AWS Certified Solutions Architect Study Guide with Online Labs

BEN PIPER is an IT consultant who has created more than 30 educational courses covering Amazon Web Services, networking, and automation. Learn more about Ben from his website at www.benpiper.com. DAVID CLINTON is a system administrator, teacher, and writer. He has created training material for subjects including Linux systems, cloud computing (AWS in particular), and container technologies like Docker. David has written books on AWS, Linux administration, and server virtualization. Many of his video training courses can be found on Pluralsight.com.

• Introduction xxvAssessment Test xxxiAnswers to Assessment Test xxxviiPart I The Core AWS Services 1Chapter 1 Introduction to Cloud Computing and AWS 3Cloud Computing and Virtualization 4Cloud Computing Architecture 4Cloud Computing Optimization 5The AWS Cloud 6AWS Platform Architecture 10AWS Reliability and Compliance 13The AWS Shared Responsibility Model 13The AWS Service Level Agreement 14Working with AWS 14AWS Organizations 14AWS Control Tower 15AWS Service Catalog 15AWS License Manager 16AWS Artifact 16The AWS cli 16AWS SDKs 17Technical Support and Online Resources 17Support Plans 17Other Support Resources 18Migrating Existing Resources to AWS 18AWS Migration Hub 19AWS Application Migration Service 19AWS Database Migration Service 19AWS Application Discovery Service 20Summary 20Exam Essentials 21Review Questions 22Chapter 2 Compute Services 25Introduction 26EC2 Instances 27Provisioning Your Instance 27Configuring Instance Behavior 32Placement Groups 33Instance Pricing 33Instance Life Cycle 34Resource Tags 35Service Limits 36EC2 Storage Volumes 36Elastic Block Store Volumes 36Instance Store Volumes 38Accessing Your EC2 Instance 39Securing Your EC2 Instance 41Security Groups 41IAM Roles 41NAT Devices 42Key Pairs 42EC2 Auto Scaling 43Launch Configurations 43Launch Templates 43Auto Scaling Groups 45Auto Scaling Options 46AWS Systems Manager 49Actions 50Insights 52AWS Systems Manager Inventory 53Running Containers 54Amazon Elastic Container Service 54Amazon Elastic Kubernetes Service 55Other Container- Oriented Services 55AWS CLI Example 56Summary 57Exam Essentials 58Review Questions 60Chapter 3 AWS Storage 67Introduction 68S3 Service Architecture 69Prefixes and Delimiters 69Working with Large Objects 69Encryption 71Logging 71S3 Durability and Availability 72Durability 72Availability 73Eventually Consistent Data 73S3 Object Life Cycle 74Versioning 74Life Cycle Management 74Accessing S3 Objects 75Access Control 75Presigned URLs 77Static Website Hosting 77Amazon S3 Glacier 79Storage Pricing 80Other Storage- Related Services 81Amazon Elastic File System 81Amazon FSx 81AWS Storage Gateway 81AWS Snow Family 82AWS DataSync 82AWS CLI Example 83Summary 84Exam Essentials 85Review Questions 86Chapter 4 Amazon Virtual Private Cloud (VPC) 91Introduction 92VPC CIDR Blocks 92Secondary CIDR Blocks 93IPv6 CIDR Blocks 93Subnets 95Subnet CIDR Blocks 96Availability Zones 97IPv6 CIDR Blocks 99Elastic Network Interfaces 99Primary and Secondary Private IP Addresses 100Attaching Elastic Network Interfaces 100Enhanced Networking 101Internet Gateways 102Route Tables 102Routes 103The Default Route 104Security Groups 106Inbound Rules 106Outbound Rules 107Sources and Destinations 108Stateful Firewall 108Default Security Group 109Network Access Control Lists 110Inbound Rules 110Outbound Rules 113Using Network Access Control Lists and Security Groups Together 114AWS Network Firewall 115Public IP Addresses 115Elastic IP Addresses 116AWS Global Accelerator 118Network Address Translation 119Network Address Translation Devices 120Configuring Route Tables to Use NAT Devices 121NAT Gateway 121NAT Instance 122AWS PrivateLink 123VPC Peering 123Hybrid Cloud Networking 124AWS Site- to- Site VPN 125AWS Transit Gateway 125AWS Direct Connect 133High- Performance Computing 134Elastic Fabric Adapter 135AWS ParallelCluster 136Summary 136Exam Essentials 137Review Questions 138Chapter 5 Database Services 143Introduction 144Relational Databases 144Columns and Attributes 144Using Multiple Tables 145Structured Query Language 146Online Transaction Processing vs. Online Analytic Processing 147Amazon Relational Database Service 148Database Engines 148Licensing Considerations 149Database Option Groups 150Database Instance Classes 150Storage 151Read Replicas 154High Availability (Multi- AZ) 155Single- Master 156Multi- Master 157Backup and Recovery 157Automated Snapshots 157Maintenance Items 158Amazon RDS Proxy 158Amazon Redshift 159Compute Nodes 159Data Distribution Styles 159Chapter 6 Redshift Spectrum 160AWS Database Migration Service 160Nonrelational (NoSQL) Databases 161Storing Data 161Querying Data 161Types of Nonrelational Databases 162DynamoDB 162Partition and Hash Keys 163Attributes and Items 164Throughput Capacity 165Reading Data 167Global Tables 168Backups 168Summary 168Exam Essentials 169Review Questions 170Authentication and Authorization— AWS Identity and Access Management 175Introduction 176IAM Identities 176IAM Policies 177User and Root Accounts 178Access Keys 180Groups 181Roles 182Authentication Tools 183Amazon Cognito 183AWS Managed Microsoft AD 183AWS Single Sign- On 184AWS Key Management Service 184AWS Secrets Manager 184AWS CloudHSM 185AWS Resource Access Manager (AWS RAM) 185AWS CLI Example 185Summary 187Exam Essentials 187Review Questions 189Chapter 7 CloudTrail, CloudWatch, and AWS Config 193Introduction 194CloudTrail 195Management Events 195Data Events 196Event History 196Chapter 8 Trails 196Log File Integrity Validation 198CloudWatch 199CloudWatch Metrics 200Graphing Metrics 201Metric Math 203CloudWatch Logs 205CloudWatch Alarms 208Amazon EventBridge 211AWS Config 212The Configuration Recorder 213Configuration Items 213Configuration History 213Configuration Snapshots 213Monitoring Changes 214Summary 216Exam Essentials 216Review Questions 218The Domain Name System and Network Routing: Amazon Route 53 and Amazon CloudFront 223Introduction 224The Domain Name System 224Namespaces 225Name Servers 225Domains and Domain Names 226Domain Registration 226Domain Layers 226Fully Qualified Domain Names 227Zones and Zone Files 227Record Types 227Alias Records 228Amazon Route 53 228Domain Registration 229DNS Management 229Availability Monitoring 231Routing Policies 232Traffic Flow 234Route 53 Resolver 234Amazon CloudFront 235AWS CLI Example 237Summary 238Exam Essentials 238Review Questions 239Chapter 9 Data Ingestion, Transformation, and Analytics 243Introduction 244AWS Lake Formation 244Ingestion 245Transformation 245Analytics 245AWS Transfer Family 246Kinesis 246Kinesis Video Streams 246Kinesis Data Streams 247Kinesis Data Firehose 248Kinesis Data Firehose vs. Kinesis Data Streams 248Summary 249Exam Essentials 249Review Questions 250Part II Architecting for Requirements 255Chapter 10 Resilient Architectures 257Introduction 258Calculating Availability 258Availability Differences in Traditional vs. Cloud- Native Applications 259Know Your Limits 262Increasing Availability 262EC2 Auto Scaling 263Launch Configurations 263Launch Templates 263Auto Scaling Groups 265Auto Scaling Options 266Data Backup and Recovery 270S 3 270Elastic File System 271Elastic Block Storage 271Database Resiliency 271Creating a Resilient Network 272VPC Design Considerations 272External Connectivity 273Simple Queue Service 273Queues 274Queue Types 275Polling 276Dead- Letter Queues 276Designing for Availability 276Designing for 99 Percent Availability 277Designing for 99.9 Percent Availability 278Designing for 99.99 Percent Availability 279Summary 280Exam Essentials 281Review Questions 282Chapter 11 High- Performing Architectures 289Introduction 290Optimizing Performance for the Core AWS Services 290Compute 291Storage 295Database 298Network Optimization and Load Balancing 299Infrastructure Automation 302CloudFormation 302Third- Party Automation Solutions 309Reviewing and Optimizing Infrastructure Configurations 310AWS Well- Architected Tool 311Load Testing 311Visualization 312Optimizing Data Operations 313Caching 313Partitioning/Sharding 315Compression 315Summary 316Exam Essentials 316Review Questions 318Chapter 12 Secure Architectures 323Introduction 324Identity and Access Management 324Protecting AWS Credentials 325Fine- Grained Authorization 325Permissions Boundaries 327Roles 328Enforcing Service- Level Protection 334Detective Controls 335CloudTrail 335CloudWatch Logs 335Searching Logs with Athena 336Auditing Resource Configurations with AWS Config 338Amazon GuardDuty 339Amazon Inspector 342Amazon Detective 343Security Hub 344Amazon Fraud Detector 344AWS Audit Manager 344Protecting Network Boundaries 344Network Access Control Lists and Security Groups 345AWS Web Application Firewall 345AWS Shield 345AWS Firewall Manager 346Data Encryption 346Data at Rest 346Data in Transit 348Macie 349Summary 349Exam Essentials 350Review Questions 351Chapter 13 Cost- Optimized Architectures 357Introduction 358Planning, Tracking, and Controlling Costs 358AWS Budgets 359Monitoring Tools 360AWS Trusted Advisor 361Online Calculator Tools 362Cost- Optimizing Compute 363Maximizing Server Density 364EC2 Reserved Instances 364EC2 Spot Instances 365Auto Scaling 368Elastic Block Store Lifecycle Manager 368Summary 368Exam Essentials 369Review Questions 370Appendix A Answers to Review Questions 375Chapter 1: Introduction to Cloud Computing and AWS 376Chapter 2: Compute Services 377Chapter 3: AWS Storage 380Chapter 4: Amazon Virtual Private Cloud (VPC) 381Chapter 5: Database Services 383Chapter 6: Authentication and Authorization— AWS Identity and Access Management 386Chapter 7: CloudTrail, CloudWatch, and AWS Config 388Chapter 8: The Domain Name System and Network Routing: Amazon Route 53 and Amazon CloudFront 390Chapter 9: Data Ingestion, Transformation, and Analytics 392Chapter 10: Resilient Architectures 393Chapter 11: High- Performing Architectures 397Chapter 12: Secure Architectures 399Chapter 13: Cost- Optimized Architectures 401Appendix B Additional Services 405Deployment Tools 406AWS Amplify 406AWS Serverless Application Repository 406AWS Proton 407Developer Tools 407Amazon API Gateway 407AWS Device Farm 407AWS Step Functions 407Infrastructure Tools 408AWS Outposts 408AWS Wavelength 408VMware Cloud on AWS 408Connectivity Tools 409Amazon Pinpoint 409AWS Transfer Family 409AWS AppSync 409Database Tools 410Amazon DocumentDB (with MongoDB Compatibility) 410Amazon Keyspaces (for Apache Cassandra) 410Amazon Quantum Ledger Database (QLDB) 410Data Streaming Tools 410Amazon Managed Streaming for Apache Kafka (MSK) 410Amazon MQ 411AWS Data Exchange 411Amazon Timestream 411AWS Data Pipeline 411Amazon AppFlow 411Machine Learning and Artificial Intelligence 412Amazon Comprehend 412Amazon Forecast 412Amazon Lex 412Amazon Polly 412Amazon Rekognition 413Amazon Textract 413Amazon Transcribe 413Amazon Translate 413Other Tools 413AWS Batch 413AWS X- Ray 414Amazon Kendra 414Amazon OpenSearch Service (Amazon Elasticsearch Service) 414Amazon Managed Grafana 414Amazon Managed Service for Prometheus 415Index 417