Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Getting Started on AWS - AWSome Day Dallas 2018

2,091 views

Published on

An introduction to the core AWS services for compute, storage, database, and networking.

  • Check the source ⇒ www.HelpWriting.net ⇐ This site is really helped me out gave me relief from headaches. Good luck!
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • The #1 Woodworking Resource With Over 16,000 Plans, Download 50 FREE Plans... ➣➣➣ https://t.cn/A62YeZUX
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • Here's How YOU Can Stake Out Your Personal Claim In Our EIGHT MILLION DOLLAR GOLDMINE... ▲▲▲ http://t.cn/AieX2Loq
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • Get Paid $25 per hour to watch YouTube videos ●●● http://t.cn/AieX6y8B
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here

Getting Started on AWS - AWSome Day Dallas 2018

  1. 1. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Getting Started on AWS Brian Johnston | 05/16/2018
  2. 2. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • Visit the Ask an Expert area • Available at Breaks and Lunch
  3. 3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Brian Johnston, Technical Trainer bjohnsta@amazon.com
  4. 4. Module 1 Introduction and History of AWS
  5. 5. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon History 1994: Jeff Bezos incorporated the company. 1995: Amazon.com launched its online bookstore. 2005: Amazon Publishing was launched. 2006: Amazon Web Services (AWS) was launched. 2007: Kindle was launched. 2011: Amazon Fresh was launched. 2012: Amazon Game Studios was launched. 2013: Amazon Art was launched. 2014: Amazon Prime Now was launched. 2015: Amazon Home Services and Amazon Echo were launched.
  6. 6. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Web Services (AWS) ComputeMessaging Mobile App Services Database Networking Development and Management Tools Payments VPC On-Demand Workforce Analytics Content Delivery StorageEnable businesses and developers to use web services to build scalable, sophisticated applications.
  7. 7. AWS Pace of Innovation AWS has been continually expanding its services to support virtually any cloud workload, and it now has more than 100 services that range from compute, storage, networking, database, analytics, application services, deployment, management, developer, mobile, Internet of Things (IoT), Artificial Intelligence (AI), security, hybrid and enterprise applications. AWS has launched a total of 1,430 new features and/or services year to date* for a total of 4,343 new features and/or services since inception in 2006. 2011 82 722 1,430 280 2013 2015 2017 * As of 1 January 2018
  8. 8. 4,343 AWS Direct Connect AWS Elastic Beanstalk Schema Conversion Tool AWS Shield EFS WorkSpaces Amazon Lumberyard Amazon Pinpoint AWS IoT AWS Managed Services Amazon Route 53 AWS Import/Export AWS OpsWorks for Chef Automate Redshift Dynamo DB Amazon Polly AWS Snowball AWS Organizations Device Farm Amazon Config Amazon RDS for Aurora WorkDocs AWS Snowball Edge CodeCommit AWS CodePipeline AWS Service Catalog CloudWatch Logs Amazon Lex AWS Greengrass AWS WAF Amazon Appstream 2.0 Amazon Athena AWS Glue Amazon Lightsail Amazon Rekognition AWS Step Functions AWS Discovery Services AWS Certificate Manager Amazon ElastiCache Mobile Analytics AWS Mobile Hub AWS Storage Gateway AWS OpsWorks AWS Batch Amazon Inspector Amazon Cognito AWS CodeDeploy AWS Personal Health Dashboard AWS Snowmobile Lambda * As of 1 January 2018 AWS Codebuild AWS X-Ray Amazon QuickSight Amazon Kinesis Firehose Amazon Workmail Amazon Inspector Machine Learning
  9. 9. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Customers Public Sector Paving the way for innovation and supporting world-changing projects in government, education and nonprofit organizations. Startups From the spark of an idea, to your first customer, to IPO and beyond, let Amazon Web Services help you build and grow your startup. Enterprise Customers Amazon Web Services delivers a mature set of services specifically designed for the unique security, compliance, privacy, and governance requirements of large organizations.
  10. 10. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Advantages and Benefits of AWS Cloud Computing Trade capital expense for flexible expense. Benefit from massive economies of scale. Eliminate guessing on your capacity needs. Go global in minutes. Increase speed and agility. Stop spending money on running and maintaining data centers.
  11. 11. AWS Positioned as a Leader in the Gartner Magic Quadrant for Cloud Infrastructure as a Service, Worldwide* AWS is positioned highest in execution and furthest in vision within the Leaders Quadrant *Gartner, Magic Quadrant for Cloud Infrastructure as a Service, Worldwide, Leong, Lydia, Bala, Raj, Lowery, Craig, Smith, Dennis, June 2017 G00315215 This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from AWS : http://www.gartner.com/doc/reprints?id=1- 2G2O5FC&ct=150519&st=sb Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
  12. 12. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Infrastructure Regions Edge LocationsAvailability Zones Foundation Services Compute (Virtual, Auto-scaling and Load Balancing) Networking Applications Virtual Desktops Collaboration and Sharing Platform Services Databases Relational NoSQL Caching Analytics Cluster Computing Real-time Data Warehouse Data Workflows App Services Queuing Orchestration App Streaming Transcoding Email Search Deployment and Management Containers Dev/ops Tools Resource Templates Usage Tracking Monitoring and Logs Mobile Services Identity Sync Mobile Analytics Notifications Storage (Object, Block and Archive) AWS Cloud Computing
  13. 13. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Elastic Beanstalk Compute Networking Storage Database Amazon CloudFront Amazon Glacier Amazon S3 Amazon EBS Auto Scaling Amazon Route 53 AWS Direct Connect Amazon VPC Amazon EC2 Elastic Load Balancing AWS Lambda Amazon Elastic Container Registry Amazon Elastic Container Service Amazon Elastic File System AWS Snowball Amazon RDS Amazon Redshift Amazon ElastiCache Amazon DynamoDB AWS Database Migration Service Amazon Lightsail AWS Batch Storage Gateway AWS Snowmobile AWS by Category: Core Services
  14. 14. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS by Category: Platform Services Internet ofThingsMobile ServicesEnterprise AppsAnalytics Amazon EMR AWS Data Pipeline Amazon Elasticsearch Amazon Kinesis Amazon Machine Learning Amazon QuickSight Amazon Redshift Amazon Athena Amazon WorkSpaces Amazon WorkMail Amazon WorkDocs AWS Mobile Hub Amazon SNS Amazon Cognito AWS Device Farm Amazon Mobile Analytics AWS Mobile SDKs AWS IoT Amazon Pinpoint AWS Greengrass
  15. 15. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS by Category: Developer and Operations Services Developer Tools Management Tools Security & Identity App Services AWS CodeCommit AWS CodeDeploy Amazon AWS AWS Identity and Access Management AWS Directory Service Amazon API Amazon AppStream AWS CodePipeline AWS CodeBuild AWS CloudTrail AWS Config Amazon Inspector AWS CloudHSM Amazon Amazon Elastic Transcoder AWS X-Ray AWS OpsWorks AWS Service Catalog AWS Key Management Service AWS WAF Amazon SES Amazon SNS AWS Trusted Advisor Amazon SQS Amazon SWF AWS Certificate Manager AWS Shield AWS Organizations
  16. 16. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Core Infrastructure and Services Security Network Security Network Security Groups NACLs Access Mgmt VPCVPC EC2 “Classic” “Public” ELB On-Demand Provision Servers AMI Amazon EC2 InstancesOn-Premises Servers Security Security Groups Network ACLs AWS IAMFirewalls ACLs Administrators Storage and Database RDBMSDAS SAN NAS Amazon EBS Amazon EFS Amazon S3 Amazon RDS Networking VPCELBRouter Network Pipeline Switch Traditional Infrastructure Amazon Web Services
  17. 17. AWS Global Infrastructure
  18. 18. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Data Centers A single data center typically houses several thousands of servers. All data centers are online. No data center is “cold”. AWS custom network equipment: Multi-ODM sourced. Amazon custom network protocol stack. Data center
  19. 19. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Availability Zones (AZ) Each Availability Zone is: Made up of one or more data centers. Designed for fault isolation. Interconnected with other Availability Zones using high-speed private links. You choose your Availability Zones. AWS recommends replicating across AZs for resiliency. Availability Zone
  20. 20. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Regions Each region is made up of two or more Availability Zones. AWS has 18 regions worldwide. You enable and control data replication across regions. Communication between regions uses AWS backbone network connections infrastructure. AWS Region Availability Zone Data center Data center Data center Data center Data center Data center Data center Data center Data center Data center Data center Data center Availability Zone Availability Zone
  21. 21. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Global Infrastructure: Regions AWS GOVCLOUD (US-WEST) OHIO OREGON N. CALIFORNIA N. VIRGINIA BEIJING SEOUL TOKYO SINGAPORE SYDNEY CANADA LONDON MUMBAI IRELAND SÃO PAULO 3 2 3 3 2 3Region & Number of AZs 3 2 4 2 2 3 BAHRAIN (Comingsoon) HONG KONG (Comingsoon) SWEDEN (Comingsoon) AWS GOVCLOUD (US- EAST) (Comingsoon) 6 New Region Coming Soon NINGXIA 2PARIS FRANKFURT 3 3 3 3
  22. 22. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Global Infrastructure – Edge Locations 102* edge locations Local points of presence that support AWS services like: Amazon Route 53 Amazon CloudFront AWS WAF AWS Shield Lambda@Edge *as of February 2018
  23. 23. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Global Infrastructure: Edge Locations and Regional Edge Caches Edge Locations Multiple Edge Locations Regional Edge Caches
  24. 24. Module 2 AWS Foundational Services
  25. 25. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Module 2 Layout Amazon Elastic Compute Cloud (EC2) Amazon Elastic Block Store (EBS) Amazon Virtual Private Cloud (VPC) Demo: Launching a Web Server Amazon Simple Storage Service (S3) Demo: Amazon S3
  26. 26. Amazon Elastic Compute Cloud (EC2)
  27. 27. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Elastic Compute Cloud (EC2) Resizable compute capacity Complete control of your computing resources Reduced time required to obtain and boot new server instances Amazon EC2
  28. 28. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon EC2 Facts Scale capacity as your computing requirements change Pay only for capacity that you actually use Choose Linux or Windows Deploy across AWS Regions and Availability Zones for reliability Use tags to help manage your Amazon EC2 resources
  29. 29. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Launching an Amazon EC2 Instance via the Management Console 1. Determine the AWS Region in which you want to launch the Amazon EC2 instance. 2. Launch an Amazon EC2 instance from a pre-configured Amazon Machine Image (AMI). 3. Choose an instance type based on CPU, memory, storage, and network requirements. 4. Configure network, IP address, security groups, storage volume, tags, and key pair.
  30. 30. 1. Determine the AWS Region
  31. 31. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Global Infrastructure: Regions AWS GOVCLOUD (US-WEST) OHIO OREGON N. CALIFORNIA N. VIRGINIA BEIJING SEOUL TOKYO SINGAPORE SYDNEY CANADA LONDON MUMBAI IRELAND SÃO PAULO 3 2 3 3 2 3Region & Number of AZs 3 2 4 2 2 3 BAHRAIN (Comingsoon) HONG KONG (Comingsoon) SWEDEN (Comingsoon) AWS GOVCLOUD (US- EAST) (Comingsoon) 6 New Region Coming Soon NINGXIA 2PARIS FRANKFURT 3 3 3 3
  32. 32. 2. Launch from an AMI
  33. 33. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Machine Image (AMI) Details An AMI includes the following: A template for the root volume for the instance (for example, an operating system, an application server, and applications). Launch permissions that control which AWS accounts can use the AMI to launch instances. A block device mapping that specifies the volumes to attach to the instance when it is launched.
  34. 34. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Instances and AMIs Select an AMI based on: Region Operating system Architecture (32-bit or 64-bit) Launch permissions Storage for the root device AMI Instances Instance Launch instances of any type Host computer Host computer
  35. 35. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. OS, Applications, and Configuration AMI Running or Stopped VM Instances AZ Region AZ Instances Instances Amazon EC2 Instances
  36. 36. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Instance Lifecycle AMI pending Launch runningrebooting Reboot Start terminated shutting-down Terminate Terminate EBS-backed instances only Stop stopping stopped
  37. 37. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Online store to discover, purchase, and deploy IT software on top of the AWS infrastructure. Catalog of 4,200+ IT software solutions including Paid, BYOL, Open Source, SaaS, and free-to-try options. Pre-configured to operate on AWS. Software checked by AWS for security and operability. Deploys to AWS environment in minutes. Flexible, usage-based billing models. Software charges billed to AWS account. Includes AWS Test Drive. https://aws.amazon.com/marketplace AWS Marketplace – IT Software Optimized for the Cloud
  38. 38. 3. Choose an Instance Type
  39. 39. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Choosing the Right Amazon EC2 Instance AWS uses Intel® Xeon® processors to provide customers with high performance and value. EC2 instance types are optimized for different use cases and workload requirements and come in multiple sizes. Consider the following when choosing your instances: Core count Memory size Storage size and type Network performance CPU technologies
  40. 40. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Benefits from Intel Capabilities C5 instances Optimized instance for compute-intensive workloads. 3.0 GHz Intel Xeon Platinum processors with new Intel Advanced Vector Extension 512 (AVX-512) instruction set. New larger instance size, c5.18xlarge, offering 72 vCPUs and 144 GiB of memory. Optimized for Amazon EBS by default.
  41. 41. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Benefits from Intel Capabilities H1 instances Storage-optimized instance. Designed for applications that require low-cost, high disk throughput and high sequential disk I/O access to very large data sets. Use case: MapReduce-based workloads, distributed file systems such as HDFS and MapR-FS, network file systems, log or data processing applications such as Apache Kafka, and big data workload clusters.
  42. 42. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Benefits from Intel Capabilities F1 instances Direct access custom FPGA hardware on the instance in a few clicks. Quickly deploy custom hardware accelerations. Predictable performance. Change the economics of FPGAs. Use existing FPGA algorithms. R4 instances Optimized for memory-intensive applications. Offer better price per GiB of RAM than R3.
  43. 43. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Benefits from Intel Capabilities T2 instances Provide a baseline level of CPU performance with the ability to burst above the baseline. For workloads that don’t use the full CPU often or consistently, but occasionally need to burst. I3 instances Non-Volatile Memory Express (NVMe) SSD-backed instance. Storage optimized for low latency, very high random I/O performance, and high sequential read throughput. High IOPS at a low cost.
  44. 44. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Intel® Processor Technologies Intel AVX (AVX, AVX2 and AVX-512) – Highly parallel HPC workloads. Intel AES-NI – Accelerates encryption/decryption of data. IntelTurbo BoostTechnology – More computing power when you need it with performance that adapts to spikes in your workload. IntelTransactional Synchronization (TSX) Extensions – Enable execution of transactions that are independent to accelerate throughput. P state & C state control – Ability to individually tune each cores performance & sleep states to improve application performance.
  45. 45. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS EC2 Instances with Intel Technologies AWS Instance Type General Purpose M5 Compute Optimized C5 Storage Optimized H1 Memory Optimized R4 Memory Optimized X1 Intel Processor Intel Xeon Platinum 8000 Intel Xeon Platinum 8000 Custom Xeon E5- v4 Intel Xeon 2686 v4 Intel Xeon 8880 v3 Intel AVX AVX 2.0 AVX 2.0 AVX 2.0 AVX 2.0 AVX 2.0 Intel AES-NI Yes Yes Yes Yes Yes Intel Turbo Yes Yes Yes Yes Yes Intel TSX No No No No Yes Per core P- C-state control Processor C-states (m5.12xlarge and m5.24xlarge) Processor C- (m5.12xlarge and m5.24xlarge) Yes (h1.8xlarge and h1.16xlarge) Yes (r4.8xlarge and r4.16xlarge) Yes (x1.16xlarge x1.32xlarge x1e.32xlarge) SSD Storage EBS Optimized by default EBS Optimized by default No EBS Optimized default EBS Optimized by default
  46. 46. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS EC2 Instances with Intel Technologies AWS Instance Type IO Optimized I3 GPU Graphics G3 GPU Compute P2 Accelerated Computing F1 Burstable Performance T2 Intel Intel Xeon 2686 v4 Intel Xeon 2686 v4 Intel Xeon 2686 v4 Intel Xeon 2686 v4 Intel Xeon Intel AVX Yes Yes Yes AVX 2.0 Yes Intel AES-NI Yes Yes Yes Yes Yes Intel Turbo Boost Yes Yes Yes Yes Yes Intel TSX No No No No No Per core P- C-state Yes (i3.8xlarge and i3.16xlarge) Yes (g3.16xlarge) Yes (p2.16xlarge) Yes (f1.16xlarge) No SSD Storage EBS Optimized by default Yes Yes EBS Optimized default EBS only
  47. 47. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Current Generation Instances Instance Family Some Use Cases General purpose (T2, M5, M4) • Low-traffic websites and web applications • Small databases and mid-size databases Compute-optimized (C5, C4) • High performance front-end fleets • Video-encoding Memory-optimized (X1e, X1, R4) • High performance databases • Hadoop/Spark clusters Storage-optimized (H1, I3, D2) • Data warehousing • Log or data-processing applications Accelerated Computing (P3, P2, G3, • Genomics research • Machine learning • 3D application streaming
  48. 48. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. On-Demand Instances Pay as you go. Reserved Instances Purchase, at a significant discount, instances that are always available 1-year to 3- year terms. Scheduled Instances Purchase instances that are always available on the specified recurring schedule, for a one-year term. Spot Instances Bid on unused instances, which can run as long as they are available and your bid is above the Spot price. Dedicated Hosts Pay for a physical host that is fully dedicated to running your instances. Dedicated Instances Pay, by the hour, for instances that run on single- tenant hardware. Amazon EC2 Purchasing Options
  49. 49. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon EC2 Pricing On-Demand Spot Instances Reserved Instances Dedicated Hosts Per-second billing (Amazon Linux and Ubuntu only) Per-hour billing (All other OSs) Per-hour billing
  50. 50. 4. Configure your instance
  51. 51. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Instance User Data Can be passed to the instance at launch. Can be used to perform common automated configuration tasks. Runs scripts after the instance starts.
  52. 52. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Adding User Data You can specify user data when launching an instance. User data can be: Linux script – executed by cloud-init Windows batch or PowerShell scripts – executed by EC2Launch or EC2Config service User data scripts run once per instance ID by default.
  53. 53. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. User Data Example Linux #!/bin/sh yum -y install httpd chkconfig httpd on /etc/init.d/httpd start User data shell scripts must start with the #! characters and the path to the interpreter you want to read the script. Install Apache web server Enable the web server Start the web server
  54. 54. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. User Data Example Windows <powershell> Import-Module ServerManager Install-WindowsFeature web-server, web-webserver Install-WindowsFeature web-mgmt-tools </powershell> Import the Server Manager module for Windows PowerShell. Install IIS Install Web Management Tools
  55. 55. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Instance Metadata Is data about your instance. Can be used to configure or manage a running instance. To get the instance metadata from within a running instance, use the following URI: http://169.254.169.254/latest/meta-data/ Metadata: Availability Zone: us-east-1d Instance type: c5.18xlarge Public IP: 34.234.30.48 Metadata: Availability Zone: us-east-1a Instance type: i3.2xlarge Public IP: 52.7.197.98
  56. 56. Block Storage Service Amazon Elastic Block Store (EBS)
  57. 57. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Persistent block level storage volumes offer consistent and low-latency performance. Stored data is automatically replicated within its Availability Zone. Snapshots are stored durably in Amazon S3. Amazon EBS Amazon Elastic Block Store (EBS)
  58. 58. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. OS, Applications, and Configuration AMI Running or Stopped VM Instances AZ VPC Region EBS EBS EBS EBS EBS EBS AZ Instances Instances Persistent EC2 Instance storage
  59. 59. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Vast amounts of unused space Create Call CreateVolume 1 GiB to 16 TiB Attach Call AttachVolume to affiliate with one Amazon EC2 instance Attached and In Use • Format from Amazon EC2 instance OS • Mount formatted drive CreateSnapshot Snapshot to Amazon S3 Detach Call DetachVolume Deleted Call DeleteVolume Amazon EBS Lifecycle
  60. 60. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon EBS Volume Types SSD-backed volumes are Optimized for transactional workloads that involve frequent read/write operations with small I/O size. Dominant in IOPS performance. HDD-backed volumes are Optimized for large streaming workloads. Dominant in throughput (measured in MiB/s).
  61. 61. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon EBS Volume Types SSD HDD Volume Type General Purpose (gp2) Provisioned IOPS (io1) Throughput Optimized HDD (st1) Cold HDD (sc1) Description Balances price and performance for a wide variety of transactional loads. Highest- SSD volume for mission-critical applications. Low-cost HDD for frequently throughput-intensive workloads. Lowest cost HDD designed for less frequently accessed workloads. Volume Sizes 1 GiB – 16 TiB 4 GiB – 16 TiB 500 GiB – 16 TiB 500 GiB – 16 TiB Dominant Performance Attribute IOPS IOPS MiB/s MiB/s
  62. 62. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon EBS Facts EBS is recommended when data must be quickly accessible and requires long-term persistence. You can launch your EBS volumes as encrypted volumes – data stored at rest on the volume, disk I/O, and snapshots created from the volume are all encrypted. You can create point-in-time snapshots of EBS volumes, which are persisted to Amazon S3.
  63. 63. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. OS: Use for boot/root volume, secondary volumes Databases: Scales with your performance needs Enterprise applications: Provides reliable block storage to run mission-critical applications Business continuity: Minimize data loss and recovery time by regularly backing up using EBS Snapshots Applications: Install and persist any application Amazon EBS Use Cases
  64. 64. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Pay for what you provision: Pricing based on region Pricing is based on: Storage IOPS (for io1) * Check Amazon EBS Pricing page for current pricing for all regions. Amazon EBS Pricing
  65. 65. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Availability Zone B Amazon EBS volumes are in a single Availability Zone Volume data is replicated across multiple servers in an Availability Zone. Availability Zone A EBS Volume 1 EBS Volume 2 Amazon EBS Scope
  66. 66. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon EC2 Instance Store Is local, complimentary direct attached block storage. Includes availability, number of disks, and size based on EC2 instance type. Is optimized for up to 3.3 million random Read IOPS and 1.4 million Write IOPS. Is SSD or HDD. Has no persistence. Automatically deletes data when an EC2 instance stops, fails or is terminated.
  67. 67. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon EBS vs. Amazon EC2 Instance Store Amazon EBS Data stored on an Amazon EBS volume can persist independently of the life of the instance. Storage is persistent. Amazon EC2 Instance Store Data stored on a local instance store persists only as long as the instance is alive. Storage is ephemeral.
  68. 68. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Reboot vs. Stop vs. Terminate Characteristic Reboot Stop/Start (EBS-backed instances only) Terminate Host computer The instance stays on the same host computer. The instance runs on a new computer. Public IP address No change New address assigned Elastic IP (EIP) EIP remains associated the instance. EIP remains associated with instance. EIP is disassociated from the instance. Instance store volumes Preserved Erased Erased EBS volume Preserved Preserved Boot volume is deleted by Billing Instance billing hour doesn’t change. You stop incurring charges soon as state is changed to stopping. You stop incurring charges as as state is changed to shutting- down.
  69. 69. Break & Ask an AWS Expert until 11:15AM
  70. 70. Networking Amazon VPC
  71. 71. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Provision a private, isolated virtual network on the AWS cloud. Have complete control over your virtual networking environment.Amazon VPC Amazon Virtual Private Cloud (VPC)
  72. 72. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. VPCs and Subnets A subnet defines a range of IP addresses in your VPC. You can launch AWS resources into a subnet that you select. A private subnet should be used for resources that won’t be accessible over the Internet. A public subnet should be used for resources that will be accessed over the Internet. Each subnet must reside entirely within one Availability Zone and cannot span zones.
  73. 73. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Virtual Private Cloud AWS Cloud Public Subnet Private Subnet VPN Only Subnet DB Server Web Server Customer Network Internet App Server VPC NAT Gateway Internet Gateway Web Server App Server DB Server Virtual Private Gateway Amazon VPC Example
  74. 74. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Security in Your VPC EC2 Key Pairs Security groups Network access control lists (ACLs) Route Table Subnet 10.0.1.0/24 Internet GatewayVPN Gateway VPC Router 10.0.0.0/16 Security Group Security Group Network ACL Network ACL Routing Table Routing Table instance instance instance instance Subnet 10.0.0.0/24 Security Group Security Group
  75. 75. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. VPN Connections VPN Connectivity Description AWS Hardware VPN You can create an IPsec hardware VPN connection between your VPC and your remote network. AWS Direct Connect AWS Direct Connect provides a dedicated private connection from a remote network to your VPC. Software VPN You can create a VPN connection to your remote network by using an Amazon EC2 instance in your that’s running a software VPN appliance.
  76. 76. Instructor Demo Launch a Web Server
  77. 77. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. What We’re Starting With Region Availability Zone A Public Subnet 2 (10.0.2.0/24) 10.0.0.0/16 Availability Zone B Private Subnet 2 (10.0.4.0/24) Public Subnet 1 (10.0.1.0/24) Private Subnet 1 (10.0.3.0/24) Internet Gateway
  78. 78. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Internet Gateway Launch a Web Server Region Availability Zone A Public Subnet 2 (10.0.2.0/24) 10.0.0.0/16 Web Server 1 Availability Zone B Private Subnet 2 (10.0.4.0/24) Public Subnet 1 (10.0.1.0/24) Private Subnet 1 (10.0.3.0/24) Configure a new security group (WebSecurityGroup) security group
  79. 79. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Internet Gateway Launch a Web Server Region Availability Zone A Public Subnet 2 (10.0.2.0/24) 10.0.0.0/16 Availability Zone B Private Subnet 2 (10.0.4.0/24) Public Subnet 1 (10.0.1.0/24) Private Subnet 1 (10.0.3.0/24) security group Web Server 1 Launch a new web server Instance
  80. 80. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Launch a Web Server Region Availability Zone A Web Server 1 Public Subnet 2 (10.0.2.0/24) 10.0.0.0/16 security group Availability Zone B Private Subnet 2 (10.0.4.0/24) Public Subnet 1 (10.0.1.0/24) Private Subnet 1 (10.0.3.0/24) Internet Gateway
  81. 81. Object Storage Service Amazon S3
  82. 82. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Storage for the Internet Natively online, HTTP/S access Storage that allows you to store and retrieve any amount of data, any time, from anywhere on the web Highly scalable, reliable, fast and durable Amazon S3 Amazon Simple Storage Service (S3)
  83. 83. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Can store an unlimited number of objects in a bucket Objects can be up to 5 TB; no bucket size limit Designed for 99.999999999% durability and 99.99% availability of objects over a given year Can use HTTP/S endpoints to store and retrieve any amount of data, at any time, from anywhere on the web Can use optional server-side encryption using AWS or customer-managed provided client-side encryption Auditing is provided by access logs Amazon S3 Facts
  84. 84. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Common Use Scenarios Storage and backup Application file hosting Media hosting Software delivery Store AMIs and snapshots
  85. 85. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. OS, Applications, and Configuration AMI Running or Stopped VM Instances AZ VPC Region EBS EBS EBS EBS EBS EBS AZ Instances Instances Backup EBS Snapshots to S3 S3 EBS Snapshots S3 Buckets
  86. 86. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon S3 stores data as objects within buckets An object is composed of a file and optionally any metadata that describes that file You control access to the bucket and its objects Amazon S3 Bucket with Objects Bucket Object Amazon S3 Concepts
  87. 87. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Objects are the fundamental entities stored in Amazon S3. When using the console, you can think of them as files. Objects consist of data and metadata. The data portion is opaque to Amazon S3. The metadata is a set of name-value pairs that describe the object. Default metadata such as the date last modified Standard HTTP metadata such as Content-Type Custom metadata at the time the object is stored A key that uniquely identifies the object within its bucket Amazon S3 Objects
  88. 88. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Object Keys An object key is the unique identifier for an object in a bucket. http://doc.s3.amazonaws.com/2018-01-28/photo.gif Bucket Object Key
  89. 89. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon S3 Region Considerations Amazon S3 creates a bucket in the region you select. You can choose a region to: Optimize latency Minimize costs Address regulatory requirements Objects stored in a region never leave the region unless you explicitly transfer them to another region.
  90. 90. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon S3 Security You can control access to buckets and objects with: Access Control Lists (ACLs) Bucket policies Identity and Access Management (IAM) policies You can upload or download data to Amazon S3 via SSL/TLS encrypted endpoints. You can encrypt data Client-Side and/or Server-Side.
  91. 91. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon S3 Versioning Protects from accidental overwrites and deletes with no performance penalty. Generates a new version with every upload. Allows easily retrieval of deleted objects or roll back to previous versions. Two states of an Amazon S3 bucket Versioning-suspended Versioning-enabled Versioning Enabled Key: photo.gif ID: 121212 Key: photo.gif ID: 111111
  92. 92. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Pay only for what you use No minimum fee Estimate monthly bill using the AWS Simple Monthly Calculator Pricing is available as: Storage Pricing Request Pricing Data Transfer Pricing: data transferred out of Amazon S3 Amazon S3 Pricing
  93. 93. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Glacier Long term low-cost archiving service Optimal for infrequently accessed data Designed for 99.999999999% durability Retrieval time: Expedited: 1 – 5 minutes Standard: 3 – 5 hours Bulk: 5 – 12 hours
  94. 94. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon S3 Storage Classes Storage Class Durability Availability Other Considerations Amazon S3 Standard 99.999999999% 99.99% Amazon S3 Standard - Infrequent Access (IA) 99.999999999% 99.9% • Retrieval fee associated with objects • Most suitable for infrequently accessed data Glacier 99.999999999% 99.99% (once restored) • Not available for real-time • Must restore objects before can access them • Restoring objects can take 1-5 minutes, 3-5 hours or 5-12
  95. 95. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Lifecycle management defines how Amazon S3 manages objects during their lifetime. Some objects might have a well-defined lifecycle: Log files Archive documents Digital media archives Financial and healthcare records Raw genomics sequence data Long-term database backups Data that must be retained for regulatory compliance Amazon S3 Object Lifecycle
  96. 96. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon S3 + Amazon Glacier S3 Lifecycle policies allow you to delete or move objects based on age and set rules per S3 bucket. bucket with objects 30 Days Glacier archive 365 Days
  97. 97. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon EBS Amazon S3 Paradigm Block storage with file system Object store Performance Very fast Fast Redundancy Across multiple servers in an Availability Zone Across multiple facilities in a Security EBS Encryption – Data and Snapshots Encryption Access from the Internet? No (1) Yes (2) Typical use case It is a disk drive Online storage (1) Accessible from the Internet if mounted to server and served with FTP, etc. (2) Only with proper credentials, unless ACLs are world-readable Amazon EBS and Amazon S3
  98. 98. Instructor Demo Amazon S3
  99. 99. Lunch & Ask an AWS Expert until 1:30PM
  100. 100. Module 3 Security, Identity, and Access Management
  101. 101. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Shared Responsibility Model Customer Responsibility AWS Responsibility AWS Foundation Services Compute Storage Database Networking AWS Global Infrastructure Regions Availability Zones Edge Locations Platform, Applications, Identity and Access Management Operating System, Network, and Firewall Configuration Customer Applications & Content Network traffic protection Client-side data encryption Server-side encryption Customers are responsible for security IN the cloud AWS is responsible for the security OF the cloud
  102. 102. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Physical Security 24/7 trained security staff AWS data centers in nondescript and undisclosed facilities Two-factor authentication for authorized staff Authorization for data center access
  103. 103. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Hardware, Software, and Network Automated change-control process Bastion servers that record all access attempts Firewall and other boundary devices AWS monitoring tools
  104. 104. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Certifications and Accreditations ISO 9001, ISO 27001, ISO 27017, ISO 27018, IRAP (Australia), MLPS Level 3 (China), MTCS Tier 3 Certification (Singapore) and more …
  105. 105. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. SSL/TLS Endpoints VPC Secure Transmission Use secure endpoints to establish secure communication sessions (HTTPS). Instance Firewalls Use security groups to configure firewall rules for instances. SSL Endpoints Security Groups Network Control Use public and private subnets, NAT, and VPN support in your virtual private cloud to create low-level networking constraints for resource access. SSL Endpoints
  106. 106. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Security Groups SSL Endpoints Security Groups Instance Firewalls Use security groups to configure firewall rules for instances. VPC Secure Transmission Use secure endpoints to establish secure communication sessions (HTTPS). Network Control Use public and private subnets, NAT, and VPN support in your virtual private cloud to create low-level networking constraints for resource access.
  107. 107. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Multi-Tier Security Groups www server www server www server app server app server app server Database Tier security group Application Tier security group Web Tier security group db server db server db server Internet Corporate Admin Network ssh/rdp api api (all other ports are blocked)
  108. 108. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Virtual Private Cloud (VPC) VPCSSL Endpoints Security Groups Network Control Use public and private subnets, NAT, and VPN support in your virtual private cloud to create low-level networking constraints for resource access. Instance Firewalls Use security groups to configure firewall rules for instances. Secure Transmission Use secure endpoints to establish secure communication sessions (HTTPS).
  109. 109. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Identity and Access Management (IAM) AWS IAM 3 Manage federated users and their permissions 2 Manage AWS IAM roles and their permissions 1 Manage AWS IAM users and their access
  110. 110. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS IAM Authentication AWS Management Console: User Name and Password IAM User
  111. 111. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS IAM Authentication AWS CLI or SDK API: Access Key and Secret Key Access Key ID: AKIAIOSFODNN7EXAMPLE Secret Access Key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY Java Python .NET AWS SDK & APIAWS CLI IAM User
  112. 112. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS IAM User Management - Groups User D DevOps Group User C AWS Account TestDev Group User BUser A
  113. 113. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS IAM Authorization Authorization Policies: Are JSON documents to describe permissions. Are assigned to users, groups or roles. IAM User IAM Group IAM Roles
  114. 114. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS IAM Policy Elements { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1453690971587", "Action": [ "ec2:Describe*", "ec2:StartInstances", "ec2:StopInstances” ], "Effect": "Allow", "Resource": "*", "Condition": { "IpAddress": { "aws:SourceIp": "54.64.34.65/32” } } }, { "Sid": "Stmt1453690998327", "Action": [ "s3:GetObject*” ], "Effect": "Allow", "Resource": "arn:aws:s3:::example_bucket/*” } ] } IAM Policy
  115. 115. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS IAM Policy Assignment IAM User IAM Group Assigned Assigned IAM Policy
  116. 116. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS IAM Policy Assignment IAM User IAM Group IAM Roles Assigned Assigned Assigned IAM Policy
  117. 117. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS IAM Roles An IAM role uses a policy. An IAM role has no associated credentials. IAM users, applications, and services may assume IAM roles. IAM Roles
  118. 118. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS IAM Policy Assignment IAM User IAM Group IAM Roles Assigned Assigned Assigned IAM Policy IAM User Assumed Assumed AWS Resources
  119. 119. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Example: Application Access to AWS Resources Python application hosted on an Amazon EC2 Instance needs to interact with Amazon S3. AWS credentials are required: Option 1: Store AWS Credentials on the Amazon EC2 instance. Option 2: Securely distribute AWS credentials to AWS Services and Applications. IAM Roles
  120. 120. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS IAM Roles - Instance Profiles Amazon EC2 App & EC2 MetaData Service http://169.254.169.254/latest/meta-data/iam/security-credentials/rolename Amazon S3 1 2 3 4 Create Instance SelectIAMRole ApplicationinteractswithS3
  121. 121. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS IAM Roles – Assume Role IAM Restricted Policy IAM User A-1 AWS Account A IAM Admin RoleIAM Admin Policy Assigned Assume Assigned 1 2 IAM User B-1 AWS Account B Amazon S3 Assume 4 Access 53 Access 1
  122. 122. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Session Access Key ID Secret Access Key Session Token Expiration Temporary Security Credentials (AWS STS) Use Cases: Cross account access Federation Mobile Users Key rotation for Amazon EC2-based apps Temporary Security Credentials 15 minutes to 36 hours
  123. 123. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Application Authentication AWS IAM Application No Support No Support OS
  124. 124. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS IAM Authentication and Authorization Authentication AWS Management Console User Name and Password AWS CLI or SDK API Access Key and Secret Key Authorization Policies IAM User IAM Group IAM Roles
  125. 125. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS IAM Best Practices Delete AWS account (root) access keys. Create individual IAM users. Use groups to assign permissions to IAM users. Grant least privilege. Configure a strong password policy. Enable MFA for privileged users.
  126. 126. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS IAM Best Practices (cont.) Use roles for applications that run on Amazon EC2 instances. Delegate by using roles instead of by sharing credentials. Rotate credentials regularly. Remove unnecessary users and credentials. Use policy conditions for extra security. Monitor activity in your AWS account.
  127. 127. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS CloudTrail Records AWS API calls for accounts. Delivers log files with information to an Amazon S3 bucket. Logs calls made using the AWS Management Console, AWS SDKs, AWS CLI and higher-level AWS services. AWS CloudTrail Amazon S3 Bucket Logs
  128. 128. Instructor Demo IAM
  129. 129. Module 4 Databases
  130. 130. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. SQL and NoSQL Databases SQL NoSQL Data Storage Rows and Columns Key-Value, documents, graphs Schemas Fixed Dynamic Querying Using SQL Focused on collection of documents Scalability Vertical Horizontal ISBN Title Author Format 9182932465265 Cloud Computing Concepts Wilson, Joe Paperback 3142536475869 The Database Gomez, Maria eBook SQL NoSQL { ISBN: 9182932465265, Title: “Cloud Computing Concepts”, Author: “Wilson, Joe”, Format: “Paperback” }
  131. 131. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Data Storage Considerations No one size fits all. Analyze your data requirements by considering: Data formats Data size Query frequency Data access speed Data retention period
  132. 132. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Managed Database Services Compute Storage AWS Global Infrastructure Database App Services Deployment and Administration Networking Amazon DynamoDB Amazon ElastiCache Amazon RDS Amazon Redshift AWS Database Migration Service
  133. 133. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Relational Database Service (RDS) Cost-efficient and resizable capacity Manages time-consuming database administration tasks Access to the full capabilities of Amazon Aurora, MySQL, MariaDB, Microsoft SQL Server, Oracle, and PostgreSQL databases Amazon RDS
  134. 134. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon RDS Simple and fast to deploy Manages common database administrative tasks Compatible with your applications Fast, predictable performance Simple and fast to scale Secure Cost-effective
  135. 135. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. DB Instances DB Instances are the basic building blocks of Amazon RDS. They are an isolated database environment in the cloud. They can contain multiple user-created databases.
  136. 136. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. How Amazon RDS Backups Work Automatic Backups: Restore your database to a point in time. Are enabled by default. Let you choose a retention period up to 35 days. Manual Snapshots: Let you build a new database instance from a snapshot. Are initiated by the user. Persist until the user deletes them. Are stored in Amazon S3.
  137. 137. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Cross-Region Snapshots Are a copy of a database snapshot stored in a different AWS Region. Provide a backup for disaster recovery. Can be used as a base for migration to a different region.
  138. 138. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon RDS Security Use IAM policies to grant access to RDS resources. Use Security Groups. Use Secure Socket Layer (SSL) connections with DB instances (Amazon Aurora, Oracle, MySQL, MariaDB, PostgreSQL, Microsoft SQL Server). Use RDS encryption to secure instances and snapshots at rest. Use network encryption and transparent data encryption (TDE) with Oracle DB and Microsoft SQL Server instances. Use security features of your DB engine to control access to DB instance.
  139. 139. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. A Simple Application Architecture Amazon RDS database instance Amazon EC2 Application Servers DB snapshots in Amazon S3
  140. 140. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Multi-AZ RDS Deployment With Multi-AZ operation, your database is synchronously replicated to another Availability Zone in the same AWS Region. Failover to the standby automatically occurs in case of master database failure. Planned maintenance is applied first to standby databases.
  141. 141. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. A Resilient, Durable Application Architecture Amazon RDS database instances: Master and Multi-AZ standby Application, in Amazon EC2 instances DB snapshots in Amazon S3
  142. 142. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon RDS Best Practices Monitor your memory, CPU, and storage usage. Use Multi-AZ deployments. Enable automatic backups. Set the backup window to occur during the daily low in WriteIOPS. To increase the I/O capacity of a DB instance: Migrate to a DB instance class with high I/O capacity. Convert from standard storage to provisioned IOPS storage and use a DB instance class optimized for provisioned IOPS. Provision additional throughput capacity (if using provisioned IOPS storage). Test failover for your DB instance.
  143. 143. Instructor Demo (Part 1) Build a database cluster
  144. 144. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. What We’re Starting With Region Availability Zone A Web Server 1 Public Subnet 2 (10.0.2.0/24) 10.0.0.0/16 security group Availability Zone B Private Subnet 2 (10.0.4.0/24) Public Subnet 1 (10.0.1.0/24) Private Subnet 1 (10.0.3.0/24) Internet Gateway
  145. 145. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Build a Database Cluster Availability Zone A Public Subnet 2 (10.0.2.0/24) 10.0.0.0/16 security group Availability Zone B Private Subnet 2 (10.0.4.0/24) Public Subnet 1 (10.0.1.0/24) Private Subnet 1 (10.0.3.0/24) Internet Gateway RDS DB SecondaryRDS DB Master Web Server 1 Create a security group for the RDS instances security group security group
  146. 146. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. security group security group Build a Database Cluster Availability Zone A Public Subnet 2 (10.0.2.0/24) 10.0.0.0/16 security group Availability Zone B Private Subnet 2 (10.0.4.0/24) Public Subnet 1 (10.0.1.0/24) Private Subnet 1 (10.0.3.0/24) Internet Gateway Web Server 1 RDS DB SecondaryRDS DB Master Deploy Amazon RDS in a multi-AZ configuration
  147. 147. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon DynamoDB Allows you to store any amount of data with no limits. Provides fast, predictable performance using SSDs. Allows you to easily provision and change the request capacity needed for each table. Is a fully managed, NoSQL database service.Amazon DynamoDB
  148. 148. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. DynamoDB Data Model Table: Music Items Attributes (name-value pairs) Artist Song Title Album Title Year Genre
  149. 149. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Primary Keys Partition Key Sort Key Table: Music Partition Key: Artist Sort Key: Song Title (DynamoDB maintains a sorted index for both keys) Table: Music Artist Song Title Album Title Year Genre
  150. 150. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Provisioned Throughput You specify how much provisioned throughput capacity you need for reads and writes. Read Capacity Unit: One strongly consistent read per second for items as large as 4 KB. Two eventually consistent reads per second for items as large as 4 KB. Write Capacity Unit: One write per second for items as large as 1 KB. Amazon DynamoDB allocates the necessary machine resources to meet your needs.
  151. 151. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Supported Operations Query: Query a table using the partition key and an optional sort key filter. If the table has a secondary index, query using its key. It is the most efficient way to retrieve items from a table or secondary index. Scan: You can scan a table or secondary index. Scan reads every item – slower than querying. You can use conditional expressions in both Query and Scan operations.
  152. 152. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Simple Application Architecture Amazon EC2 app instances Amazon DynamoDB Business logic
  153. 153. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon RDS and Amazon DynamoDB Factors Relational (Amazon RDS) NoSQL (Amazon DynamoDB) Application Existing database apps Business process–centric New web-scale applications Large number of small writes and Application Characteristics Relational data models, transactions Complex queries, joins, and updates Simple data models, transactions Range queries, simple updates Scaling Application or DBA–architected (clustering, partitions, sharding) Seamless, on-demand scaling based on application requirements QoS Performance–depends on data model, indexing, query, and storage optimization Reliability and availability Durability Performance–Automatically by the system Reliability and availability Durability
  154. 154. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Database Considerations If You Need Consider Using A relational database service with minimal administration Amazon RDS Choice of Amazon Aurora, MySQL, MariaDB, Microsoft Server, Oracle, or PostgreSQL database engines Scale compute and storage Multi-AZ availability A fast, highly scalable NoSQL database service Amazon DynamoDB Extremely fast performance Seamless scalability and reliability Low cost A database you can manage on your own Your choice of AMIs on Amazon EC2 and EBS that provide scaling for compute and storage, complete control over instances, and more.
  155. 155. Instructor Demo (Part 2) Interact with the database using an application
  156. 156. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. security group security group Build a Database Cluster and Connect to It Availability Zone A Public Subnet 2 (10.0.2.0/24) NAT Server security group 10.0.0.0/16 security group Availability Zone B Private Subnet 2 (10.0.4.0/24) Public Subnet 1 (10.0.1.0/24) Private Subnet 1 (10.0.3.0/24) Internet Gateway Web Server 1 RDS DB SecondaryRDS DB Master Navigate to the Web Server and configure the ODBC connection
  157. 157. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Build a Database Cluster and Connect to It Availability Zone A Public Subnet 2 (10.0.2.0/24) 10.0.0.0/16 security group Availability Zone B Private Subnet 2 (10.0.4.0/24) Public Subnet 1 (10.0.1.0/24) Private Subnet 1 (10.0.3.0/24) Internet Gateway RDS DB Secondary security group RDS DB Master security group Web Server 1
  158. 158. Break & Ask an AWS Expert until 3:15PM
  159. 159. Module 5 AWS Elasticity and Management Tools
  160. 160. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Latency Utilization CloudWatch Elastic Load Balancing Auto Scaling group Execute AS Policy Trio of Services EC2 Auto Scaling
  161. 161. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Elastic Load Balancing Distributes traffic across multiple EC2 instances, in multiple Availability Zones Supports health checks to detect unhealthy Amazon EC2 instances Supports the routing and load balancing of HTTP, HTTPS, SSL, and TCP traffic to Amazon EC2 instances Elastic Load Balancing
  162. 162. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Classic Load Balancer - How It Works Register instances with your load balancer. Availability Zone A Availability Zone B load balancer X
  163. 163. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Application Load Balancer – How It Works Register instances as targets in a target group, and route traffic to a target group. Target Group /mobile load balancer Listener ListenerRule Rule Rule Target Group Target Group /api Target Target Target Target Target Target Target Health Check Health Check Health Check
  164. 164. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Network Load Balancer – How It Works Register instances as targets in a target group, and route traffic to a target group based on port. load balancer Listener :80 Target Group Target Target Health Check Listener :443 Target Group Target Target Health Check
  165. 165. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Elastic Load Balancing types Application Load Balancer (ALB) • Flexible application management • Advanced load balancing of HTTP and HTTPS traffic • Operates at the request level (layer 7) Network Load Balancer (NLB) • Extreme performance and static IP for your application • Load balancing ofTCP traffic • Operates at the connection level (Layer 4) Classic Load Balancer (CLB) PREVIOUS GENERATION for HTTP, HTTPS, and TCP • Existing application that was built within the EC2-Classic network • Operates at both the request level and connection level HTTP HTTPS TCP
  166. 166. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon CloudWatch A monitoring service for AWS cloud resources and the applications you run on AWS Visibility into resource utilization, operational performance, and overall demand patterns Custom application-specific metrics of your own Accessible via AWS Management Console, APIs, SDK, or CLI Amazon CloudWatch
  167. 167. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon CloudWatch Facts Collects metrics from other AWS resources View graphics and statistics Set and Trigger Alarms Collect Logs
  168. 168. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon CloudWatch Architecture AWS resources that support CloudWatch Amazon CloudWatch Amazon CloudWatch Alarm SNS Email Notification Auto Scaling Available Statistics Statistics Consumer AWS Management Console CloudWatch Metrics CPUUtilization StatusCheckFailed Custom Application- Specific Metrics PageViewCount
  169. 169. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. CloudWatch Metrics Examples
  170. 170. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. EC2 Auto Scaling Scale your Amazon EC2 capacity automatically Well-suited for applications that experience variability in usage Available at no additional charge Auto Scaling
  171. 171. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. EC2 Auto Scaling Benefits Better Cost Management Better Availability Better Fault Tolerance
  172. 172. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. EC2 Auto Scaling Components Auto Scaling GroupLaunch Configuration Scaling Plan
  173. 173. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. EC2 Auto Scaling Launch Configurations A launch configuration is a template that an Auto Scaling group uses to launch EC2 instances. When you create a launch configuration, you can specify: AMI ID Instance type User data Block device mapping Security groups Key pair
  174. 174. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. EC2 Auto Scaling Groups Contain a collection of EC2 instances that share similar characteristics. Instances in an Auto Scaling group are treated as a logical grouping for the purpose of instance scaling and management. Auto Scaling group Minimum size Desired capacity Maximum size Scale out as needed
  175. 175. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. EC2 Auto Scaling Plans Auto Scaling Minimum Health Check monitors running instances within an Auto Scaling group. If an unhealthy instance is found, it can be replaced. Manual Scaling Specify a new minimum for your Auto Scaling group. Manually invoke Auto Scaling policies. Scheduled Scaling Scaling functions are performed as a function of time and date. On Demand Scaling Create a policy to scale your resources. Define when to scale using CloudWatch Alarms.
  176. 176. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. EC2 Auto Scaling Basic Lifecycle instances Auto Scaling group Scale Out Amazon CloudWatch Scheduled Event Scale In Amazon CloudWatch Scheduled Event Launch Instance Attach to Group Detach from Group Terminate Instance X
  177. 177. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Auto Scaling Monitors your applications and adjusts capacity Build scaling plans for resources including: Amazon EC2 instances and Spot Fleets Amazon ECS tasks Amazon DynamoDB tables and indexes Amazon Aurora Replicas Amazon EC2 Auto Scaling is part of AWS Auto Scaling
  178. 178. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Latency Utilization CloudWatch Elastic Load Balancing Auto Scaling group Execute AS Policy Trio of Services EC2 Auto Scaling
  179. 179. Instructor Demo Scale and Load Balance the Architecture
  180. 180. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. What We’re Starting With Availability Zone A Public Subnet 2 (10.0.2.0/24) 10.0.0.0/16 security group Availability Zone B Private Subnet 2 (10.0.4.0/24) Public Subnet 1 (10.0.1.0/24) Private Subnet 1 (10.0.3.0/24) Internet Gateway RDS DB Secondary security group RDS DB Master security group Web Server 1
  181. 181. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Scale and Load Balance the Architecture Availability Zone A Public Subnet 2 (10.0.2.0/24) 10.0.0.0/16 security group Availability Zone B Private Subnet 2 (10.0.4.0/24) Public Subnet 1 (10.0.1.0/24) Private Subnet 1 (10.0.3.0/24) Internet Gateway RDS DB Secondary security group RDS DB Master security group Application Load Balancer Web Instance Web Instance security group Web Server 1 Create an AMI image from an existing instance
  182. 182. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Scale and Load Balance the Architecture Availability Zone A Public Subnet 2 (10.0.2.0/24) 10.0.0.0/16 security group Availability Zone B Private Subnet 2 (10.0.4.0/24) Public Subnet 1 (10.0.1.0/24) Private Subnet 1 (10.0.3.0/24) Internet Gateway RDS DB Secondary security group RDS DB Master security group Application Load Balancer Web Instance Web Instance security group Web Server 1 Deploy an Application Load Balancer
  183. 183. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Scale and Load Balance the Architecture Availability Zone A Public Subnet 2 (10.0.2.0/24) 10.0.0.0/16 security group Availability Zone B Private Subnet 2 (10.0.4.0/24) Public Subnet 1 (10.0.1.0/24) Private Subnet 1 (10.0.3.0/24) Internet Gateway RDS DB Secondary security group RDS DB Master security group Application Load Balancer Web Instance Web Instance security group Web Server 1Application Load Balancer Configure a Launch Configuration and Auto Scaling Group
  184. 184. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Scale and Load Balance the Architecture Availability Zone A Public Subnet 2 (10.0.2.0/24) 10.0.0.0/16 security group Availability Zone B Private Subnet 2 (10.0.4.0/24) Public Subnet 1 (10.0.1.0/24) Private Subnet 1 (10.0.3.0/24) Internet Gateway RDS DB Secondary security group RDS DB Master security group Application Load Balancer Web Instance Web Instance security group Web Server 1 Test and monitor your Auto Scaling Group Application Load Balancer
  185. 185. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Scale and Load Balance the Architecture Availability Zone A Public Subnet 2 (10.0.2.0/24) 10.0.0.0/16 security group Availability Zone B Private Subnet 2 (10.0.4.0/24) Public Subnet 1 (10.0.1.0/24) Private Subnet 1 (10.0.3.0/24) Internet Gateway RDS DB Secondary security group RDS DB Master security group Application Load Balancer Web Instance Web Instance security group Web Server 1
  186. 186. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Best practice and recommendation engine. Provides AWS customers with performance and security recommendations in four categories: Cost optimization Security Fault tolerance Performance improvement. AWS Trusted Advisor AWS Trusted Advisor
  187. 187. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Cost Optimization Amazon EC2 Reserved Instance Optimization Low-utilization Amazon EC2 Instances Idle load balancers Underutilized Amazon EBS volumes Amazon RDS idle DB instances Amazon EC2 Reserved Instance Lease Expiration
  188. 188. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Security Security groups – Unrestricted Access AWS IAM use Amazon S3 bucket permissions MFA on Root Account AWS IAM password policy Amazon RDS security group access risk
  189. 189. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Fault Tolerance Amazon EBS Snapshots Load balancer optimization Auto Scaling Group Resources Amazon RDS Multi-AZ Amazon RDS Backups ELB connection draining
  190. 190. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Performance Improvement High-utilization Amazon EC2 instances Service limits Large number of rules in EC2 security group Overutilized Amazon EBS Magnetic volumes Amazon EC2 to EBS throughput optimization
  191. 191. AWS Support
  192. 192. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Enterprise Business Developer Basic Customer Service 24x7x365 Support Forums Documentation, White Papers, Best Practice Guides AWS Trusted Advisor Full Checks Full Checks Basic Checks Basic Checks Access to Technical Support Phone, chat, email, live screen sharing, TAM (24/7) Phone, chat, email, live screen sharing Email (local business hours) Support for Health Checks Primary Case Handling Sr. Cloud Support Engineer Cloud Support Engineer Cloud Support Associate Technical Customer Service Associate Users who can create Technical Support cases Unlimited (IAM supported) Unlimited (IAM supported) 1 (account credentials only) Case Severity/Response Times Critical: < 15 minutes Urgent: < 1 hour High: < 4 hours Normal: < 12 hours Low: < 24 hours Urgent: < 1 hour High: < 4 hours Normal: < 12 hours Low: < 24 hours Normal: < 12 hours Low: < 24 hours Architecture Support Application Architecture Use case guidance Building blocks Best Practice Guidance Client-Side Diagnostic Tools AWS Support API Third-Party Software Support Infrastructure Event Management Available at additional cost AWS Concierge Direct access to Technical Account Manager (TAM) Prioritized Case Routing Management Business Reviews Support Comparison
  193. 193. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Support Options The Technical Account Manager provides... A dedicated voice within AWS to serve as your advocate. Proactive guidance and insight into ways to optimize AWS through business and performance reviews. Orchestration and access to the full breadth and depth of technical expertise across the full range of AWS. Access to resources and best practice recommendations. Infrastructure Event Management provides... A common understanding of event objectives and use cases through pre-event planning and preparation. Resource recommendations and deployment guidance based on anticipated capacity needs. Dedicated attention of your AWS Support team during your event. The ability to immediately scale down resources to normal operating levels post- event.
  194. 194. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Support Options AWS Trusted Advisor provides... Insight into how and where you can get the most impact for your AWS spend. Opportunities to reduce your monthly spend and retain or increase productivity. Guidance on getting the optimal performance and availability based on your requirements. Confidence that your environment is secure. The Concierge Service provides... A primary contact to help manage AWS resources. Personalized handling of billing inquiries, tax questions, service limits, and bulk reserve instance purchases. Direct access to an agent to help optimize costs, and identify underutilized resources.
  195. 195. Module 6 Course Wrap-Up
  196. 196. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Expand Your Cloud Skills with AWS aws.amazon.com/certificationaws.training aws.amazon.com/training Digital Training Free, self-paced online courses built by AWS experts Classroom Training Classes taught by accredited AWS instructors AWS Certification Exams to validate expertise with an industry-recognized credential
  197. 197. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Self-Paced Labs Learn an individual AWS Service topic Follow a Learning Quest by AWS Service Area or Use Case Practice working with AWS as you prepare for an exam For more information, see aws.amazon.com/training/self-paced-labs/.
  198. 198. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Training Courses For more information about course description, see aws.amazon.com/training. AWS Technical Essentials Instructor-Led | 1 day Architecting on AWS Instructor-led | 3 days Developing on AWS Instructor-led | 3 days Systems Operations on AWS Instructor-led | 3 days Big Data Fundamentals Online | 3 hours Big Data on AWS Instructor-led | 3 days Advanced Architecting on AWS Instructor-led | 3 days DevOps Engineering on AWS Instructor-led | 3 days Security Operations on AWS Instructor-led | 3 days Migrating to AWS Instructor-led | 2 days
  199. 199. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Certifications For more information, see aws.amazon.com/certification.
  200. 200. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Connect to the Architecture Availability Zone A Public Subnet 2 (10.0.2.0/24) 10.0.0.0/16 Availability Zone B Private Subnet 2 (10.0.4.0/24) Public Subnet 1 (10.0.1.0/24) Private Subnet 1 (10.0.3.0/24) Internet Gateway RDS DB Secondary security group RDS DB Master security group Application Load Balancer Web Instance Web Instance security group
  201. 201. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Ask an AWS Expert until 4:30PM
  202. 202. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Keep Learning Get 10% off your next AWS training class. Register using code: MK10USAWSDAY18-1-7QBV0PSRN0SL http://aws.amazon.com/training/ Code Expires Dec 31, 2018. This discount code is good for 10% off Technical Essential classes offered by AWS.
  203. 203. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Complete the post-event Survey for a $50 AWS Credit Code! Surveys will go out early next week
  204. 204. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. THANKYOU you to our sponsor!

×