My Exam Notes AWS Solution Architect Associate Certification

24 Mar 2019 - Kunal Patil

AWS Solutions Architect February 2018 Associate Level Certification Exam Notes.

Go to the blog post for a listing of material and useful links to pass AWS Solutions Architect February 2018 Associate Level Certification exam.

Contents

AWS Services Documentation

Documentation of all AWS Services

Identity and Access Management

IAM Policies

Control what this user can do in AWS.

{
  "Version":"2012-10-17",
  "Statement": [
    {
      "Action": [
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::mybucket/*"
    }
  ]
}

Note: IAM policy has three main parts: Action, Effect and Resource. An IAM policy DOESN’T have principal.

  • When a new user is created in IAM, it will get Access Key ID and Secret Access Key generated automatically

IAM Roles

Simple Storage Service

S3 Usage Patterns (When to use S3)

  1. Store and distribute static web content and media (directly deliver static content from S3 or act as content store for AWS CloudFront CDN)
  2. Host entire static web sites
  3. Data store for computation and large scale analytics
  4. Use as a highly durable, scalable, and secure solution for backup and archiving of critical data (using Glacier and Cross-region replication)

When NOT to use S3:

  1. As a file system
    • Use AWS EFS instead
  2. Strucured data with queries
    • Use RDS, DynamoDB or Amazon CloudSearch
  3. Rapidly/Frequently Changing Data
    • Use RDS, DynamoDB, EFS or Amazon CloudSearch
  4. Archival
    • Use Amazon Glacier
  5. Dynamic Website Hosting
    • Use EC2 or EFS

Performance

S3 Cost Model

Amazon S3 Standard has three pricing components:

S3 Storage Classes

  1. S3 Standard: 99.999999999% durability(11 nines), 99.99% availability (4 nines), can sustain loss of 2 AZs concurrently
  2. S3 Infrequently Accessed (S3-IA): For data less frequently accessed, but needs faster retrieval when required. Charged for retrieval fee
  3. S3 Infrequently Accessed One Zone (S3 One zone-IA): S3-IA with no redundancy as it spans in only one AZ
  4. Glacier: For data archival. Typical retrieval time will be 3-5 hours
  5. **Reduced Redundancy Storage (S3 RRS)(Deprecated. Use S3 One zone- IA instead):** Reduced Redundancy Storage (RRS) is an Amazon S3 storage option that enables customers to store noncritical, reproducible data at lower levels of redundancy than Amazon S3’s standard storage. Designed to provide 99.99% durability and 99.99% availability of objects over a given year. Designed to sustain the loss of data in a single facility.

S3 Data Consistency Model

Read-after-write for HTTP GET/LIST operation after object is written(PUT) to S3 bucket successfully. However, if HTTP GET/HEAD request is made before object is written to S3 bucket, then S3 ensures eventually consistent data model for read-after-write.

Eventual consistency also applies to overwrite PUTs and DELETEs in all regions. This is due to S3’s high availability (replication) takes some time to propogate the PUT/DELETE overwrite across all AZs.

Interfaces

  1. AWS Console: Max file size that can be uploaded to S3 from AWS console is 78 GB
  2. AWS CLI commands/scripts
  3. AWS SDKs and REST API calls
  4. AWS Services:
    • AWS Direct Connect
    • AWS Storage Gateway
    • Amazon Kenesis Data Firehose
    • Amazon Kenesis Video Streams
    • Amazon Kenesis Data Streams
    • Amazon S3 Transfer Acceleration
    • AWS Snowball
    • AWS Snowball Edge
    • AWS Snowmobile
    • Third Party Connectors

      Note that when using Amazon Glacier as a storage class in Amazon S3 you use the Amazon S3 API, and when using “native” Amazon Glacier you use the Amazon Glacier API. For example, objects archived to Amazon Glacier using Amazon S3 lifecycle policies can only be listed and retrieved by using the Amazon S3 API or the Amazon S3 console. You can’t see them as archives in an Amazon Glacier vault.

Data Access: REST APIs to access buckets and objects

Using custom domain names to access S3 bucket:

S3 uses DNS for routing requests.

Handling Routing errors:

If a request to S3 is incorrectly routed to incorrect AWS region, S3 sends temporary redirect. Ensure to implement retry logic in you requester application for redirect response codes.

If a request to S3 is mal-formed, S3 sends permanent redirect and responds with 4XX bad request error code. Fix the request to resolve this issue.

Operations on Objects

  1. PUT
    • Single Part- Use for objects of size <= 5GB. Recommended for objects less than 100 MBs.
    • Multi part- Use for objects of size > 5GB and <= 5TB. Recommended for objects greater than 100 MBs. Ensure aborting or completing incomplete mult-part PUTs. There is an option in Lifecycle Management section in AWS console to automatically do this.

  2. COPY Copy objects within S3, rename objects by creating copy and deleting the original, update metadata of object or move objects across S3 locations.

  3. GET Retrieve full object or in multi-part by using *Range GET

  4. DELETE Delete single or multiple objects with one DELETE. If versioning is disabled, DELETE will permanently deteles the object. If versioning is enabled, S3 can delete object version permanently or insert delete marker. If DETELE request only contains the key name, S3 will insert delete marker and this becomes current version of the object. If you try to GET a object that has delete marker, S3 will respond with 404 NOT FOUND error.

To recover the object, remove delete marker from current version of the object. Delete a specific version of the object by specifying object key and version ID.

To delete the object completly, you MUST detele each individual version.

Pre-signed URLs

These are used to provide access(PUT/GET) to users/applications who do not have AWS credentials and still not exposing the S3 buckets publicly. These URLs can be programmatically generated using Java/.Net AWS SDK or AWS CLI.

A pre-signed URL has: security credentials, bucket name, object key, HTTP method and expiration date-time.

Cross Origin Resource Sharing (CORS)

CORS can be configured using a XML config file that can contain 100 CORS rules.Use AWS SDK to apply CORS configuration to S3 bucket. CORS configration is used to allow access to S3 objects from an application hosted in different domain.

S3 Bucket Access

Bucket Policies

Control who can access this bucket.

  • Use to make entire bucket public
  • Bucket Policies are similar to IAM policy but are applied to AWS resources (S3 in this case). Hence it will also have principal defined in the policy as opposed to IAM policies.
  • Bucket policies can also have conditions. Condition values can be date, time, ARN of requester, IP of requester, user name, user id and user agent. S3 policy also support conditions using object tags.
  • Can be used to put size limit policies (upto 20KBs) on S3 buckets/objects.
  • Sample bucket policy:
{
  "Version":"2012-10-17",
  "Statement": [
    {
      "Action": [
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Principal": "aws:arn:iam::123456789012:user/john",
      "Resource": "arn:aws:s3:::mybucket/*"
    }
  ]
}

Access Control Lists

NOTE: Use VPC endpoint for secured connection between EC2 instances and S3. Using VPC endpoint, the traffic from EC2 to S3 bucket will not be directed via internet, making it more secured. You can control access to S3 via VPC endpoint by applying VPC endpoint policies OR using bucket policies. VPC endpoint policy is a resource policy which means it needs principal to be specified.

Encryption

Data At Rest

Server Side Encryption
Default Encryption

It can be either AES-256 or AWS-KMS or None. Any new object will be encrypted with the chosen default encryption.

Client Side Encryption

Data In Transit

Security

Bucket Options

  1. Versioning: Recycle-bean like feature
    • Delete the Delete Marker to restore the deleted versioned object
    • Suspend Versioning:
    • PUT: If a new version of an object is uploaded, then if that object had any previous versions, a new version of the object will be uploaded with Null version ID with old versions intact. If, the object had no previous versions, a new version of the object will be uploaded with Null version ID.
    • DELETE: If an object had multiple existing versions, DELETE operation will create a Detele Marker. When you delete the Detele Marker, it will delete the marker but all previous versions of the object will be retained. If an object had no existing versions, DELETE operation will create a Detele Marker. When you delete the Delete Marker, it will delete the marker and the object’s version too.
  2. Server Access Logging:
    • Server access logs contain the following:
      • Requester
      • Bucket Name
      • Request Time
      • Request Action
      • Response Status
      • Error Code
    • Logs are written to another S3 Bucket or the same bucket on which the Server Access Logging is enabled. Ensure that the destination bucket has right permissions to allow writing logs to it.
  3. Object-level Logging:
    • Using CloudTrail Logging
    • Know Who, When and What about the requests at the objects and buckets level

      Recommendation: If you enable object access logging on all the S3 buckets in your account then choose the destination bucket to use for logging in another AWS account.

  4. Static Website Hosting: More Details Here
    • No additional service is required to host static website (client-side scripting is supported but NOT server side scripting)
    • Format 1: <bucket-name>.s3-website-<AWS-Region>.amazonaws.com
    • Format 2: <bucket-name>.s3-website.<AWS-Region>.amazonaws.com
  5. Default Encryption

Managing Storage

Performance Optimization

Storage Gateway

Snowball

Snowball

Snowball Edge

SnowMobile

Elastic Compute Cloud

General Purpose General Purpose General Purpose Compute Optimized Memory Optimized Memory Optimized Memory Optimized Memory Optimized Accelerated Computing Accelerated Computing Accelerated Computing Storage Optimized Storage Optimized Storage Optimized
A T M C R X H (High Memory) Z P G F H I D
a1 t3, t2 m5, m5a, m4 c5, c5n, c4 r5, r5a, r4, x1e, x1, u-*tb1.metal z1d p3, p2 g3 f1 h1 i3 d2

EC2 Placement Groups

You can launch or start instances in a placement group (to achieve high throughput and low latency), which determines how instances are placed on underlying hardware. When you create a placement group, you specify one of the following strategies for the group:

Autoscaling

Elastic Block Storage

Elastic Load Balancer

  1. Network Load Balancer(NLB):
    • Works on Network Level of OSI model. Handles millions of TCP requests per second securely(TLS) with ultra-high performance.
    • Does not need Security Groups configuration to allow traffic to the NLB itself.
    • The security groups for your instances must allow traffic from the VPC CIDR on the health check port - Target Types can be- 1. Instance or 2. IP
      - Health Check is not a path but it is the port on which traffic is allowed on NLB or can be a different port - You may also add one Elastic IP per Availability Zone if you wish to have specific addresses for your load balancer.
  2. Classic Load Balancer(usually referred as ELB):
    • For both HTTP/HTTPS and TCP. Choose a Classic Load Balancer when you have an existing application running in the EC2-Classic network.

Elastic File Service

Lambda Functions

Cloudwatch

Virtual Private Cloud And Other Services

Security Groups (SG)

Network Access Control Lists (NACLs)

Network Access Translation (NAT)

VPC Endpoints

Refer [this link to see how to connect public ELB to EC2 instances in private Subnet] (https://aws.amazon.com/premiumsupport/knowledge-center/public-load-balancer-private-ec2/)

VPC Peering

AWS Direct Connect

Security Token Service (STS)

Route 53

Databases

RDS- Relational Database Service- OLTP (OnLine Transaction Processing)

RDS Automated Backups

RDS Snapshots

Backups/Snapshots Restore

Encryption

Multi-AZ Deployment

Read Replicas

DynamoDB- No SQL

Redshift- Data Warehousing- OLAP (OnLine Analytical Processing)

ElastiCache

Simple Queue Service

Simple Workflow Service

Simple Notification Service

Elastic Transcoder

API Gateway

Kinesis

CloudFormation

Elastic Container Service

Elastic Beanstalk

AWS Well Architected

AWS Organizations

Other Notes

AWS services that are specific to a region

AWS services that are NOT specific to a region

Exam Structure In January 2019

One of my colleagues passed the AWS Certified Solutions Architect Associate Exam in January 2019. Following are the tips from her based on the questions appeared in the exam: Important Topics:

Some questions appeared on AWS Certified Solutions Architect Associate Exam in January 2019:

  1. CloudFormation templates structure in json format was given to check if those are valid templates
  2. Which database to use in order for the application to be fully managed, highly scalable, n latency in milliseconds?
  3. In order to give end user low latency why do you attach Cloudfront on S3 and why not on EC2?
  4. How will you make your EC2 application more disaster recoverable. (copy to another AZ, Region, take snapshots)?
  5. How will you encrypt data at rest (SSL,KMS,STS)?
  6. How will you encrypt data in transit in S3?
  7. How will you encrypt data in S3 if you dont want to manage keys and what will you use if you want to manage keys?
  8. Your data is infrequently accessed. What will be the cheapest solution by which you can retrieve data within milliseconds?
  9. Database tier needs access to web tier and web tier needs access to internet; what needs to be done?
Read Other Posts