AWS certified Solution Architect Associate Exam Preparation: Short Notes on AWS topics

In this article, I will share some short notes on AWS service topics that will help you while preparing for the exam. These notes will be helpful to recall the important points for exam preparation.

Photo by Glenn Carstens-Peters on Unsplash

EC2 (Amazon Elastic Compute Cloud)

• EC2 has by default a 20-instance limit per region, and we increase this limit by submitting a request to AWS. (This point helps if you get an error while launching a new instance.)
• Try to use it to spot instances of non-critical workloads or if task interruption is acceptable. This will help us reduce the cost of EC2.
• Storage options for your Amazon EC2 instances (EBS, EFS, instance store, S3, Fsx).
• Paravirtual /dev/sda1 Reserved for root volume.
• We can detach the EBS volume from an instance and attach it to another instance, but there are some limitations while detaching the volumes. If your volume stays in the detaching state, we can force the detachment by choosing Force Detach.
• We can attach additional instance store volumes to the supported instances by using /dev/sdc.
• We can terminate, stop, or start the instance by using the resources tag and the principal tag.
• One public and one private IP will be assigned to EC2 at the default VPC launch time.
• The main reason the EC2 instance is automatically terminated immediately is because the AMI may be missing, the snapshot is corrupted, or the volume has reached its limit.
• EC2 billing starts when the instance enters the running state; this may be a very hibernated instance.
• EC2 runs on Xen-based hypervisors.
• EC2 instance store persists only in reboot time, not instance stop, restart, or terminated state.
• We can attach the multiple numbers of ENI to EC2, but this number is based on the instance type.
• After launching the instance, we cannot change the security group only in the EC2 Classic instance.
• Changes made to the security group immediately take effect, so there is no need to restart the service.
• Some kinds of testing, like penetration testing, require AWS approval.
• Retrieve instance metadata ip4 (http://169.254.169.254/latest/meta-data/) ip6 (http://[fd00:ec2::254]/latest/meta-data/)
• Data transfer chargers between services in the same availability zone are free, for example, EC2 instances and RDS.
• Capture the EC2 API calls using CloudTrail.
• payment for reserved instances is never refundable
• understand the different types of placement groups for high-performance applications
• Use port 22 to do SSH login, and if you need only one IP address to use this port, then use the /32 subnet. If you are unable to do SSH, then check the corresponding security group.
• Add secondary ENI to EC2 to use SSH without affecting already existing ENI.
• If the EC2 instance stops, then the data kept with EBS will remain on the disk.
• If an EC2 instance is terminated, then by default the root device volume will also be terminated. However, we can preserve the root volume when an instance terminates by changing the DeleteOnTermination attribute for the root volume to False.
• Hibernation saves the contents from the instance memory to the EBS root volume, and we cannot hibernate the instance for more than 60 days; it is only available for on-demand and reserved instances. Use hibernation to reduce the bootstrapping time, like the pre-warm feature. HDD volumes cannot be used as boot volumes.
• User data scripts only run during the boot cycle when we first launch the EC2 instance. For an already-running EC2 instance, use the run command to execute scripts.
• Sometimes you are unable to start the instance because the root EBS volume is encrypted and you do not have permission to access the KMS key for decryption or because of an insufficient instance capacity error.Learn about on-demand vs. reserved vs. spot instances.

CDN (content delivery network)

• S3, EC2, Route53, and load balancers can all be used as origin servers for the cloudfront.
• it is a global service
• S3 Glacier, we cannot use it as the origin server.
• the edge location where content will be stored; the edge location should not just read but write it too.
• cache duration can be changed using the TTL value.
• origin fetch is free of charge.
• Distributions are collections of edge locations.
• If files were not cached in cloudfront, then the request will be made to the origin server.
• We can use the lambda edge function in the cloud.
• We can set the price class for the cloud front to reduce the cost based on the countries.
• Cloud Front also supports Geo-restriction features.
• Proxy HTTP methods like PUT, POST, and PATCH/DELETE will directly hit the origin server.

EBS (Amazon Elastic Block Store)

• You may observe performance issues while taking the EBS snapshots in progress.
• We can encrypt the EBS volumes.
• EBS backups are asynchronous.
• A provisioned IOPS volume must be at least 10 GB in size.
• We cannot detach the root volume without stopping the EC2 instance.
• Magnetic EBS volumes are very low-cost.
• EBS supports the multi-attach feature.

Security

• The cloud watch receives data every minute.
• Tags let you categorise the EC2 instance and other resources in different ways to manage, for example, billing and event separation.
• A trusted adviser is used for performance, cost optimisation, security, and fault tolerance.
• Every user created in the IAM system starts with no permissions.
• key pair can be used only for EC2 instances and cloud front.

RDS (Amazon Relational Database Service)

• We cannot use the standby infrastructure for read or write purposes in multi-AZ deployments.
• under management options We see the DB backup and maintenance options.
• Readshift is good for batch analysis compared to RDS
• Redshift is the columnar data storage for DB tables.
• The automatic failover mechanism simply changes the CNAME record of the main DB instance to point to the standby DB instance.
• Automated backups are enabled by default for new database instances.
• BYOL and licences required for Oracle RDS
• SQS will help with capturing a large spike of traffic, and later we can write the data to RDS.
• data will be synchronously copied to standby instance
• data will Asynchronously copied to read replicas
• RDS security groups are used to control what IP address or EC2 instance can connect to your DB instances.
• DynamoDB supports both incremental and decremental atomic operations.
• If you modify the DB instance and DB parameter group, then reboot is required.
• RDS has a few main components. DB instance, DB snapshots, DB parameter, DB security group
• MySQL default port is 3306
• PostgreSQL default port is 5432
• Dynamo DB default port is 8000
• if master database is encrypted, the replicas also encrypted
• The snapshot retention period can be 1 to 35 days
• SQS does not support industry-standardised messaging APIs and protocols.

Other Shot notes

• Pilot Light is a small part of your critical core infrastructure that is always running, so when the time comes for recovery, we can rapidly provision for full-scale production.
• Warm Standby is a scaled-down version of a fully functional environment that is always running in the cloud.
• Multi-site is deploying infrastructure across the available regions.
• RDS multi-AZ is like creating replicas in another AZ and synchronously replicating them.
• Alias record can be used to map the domain apex to ELB
• we take EBS backup manually or by using Data life-cycle manager
• The launch type of Amazon ECS determines the type of infrastructure on which tasks and services are hosted.
• ECS charged based on the launch type and volume used.
• The API gateway is stateless, and the Web socket is statefull.
• Route 53 has simple routing, fail-over routing, geolocation routing, latency-based routing region, IP-based routing, multi-value answer routing, weight routing.
• The default region in the US is us-east-1.
• We can use a weighted routing policy to distribute the traffic across regions.
• A CNAME record is used to associate another domain with an existing domain, but it cannot be used for apex.
• A record used to associate the IPv4 address with a domain name
• NS records the specified authoritative server for a zone.
• ALIAS records can be used to resolve apex or nake domain names to map and select the ELB DNS as a target.
• PTR records are reverse lookup records where you use the IP to find the DNS name.
• The same IAM user cannot be associated with multiple accounts.
• There is a limit in groups to add IAM users.
• A policy is a document that provides a formal statement of one or more permissions.
• We can use tags on resources along with the IAM user, which can prevent specific users from terminating the production EC2 resources.
• We can develop an ID broker that authenticates again using LDAP.
• IAM credentials reports cannot be downloaded as XML files.
• IAM is a global service.
• As a security best practice, we must not share the root account credentials with others, so create an IAM user with the least privileges for that purpose.
• IAM allows you to set up users, groups, policies, and roles.
• Root accounts always follow the best practices for security, like a strong password. If you create an access key, delete it or rotate it regularly. Enable MFA, and never share credentials with others.
• Configure AWS Collapse to log all IAM actions.
• STS only gives temporary authentication permission, and it is not suitable for medium- to long-term access tokens.
• Lambda functions need the IAM role to access other services.
• We can assume my role while accessing the resources from the other account.
• IAM Roles used to delicate access to users or services.
• Permissions boundaries can be used to control the maximum permission employees can grant to the IAM principle, that is, users and roles that they create and manage.
• All users and roles in linked accounts, including the root users, are impacted by SCPs.
• SCP is the type of policy that can be used to manage your organisation.
• SCP offers Central the maximum available permission for all accounts in your organisation.
• load balancer uses the HTTP protocol for checking the health of your instance.
• ELB uses a 4-tyre key-based architecture for encryption.
• ELB supports IP4 and IP6
• We can configure the security group of the EC2 instance to allow access to the ELB as the source security group.
• Auto-scaling creates easy-to-instance templates from a launched template.
• Use sticky sessions to ensure that all requests will be sent to the same application instance.
• Dedicated hosts are used to maintain a physical server that is dedicated to your use case.
• The connection draining feature is to ensure that the elastic load balancer stops sending requests to instances that are deregistering while keeping the existing connection open.Global accelerator uses anycast IP addresses, which means IT doesn’t change when failing over between regions
• We can use a static IP address instead of a global accelerator, but it won’t provide intelligent routing of traffic for low latency and see. Also, we can use Route 53, which fails every hour, but this route also won’t provide intelligent routing of traffic.
• CDN for content, but GA for TCP and UDP.
• ELB provides load balancing within one region, but Global Accelerator provides traffic management across multiple regions.
• High availability means applications must run at least into the availability zone to survive and avoid Auto Centre loss.
• Manual scaling is the most basic way to scale, but autoscaling uses more advanced scaling techniques.
• Standby instances are still part of the auto-scaling group, but they do not act on all the application traffic.
• If you want to apply any updates to instances of the scaling group, then we can suspend those instances by putting them into standby mode. Once maintenance is done again, we can put them back in service mode.
• Auto-scaling groups consist of target tracking policies, step scaling policies, simple scaling policies, schedule policies, and predictive scaling policies.
• by default ELB weight for 300 seconds before completing the DE registration process.
• Cross-zone load balancing will ensure all traffic is distributed evenly among the available zones in all AZ.
• To restrict web services to being accessible only through the ELB, we can configure the web tyre security group to allow only traffic from the ELB.
• NAT Gateway helps resources that are inside a private subnet initiate outbound internet traffic.
• Launch templates are immutable, so we need to always create a new launch template if we need to make any modifications to the existing launch template.
• EC2 to partial instance hours are billed as full hours.
• RDS data transfer between regions incurs charges.
• advantages: consolidated billing of one bill per AWS account; very easy to track charges and allocated costs; volume pricing discount.
• Cloudtrail can be configured for control plane operations and data plan operations.
• After the VPC instance is launched, we can change the security group.
• Security groups act like firewalls at the instant-level network or additional layers of security at the subnet-level.
• The route table should have 0.0.0.0/0 and your IG as a target to use internet traffic.
• network ACL is stateless, so we need to configure both inbound and outbound traffic.
• By default, network ACLs allow inbound and outbound traffic.
• The default security group settings allow inbound and outbound traffic.
• Security groups are statefull, so only the inbound traffic rule configuration is enough.
• It is not possible to detach primary ENI from the instance; we can add a number of ENI to the instance as a secondary.
• instances must have public IP addresses to connect to the internet gateway.
• can be used to connect between two vpcs in different regions or the same region, and private DNS values cannot be resolved between instances in a peer vpc.
• VPC peering cannot be used on premises.
• AWS Direct Connect makes it easy to establish a dedicated network connection to AWS from on-premises and in an environment, but it won’t provide IPsec. To use IPsec, we need to use the VPN.
• The advantages of NAT gateways over NAT instances are that they are managed for you by AWS, are highly available within each availability zone, cannot be assigned to security groups, and do not support forwarding.
• The AES-256 algorithm is always used everywhere.
• Successful responses to a put request only occur when a complete object is saved in S3, and multipart supports 5 GB.
• A multi-part upload will help improve the performance of your application.
• For large-scale persistence data storage, use Amazon S3 or EBS volumes.
• AWS cloud trial to audit all Amazon S3 bucket API calls but server access login for each bucket and object at deeper level events and insights.
• The maximum key length of a tag is 128 Unicode characters.
• s3 means simple storage service.
• To secure S3 objects by enabling MFA delete for S3 objects and bucket versioning.
• S3 Intelligent saves costs by automatically moving the data to the most cost-effective access tier without performance impact or operational overhead.
• FSX for Lustre makes it easy and cost-effective to launch and run high-performance file systems such as machine learning and HPC.
• S3 supports client-side encryption and server-side encryption.
• S3 transfer acceleration utilises cloudfront and edge networks to accelerate the upload to S3 instead of uploading directly to S3 buckets.
• Read more about AWS S3 object lock features such as compliance mode, government mode, retention mode, and legal mode.
• for S3 faster upload using S3 transfer acceleration and S3 multipart upload.
• AWS Snow Mobile is an extra migration device used to move extremely large amounts of data to AWS.
• AWS Transfer Family is a secure transfer service that enables you to transfer files into and out of AWS Store Surface Cloud Front. It is a content delivery network service that helps you distribute your static and dynamic content quickly.
• Using AWS Direct Connect, you can link your internal network directly to the AWS cloud by connecting to an AWS Direct Connect location and creating a virtual bypass of the internet.
• AWS ELB automatically distributes incoming application traffic across multiple targets, and Violet LB only routes traffic based on routing number. ALB facilitates context routing based on multiple references, including query string parameters, source IP and port number, and hostname name and path.
• Aws Global Accelerators is a service that allows you to route traffic to your applications using the global network instead of the internet. It also provides you with two public static IP addresses that users can connect to to reach your application and point.
• AWS while architect tool is designed to help you review the state of your application and workload against architectural best practices and identify opportunities and improvements.
• AWS application migration service is a block-level application that simplifies the process of migrating applications from physical, virtual, and cloud-based servers to AWS.
• AWS server migration service is an agent-less migration service to migrate on-premises virtual machines to AWS using virtual appliances.
• The AWS migration hub provides a central location to collect server and application inventory data for assessment planning and tracking of migration to AWS.
• ECS fully manages a container orchestration service that simplifies your development management and scaling of containerised applications.
• Cloud formation is a service that gives developers and businesses an easy way to create a collection of AWS and third-party resources and helps to deploy stacks with less overhead.
• AWS cloud trial enables auditing security monitoring and operation troubleshooting by tracking user activity and API usage.
• AWS Cloud Watch is a monitoring and management service that provides data and actionable insights for AWS.
• AWS Compute Optimizer uses machine learning and artificial intelligence to reduce the cost by 25%, and it gives recommendations on EC2, EBS, ECS, fargates, etc.
• The AWS configuration service enables you to access the audit and availability configuration of your AWS resources. It also allows you to automatically record configuration I against the desired configuration.
• AWS Control Tower offers the easiest way to set up and govern a secure multi-account AWS and establishes a landing zone that is based on the best practices blueprints, allowing teams to provision new accounts quickly.
• AWS License Manager makes it easy for you to manage your software licences from vendors.
• AWS-managed grafana helps in the visualisation, analysis, and correlation of operation sources and queries across multiple AWS accounts and regions.
• AWS Prometheus helps monitor and provide alerts on applications and infrastructure at scale.
• The AWS personal health dashboard is a single place to learn about the availability and operations of AWS services. You can view the overall status of AWS services, like maintenance, schedule, etc.
• AWS Proton is a tool to help with infrastructure automation code deployment and uses a template to define and maintain shared applications.
• ECR is a fully managed container registry integrated with ECS, EKS, Lambda, and Fargate, and it is also integrated with IAM, providing resources for level control of each repository. You only pay for the amount of data used in your public or private repository; it is a regional service.
• We can set up an AWS privatelink endpoint to allow your instance to pull the images from your private repository without traversing through the problem internet.
• ECR supports elastic beanstalk.
• AWS System Manager provides a browser-based interactive shell, cli, and browser-based remote desktop access for managing instances on your cloud.
• A trusted AWS advisor provides a recommendation that helps you follow AWS best practices. Trusted advisors evaluate your accounts by using checks.
• Snapshots help with point-in-time recovery. Snapshots usually take a copy of the EBS volume and place it in Amazon S3.
• VPC peering allows you to route traffic between two AWS servers and a VPC via private IPs.
• The private link provides private connectivity between VPC, AWS services, and your on-premises network without exposing your traffic to the public internet.
• VPC means virtual private cloud, and it is a logically isolated section of the AWS cloud.
• We can securely copy the files between two EC2 instances without a single point of failure using VPC peering.
• vpc gateway in points only for Dynamo DB and S3.
• VPN is not possible between two VPCs.
• transit gateway if you would like to connect multiple VPCs.
• To copy the data from one S3 bucket to another S3 bucket, we need to enable the S3 version in the source and destination buckets and copy the data using cross-region replication.
• If we stop the EC2 classic instances, then public and private IP addresses will be released.
• Learn about S3 buckets and their objects. static website hosting, tagging s3 bucket and its objects, s3 inventory configuration, life cycle configuration, bucket policy, bucket analytics configuration, cross configuration for buckets, s3 event notification, cross-region replica request pay buckets multi-part upload, S3 BitTorrent protocols, Amazon S3 encryption, pre-signed urls.
• Learn more about Amazon antennas, AWS data exchange, AWS data pipeline, Amazon EMR, glue, kinesis, lake formation, quick sight, and redshift.
• Learn about Amazon AppFlow, app sync event Bridge, Amazon MQ, SNS, SQS, and step functions.
• Try to understand the difference between the AWS budget, cost, and usage report. AWS Explorer and savings plans, and also try to create a graph about comparing your usage cost for this current month versus the previous month.
• make all the difference between standard SQS and FIFO SQS, when to use them, and their limitations. SQS dead-letter queue, SQS visibility timeout, and how to schedule an instance based on the SQS size using cloud metrics.
• Keep some notes on the AWS outposts.
• Learn more about containers such as ECR, ECS, EKS, ECS anywhere, and EKS anywhere.
• Amazon Neptune is a graph database and Amazon time series database used to save IOT streaming data.
• AWS Device Farm is an application testing service that lets you improve the quality of your web-based mobile apps.
• Amazon pinpoint services can be used to engage with your customers across multiple messaging channels.
• Amazon Comprehand is used for NLP and document processing. The Amazon forecast is a time series for casting services. Amazon Kendra search service and Amazon Lex are AIs used for conversational channels. Amazon Polly uses deep learning technology to synthesise natural sounds, like text to speech and Amazon rekognition image processing. Amazon Sage Maker is a machine learning service that can quickly try and use your ML model. Amazon Textract is a text and handwriting data extraction service. Amazon transcribe is used for speech-to-text. Amazon Translate is a neural machine translation service.
• Learn the difference between AWS Artifact, AWS Audit Manager, and AWS Licence Manager.
• The Amazon Cognito service is used to provide authentication and authorization.
• in disaster recovery. Active-active fail-over means running a full secondary production system and being ready to serve the traffic when needed.
• Pilot-light means running core services in standby mode.
• In AWS Elastic Beanstalk, simply upload your code, and it will automatically deploy and provide capacity provisioning, load balancing, and auto-scaling.
• AWS Fargate is a compute engine for Amazon ECS that allows you to run containers without having to manage servers or clusters.
• In ECS, there are two types of launch types: fargate and EC2 launch types.
• Use EC2 to launch if you need more granular control over the infrastructure.
• In AWS Lambda Run your code without managing the server, and you pay only for the computer time you consume. Set up your code to automatically trigger the lambda from other AWS services.
• When you launch an instance, the AMI you selected is copied to the root device volume, which contains the image used to boot the volume, and the AMI is reusable.
• When architecting an application for high availability, consider at least two EC2 instances in two separate availability zones.
• When you stop an instance, the instance gets a new public IP address but maintains the same private IP address.
• When you stop an instance, the instance gets a new public IP address but maintains the same private IP address. When you terminate the instance, data will be lost, and you will lose both the public and private IP addresses of the machine. You can no longer access the machine, and AWS does not charge for usage or direct transfer fees, but EBS volume still charges.
• vpc subnets are of two types: public and private.
• EBS supports the multi-attach feature, but this is in the same availability zone.
• S3 life cycle supports two types of action: transition action used to change the storage class of the object, and expiration action used to delete the object after a certain number of days.
• Learn about 3-tier architecture. multi-tier architecture and serverless architecture.
• Each object in S3 has a storage class associated with it.
• network foundation, edge networking hybrid connectivity, application networking, and network security These are the network options available in AWS.
• When VPC launches into a region and cannot be spread for multiple reasons and the subnet cannot span more than 1 availability zone, only some resources, like EC2, require their resources to be launched into the Amazon VPC.
• Each subnet must be associated with the route table, and every subnet created is automatically associated with the main route table for the VPC. We associate route tables with multiple subnets, but subnets cannot be associated with more than one route table.
• Virtual gateways can support a single VPC at a time, virtual gateways at the VPC level, and transit gateways support multiple VPCs.
• VPC endpoints are of two types. One is the gateway endpoint, which only supports S3 and DynamoDB, and the interface endpoint can only be created for services that are powered by an AWS private link.
• VPC components are CIDR blocks, subnet internet gateways, and a route table.
• CIDR blocks can be partitioned into one more range of IP addresses called the subnet. Subnet security is crucial. When configuring the subnet, always consider whether to make it public or private by attaching or removing an internet gateway.
• Although all EBS volume types support encryption, not all instance types are supported.
• Learn about OAI, OAC, signed cookies, signed urls, and pre-signed urls.
• Learn about SQS vs SWF.
• Radis Cachi does not support CPU cores or multithreading.
• Consider using block device mapping to specify additional EBS volume or instance volume when an instance is launching or running.
• Learn about DDOS vs. Gurd Duty vs. Macie vs. Inspector vs. Detective vs. AWS Config.
• Learn about the Coludwatch agent.
• Learn about the firewall manager vs. Newtork firewall vs. VPC flowlog.
• Learn about the auto-scaling, warm period, and cooldown period.
• Learn about organisation, organisation unit, management account, individual account, member account, billing discount, and SCP.
• Learn about Congito user pools and idenetity pools.
• Learn about lifecycle hooks in the auto-scaling group.
• Learn about geoproximity vs. geolocation routing.
• Learn about NLB vs. ALB.
• Learn about EFS vs. EFX vs NFS vs NAS vs SMB protocols.
• Learn about kinesis vs. data firehose
• Learn about convertible reserved vs. standard reserved instance.
• Learn about server access logging vs cloud trail.
• Learn about IP4 vs. IP6 dns records.
• Learn about Agent based vs. agent less based discovery.
• Learn about the S3 difference between storage classes and the transition period.
• Learn about cloud formation templates like mapping, resources, etc…
• Learn about cloudwatch access logging and cloudwatch execution logging.
• Learn about snapshots vs backups.
• Learn about automated snapshots vs manual snapshots
• Learn about user vs role vs groups
• Learn about service. role vs. services linked role vs. web identity role vs. SAP 2.0 roles vs. custom roles.
• Learn about trust policy (who can assume this role) vs. permission policy (what an assumed role can do).
• Learn about identity-based policy vs. resource-based policy vs permission boundary vs session policy
• Principles are root users, IAM users, roles, or temporary STS.
• Learn about DATA sync, data sync discovery.
• Learn about data sync and data sync discovery.
• Learn about snowball vs. snow cone vs. snowmobile and its support file systems.
• Learn about data sync vs. storage gateway.
• Learn about data sync vs. S3 transfer acceleration.
• Learn about AWS storage gateways, like tape gateway vs. S3 file gateway and FSx gateway vs. volume gateway.
• Learn about S3 KMS and key rotation policy.
• Learn about AWS secret manager vs parameter store

conclusion

In this article, I give the resources and information needed to study for the exam and also read topics briefly from AWS documentation to gain deeper knowledge. Usually, exam questions are based on this topic, and you always need to consider solutions like how to manage or improve the existing application based on the above topics.

If you are looking for online tutorials for the exam, check out my previous blog, where I mentioned some good tutorials to sign up for.

Follow me for more if you found this article helpful.

and if you have any doubts, please mention them in the comment section below.

Thank you.