AWS SAA notes

11 October 2022 11:30

• When creating your AWS account, you may have an existing identity provider internal to your company that offers Single
Sign On (SSO). If this is the case, it is useful, efficient, and entirely possible to reuse your existing identities on AWS. To do
this, you let an IAM role be assumed by one of the Active Directories. This is because the IAM ID Federation feature
allows an external service to have the ability to assume an IAM role.
• S3 pre-signed URL:

• As a rule of thumb, if it takes more than one week to upload your data to AWS using the spare capacity of your existing
internet connection, then you should consider using Snowball.

• Relevant file information passing through Storage Gateway like file ownership, permissions, timestamps, etc.
are stored as metadata for the objects that they belong to. Once these file details are stored in S3, they can be
managed natively. This mean all S3 features like versioning, lifecycle management, bucket policies, cross
region replication, etc. can be applied as a part of Storage Gateway.

• When your EC2 instance is running, you are charged on CPU, memory, storage, and networking. When it is
stopped, you are only charged for EBS storage.

• With EC2 VM Import, you can import existing VMs into AWS as long as those hosts use VMware ESX, VMware
Workstation, Microsoft Hyper-V, or Citrix Xen virtualization formats.

• By default, the public IP address of an EC2 Instance is released when the instance is stopped even if its
stopped temporarily. Therefore, it is best to refer to an instance by its external DNS hostname. If you require a
persistent public IP address that can be associated to the same instance, use an Elastic IP address which is
basically a static IP address instead.

• Reserved Instances that are terminated are billed until the end of their term.

• By default, an EC2 instance with an attached AWS Elastic Block Store (EBS) root volume will be deleted
together when the instance is terminated. However, any additional or secondary EBS volume that is also
attached to the same instance will be preserved. This is because the root EBS volume is for OS installations
and other low-level settings. This rule can be modified, but it is usually easier to boot a new instance with a
fresh root device volume than make use of an old one.

• You can move an existing instance into a placement group provided that it is in a stopped state. You can move the
instance via the CLI or an AWS SDK, but not the console. You can also take a snapshot of the existing instance, convert it
into an AMI, and launch it into the placement group where you desire it to be.

• Wherever your EC2 instance is, your volume for it is going to be in the same availability zone. After you create a volume,
you can attach it to any EC2 instance in the same availability zone. You can change EBS volumes on the fly, including the
size and storage type.

Typical 7 migration strategies:

AWS SAA Page 1
Typical 7 migration strategies:
----------------------------------------
first 4 involve migrating workloads to AWS cloud

Rehost (list and shift) : possible to use AWS application migration service
Relocate: hypervisor-level lift and shift (e.g. VMware to VMware migration)
Replatform: lift, tinker and shift (retaining core arch. but opting for few managed
services)
Refactor: Modernize

Retire: shut-off few apps, reduce spend/management/security

Retain/Revisit: Keeping certain apps on-prem
Repurchase: Moving workflows to SaaS

AWS SAA Page 2

Storage Gateway
11 October 2022 16:45

Stored Volumes Vs Cached Volumes

Stored Volume - AWS S3 is used only as a secure and a reliable backup

Cached Volume - AWS is used as the primary data source and the local hardware
is used as a caching layer

AWS SAA Page 3

EBS
11 October 2022 17:58

EBS Snapshots:

• Snapshots only capture the state of change from when the last snapshot was taken. This is what is recorded in each
new snapshot, not the entire state of the server.

• Because of this, it may take some time for your first snapshot to be created. This is because the very first snapshot's
change of state is the entire new volume. Only afterwards will the delta be captured because there will then be
something previous to compare against.

• EBS snapshots occur asynchronously which means that a volume can be used as normal while a snapshot is taking
place.

• A short summary for creating copies of EC2 instances:

Old instance -> Snapshot -> Image (AMI) -> New instance

AWS SAA Page 4

ENI
11 October 2022 18:21

1. When you move a network interface from one instance to another, network traffic is redirected to the new instance.

2. Enhanced Networking ENI uses single root I/O virtualization to provide high-performance networking capabilities on
supported instance types. SR-IOV provides higher I/O and lower throughput and it ensures higher bandwidth, higher
packet per second (PPS) performance, and consistently lower inter-instance latencies. SR-IOV does this by dedicating the
interface to a single instance and effectively bypassing parts of the Hypervisor which allows for better performance.

3. You can attach a network interface to an instance in 3 ways:

a. Hot attach - while instance is running
b. Warm attach - while instance is stopped
c. Cold attach - when instance is being launched

AWS SAA Page 5

Security Groups
11 October 2022 18:30

1. Security groups are specific to a single VPC, so you can't share a Security Group between multiple VPCs. However, you
can copy a Security Group to create a new Security Group with the same rules in another VPC for the same AWS Account.

Security Groups are regional and can span AZs, but can't be cross-regional.

2. Security group - firewall for ec2 instance, NACL - firewall for subnet

AWS SAA Page 6

RDS
13 October 2022 13:16

• You cannot create an encrypted Read Replica from an unencrypted master DB instance.
• You also cannot enable encryption after launch time for the master DB instance.
• Therefore, you must create a new master DB by taking a snapshot of the existing DB, encrypting it, and then creating
the new DB from the snapshot. You can then create the encrypted cross-region Read Replica of the master DB.

Amazon RDS Proxy is a fully managed, highly available database proxy for Amazon Relational Database Service
(RDS) that makes applications more scalable, more resilient to database failures, and more secure. Amazon RDS
Proxy allows applications to pool and share connections established with the database, improving database
efficiency and application scalability.

Amazon RDS Proxy can be enabled for most applications with no code changes

AWS SAA Page 7

CloudFront
13 October 2022 13:19

CloudFront Geo Restriction:

Allow your users to access your content only if they're in one of the countries
on a whitelist of approved countries.

Prevent your users from accessing your content if they're in one of the
countries on a blacklist of banned countries.

AWS SAA Page 8

Cloudwatch / Cloudtrail
13 October 2022 18:38

• CloudWatch is NOT CloudTrail so it is important to know that only CloudTrail can monitor AWS access
for security and auditing reasons.
• CloudWatch is all about performance. CloudTrail is all about auditing.

• The following metrics are not collected from EC2 instances via CloudWatch:
○ Memory utilization
○ Disk swap utilization
○ Disk space utilization
○ Page file utilization
○ Log collection

If you need the above information, then you can retrieve it via the official CloudWatch agent or
you can create a custom metric and send the data on your own via a custom script.

AWS SAA Page 9

Miscellaneous
13 October 2022 18:49

Athena -->

• interact and query data from S3 using standard SQL commands

• It is serverless, requires no provisioning, and you pay per query and per TB scanned.
• You basically turn S3 into a SQL supported database by using Athena
• Athena allows you to query encrypted data stored in Amazon S3 and write encrypted
results back to your bucket.

Hadoop Vs Spark
Hadoop - high latency computing framework designed to handle batch processing efficiently
Spark - low latency computing framework designed to handle real-time data efficiently

AWS SAA Page 10

VPC
21 October 2022 12:29

AWS SAA Page 11

AWS SAA Page 12
Create custom route tables to fine tune and allow access from subnet to internet/other networks and vice versa.

Network ACL -- like a firewall at subnet level, they are stateless (need to specify both inbound and outbound port rules)
Security Group -- stateful (no need to specify outbound rules)

AWS SAA Page 13

Organizations
21 October 2022 12:35

A company has divested a single business unit and needs to move the AWS account owned by
the business unit to another AWS Organization. How can this be achieved?

-- migrate the account using AWS Organizations console

Accounts can be migrated between organizations. To do this you must have root or IAM access
to both the member and master accounts. Resources will remain under the control of the
migrated account.

AWS SAA Page 14

ECS
21 October 2022 12:39

AWS SAA Page 15

FSx
21 October 2022 12:43
Amazon FSx works natively with Amazon S3, making it easy to access your S3 data to run data processing
workloads. Your S3 objects are presented as files in your file system, and you can write your results back
to S3. This lets you run data processing workloads on FSx for Lustre and store your long -term data on S3
or on-premises data stores.

AWS SAA Page 16

IAM
21 October 2022 12:46

AWS SAA Page 17

Q&A's
21 October 2022 14:35

Q An application has been migrated to Amazon EC2 Linux instances. The EC2 instances run Q A company runs an application in an Amazon VPC that requires access to an Amazon Elastic Container Service
several 1-hour tasks on a schedule. There is no common programming language among these (Amazon ECS) cluster that hosts an application in another VPC. The company’s security team requires that all
tasks, as they were written by different teams. Currently, these tasks run on a single instance, traffic must not traverse the internet.
which raises concerns about performance and scalability. To resolve these concerns, a
solutions architect must implement a solution.

Which solution will meet these requirements with the LEAST Operational overhead?

A --> The best solution is to create an AMI of the EC2 instance, and then use it as a template
for which to launch additional instances using an Auto Scaling Group. This removes the issues
of performance, scalability, and redundancy by allowing the EC2 instances to automatically
scale and be launched across multiple Availability Zones.

AWS SAA Page 18

Storage
21 October 2022 14:51

Instance store is ideal for temporary storage of information that changes frequently, such as buffers, caches, scratch data, and
other temporary content, or for data that is replicated across a fleet of instances, such as a load-balanced pool of web servers.

AWS SAA Page 19

Glue
21 October 2022 18:32

• Fully managed, scale out Apache Spark environment

• Glue Data Catalogue - a central metadata repository, an ETL engine that can automatically generate Scala or Python code, and a flexible scheduler that handles dependency resolution, job monitoring, and retries

• Glue Data Crawler - use it to populate glue data catalog with tables, crawls multiple data stores in a single run

AWS SAA Page 20

Kinesis
22 October 2022 17:15

Record --> Shard --> Stream

Record = partition key + sequence number + data blob (max size 1 MB)
Shard = a base throughput unit of stream
Capacity = 1 MB/sec for input, 2MB/sec for output
Supports 1000 PUT records/sec

Shard split and shard merge

You pay per shard basis - hence shard split raises capacity and cost

KCL - Kinesis Client Library

AWS SAA Page 21

SNS
26 October 2022 11:51

AWS SAA Page 22

APN - training
03 October 2023 16:19

Myawscert@23

Alternative architecture to EC2 based 3-tier web application

architecture

AWS SAA Page 23

Security
05 November 2023 15:36

AWS SAA Page 24

After a successful user pool sign-in, your web or mobile app will receive
user pool tokens from Amazon Cognito. These tokens can then be used
to retrieve AWS credentials via Amazon Cognito identity pools. These
credentials allow your app to access other AWS services and you don’t
have to embed long-term AWS credentials in your app.
AWS SAA Page 25
have to embed long-term AWS credentials in your app.

AWS SAA Page 26

EC2
06 November 2023 16:27

If Amazon EC2 Auto Scaling has a scaling policy that calls for a scale down action, it informs ELB that the EC2 instance will be
terminated. ELB can prevent Amazon EC2 Auto Scaling from terminating an EC2 instance until all connections to the
instance end. It also prevents any new connections. This feature is called connection draining.

AWS SAA Page 27

Databases
25 November 2023 19:36

AWS SAA Page 28

Data Analytics on AWS
26 November 2023 14:53

By making 10% more data accessible, a typical Fortune 1000 company will see a $65 million increase in net income.
[Link]
5062b36b578b

85% of businesses want to be data driven, but only 37% have

been successful.

AWS SAA Page 29

Redshift Features:
Massively parallel processing, Columnar Storage, shared-nothing architecture (independent compute
nodes without any dependencies)

AWS SAA Page 30

AWS SAA Page 31
Data lake on AWS : Reference architecture

AWS SAA Page 32

AWS SAA Page 33
Event-driven Architectures
27 November 2023 18:37

Adding SQS to establish an asynchronous connection between API gateway and Lambda service

AWS SAA Page 34