"The on-demand delivery of compute power, database storage, applications, and other IT resources" (pay-as-you-go)
Amazon Web Services owns and maintains the network-connected hardware required for these application services, while the client provisions and uses it via a web application (portal).
Private Cloud: (rockspace) Cloud services used/owned by a single organization, not exposed to the public. Complete control (provides security for sensitive applications) to meet specific buisness needs.
Public Cloud: (azure, google cloud, aws) Cloud resources owned and operated by a 3rd party cloud service provider delivered over the internet.
Hybrid Cloud: Keep some servers on premises and extend some capabilities to the cloud. Control over sensitive assets in pthe private infrastructure but maintain the flexibility and cost effectiveness of the public cloud.
- On-demand self service allows users to provision resources and use them without human interaction from the service provider.
- Broad network access allows resources to be accessed by diverse client platfroms.
- Multi-tenancy and resource pooling enables multiple customers to access the same, shared, infrastructure and applications with security and privacy.
- Rapid elasticity and scalability provides automatic and quick acquisition and disposure of resources when needed (quickly and easily scale based on demand).
- Measured service, users pay exactly/correctly for what was used.
- Trade capital expense (CAPEX) for operational expense (OPEX) hardware is not owned and thereby reduce total cost of ownership.
- Benefit from massive economies of scale price reduced as AWS is more efficient due to large scale usage/growth.
- Stop guessing capacity scale based in actual measured usage.
- Increased speed and agility
- Stop spending money running and maintaining data centres
- Global coverage in minutes leveraging AWS global infrastructure.
Infrastructure as a Service (IaaS) provides the building blocks for cloud IT, networking, computers, data storage space, etc. with the highest level of flexibility (easy parallel with traditional on-premises IT). Amazon EC2 (on AWS), GCP, Azure, Rackspacem Digital Ocean, Linode, etc.
Platform as a Service (PaaS) removes the need for your organization to manage the underlying infrastructure, focusing on the deployment and managment of the applications. Elastic Beanstalk (on AWS), Heroku, Google App Engine (GCP), Windows Azure, etc.
Software as a Service (SaaS) has the service provider run and manage the completed product. Many AWS services (Rekognition for Machine Learning), Google Apps (Gmail), Dropbox, Zoom, etc.
AWS Regions are clusters of data centres located all around the world, each with a unique name (us-east-1, eu-west-3, ...) specifying their location. Most AWS services are region-scoped. Choosing an AWS Region can depend on: https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/
- compliance with data governance and legal requirements (data never leaves a region without explicity permission, etc.).
- Proximity to customers (reduce latency).
- Service availability within a Region (new services/features may not be available in every Region).
- Pricing varies from Region to Region (transparent in the service pricing page).
Each Region has [3-6] AWS Availability Zones; discrete data centres with redundant power, networking, and connectivity seperate from each other so they isolated from disasters/outages (prevents cascade from one Availability Zone to another). Each Region's Availability Zones are connected with high bandwidth, ultra-low latency networking.
AWS Points of Presence (Edge Locations) allows the delivery of content to end users with lower latency.
https://aws.amazon.com/compliance/shared-responsibility-model/
-
AWS Managment Console (protected by password + MFA)
IAM provides the ability to set up a Password Policy to require minimum password length, specific character types (uppercase, numbers, non-alphanumeric, etc.), allow users to change their password or define a password expiration, and prevent password re-use.
IAM additionally provides Multi-Factor Authentication (MFA), verifying ones identity using an authorized item they possess ("something you know and something you have"), through
- Virtual MFA device (Google Authenticator, Authy, etc.)
- Universal 2nd Factor (U2F) Security Key (Yubikey by Yubico)
- Hadrware Key Fob MFA device (Gemalto)
- Hadrware Key Fob MFA device for AWS GovCloud (SurePassID).
-
AWS Command Line Interface (CLI) (protected by access keys); tool to interact with AWS services in command-line shell.
-
AWS Software Developer Kit (SDK) for code ( protected by access keys); language-specific APIs (set fo libraries) to access and manage AWS services programmatically, embedded within application.
Access keys are generated through teh AWS Console with users being responsible for their own keys. Access keys are secret, just like a password. do NOT share them, even with colleagues (have them generate their own).
Access Key ID ~= username Secret Access Key ~= password
Root account created by default, shouldn't be used or shared. A User should be used instead. Users are the people within an organization, and can blong to zero, one, or more Groups (can only contain users, not other Groups).
Users and/or Groups can be assigned JSON documents called IAM Policies, describing the AWS permissions assigned by the Root. In AWS, least privilege prinicple is applied (users are given the least privilege required).
IAM Policies are structured as:
{
// policy language version, usually "2012-10-17"
"Version": "2012-10-17",
// how to identify a given policy (optional)
"Id": "S3-Account-Permissions",
// one or more individual statements
"Statement": [
{
// how to identify a given statement (optional)
"Sid": "1",
// whether the statement allows or denies ("Allow"/"Deny") access
"Effect": "Allow",
// account/user/role to which this policy is applied to
"Principal": {
"AWS": ["arn:aws:iam::123456789012:root"]
},
// list of api calls this policy allows or denies
"Action": ["s3:GetObject", "s3:PutObject"],
// list fo resources to which the actions are applied to
"Resource": ["arn:aws:s3::mybucket/*"],
// conditions for when this polcy is in effect (optional)
"Condition": { "StringEquals": { "aws:username": "johndoe" } }
}
]
}Some AWS services will need to perform actions on the user's behalf; and just like users, permissions must be assigned to AWS services with IAM Roles
IAM Credentials Report (account level) lists all your account's users and the status of their various credentials. IAM Access Advisor (user level) shows the service permissions granted to a user and when those services were last accessed.
IaaS that consists of renting virtual machines (EC2 instances), storing data in virtual drives (EBS), distributing load across machines (ELB), and scaling the services using an auto scaling group (ASG). It is configured by defining the desired:
- Operating System (OS)
- Compute Power & Cores (CPU)
- Random-Access Memory (RAM)
- Storage Space (network-attached, hardware)
- Network Card
- Firewall Rules
- Bootstrap Script (configure at first launch)
EC2 User Data Script in only run once at the instance first start and is responsible for bootstrapping (launching initial commands for application) the EC2 instances. This script is run with the root user.
aws-rashri-v1