Symbols

12-factor app rules, 386–393

administrative processes, 393

backing services, 389

codebase, 386–388

concurrency, 392

configuration storage, 388–389

dependencies, 388

development/production parity, 393

disposability, 392–393

isolate/build/run stages, 389–390

log streams, 393

port binding, 392

stateless processes, 390–391

A

accelerated computing instances, 160–161

acceptor VPCs, 123

Access Advisor, 360–361

access control lists (ACLs), 348

access keys for IAM users, 329–331

rotating, 335–337

access logs, 244

access management. See IAM (identity and access management)

ACID, DynamoDB and, 306–307

ACLs (access control lists), 348

actions (CloudWatch), additional settings, 226

actions (IAM), 324–325, 344–345

adaptive capacity in DynamoDB, 304–305

administrative access (security groups), 115

administrative processes in 12-factor app rules, 393

AEAD encryption, 123

alarms (CloudWatch)

additional settings, 225–226

creating, 224–225

ALB (Application Load Balancer), 233–243

creating, 234–237

features, 229

health check configuration, 242–243

HTTPS listener security settings, 239–240

rules, 237–239

sticky session support, 242

target groups, 233–234, 240–241

user session maintenance, 241

Alias records, 140–141

Amazon ECS (Elastic Container Service), 204–205

Amazon EFS (Elastic File System), 257, 281

key features, 282

performance comparison, 284–286

performance modes, 283

security, 284

throughput modes, 283

usage examples, 282

Amazon ElastiCache, 257

Amazon FSx for Lustre, 258, 282

usage examples, 282

Amazon FSx for Windows File Server, 258, 282, 286–287

usage examples, 282

Amazon LightSail, 206

Amazon Machine Images (AMIs). See AMIs (Amazon Machine Images)

Amazon Macie, 279

Amazon RDS (Relational Database Service), 258, 287–294

best practices, 293–294

database engines, 288

database instances, 288–290

high availability, 290–291

installation, 292–293

performance, 293

Amazon S3, 257, 269–281

bucket configuration options, 272

data consistency, 272

Glacier class (S3), 280–281

management, 274–277

performance comparison, 284–286

security, 278–280

static website creation, 404

storage classes, 273–274

terminology, 270–271

usage examples, 270

versioning, 277–278

Amazon web services. See AWS (Amazon web services) cloud services

AMIs (Amazon Machine Images), 164–175

in AWS Marketplace, 167–168

best practices, 174–175

build considerations, 173–174

components of, 165

creating custom, 168–170

designing, 171–173

Linux AMIs, 166–167

Windows AMIs, 167

analyzing costs, 69

Cost Explorer, 71–73

Simple Monthly Calculator, 73–74

TCO (Total Cost of Ownership) Calculator, 75

Trusted Advisor, 69–70

API Gateway, 402–404, 406

app server inbound ports (security groups), 114

Application Load Balancer (ALB), 233–243

creating, 234–237

features, 229

health check configuration, 242–243

HTTPS listener security settings, 239–240

rules, 237–239

sticky session support, 242

target groups, 233–234, 240–241

user session maintenance, 241

application migration to AWS, 196–202

AWS Migration Hub, 199–200

AWS SMS (Server Migration Services), 200–201

choosing applications, 21–23

questions to ask, 23–24

steps in, 197–198

tools for, 196–197

VM Import/Export service, 202

Well-Architected Framework, 24–26

application scaling. See scaling

application security, 18–19

application stacks, 206

archives (S3 Glacier), 281

ASGs (auto scaling groups), 248–251

lifecycle hooks, 251

scaling options, 249–251

associating services, hosting services versus, 81

attaching EBS volumes, 264–265

attributes (VPC DNS), 143–144

Aurora, 294–298

architecture, 295–297

communication in, 297–298

authentication

in IAM, 320–322

load balancer support, 233

MFA (multifactor authentication), 337

serverless Web app example, 405

authorization in IAM, 323–324

auto recovery, 189–190

auto scaling

AWS Auto Scaling, 251–252

EC2 auto scaling, 245–251

ASGs (auto scaling groups), 248–251

benefits of, 245–246

launch configurations, 246

launch templates, 247

auto scaling groups (ASGs), 248–251

lifecycle hooks, 251

scaling options, 249–251

automation, 373–406

12-factor app rules, 386–393

administrative processes, 393

backing services, 389

codebase, 386–388

concurrency, 392

configuration storage, 388–389

dependencies, 388

development/production parity, 393

disposability, 392–393

isolate/build/run stages, 389–390

log streams, 393

port binding, 392

stateless processes, 390–391

API Gateway, 402–404, 406

AWS Service Catalog, 384–385

CloudFormation, 375–384

benefits of, 377

change sets, 377, 382–383

EC2 instance creation, 381–382

stack sets, 383–384

stacks, 380–381

templates, 377–380, 381

CodeDeploy, 399–400

CodePipeline, 397–399

Elastic Beanstalk, 394–397

availability

in Amazon RDS, 290–291

AWS customer agreement, 42

projected service downtime, 43

availability zones (AZ)

distribution, 37–38

failover, 38–40

list of, 35–37

load balancer support, 233

subnet creation, 95–97

in VPCs, 95

AWS (Amazon web services) cloud services

application security, 18–19

automation. See automation

characteristics of, 10–13

compliance standards, 19–20

data security, 16–17

defined, 1

designing. See designing AWS

developer options, 6, 20–21

IaaS at, 6–8

limitations, 15–16

migrating applications to, 196–202

AWS Migration Hub, 199–200

AWS SMS (Server Migration Services), 200–201

choosing applications, 21–23

questions to ask, 23–24

steps in, 197–198

tools for, 196–197

VM Import/Export service, 202

Well-Architected Framework, 24–26

moving to, 5–6

network security, 18

networking. See networking

operational benefits, 14–15

PaaS at, 8–10

AWS Auto Scaling, 251–252

AWS CodeCommit, 387–388

AWS CodeDeploy, 399–400

AWS CodePipeline, 397–399

AWS Config, cost of, 61–62

AWS ECS for Kubernetes (EKS), 205–206

AWS Fargate, 205

AWS Firecracker, 208

AWS Inspector, 370

AWS Marketplace, AMIs in, 167–168

AWS Migration Hub, 199–200

AWS Organizations, 365–366

SCPs (service control policies), 347

AWS Promotional Credit, 6

AWS RAM (Resource Access Manager), 366–368

AWS Service Catalog, 384–385

AWS Shield, 46

AWS Shield Advanced, 46

AWS SMS (Server Migration Services), 200–201

AZ. See availability zones (AZ)

B

BAA (Business Associate Addendum), 54

backing services in 12-factor app rules, 389

backups

AWS services available, 14

in DynamoDB, 308

bare-metal instances, 161–162

batch operations (S3), 274–275

Blackfoot edge devices, 84–85

block storage. See EBS (elastic block storage)

broad network access, defined, 11

buckets (S3)

configuration options, 272

data consistency, 272

management, 274–277

security, 278–280

static website creation, 404

storage classes, 273–274

terminology, 270–271

versioning, 277–278

burst instances, 157–158

bursting in EBS, 261–262

Business Associate Addendum (BAA), 54

BYOIP (Bring Your Own IP), 107–109

C

C states, 160

C4 instances, 149, 159

C5 instances, 150, 159

capacity units sizes in DynamoDB, 302–303

change sets (CloudFormation), 377, 382–383

changing instance types, 176–177

choosing

applications to migrate, 21–23

listeners, 236

location, 30–32

regions, 49

storage type, 258–259

CIDR blocks, creating, 91

primary CIDR block, 91–93

secondary CIDR blocks, 93

CLB (Classic Load Balancer), 229

cloud computing. See AWS (Amazon web services) cloud services; public cloud services

Cloud Foundry, 9

cloud storage. See storage

CloudFormation, 375–384

benefits of, 377

change sets, 377, 382–383

EC2 instance creation, 381–382

stack sets, 383–384

stacks, 380–381

templates, 377–380, 381

CloudFront, 47–48

CloudHub, 137

CloudTrail, 362–365

CloudWatch, 211–227

agent installation, 216–217

alarm creation, 224–225

alarm/action settings, 225–226

cost of, 223

dashboard, 224

EC2 instance monitoring, 226

features, 213

load balancer metrics, 243–244

logging data, 215–216

metrics in, 213–215

rebooting/recovering EC2 instances, 226–227

service integration, 219–220, 223

terminology, 220–223

CNAME records, 140–141

codebase in 12-factor app rules, 386–388

CodeCommit, 387–388

CodeDeploy, 399–400

CodePipeline, 397–399

Cognito, 353, 405

compliance standards, 19–20

designing AWS, 49–51

GovCloud, 56

HIPPA (Health Insurance Portability and Accountability Act), 54–55

list of, 53–54

NIST (National Institute of Standards and Technology), 55–56

PCI compliance checklist, 51–52

compute costs

calculating, 62

optimizing, 67–68

compute optimized instances, 159

compute services, 147. See also EC2 instances

concurrency in 12-factor app rules, 392

conditions (IAM), 320, 350

configuration storage in 12-factor app rules, 388–389

connection draining, 232–233

connectivity. See networking

containers, 203–206

Amazon ECS, 204–205

AWS ECS for Kubernetes (EKS), 205–206

AWS Fargate, 205

virtual machines (VMs) versus, 204

convertible reserved instances, 181

cooldown, 249–250

cost

analyzing, 69

Cost Explorer, 71–73

Simple Monthly Calculator, 73–74

TCO (Total Cost of Ownership) Calculator, 75

Trusted Advisor, 69–70

calculating, 59–60

compute costs, 62

data transfer costs, 64–66

managed services, 60–62

storage costs, 63–64

tiered costs, 66–67

of CloudWatch, 223

of EC2 instances, 177–187

reserved instances (RI), 178–182

spot instances, 182–187

of IP addressing, 102, 106–107

of load balancers, 228

of measured services, 12–13

optimizing, 67

compute costs, 67–68

reserved pricing, 69

of PrivateLink, 130

of public cloud services, 4–5

of S3 storage, 269

Cost Explorer, 71–73

Create VPC wizard, 87–88

credential reports (IAM), 360

cross-account access (IAM roles), 354–355

CRR (cross-region replication), 276

custom AMIs, 168–170

custom policies (IAM), 339

custom route tables, 100–101

custom security groups, 113–114

customer gateways, 135–136

D

D2 instances, 161

dashboard (CloudWatch), 224

data access, questions to ask, 22–23

data centers

history of cloud computing, 2–4

moving to AWS, 5–6

operational benefits of AWS, 14–15

data consistency

in DynamoDB, 305–306

in S3 storage, 272

data control, 17

data privacy, 17, 41

data security, 16–17

data transfer

cost of, 64–66

options for, 309–313

database server inbound ports (security groups), 114–115

databases

Amazon RDS (Relational Database Service), 287–294

best practices, 293–294

database engines, 288

database instances, 288–290

high availability, 290–291

installation, 292–293

performance, 293

Aurora, 294–298

architecture, 295–297

communication in, 297–298

DynamoDB, 298–308

ACID and, 306–307

adaptive capacity, 304–305

backup/restore, 308

capacity units sizes, 302–303

data consistency, 305–306

DAX, 308

global tables, 307

queries in, 300–301

serverless Web app example, 405

SQL databases versus, 299–300

tables in, 301–302

Secrets Manager, 368–369

DataSync, 311

DAX (DynamoDB Accelerator), 308

DDoS attacks

AWS Shield, 46

AWS Shield Advanced, 46

dedicated hosts, 162

dedicated instances, 162–163

default region, 33

default security group, 112–113

default VPC, 93–95

dependencies in 12-factor app rules, 388

designing AMIs, 171–173

designing AWS, 29–30

availability zones (AZ)

distribution, 37–38

failover, 38–40

list of, 35–37

compliance standards, 49–51

GovCloud, 56

HIPPA (Health Insurance Portability and Accountability Act), 54–55

list of, 53–54

NIST (National Institute of Standards and Technology), 55–56

PCI compliance checklist, 51–52

cost analyzation, 69

Cost Explorer, 71–73

Simple Monthly Calculator, 73–74

TCO (Total Cost of Ownership) Calculator, 75

Trusted Advisor, 69–70

cost calculation, 59–60

compute costs, 62

data transfer costs, 64–66

managed services, 60–62

storage costs, 63–64

tiered costs, 66–67

cost optimization, 67

compute costs, 67–68

reserved pricing, 69

edge location services, 44

AWS Shield, 46

AWS Shield Advanced, 46

CloudFront, 47–48

Lambda@Edge, 48–49

list of, 44–45

Route 53, 45–46

WAF (Web Application Firewall), 47

latency, 57–58

location selection, 30–32

questions to ask, 30

regions

choosing, 49

defined, 32–33

isolation, 34

service separation in, 35

services offered at, 58–59

SLAs (service-level agreements)

AWS customer agreement, 40–42

failure protection, 42–44

developers, AWS options for, 6, 20–21

Direct Connect, 138–139, 310–311

disposability in 12-factor app rules, 392–393

DNS services, Route 53, 45–46, 139–144

Alias records versus CNAME records, 140–141

DNS hostnames, 143–144

health checks, 142–143

private DNS zones, 143

routing protocols, 141–142

dynamic port mapping, 232

DynamoDB, 298–308

ACID and, 306–307

adaptive capacity, 304–305

backup/restore, 308

capacity units sizes, 302–303

data consistency, 305–306

DAX, 308

global tables, 307

queries in, 300–301

serverless Web app example, 405

SQL databases versus, 299

tables in, 301–302

E

EBS (elastic block storage), 257–258, 259–269

general-purpose SSD baseline, 261–262

performance, 263, 284–286

provisioned IOPS (io1), 262–263

volumes

attaching, 264–265

best practices, 269

elastic, 264

encryption, 265–266

snapshots, 266–268

tagging, 268

types of, 260–261

EBS-backed AMIs

creating, 169

instance store-backed AMIs versus, 170–171

EC2 auto scaling, 245–251

ASGs (auto scaling groups), 248–251

benefits of, 245–246

launch configurations, 246

launch templates, 247

EC2 Fleet, 186–187

EC2 instances

AMIs, 164–175

in AWS Marketplace, 167–168

best practices, 174–175

build considerations, 173–174

components of, 165

creating custom, 168–170

designing, 171–173

Linux AMIs, 166–167

Windows AMIs, 167

architecture, 152

auto recovery, 189–190

CodeDeploy and, 399–400

cost of, 177–187

reserved instances (RI), 178–182

spot instances, 182–187

creating with CloudFormation, 381–382

health checks, 230–231

history of virtualization, 148–152

launch templates, 176

monitoring, 226

naming conventions, 153

network performance, 163–164

ordering, 190–196

configuration options, 192

storage options, 193

rebooting/recovering, 226–227

resource isolation, 153–154

storage, 187–189

tagging, 175

types of, 155–163

accelerated computing, 160–161

bare-metal, 161–162

burst, 157–158

changing, 176–177

compute optimized, 159

dedicated hosts, 162

dedicated instances, 162–163

general-purpose, 156–157

M1, 156

memory-optimized, 159–160

micro, 156

for paravirtualization, 156

storage-optimized, 161

vCPUs, 154–155

EC2-Classic, 80

EC2-VPC. See VPCs (virtual private clouds)

edge location services, 44

AWS Shield, 46

AWS Shield Advanced, 46

CloudFront, 47–48

Lambda@Edge, 48–49

list of, 44–45

Route 53, 45–46

WAF (Web Application Firewall), 47

EFS (Elastic File System). See Amazon EFS (Elastic File System)

egress-only Internet gateway (EOIG), 132–133

EIP (elastic IP addresses), 104–106

EKS (AWS ECS for Kubernetes), 205–206

Elastic Beanstalk, 389–390, 394–397

elastic block storage (EBS). See EBS (elastic block storage)

Elastic Compute Cloud. See EC2 instances

Elastic Container Service (Amazon ECS), 204–205

elastic EBS volumes, 264

Elastic File System (EFS). See Amazon EFS (Elastic File System)

elastic IP addresses (EIP), 104–106

elastic load balancing (ELB). See ELB (elastic load balancing)

ElastiCache, 308–309

elasticity, 12, 209–211

in 12-factor app rules, 392

AWS Auto Scaling, 251–252

defined, 12

EC2 auto scaling, 245–251

ASGs (auto scaling groups), 248–251

benefits of, 245–246

launch configurations, 246

launch templates, 247

NIST definition, 209–210

ELB (elastic load balancing), 227–233

additional features, 231–233

designed redundancy, 229–230

EC2 health checks, 230–231

feature comparison, 229

monitoring, 243–244

security groups, 116–117

encryption

AEAD, 123

EBS volumes, 265–266

endpoints

in Aurora, 298

gateway endpoints, 125–128

interface endpoints, 128–131

enhanced networking, 163–164

entities (IAM), 319

EOIG (egress-only Internet gateway), 132–133

ephemeral ports, 121–122

ephemeral storage. See EBS (elastic block storage)

F

F1 instances, 161

failover

in Amazon RDS, 290–291

of availability zones (AZ), 38–40

AWS SLA, 42–44

in Route 53, 142–143

Fargate, 205

file synchronization in Amazon EFS, 286

Firecracker, 208

firewalls

NACLs (network access control lists), 117–122

ephemeral ports, 121–122

inbound/outbound rules, 118–120

WAF (Web Application Firewall), 47

flow logs, 122–123

G

G3 instances, 160

gateway VPC endpoints, 125–128

gateways

customer gateways, 135–136

gateway VPC endpoints, 125–128

Internet gateways, 131–133

Storage Gateway, 312–313

VPG (virtual private gateway), 134–135

GDPR, 20

general-purpose instances, 156–157

general-purpose SSD (gp2), 261–262

Geo DNS, 142

Glacier class (S3), 274, 280–281

Glacier Deep Archive class (S3), 274

global DynamoDB tables, 307

golden AMI pipeline sample configuration, 174

GovCloud, 56

gp2 (general-purpose SSD), 261–262

Gramm-Leachy-Billy Act, 20

groups (IAM), 320, 332

GuardDuty, 369–370

H

H1 instances, 161

health checks

configuring, 242–243

on EC2 instances, 230–231

in Route 53, 142–143, 231

Health Insurance Portability and Accountability Act (HIPPA), 20, 54–55

Heroku, 9, 386

high availability. See availability

high-memory instances, 160

HIPPA (Health Insurance Portability and Accountability Act), 20, 54–55

history

of public cloud services, 2–4

of virtualization, 148–152

host-based routing, 238

hosting services, associating services versus, 81

hostnames (DNS), 143–144

HTTP access (security groups), 114

HTTPS listener security settings, 239–240

hyperthreading, 154

hypervisors

Nitro, 150–151

Xen, 148–150

I

I3 instances, 161

IaaS (infrastructure as a service), 6–8

IAM (identity and access management), 317–365

access requests, 322–323

account details, 332–333

account summary, 333–334

actions, 324–325

authentication, 320–322

authorization, 323–324

AWS services available, 15

best practices, 358–360

features, 318

groups, 332

identity federation, 357–358

MFA (multifactor authentication), 337

password policies, 334–335

policies, 337–350

ACLs (access control lists), 348

actions, 344–345

conditional elements, 350

creating, 341–342

elements of, 342–343

identity-based, 337–339

in-line, 340–341

permission boundaries, 346–347

resource-based, 340

SCPs (service control policies), 347

session policies, 348

summary tables, 348–349

syntax, 343–344

versioning, 349

roles, 351–355

cross-account access, 354–355

when to use, 352–353

signing in, 332

STS (security token service), 355–356

tagging identities, 350–351

terminology, 319–320

tools for, 360–365

users, 325–334

access keys, 329–331

creating, 328–329

identifying, 328

root user, 326–328

rotating access keys, 335–337

ICMP access (security groups), 115

identities (IAM), 319

tagging, 350–351

identity federation, 357–358

identity management. See IAM (identity and access management)

identity-based policies (IAM), 337–339

inbound port numbers, 121–122

inbound rules (NACLs), 118–120

infrastructure as a service (IaaS), 6–8

infrastructure as code. See automation

in-line policies (IAM), 340–341

installing

Amazon RDS (Relational Database Service), 292–293

CloudWatch agent, 216–217

instance storage. See EBS (elastic block storage)

instance store-backed AMIs

creating, 169–170

EBS-backed AMIs versus, 170–171

instances (EC2). See EC2 instances

Intelligent-Tiering class (S3), 273–274

interface VPC endpoints, 128–131

Internet gateways, 131–133

inventory processing (S3), 277

io1 (provisioned IOPS), 262–263

IP addressing

BYOIP, 107–109

cost of, 106–107

elastic addresses, 104–106

IPv6 addresses, 110

load balancer support, 232

primary CIDR block, 91–93

private IPv4 addresses, 102–103

public IPv4 addresses, 103–104

secondary CIDR blocks, 93

IPv4 addressing

elastic addresses, 104–106

private addresses, 102–103

public addresses, 103–104

IPv6 addressing, 110

isolation of regions, 34

J

job function policies (IAM), 339

L

Lambda, 206–208, 400–401

Lambda@Edge, 48–49

latency, designing AWS, 57–58

latency-based routing (LBR), 142

launch configurations, 246

launch templates, 176, 247

Launch VPC Wizard, 88–89

LBR (latency-based routing), 142

LCUs (load capacity units), 228

lifecycle hooks, 251

LightSail, 206

Linux AMIs, 166–167

listeners, choosing, 236

load balancers, 18–19, 227–244

ALB (Application Load Balancer), 233–243

creating, 234–237

health check configuration, 242–243

HTTPS listener security settings, 239–240

rules, 237–239

sticky session support, 242

target groups, 233–234, 240–241

user session maintenance, 241

cost of, 228

ELB (elastic load balancing), 227–233

additional features, 231–233

designed redundancy, 229–230

EC2 health checks, 230–231

feature comparison, 229

monitoring, 243–244

NLB (Network Load Balancer), 244

security groups, 116–117

load capacity units (LCUs), 228

local instance storage, 187–189

location, choosing, 30–32

log streams in 12-factor app rules, 393

logging data, 215–216

M

M1 instances, 156

M4 instances, 157

M5 instances, 156, 157

magnetic drives

EBS (elastic block storage), 263

local instance storage, 187–189

managed policies (IAM), 338

managed services

cost of, 60–62

defined, 7

operational benefits, 14–15

mapping service, 85–86

measured services, 12–13

memory caches, 308–309

memory-optimized instances, 159–160

MFA (multifactor authentication), 337

micro instances, 156

migrating applications to AWS, 196–202

AWS Migration Hub, 199–200

AWS SMS (Server Migration Services), 200–201

choosing applications, 21–23

questions to ask, 23–24

steps in, 197–198

tools for, 196–197

VM Import/Export service, 202

Well-Architected Framework, 24–26

mobile application authentication, 353

monitoring, 211–227

AWS services available, 14

CloudWatch

agent installation, 216–217

alarm creation, 224–225

alarm/action settings, 225–226

dashboard, 224

metrics in, 213–215

rebooting/recovering EC2 instances, 226–227

service integration, 219–220, 223

terminology, 220–223

EC2 instances, 226

importance of, 211–213

load balancers, 243–244

logging data, 215–216

planning for, 217–219

moving to AWS (Amazon web services) cloud, 5–6

multifactor authentication (MFA), 337

N

NACLs (network access control lists), 117–122

ephemeral ports, 121–122

inbound/outbound rules, 118–120

naming conventions for EC2 instances, 153

NAT gateway services, 97–98

National Institute of Standards and Technology (NIST)

AWS compliance, 55–56

public cloud definitions, 10–13

scaling/elasticity definition, 209–210

network access, broad, 11

network access control lists (NACLs), 117–122

ephemeral ports, 121–122

inbound/outbound rules, 118–120

Network Load Balancer (NLB), 244

features, 229

network security, 18

networking, 77–78

availability zones (AZ), 95

AWS networking internals, 81–83

default VPC, 93–95

Direct Connect, 138–139

EC2-Classic, 80

flow logs, 122–123

Internet gateways, 131–133

IP addressing

BYOIP, 107–109

cost of, 106–107

elastic addresses, 104–106

IPv6 addresses, 110

private IPv4 addresses, 102–103

public IPv4 addresses, 103–104

mapping service, 85–86

NACLs, 117–122

ephemeral ports, 121–122

inbound/outbound rules, 118–120

number of VPCs, 90–91

packet flow, 83–85

peering VPCs, 123–125

performance, EC2 instances and, 163–164

questions to ask, 77–78

Route 53, 139–144

Alias records versus CNAME records, 140–141

DNS hostnames, 143–144

health checks, 142–143

private DNS zones, 143

routing protocols, 141–142

security, 79–80

security groups, 110–113

administrative access, 115

app server inbound ports, 114

custom, 113–114

database server inbound ports, 114–115

default, 112–113

ELB traffic flow, 116–117

PING access, 115

stretch layer 2 network designs, 82

subnets

creating, 95–97

NAT gateway services, 97–98

route tables, 98–102

VPC CIDR block creation, 91

primary CIDR block, 91–93

secondary CIDR blocks, 93

VPC console, 78–79

VPC creation, 86–90

VPC endpoints

gateway endpoints, 125–128

interface endpoints, 128–131

VPN connections, 133–138

CloudHub, 137

customer gateway, 135–136

route propagation, 137–138

VPG (virtual private gateway), 134–135

NIST (National Institute of Standards and Technology)

AWS compliance, 55–56

public cloud definitions, 10–13

scaling/elasticity definition, 209–210

Nitro hypervisor, 150–151

NLB (Network Load Balancer), 244

features, 229

O

object lock (S3), 275–276

object storage. See Amazon S3

object tags (S3), 277

on-demand scaling, 250–251

on-demand self-service, 10–11

One Zone-1A class (S3), 274

OpsWorks, 376

optimizing costs, 67

compute costs, 67–68

reserved pricing, 69

ordering EC2 instances, 190–196

configuration options, 192

storage options, 193

OUs (organizational units), 366

outbound rules (NACLs), 118–120

P

P states, 160

PaaS (platform as a service), 8–10

packet flow, 83–85

paravirtualization, 148, 152, 156

parity in 12-factor app rules, 393

password policies (IAM), 334–335

path-based routing, 238–239

PCI (Payment Card Industry) compliance checklist, 51–52

PCI DSS, 20

peering VPCs, 123–125

performance

Amazon EFS (Elastic File System), 283

Amazon RDS (Relational Database Service), 293

EBS (elastic block storage), 263

EC2 instances and networking, 163–164

storage comparison, 284–286

permission boundaries (IAM policies), 346–347

PING access (security groups), 115

planning for monitoring, 217–219

platform as a service (PaaS), 8–10

policies (IAM), 337–350

ACLs (access control lists), 348

actions, 344–345

conditional elements, 350

creating, 341–342

elements of, 342–343

identity-based, 337–339

in-line, 340–341

permission boundaries, 346–347

resource-based, 340

SCPs (service control policies), 347

session policies, 348

summary tables, 348–349

syntax, 343–344

terminology, 319–320

versioning, 349

policy objects (IAM), 320

Policy Simulator, 361–362

port binding in 12-factor app rules, 392

pricing. See cost

primary CIDR block, planning, 91–93

principals (IAM), 320

privacy, 17, 41

private cloud services, 8

private DNS zones, 143

private IPv4 addresses, 102–103

private subnets, 18

PrivateLink, 128–131

provisioned IOPS (io1), 262–263

provisioning capacity in DynamoDB, 302–303

public cloud services

application security, 18–19

compliance standards, 19–20

cost of, 4–5

data security, 16–17

defined, 5

history of, 2–4

IaaS, 6–8

limitations, 15–16

network security, 18

NIST definitions, 10–13

operational benefits, 14–15

PaaS, 8–10

public IPv4 addresses, 103–104

PVHVM hybrid model, 148–149

Q

quality of service, AWS customer agreement, 41

queries in DynamoDB, 300–301

R

R4 instances, 159

R5 instances, 159

rapid elasticity, 12

RDS (relational database service). See Amazon RDS (Relational Database Service); databases

rebooting EC2 instances, 226–227

recovering EC2 instances, 226–227

redundancy. See load balancers

regions

availability zones (AZ)

distribution, 37–38

failover, 38–40

list of, 35–37

choosing, 49

default, 33

defined, 32–33

isolation, 34

service separation in, 35

services offered at, 58–59

relational database service (RDS). See Amazon RDS (Relational Database Service); databases

requester VPCs, 123

reserved instances (RI), 178–182

limits, 179–181

scheduled instances, 182

types of, 181–182

reserved pricing, 69

resiliency. See scaling

Resource Access Manager (AWS RAM), 366–368

resource isolation, 153–154

resource pooling

defined, 11–12

for scaling, 211

resource-based policies (IAM), 340

resources (IAM), 320

access requests, 322–323

RESTful communication, 406

restoring DynamoDB tables, 308

RI (reserved instances), 178–182

limits, 179–181

scheduled instances, 182

types of, 181–182

roles (IAM), 319, 351–355

cross-account access, 354–355

when to use, 352–353

root user (IAM), 326–328

rotating IAM access keys, 335–337

Route 53, 45–46, 139–144

Alias records versus CNAME records, 140–141

DNS hostnames, 143–144

health checks, 142–143, 231

private DNS zones, 143

routing protocols, 141–142

route propagation, 137–138

route tables, 98–102

routing protocols

load balancer support, 232

Route 53 support for, 141–142

rules (ALB), 237–239

rules (NACLs), 118–120

S

S3. See Amazon S3

Sarbanes-Oxley, 20

scaling, 12, 209–211

in 12-factor app rules, 392

AWS Auto Scaling, 251–252

AWS services available, 15

defined, 12

EC2 auto scaling, 245–251

ASGs (auto scaling groups), 248–251

benefits of, 245–246

launch configurations, 246

launch templates, 247

NIST definition, 209–210

scheduled reserved instances, 182

scheduled scaling, 250

SCPs (service control policies), 347

secondary CIDR blocks, adding, 93

Secrets Manager, 368–369

security, 315–316

in Amazon EFS, 284

application security, 18–19

AWS customer agreement, 41

AWS Inspector, 370

AWS Organizations, 365–366

AWS RAM (Resource Access Manager), 366–368

data security, 16–17

GuardDuty, 369–370

HTTPS listener security settings, 239–240

IAM (identity and access management), 317–365

access requests, 322–323

account details, 332–333

account summary, 333–334

actions, 324–325

authentication, 320–322

authorization, 323–324

best practices, 358–360

features, 318

groups, 332

identity federation, 357–358

MFA (multifactor authentication), 337

password policies, 334–335

policies, 337–350

roles, 351–355

rotating access keys, 335–337

signing in, 332

STS (security token service), 355–356

tagging identities, 350–351

terminology, 319–320

tools for, 360–365

users, 325–334

network security, 18

networking, 79–80

in S3 storage, 278–280

Secrets Manager, 368–369

security groups, 110–113

administrative access, 115

app server inbound ports, 114

custom, 113–114

database server inbound ports, 114–115

default, 112–113

ELB traffic flow, 116–117

PING access, 115

security token service (STS), 355–356

selecting. See choosing

self-service portals, 10–11

Server Migration Services (AWS SMS), 200–201

server name identification (SNI), 231

server usage, operational benefits of AWS, 14

serverless Web app example, 404–406

API Gateway setup, 406

authentication, 405

DynamoDB tables, 405

static website creation, 404

Service Catalog, 384–385

service consumers, 129

service control policies (SCPs), 347

service providers, 129

serviceless computing, 206–208, 400–401

service-level agreements (SLAs), 15–16

service-linked roles (IAM), 352

session policies (IAM), 348

SFTP (Secure FTP), 312

shared file systems. See Amazon EFS (Elastic File System); Amazon FSx for Lustre; Amazon FSx for Windows File Server

signing in as IAM user, 332

Simple Monthly Calculator, 73–74

Simple Storage Service. See Amazon S3

SLAs (service-level agreements), 15–16

AWS customer agreement, 40–42

failure protection, 42–44

snapshots (EBS), 266–268

tagging, 268

SNI (server name identification), 231

Snowball, 311–312

Snowball Edge, 312

Snowmobile, 312

spot capacity pools, 185–186

spot fleet requests, 184–185

spot instances, 182–187

EC2 Fleet, 186–187

spot capacity pools, 185–186

spot fleet, 184–185

SQL databases, DynamoDB versus, 299–300

SSD (solid state drive) storage, 187–189

SSL/TLS decryption, 231–232

stack sets (CloudFormation), 383–384

stacks (CloudFormation), 380–381

Standard class (S3), 273

standard reserved instances, 181

Standard-1A class (S3), 274

stateless processes in 12-factor app rules, 390–391

statements (IAM), 320

static websites, creating, 404

sticky sessions, 242

storage

Amazon EFS (Elastic File System), 281

key features, 282

performance modes, 283

security, 284

throughput modes, 283

usage examples, 282

Amazon FSx for Windows File Server, 286–287

Amazon RDS (Relational Database Service), 287–294

best practices, 293–294

database engines, 288

database instances, 288–290

high availability, 290–291

installation, 292–293

performance, 293

Amazon S3, 269–281

bucket configuration options, 272

data consistency, 272

Glacier class (S3), 280–281

management, 274–277

security, 278–280

storage classes, 273–274

terminology, 270–271

usage examples, 270

versioning, 277–278

Aurora, 294–298

architecture, 295–297

communication in, 297–298

choosing, 258–259

cost of, 63–64

data transfer options, 309–313

DynamoDB, 298–308

ACID and, 306–307

adaptive capacity, 304–305

backup/restore, 308

capacity units sizes, 302–303

data consistency, 305–306

DAX, 308

global tables, 307

queries in, 300–301

SQL databases versus, 299–300

tables in, 301–302

EBS (elastic block storage), 259–269

attaching volumes, 264–265

best practices, 269

elastic volumes, 264

general-purpose SSD baseline, 261–262

performance, 263

provisioned IOPS (io1), 262–263

snapshots, 266–268

tagging volumes/snapshots, 268

volume encryption, 265–266

volume types, 260–261

ElastiCache, 308–309

local instance storage, 187–189

operational benefits of AWS, 14

performance comparison, 284–286

types of, 187, 256–258

storage class analysis (S3), 277

Storage Gateway, 312–313

storage-optimized instances, 161

stretch layer 2 network designs, 82

STS (security token service), 355–356

subnets

creating, 95–97

NAT gateway services, 97–98

route tables, 98–102

synchronization in Amazon EFS, 286

T

T1 instances, 156

T2 instances, 157–158

T3 instances, 157–158

tables in DynamoDB, 301–302

adaptive capacity, 304–305

backup/restore, 308

global tables, 307

provisioning capacity, 302–303

serverless Web app example, 405

tagging

EBS volumes/snapshots, 268

EC2 instances, 175

identities (IAM), 350–351

target groups, 233–234, 240–241

target tracking, 249–250

TCO (Total Cost of Ownership) Calculator, 75

templates (CloudFormation), 377–380, 381

temporary credentials in IAM, 352, 355–356

testing

AWS services available, 15

stages in 12-factor app rules, 389–390

throughput

Amazon EFS (Elastic File System), 283

EBS (elastic block storage), 263

tiered costs, 66–67

Total Cost of Ownership (TCO) Calculator, 75

trust policies (IAM), 351

Trusted Advisor, 69–70

U

updating Elastic Beanstalk applications, 396–397

user session maintenance, 241

users (IAM), 319–320, 325–334

access keys, 329–331

account details, 332–333

account summary, 333–334

creating, 328–329

groups, 332

identifying, 328

root user, 326–328

rotating access keys, 335–337

signing in, 332

V

vaults (S3 Glacier), 281

vCPUs (virtual CPUs), 154–155

versioning

IAM policies, 349

in S3 storage, 277–278

virtual machines (VMs), containers versus, 204

virtual private clouds. See networking; VPCs (virtual private clouds)

virtual private gateway (VPG), 134–135

virtual servers. See EC2 instances

virtualization

history of, 148–152

with VMware, 8

VM Import/Export service, 202

VMs (virtual machines), containers versus, 204

VMware, 8

volumes (EBS)

attaching, 264–265

best practices, 269

elastic, 264

encryption, 265–266

snapshots, 266–268

tagging, 268

types of, 260–261

VPCs (virtual private clouds). See also networking

availability zones (AZ), 95

AWS networking internals, 81–83

CIDR block creation, 91

primary CIDR block, 91–93

secondary CIDR blocks, 93

console, 78–79

creating, 86–90

default VPC, 93–95

defined, 6–7

Direct Connect, 138–139

endpoints

gateway endpoints, 125–128

interface endpoints, 128–131

flow logs, 122–123

hosting versus associating services, 81

Internet gateways, 131–133

IP addressing

BYOIP, 107–109

cost of, 106–107

elastic addresses, 104–106

IPv6 addresses, 110

private IPv4 addresses, 102–103

public IPv4 addresses, 103–104

number of, 90–91

packet flow, 83–85

peering connections, 123–125

Route 53, 139–144

Alias records versus CNAME records, 140–141

DNS hostnames, 143–144

health checks, 142–143

private DNS zones, 143

routing protocols, 141–142

security, 79–80

security groups, 110–113

administrative access, 115

app server inbound ports, 114

custom, 113–114

database server inbound ports, 114–115

default, 112–113

ELB traffic flow, 116–117

PING access, 115

subnets

creating, 95–97

NAT gateway services, 97–98

route tables, 98–102

VPN connections, 133–138

CloudHub, 137

customer gateway, 135–136

route propagation, 137–138

VPG (virtual private gateway), 134–135

VPG (virtual private gateway), 134–135

VPN connections, 133–138

CloudHub, 137

customer gateway, 135–136

route propagation, 137–138

VPG (virtual private gateway), 134–135

W

WAF (Web Application Firewall), 47

Well-Architected Framework, 24–26

Windows AMIs, 167

WRR (weighted round robin), 141

X

X1 instances, 150, 159, 160

Xen hypervisor, 148–150

Z

Z1d instances, 160