AWS

Beanstalk

• Elastic Beanstalk consists of a single ZIP file or WAR file (you can include multiple WAR files inside your ZIP file).

• It must not exceed 512 MB and must not include a parent folder or top-level directory (subdirectories are fine).

ECS

• One of its features is a setting that allows Auto Scaling to automatically replace an instance if it becomes unhealthy.

• If you are already using a load balancer, you can use the same health checks for both the load balancer and Auto Scaling.

• You can also send health check signals using the Auto Scaling API, either directly from your instances or from an external monitoring service.

• Auto Scaling can be used as a launch template for your EC2 instances, allowing you to adjust the number of running instances according to your needs.

Serverless Application Model (SAM)

Deploy

AWS X-Ray

API gateWay

Lambda

Lambda as a plugin system for other AWS services

S3

• S3 does not provide an API to resize an image after it is uploaded to a bucket, but Lambda can be used to add this capability.

Application Load Balancer (ALB)

• ALB's API allows for a fixed response for a given route, but it cannot respond with an image. Lambda can be used to enable this.

CloudFront

• CloudFront cannot rewrite a request URL based on request cookies (which is useful for A/B testing), but Lambda can be used to make CloudFront do this with a few lines of code.

CloudWatch

• CloudWatch does not support regex-based alerting on application logs, but this feature can be added with a few lines of Lambda code.

Kinesis

• Kinesis does not provide an API to filter records and write them to DynamoDB, but this can be easily accomplished with Lambda.

CloudFormation

• CloudFormation's native modeling language has many limitations and, for example, it cannot create and validate a new TLS certificate from the AWS Certificate Manager. Lambda can be used to extend the CloudFormation language to add almost any capability.

Limitations

• Cold start

• Limit on code bundle

• Stateless ( Cloud use other services such as DynamoDB and ElasticCache to preserve the states)

Serverless functions or Lambda functions

IAM

Principal

• IAM users (long lived)
• password-based Console access
• access-key-based (Access Key ID - Secret Access Key pairs)

• IAM roles
• process-based
• configure S3 to replicate a bucket’s contents into another bucket
• a Lambda function needs to access other resources

How to get the temporary rule?

aws sts assume-role \
    --role-arn <role arn> \
    --role-session-name test_session

{
    "Credentials": {
        "AccessKeyId": "ASMH...", // AccessKeyId
        "SecretAccessKey": "8dj...", // SecretAccessKey
        "SessionToken": "JioIjsn7Sidj...", // SessionToken
        "Expiration": "2021-01-01T08:00:00+00:00" // 
    },
    "AssumedRoleUser": {
        "AssumedRoleId": "AROA...:test_session",
        "Arn": "<arn>:assumed-role/test_role/test_session"
    }
}

Resource

arn:partition:service:region:account-id:resource-id

• The partition is usually aws, the exceptions are regions in China and the US GovCloud.

• The service is the AWS product, such as s3 or iam.

• The region specifies which region the resource is located if any. There are global resources, such as IAM users, that do not have a region.

• The account-id is the 12-digits account number.

• And finally, the resource-id is the local identifier of the resource. It can specify sub-resources too, such as the name of objects inside an S3 bucket.

Actions, resources, and condition keys for Amazon S3

Lists all of the available service-specific resources, actions, and condition keys that can be used in IAM policies to control access to Amazon S3.

https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html#amazons3-resources-for-iam-policies

Service control policies (SCPs)

Best practices

Best practices

• Use groups to assign permissions to users

• Create standalone policies instead of using inline policies

CloudTrail logging

• CloudTrail stores logs for 90 days, but it’s a best practice to configure it to send them to an S3 bucket for permanent storage. We can configure a trail to do that.

• It can take up to 15 minutes for an event to appear in CloudTrail.

• event name

• event source

• etc

aws cloudtrail lookup-events

IAM Policies

• Identity-based policies: Attached to an IAM user, group, or role

• Resource-based policies: Attached to AWS resources

• Service-control policies: Attached to accounts

• Session policy: Attached to assume role sessions

• Permissions boundary: Attached to identities as a boundary

Identity-based policies

• Customer managed policy

• AWS managed policies
• AdministratorAccess - gives all permissions an identity can have
• PowerUserAccess - except for permissions and account management
• service-based policies - allow access to a single service inside an account
• AmazonS3FullAccess
• AmazonS3ReadOnlyAccess

Resource-based policies

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<id>:user/user1"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::<bucket>/text.txt"
        }
    ]
}

Service control policy (SCP)

• restrict which regions an account can use

• a development account does not need to buy reserved EC2 instances

• restrict access, meaning an operation is denied if it does not explicitly allow it.

Session policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": "<bucket>/text.txt"
        }
    ]
}

• an Effect (Allow or Deny)

• an Action
• s3:PutObject

• a Principal ("NotPrincipal" or "Principal")
• "AWS": "<iam>:user/user2" specific an IAM user
• "AWS": "<iam>:role/role2" specific roles
• "AWS": "*" anonymous user, which is used to give public access
• "Service": "lambda.amazonaws.com" give access to an AWS service

• a Resource ("NotResource" or "Resource")
• "arn:aws:s3:::<bucket>"
• "arn:aws:s3:::<bucket>/*"
• "arn:aws:iam::<accountId>:user/admin/*"

• a Condition
• StringLike
• StringEquals

        "StringLike": {
            "s3:ExistingObjectTag/access": "project*"
        }

{
    "Condition": {
        "StringEquals": {
            "s3:ExistingObjectTag/access": "projectA"
        }
    },
    // ...
}

• If the access tag is projectA, then the policy matches.

• If the access tag is something else, such as projectB, *thenthe policy does not match.

• If there is no access tag, then the policy does not match.

{
    "Condition": {
        "StringEqualsIfExists": {
            "s3:ExistingObjectTag/access": "projectA"
        }
    },
    // ...
}

• If the access tag is projectA, then the policy matches.

• If the access tag is something else, such as projectB, then the policy does not match.

• If there is no access tag, then the policy matches.

Example:

1. Create the S3RestrictedPolicy IAM policy. Ensure only the appconfig buckets are accessible.
• Select the S3 service and all S3 actions
• Select all resources except bucket
• Add the appconfig bucket names to the policy

2. Create the S3RestrictedRole IAM role.
• Set the trusted entity to another AWS account
• Add your account ID
• For permissions, select the S3RestrictedPolicy

3. Attach the S3RestrictedPolicy to the dev1 user.

1. Create the AssumeS3Policy IAM policy.
• Select the STS service
• Select AssumeRole under the write options
• Add the S3RestrictedRole

2. Attach the AssumeS3Policy to the dev3 user.

3. Assume the S3RestrictedRole as the dev3 user.
• Log in as the dev3 user
• Switch roles to the S3RestrictedRole
• Verify access in S3

Evaluation flow

Policy evaluation logic

When a principal tries to use the AWS Management Console, the AWS API, or the AWS CLI, that principal sends a request to AWS. When an AWS service receives the request, AWS completes several steps to determine whether to allow or deny the request.

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html

VPC (virtual private cloud)

Public service endpoints

protocol://service_code.region_code.amazonaws.com

AWS PrivateLink

Regional DNS

ndpoint_id.service_id.region.vpce.amazonaws.com

zonal DNS

endpoint_id-az_name.service_id.region.vpce.amazonaws.com

#AWS CLI Pagination commands
#Remember to replace <YOUR_BUCKET_NAME> with the name of your S3 bucket

aws s3api list-objects --bucket <YOUR_BUCKET_NAME>
aws s3api list-objects --bucket <YOUR_BUCKET_NAME> --page-size 5
# default get 1000 objects per call and show all results by merging all objects 
# will retire all objects but each api call will only fetch 5 objects

aws s3api list-objects --bucket <YOUR_BUCKET_NAME> --max-items 1

Redis

sophisticated solution

Persistence, Multi-AZ or failover

Support sorting and ranking data

complex data types like lists and hashes

 

Compare

CloudWatch

• Standard resolution, with data having a one-minute granularity

• High resolution, with data at a granularity of one second

• CloudWatch agent - define your own metrics.

• CloudWatch Logs - monitor operating system and application logs

DynamoDB

On-demand:

Provisioned capacity:

• Requests are evenly distributed throughout the day.

• There is no capacity headroom, meaning that if there were more than one million requests in a day, you would be throttled. Therefore, you must monitor your utilization and proactively provision the necessary capacity.

Primary key

Indexes

• They’re immediately consistent

• Don’t allows a table to keep growing indefinitely goes away.

• All the records that share the same partition key need to fit in 10 GB

• Don’t constrain your table size

• Eventually consistent

• Much less worrisome than that of local indexes

• The provisioned throughput of a global index happens to be insufficient to keep up with updates on the main table, then that queue can get full. When that happens, disaster strikes: All write operations on the main table start failing.

RCUs/WCUs

S3

Benefit

• Highly durable

• Very easy to use

• Infinite bandwidth

• Infinite storage space

• Zero capacity management

• Set replication for a S3 bucket

Limitations of S3

• You cannot append to objects.

• If you have rapidly changing data (e.g. log files), you must buffer updates and periodically flush them to S3 as new objects. This reduces data durability, as the buffered data is typically stored in a single place without replication.

• A solution to this issue is to buffer data in a durable queue, such as SQS or Kinesis Streams.

ELB

• Application Load Balancer
• HTTP and HTTPS
• at Layer 7
• handle multiple domains (via host-based routing)
• proper reverse proxies that sit between the internet and your application

• Network Load Balancer
• TCP and high performance
• at layer 4
• most expensive option
• TCP passthrough (Only support in the NLB rather than ALB)
• load balancers

• Classic Load Balancer (Legacy)
• HTTP/HTTPS and TCP

• Gateway Load Balancer
• Third party virtual appliance (AWS marketplace, virtual firewalls)

• X-Forwarded-For

• couldn’t build connection to server

• application has issues

Support for TLS/HTTPS

CloudFormation

• Zip the function codes and upload them to S3, then add a reference to it in an AWS:Lambda:Function resource in the template.

• Create an AWS:Lambda:Function resource and write the Lambda function codes inline.

Kinesis

Kinesis vs SQS

• SQS can only have one consumer, while Kinesis can have many.

• Once an SQS message gets consumed, it gets deleted from the queue. But Kinesis records get added to a list in a stable order, and any number of consumers can read a copy of the stream by keeping a cursor over this never-ending list.

• Multiple consumers don’t affect each other, and if one falls behind, it doesn’t slow down the other consumers.

• Whenever consumers read data out of Kinesis, they will always get their records in the same order.

KMS

STS

Cognito

CloudFront/Global Accelerator

Origin Protocol Policy

Viewer Protocol Policy

• HTTP and HTTPS

• Redirect HTTP to HTTPS

• HTTPS Only

Appsync

• Use graphQL backed by kinds of data sources like DynamoDB and Lambda.

• Use with Cognito to do user authorization