Welcome back to Backspace Academy. If you have done all the lectures and 2
you've done all the labs and you've made it this far give yourself a big pat on 3
the back. Now AWS, they produce an exam guide which used to be called an exam 4
blueprint and what it does, it talks about four main domains upon which you 5
will be assessed in the exam, and those are cloud concepts, security and 6
compliance, technology, and billing and pricing, and then finally we'll look at 7
the resources that are available for you. Where you can actually download 8
this exam guide. Where you can download some sample questions from AWS and other 9
resources that are going to help you to prepare for the exam. 10
AWS defines a number of goals which the exam will seek to assess you on. The 11
first one there is to explain the value of the AWS cloud. Ok what's the advantage 12
of using the AWS cloud over using your own resources? Understand the shared 13
responsibility model. We've talked quite a bit about. Then security best practices. 14
We also need to know about costs. How can we reduce costs? How can we monitor costs? 15
The economics. Talk about total cost of ownership and that sort of thing. Billing 16
practices. Where can we get information and support for billing? How can we alert 17
ourselves to issues with billing? We also need to describe and position the core 18
AWS services including compute, for example ec2, if its serverless lambda. 19
Network, understand VPC quite well. CloudFront, databases need to know RDS, 20
need to know DynamoDB for noSQL and also storage, we've got EBS, EFS and of 21
course we've got Amazon S3 and Glacier. Understand those as well and also 22
identify the AWS services that you would use in common use cases, and this is 23
where you're going to leverage off those Backspace Academy labs. 24
Again the knowledge required for the exam is broken up into four domains. 25
Now don't get too hung up on these domains because different services will go into 26
different domains and multiple domains and it is very vague but it does provide 27
a little bit of guidance around what areas you need to concentrate on. 28
The first domain there is cloud concepts, security and compliance, technology and 29
finally billing and pricing. One thing that a cloud practitioner may need to do 30
is that they may need to sell the value of AWS to management or to customers and 31
so we need to understand what that AWS cloud value proposition actually is. 32
The first thing is that we need to understand those six advantages of cloud 33
computing and those are defined in the overview of Amazon Web Services white 34
paper. They're also defined in our business case lecture as well that we 35
did previously. So those are to trade capital expense for a variable expense. 36
We're not buying a physical server. We've got a variable expense that is going to 37
vary according to our needs. We're going to benefit from massive economies of 38
scale. All of those costs of this AWS cloud are shared amongst millions and 39
millions of users. We don't need to guess capacity anymore we can have elastic 40
infrastructures that can expand and contract according to our demand. We can 41
increase our speed and agility and get to market quickly. We can stop spending 42
money on running and maintaining data centers. Let's get AWS to do all of that 43
hard stuff for us, and we're going to go global in minutes. 44
Also understand that it also allows your business to focus on generating revenue 45
not on maintaining data centers and the like. It provides a pay-as-you-go pricing 46
and it does this as a variable cost. So you don't have a fixed costs that you 47
may be wasting a percentage of that. You're going to have a variable cost 48
that's going to vary according to your needs. 49
There is also the AWS marketplace which can provide high quality solutions for us 50
from a number of third-party vendors as well, and that can provide increased 51
value over just using the core AWS services. You will need to understand the 52
economics of using the AWS cloud. Now that not only includes saving the cost 53
of purchasing a server as opposed to using it on an on-demand basis on ec2, 54
you need to also take into consideration all of the other costs such as 55
electricity, such as licensing, such as labor, all of these other costs that go 56
into the lifecycle cost of owning your own on-premises server, as opposed to 57
using the AWS cloud. You also need to understand that there is a TCO tool that 58
is available as well. If you are going to use a number of AWS services and you 59
would like to get an estimate of that you can use the AWS pricing calculator 60
and that will allow you to select all of those AWS services that you are going to 61
be using and how much of those that you are going to be using and you can put 62
those inputs into the AWS pricing calculator and that will give you the 63
monthly or yearly cost of using those AWS services. 64
You will need to understand some design principles for a best practices cloud 65
architecture. The first one there is designed for failure and making sure 66
that our architecture is fault tolerant and it is not exposed to single points 67
of failure and we do that by using architecture that is spanning multiple 68
availability zones. So if that one availability zone goes down the other 69
availability zone will still continue to operate and the infrastructure inside 70
that will continue to operate. We can also have multi region architectures as 71
well in case a whole region goes down. The next concept there is elasticity and 72
making sure that our infrastructure can expand and contract depending on demand 73
and the best way to do that is by using an auto scaling resource. A good example 74
is the ec2 auto scaling which can add instances when demand is high and can 75
terminate those instances when demand is low and we can distribute those requests 76
for those instances through an elastic load balancer. The next concept there is 77
loose coupling as opposed to tight coupling where we would have multiple 78
processes that will be linked to each other like a chain and if one of those 79
processes becomes bogged under with demand then the whole chain will be 80
affected. Those chain of processes that are linked together will be affected, but 81
if we put a queue between each one of those processes in that chain of 82
processes, then we have loose coupling and the variation between the capacity 83
of those processes in that chain won't affect the entire system and 84
when that that process is caught up, the queue will go down there are also. Design 85
principles defined in the AWS well architected framework. First off stop 86
guessing your capacity needs. Test your systems at production scale. Make sure 87
that you have a developer or a test or a development environment that you can 88
test with very high demand, that you would 89
expect from a high demand production environment and then you can shut it 90
down after you've finished testing. Automate to make architectural 91
experimentation easier. So using Cloudformation and these sorts of tools that 92
can help you to automate things. Allow for evolutionary architectures. Don't 93
accept your architecture as set in stone. Always continuously improve it. 94
Drive architectures using data. Take advantage of Cloudwatch logs and this sort of 95
thing and analyze your data that's coming out of your infrastructure and 96
improve through game days. Conduct simulations on your environment and 97
try and forecast what is going to happen with your environment as well. A number 98
of specific points that you need to know in relation to cloud architecture. 99
Understand RDS, the different engines are available you've got mySQL, Oracle, 100
SQL Server, PostgreSQL and MariaDB. Understand that you can have 101
it as a multiple availability zone. Also understand that you can have cross 102
region read replicas but that's not available 103
in all regions and it's not available for Microsoft SQL Server but for the 104
other engines it is. Understand the difference between a relational and a 105
noSQL database and of course RDS is relational and DynamoDB is noSQL. 106
Also remember that ec2 is another option for hosting a database. 107
So you can actually download and install mySQL on an ec2 server and there you've 108
got a ec2 hosted database, and so that's another thing to take into consideration. 109
So if you have a question that may be asking about a relational database and 110
you can't see a relational database server and there's an option there for 111
ec2 then remember that you can always use ec2 to run a relational database by 112
doing it yourself. Also you'll need to be able to recall the AWS well architected 113
framework five pillars of operational excellence, security, 114
reliability, performance, efficiency and cost optimization. With 115
the AWS shared responsibility model you need to understand that AWS is 116
responsible for security of the cloud and their customers are responsible for 117
security in the cloud and you need to understand exactly what that means. 118
AWS they monitor their global infrastructure for different types of 119
attacks. They make sure that people who are employed by AWS are good people and 120
have been security checked and that sort of thing, but AWS cannot be held 121
responsible for any unsecure practices that you do inside of their cloud. 122
For example you might have a public web site that's hosted on Amazon s3 and that has 123
some very sensitive information and you accidentally release that to the public. 124
Now AWS, they're not responsible for that. That is your responsibility. You need to 125
make sure that you as a customer of AWS secure your use inside of that cloud and 126
you don't do anything that compromises your own security. Here we can see AWS 127
is responsible for security of the cloud and we can see there the compute, storage, 128
database and networking and their global infrastructure. They're responsible for 129
security of that, but what goes on top of that and, what is used within that cloud, 130
that is your responsibility. So customers are responsible for their security and 131
compliance in the cloud. Now one thing that you need to understand is that 132
this shared responsibility model varies depending on what service you're using. 133
If you're using ec2 then obviously all of this would be. Everything there in 134
green would relate to your responsibility if you're using Amazon s3. 135
Then you're not going to be responsible for the operating system and that sort 136
of thing. So AWS will take further responsibility over that themselves. 137
The key areas in relation to cloud security that you need to concentrate on, 138
obviously virtual private cloud or VPC that's going to be on the exam. 139
You'll need to understand what a subnet is. Understand the difference between a 140
private and a public subnet. You'll need to understand what a security group is 141
and a network access control list. You'll also need to understand the difference 142
between a security group and that a security group is associated to an ec2 143
instance and, a network access control list is associated to a VPC subnet. 144
You'll also need to understand that you can peer through VPC and you can 145
peer two VPCs together and, there are also flow logs that are available to 146
track traffic in and out of a subnet as well. You can create a virtual private 147
network or VPN for short and that will allow you to connect between your VPC 148
and a remote computer or a remote on-premises data center, and you can do 149
that over the Internet or you can do it over a Amazon Direct Connect connection, 150
and one thing that you need to understand is that you need to have a 151
virtual private gateway on the Amazon side of things, and you need to have a 152
customer gateway device on your side. So on your side you need the customer 153
gateway on the Amazon side you need a virtual private gateway. There are 154
services on AWS that can handle distributed denial of service or DDoS 155
attacks on your infrastructure. The main one there being AWS Shield and Cloudfront 156
and also there is the Web Application Firewall or WAF. In relation to 157
compliance you need to understand that we have an AWS compliance program which 158
covers all of the regulations and standards and whatever that AWS is 159
compliant with or can help you to become compliant with. As well we have the AWS 160
Artifact service which is a repository of all information concerning the AWS 161
compliance program. So if you're looking for a document related to a 162
certain compliance, then you can find that probably on the AWS Artifact 163
service. We also have AWS Config which is a configuration management service which 164
can alert us to any changes in the configuration of our architecture and 165
that may impact compliance with any standards. With AWS access and management 166
capabilities you need to understand the concept of grant least privileged access. 167
What that means is that you only give people access to the minimum that they 168
need. Don't give them anything more than that. You grant least privilege. You need 169
to understand that. You need to understand IAM users, groups of users, 170
what an IAM role is and how you use it. For example if you wanted someone 171
outside of your AWS account to be granted limited access and you could do 172
that through an IAM role and they could assume that role for a temporary period. 173
You also need to understand what an IAM policy is. You don't need to 174
understand how to write a policy or the specifics of policies but you need to 175
understand what a policy is and how they fit in. We also need to understand AWS 176
organizations and how we can use it to manage multiple AWS accounts for an 177
organization. You need to understand how multi-factor authentication can increase 178
the security of an IAM user. We also need to know that there are account password 179
policies that we can apply to a user or we can put apply to a group of users and 180
they can define the complexity of the password and also the expiry time on 181
that password as well. There are two main services for achieving single sign-on. 182
The first one there is AWS single sign-on, 183
easy enough to remember, but there is also the AWS directory service that is 184
specifically for the Microsoft Active Directory. Cloudtrail can be used to 185
monitor all of the calls to and from our AWS account. So every time someone uses 186
the management console and accesses our account or someone uses the software 187
development kit or a command line interface, all of those calls will be 188
tracked and we can log those calls as a Cloudtrail log as well and we can use 189
those logs for later on for security analysis or for performance analysis as 190
well. IAM access keys are used by a user to 191
access the AWS account from the command line interface or a software development 192
kit. The access Keys they consist of an access key ID and a secret access key. 193
Now the IAM access Keys, they are not SSH key pairs, they are a secret key 194
and an access key ID that allow you, once you're connected to the AWS cloud, 195
they allow you to have access to certain resources that are defined in an IAM policy. 196
Don't confuse those with an ec2 SSH key pair. They are something that's 197
totally different. They are an SSH key pair that is used for you to connect 198
into an ec2 instance. 199
Resources for security support. Amazon Inspector, the automated security 200
assessment service. We also have AWS trusted adviser which provides an audit 201
of your AWS resources based on not only security but also cost optimization, 202
performance, security, fault tolerance and also the service limits of AWS as well. 203
If you have the IP address of someone who is trying to attack your AWS service 204
then you can always provide that to the AWS support service and you just do that 205
by filling out a report abuse form. Penetration testing in the past was not 206
allowed. You needed to actually go to AWS and get permission to conduct any 207
penetration testing, but now penetration testing for specific activities is 208
permitted on certain services, such as ec2, RDS, Cloudfront and a few others as 209
well. One thing that you need to remember is 210
that not all of these activities. Not all of these penetration activities or 211
simulated attacks are allowed by AWS. So that includes DDoS or dos attacks. 212
You cannot do those are they not part of a authorized activity to do on permitted 213
services or any other AWS services. 214
Deploying and operating in the AWS cloud. You need to know the services are 215
available to help you with on-premises architecture and hybrid solutions as 216
well, such as the snowball service, which allows you to store massive amounts of 217
data on a snowball device and deliver that to AWS for uploading on an AWS 218
service. The AWS Storage Gateway which helps us to integrate our on-premises 219
storage with the AWS storage and also the database migration service which 220
simplifies migrating on-premises data or databases over to RDS or Aurora. 221
The options available for us to deploy our software. We have the elastic beanstalk 222
service which we know quite a bit about. we've used quite a bit. There is 223
Codecommit which is AWSs GIT repository. We have Codepipeline which provides a 224
pipeline between our software development and our deployment of our 225
actual code on an elastic Beanstalk or an ec2 instance or whatever, and we have 226
Codedeploy which allows us to deploy that and can integrate with 227
Codepipeline and, we also have Cloudformation which allows us to define our 228
infrastructure as code in a JSON template and also Opsworks which allows 229
us to define that also as a Chef recipe, and that's where we need to understand 230
infrastructure as code. So Cloudformation we can define it as a JSON 231
template and we can have version control over that or we can define it with 232
Opsworks as a Chef recipe. You need to understand that there are software 233
development kits that allow us to develop our own software that can 234
communicate with AWS, and also the AWS command-line interface which allows us 235
to issue commands to AWS without using the AWS management console. AWS global 236
infrastructure. You need to understand what a region is. What an availability 237
zone and what an edge location is and, what we use them for. You need to 238
understand the AWS Direct Connect service and how we can use it for a very 239
high-speed connection between our on-premises data center 240
and AWS. We also need to understand that there are global and regional 241
services. For example Amazon s3 cloudfront and route 53 are all global 242
services. You don't define a region when you're using the AWS management console. 243
They are a global service as opposed to ec2 where you're launching an instance 244
into a specific region. The core AWS services that you need to know very well, 245
the first one there is object storage, that includes Amazon s3 and Amazon 246
Glacier. What you really need to understand is the redundancy levels for 247
all of those different types of Amazon s3 and glacier and the durability of 248
those and also the retrieval time. So obviously Glacier the retrieval time 249
takes a lot longer than Amazon s3. You need to understand all of that. With ec2, 250
understand what an AMI is and what is defined within an AMI. Understand the 251
different storage options that are available to connect to an ec2 instance 252
and understand the difference between an instance store volume and an EBS volume 253
and what happens when an instance is terminated with those different types of 254
storage. Also need to know the main different types of ec2 instances 255
that are out there and also the burstable types and that sort of thing. 256
You need to understand that there are three different types of elastic load balancer 257
being the classic, the application and the network elastic load balance. 258
We also need to understand Cloudwatch. How we can use it for monitoring our 259
services and the different types of Cloudwatch we can have detailed 260
monitoring and standard monitoring. We have alarms and also there are 261
Cloudwatch logs that can store Cloudwatch information as well. 262
Other AWS services you need to understand. The difference between a 263
relational database and a noSQL database. So for relational we've got RDS 264
and the number of different database engines there that are available. We also 265
have Amazon Aurora which is only for mySQLor PostgreSQL databases 266
and the noSQL option there is DynamoDB and we also have a data warehouse 267
solution there being Redshift and in memory storage as well with ElastiCache. 268
Be aware that there are serverless offerings as well. We have AWS Lambda and 269
S3 is part of that serverless offering DynamoDB is a service noSQL database, 270
SQS simple queuing and simple notification service. They are also 271
serverless services. Also be aware that we have a machine-learning offering as 272
well. One of those quite common one there is Amazon Recognition for recognizing 273
objects within images, and we also have streams there for Kinesis. So be aware of 274
those services as well they may appear on the exam. 275
If you run into trouble with an AWS technology there is support available. 276
AWS has a number of different support plants from free right up to enterprise. 277
You need to understand what they are. Understand which ones have a Technical 278
Account Manager? Which ones have phone support? The difference response time for 279
each one of those plans also. Also understand which ones have trusted 280
advisor included in those as well The AWS partner network or is a group of 281
organizations that are approved by AWS to provide technology solutions possibly 282
in the form of software that can work with AWS or they can also provide 283
consulting to help you migrate over to AWS. So there are two different types of 284
AWS partner that are available that being a technology partner or a 285
consulting partner. The AWS professional services is a group of experts within 286
AWS that have specialized knowledge on a specific area of AWS and you can use 287
those in combination with an AWS partner to handle very complicated and difficult solutions. 288
AWS quick starts are reference deployments normally in the format of a 289
cloudformation template that you can use to deploy an architecture 290
automatically. The AWS personal health dashboard. If you go to the management console 291
and click on the personal health dashboard, that will show you all of the 292
events that are impacting the AWS cloud that may impact you. 293
Pricing models for AWS. With ec2 you're going to have to know all of the 294
different pricing models being on demand, spot, reserved, dedicated hosts. Also 295
understand what a savings plan is. You'll need to understand that quite well. 296
You'll also need to understand per second billing and where it applies. 297
It only applies on on-demand, reserved and spot instances that are running Linux. 298
AWS billing and pricing account structures. Now if you have got a large 299
organization that has multiple business units and multiple geographic regions 300
and whatever, you may want to have those separated in multiple accounts and you 301
can do that and you can also manage those centrally using AWS organizations. 302
The big advantage of that as well is that you can have consolidated billing, 303
so one single bill for all of those multiple accounts and you can also 304
manage the access and management of all of those multiple accounts centrally as 305
well by combining those all into an AWS organization. You can also apply cost 306
allocation tags to all of your resources or some of your resources to keep track 307
of those resources and can see a bit more fine-grained detail about specific 308
resources that you've got. So you might want to put a cost allocation tag for 309
all of the developer's resources and see how much they're costing or you might 310
want to do it for accounting or whatever. So cost allocation tags are a good 311
option for giving further granularity to your AWS bill. The support options that 312
are available for billing. First off we can go to the management console and 313
have a look at the AWS billing dashboard. From there we can download a cost and 314
usage report if we want. We can also go into the AWS Cost Explorer and get more 315
fine-grained detail around what those costs were. If we would like to be 316
alerted when cost exceed a certain level, we can set up an AWS budget. They can 317
define exactly what our budgeted costs should be and when that is exceeded we 318
will be alerted. What we can also do is set up a cloudwatch billing alert as 319
well were our bill actually exceeds a certain level then we will be alerted 320
to that, and also if we have any problems with our bill that is free support on 321
AWS you don't have to pay for that. 322
A couple of resources that you may want to check out. The first one there is the 323
about AWS website. So if you go to that you'll see that there are some standard 324
solutions that you can use and also it will go into a bit more detail about the 325
global infrastructure. Now nothing in there is not already covered in the 326
course but you might want to have a quick look at it. The other thing there 327
is to have a look at the products website. So although you need to know 328
some products quite well such as ec2 and s3 and and these sorts of products quite 329
well, you may get a question that is just a very simple question about an obscure 330
service or product and you just need to know that it exists. For example there 331
might be some something that says what service do you use to recognize an 332
object in an image and so you would know that would be AWS recognition and 333
so if you go to the products website you'll see that there will be just a 334
very short description, a sentence or two about each one of those services. 335
That'll help you to understand on a very broad picture about any of those obscure 336
services as well. Once you're finished your preparation, you can go to the 337
certification website. Go to AWS website then certification and then certified 338
cloud practitioner. From there you can download the exam guide and also you can 339
download some sample questions for free from AWS. One thing to take into 340
consideration though is that those sample questions, none of those will 341
appear on the final exam, so they give you a good idea of the sorts of areas 342
that AWS will be examining you on but they won't be actual questions that will 343
appear on the final exam. So that brings us to the end of the lecture and 344
good luck with the exam!