210 lines
4.2 KiB
Markdown
210 lines
4.2 KiB
Markdown
# AWS Core Services Overview
|
||
|
||
## Compute & Container Services
|
||
|
||
**EC2 (Elastic Compute Cloud)**
|
||
|
||
* Infrastructure as a Service (IaaS)
|
||
* Provides virtual machines (instances)
|
||
* Storage options:
|
||
|
||
* **EBS** (Elastic Block Store): High-performance block storage attached to a single instance
|
||
* **EFS** (Elastic File System): Network file system that can be mounted by multiple instances
|
||
* Requires user management of OS, patching, and scaling
|
||
|
||
**ECS (Elastic Container Service)**
|
||
|
||
* AWS-managed container orchestration service
|
||
* Supports Docker containers
|
||
* Deployment options:
|
||
|
||
1. **EC2 Launch Type** – you manage EC2 instances
|
||
2. **Fargate Launch Type** – serverless, AWS manages infrastructure
|
||
|
||
**ECR (Elastic Container Registry)**
|
||
|
||
* Fully managed Docker container image registry
|
||
* Used to store, manage, and deploy container images for ECS and EKS
|
||
|
||
**EKS (Elastic Kubernetes Service)**
|
||
|
||
* Managed Kubernetes service
|
||
* AWS manages the Kubernetes control plane
|
||
* Worker nodes can run on EC2 or Fargate
|
||
|
||
**AWS Lambda**
|
||
|
||
* Serverless compute service
|
||
* Event-driven execution
|
||
* Maximum execution time: **15 minutes**
|
||
* No server management required
|
||
* Common use cases: APIs, background jobs, automation
|
||
|
||
---
|
||
|
||
## Messaging & Integration
|
||
|
||
**SQS (Simple Queue Service)**
|
||
|
||
* Fully managed message queue service
|
||
* Used for decoupling and scaling distributed systems
|
||
* Supports Standard and FIFO queues
|
||
|
||
---
|
||
|
||
## Databases
|
||
|
||
**RDS (Relational Database Service)**
|
||
|
||
* Managed relational databases (MySQL, PostgreSQL, Oracle, SQL Server, MariaDB, Aurora)
|
||
* Typically deployed in **private subnets**
|
||
* High availability using Multi-AZ
|
||
* Automated backups, patching, and scaling
|
||
|
||
**DynamoDB**
|
||
|
||
* Fully managed NoSQL key-value and document database
|
||
* Serverless, auto-scaling, and highly available
|
||
* Low latency and global replication support
|
||
|
||
---
|
||
|
||
## Networking & Traffic Management
|
||
|
||
**VPC (Virtual Private Cloud)**
|
||
|
||
* Isolated virtual network in AWS
|
||
* Uses CIDR ranges for IP addressing
|
||
|
||
**Subnets**
|
||
|
||
* **Public Subnet**: Has a route to the Internet Gateway
|
||
* **Private Subnet**: No direct internet access
|
||
|
||
**Internet Gateway (IGW)**
|
||
|
||
* Enables inbound and outbound internet access for public subnets
|
||
|
||
**NAT Gateway**
|
||
|
||
* Placed in a public subnet
|
||
* Allows **outbound-only** internet access for private subnet resources
|
||
* Cannot receive inbound connections
|
||
|
||
**Route 53**
|
||
|
||
* Managed DNS service
|
||
* Supports domain registration, routing policies, and health checks
|
||
|
||
---
|
||
|
||
## Load Balancing
|
||
|
||
**ELB (Elastic Load Balancing)**
|
||
|
||
* Distributes traffic across multiple targets
|
||
|
||
**ALB (Application Load Balancer)**
|
||
|
||
* Layer 7 (Application layer)
|
||
* Supports HTTP/HTTPS routing rules
|
||
* Can route traffic to:
|
||
|
||
* EC2
|
||
* ECS
|
||
* Lambda
|
||
* IP addresses
|
||
|
||
---
|
||
|
||
## Security & Identity
|
||
|
||
**IAM (Identity and Access Management)**
|
||
|
||
* Manages users, groups, roles, and permissions
|
||
* Global AWS service
|
||
|
||
**IAM Roles**
|
||
|
||
* Used by AWS services to access other AWS resources securely
|
||
|
||
**IAM Reports**
|
||
|
||
* **Credential Report**: Shows credential status for all users
|
||
* **Access Advisor**: Shows last-used service permissions
|
||
|
||
**Security Groups**
|
||
|
||
* Stateful virtual firewalls for AWS resources
|
||
* Control inbound and outbound traffic
|
||
* Attached to EC2, ALB, RDS, ECS, etc.
|
||
|
||
---
|
||
|
||
## Monitoring & Logging
|
||
|
||
**CloudWatch**
|
||
|
||
* Monitoring and observability service
|
||
* Collects metrics, logs, and events
|
||
* Used for alarms, dashboards, and automation
|
||
|
||
---
|
||
|
||
## AWS Global Infrastructure
|
||
|
||
**Region**
|
||
|
||
* Geographic area containing multiple Availability Zones
|
||
|
||
**Availability Zone (AZ)**
|
||
|
||
* One or more isolated data centers within a region
|
||
|
||
**Global Services**
|
||
|
||
* IAM
|
||
* Route 53
|
||
* CloudFront
|
||
* AWS WAF
|
||
|
||
**Regional Services**
|
||
|
||
* EC2
|
||
* ECS
|
||
* EKS
|
||
* RDS
|
||
* Lambda
|
||
|
||
---
|
||
|
||
## IP Addressing
|
||
|
||
**Private IP**
|
||
|
||
* Assigned from VPC CIDR range
|
||
* Used for internal communication
|
||
|
||
**Public IP**
|
||
|
||
* Assigned automatically to EC2 instances in public subnets
|
||
* Released when instance is stopped
|
||
|
||
**Elastic IP (EIP)**
|
||
|
||
* Static public IPv4 address
|
||
* Remains allocated even if the instance stops
|
||
* Used for failover and stable endpoints
|
||
|
||
---
|
||
|
||
## Database Networking Best Practices
|
||
|
||
* RDS instances should run in **private subnets**
|
||
* Access options:
|
||
|
||
* EC2 in the same VPC
|
||
* Bastion host
|
||
* VPN or Direct Connect
|
||
* NAT Gateway can be used for outbound access (updates, patches)
|