed access logs.

Which specific ALB routing feature—like URL path routing or Lambda integration—would you like to
explore next?