Amazon Web

Services:
Architect
Associate
Certification
AWS Design
Fundamentals
The Thought Process
▪Provide implementation guidance based on best practices
▪Identify and define technical requirements
▪Identify services that meet technical requirements
▪Build secure and reliable applications
▪Basic architecture principles
What We will
Cover
▪How to architect solutions using
AWS services
▪Design solutions based on AWS’s
well architected framework
▪Design patterns for scale,
reliability, and high-availability
▪Best practices based on AWS
recommended architectural
principles
The Well Architected
Framework
AWS Design Pillars
Security Reliability

Performance Cost
Efficiency Optimization

Operational
Excellence
AWS Design Principals
1. Scalability at all levels – compute and data
2. Design with security
3. Removing single points of failure
4. Managed services instead of manual processes
5. Implement caching at each layer
6. Optimize for performance and cost
7. Choose the right database solution
8. Loose coupling with stateless designs
9. Move from fixed servers to disposable resources
The Well Architected Tool
AWS Global
Services
▪Areas of the world where Amazon offers AWS cloud services

▪Each region is a geographical location

▪ Where do you operate?
▪ Where your customers?
▪ Where are you allowed to operate?

▪Each region is completely independent and isolated

▪Pricing differences depending on geographical location (Region) region

▪Resources are not typically replicated across regions unless customers choose to do the manual work

▪Traffic between regions faces additional charge for ingress and egress traffic

Regions
Local Regions

Contains a single Available to select There is a local Complements the Local regions are
data center AWS customers region in Osaka, Asia Pacific (Tokyo) isolated from all AWS
Japan Region Regions
Availability Zones
▪An availability Zone contain at least one data center
▪Most availability zones contain multiple data centers
▪Each availability zone has inexpensive low latency Availability Zone

network connectivity to the other availability zones in the

same region
▪Designing with two AZ’s is best practice Availability Zone

▪Traffic within a region, spanning availability zones, has

additional charges for egress traffic (outgoing)
Availability Zone

region
 Edge Locations
▪Edge locations allow access to Amazon resources
▪Your location and proximity to the best entry point to
Amazon services is determined by Route 53 (DNS)
▪What services are hosted at an Edge location ?

▪ Route 53 – DNS services

▪ CloudFront – Content delivery network

▪ WAF – Web application firewall

Regions and Zones @ AWS
Edge locations @ AWS
Choosing AZ’s Cheat Sheet
▪Utilize 2 availability zones per region
▪ If resources in one AZ fail, or are unavailable, your
application should continue to work from the other AZ

▪AZ’s provide failover and HA design possibilities

▪Two availability zones per region is current best practice
 Availability Zones

Availability Zone Availability Zone Availability Zone

Region
Availability Zones in Operation
▪EC2 instances can launch across multiple subnets hosted
in multiple availability zones
▪ELB can target instances across multiple availability zones
▪Auto Scaling can scale instances across multiple
availability zones
▪Route 53 can distribute traffic across EC2 Instances and
ELB in different AZs and regions
▪RDS solutions are replicated across multiple availability
zones
▪DynamoDB is replicated across multiple availability zones
AZ’s in
Operation
Design Project
1. Customer wants to move their fitness tracker
application from their on premise data center in
Chicago to the AWS cloud.
2. Customers are located on the East and West coast
of North America and Canadian customers are
mostly located in Toronto, Canada.
3. What regions would you choose for hosting the SaaS
application.
4. The application is a SaaS app with no compliance
issues.
Region Possibilities
 Corporate resources are starting to be deployed at AWS
by your developers. Your company wants to ensure
AWS compliance levels match against their corporate
requirements. Choose the two answers that reflect best
practices for carrying out an initial security audit and
compliance review.
[1] Review applicable third-party AWS compliance
Sample AWS reports and attestations

Question [2] Carry out a detailed audit of on-premise computer

operations
[3] Request approval to perform relevant network scans
and penetration tests of your systems instances
[4] Meet with the third-party auditors to discuss AWS
compliance standards
 Corporate resources are starting to be deployed at AWS
by your developers. Your company wants to ensure
AWS compliance levels match against their corporate
requirements. Choose the two answers that reflect best
practices for carrying out an initial security audit and
compliance review.
[1] Review applicable third-party AWS compliance
Sample AWS reports and attestations

Question [2] Carry out a detailed audit of on-premise computer

operations
[3] Request approval to perform relevant network scans
and penetration tests of your systems instances
[4] Meet with the third-party auditors to discuss AWS
compliance standards
VPC Design
VPC Functional Design
▪VPCs span all availability zones per region
▪Subnets are hosted within the selected availability zone
▪EC2 instances and subnets reside within a data center
(AZ)
▪Route tables control subnet traffic flow
VPC Cheat Sheet
▪Internet gateway’s IGW provides access to the Internet
▪Virtual gateway’s VGW provides access to on-premise data
centers
▪A VPC can have one IGW and one VGW
▪NAT servers or services provide outbound Internet access for
instances hosted in private subnets
▪Elastic IP addresses are static persistent public IP addresses
▪Security groups secure instances hosted on subnets
▪NACL’s secure traffic at the subnet layer
▪VPC’s have an option for controlling tenancy of instances
 VPC Components
▪Subnets ▪Elastic network interface (ENIs)
▪Route tables ▪Endpoint - interface, gateway
▪Security groups (SG) ▪Peering
▪Network access control lists (NACLs) ▪NAT instance
▪IP addresses ( Public, Private) ▪DHCP option sets
▪Elastic IP address ▪External connectivity options (VPG,
IGW)
▪NAT gateway service
VPN
Design
 Let’s think about packet flow

Error
Source Destination Data
Checking

Data Packet
Bare Metal Server

Embedded
Router
Bare Metal Server Bare Metal Server

Embedded Embedded
Router Router

IP packet travels across

physical AWS network
Bare Metal Server Bare Metal Server

Embedded Embedded
Router Router

Instance Instance IP Destination Physical IP

Home VPC
Subnet Address Service Address of VPC

IP Packet
One VPC, Two VPC ….
Multiple Virtual Data Centers

Production Development
Multi-VPC Based on Requirements
▪Application isolation – public, private application
stack
▪Production from non-production – multiple
VPC’s
▪Compliance audit containment – multiple VPC’s,
flow logs
▪Multi–tenant isolation – VPC tenancy
▪Business unit design – VPC sharing
▪Shared corporate services – monitoring,
authentication
Multiple VPC Use
Case
▪Multiple VPC’s provide segmentation by default
▪Subnet segmentation not enough for compliance
▪Different rules, routing, requirements

▪VPCs can be interconnected

▪ Peering
▪ Shared
VPC Design Security Criteria
▪Network segmentation – controlling data flow from one
network segment to another
▪Security zoning – isolation of workloads using one or
more solutions
▪ Security management – controlled administration
▪ Network segmentation – control traffic flow
▪ Identity and access – access control
▪ Audit trails – who did what
VPC Reality Check
▪Most AWS services do not reside within a VPC
▪ They can still access resources hosted in your VPCs

▪Managed service are given permission to access your

resources hosted in a VPC (IAM role)
▪Other AWS services can be hosted within a VPC
▪ EC2 instances, Load Balancers, Auto Scaling, EBS
volumes

▪Other AWS services integrate with VPC resources as

required
Services that can be hosted in VPCs
EC2

IGW EBS

NACLs

ELB VPG
Auto
Scale
 AWS Config

CloudWatch CloudTrail
Services that
Trusted
Advisor integrate
IAM Inspector
with VPCs
CloudWatch
Sharing VPC Resources
▪How can we share VPCs?
▪ Enable peering between two VPCs within a region
▪ Enable peering between two VPCs in different regions

▪How can we share VPC resources between different

teams?
▪ Enable peering between two VPCs that have different AWS
accounts

▪How can we provide additional redundancy for our

resources?
▪ Multi-region failover
▪ Cross region replication
Sharing Resource with RAM
▪How can we share VPC resources between different
teams with different accounts?
▪Example: Share a VPC Subnet
▪ Enable AWS Resource Access Manager and share
resources between AWS accounts
▪ Accept invitation to join resource share
▪ Share subnet with AWS account

▪ Owner permissions – control all VPC resources

▪ Participant permissions – control their resources
Design Project
1. Customer wants to share a hosted application in the
AWS between 4 separate divisions, each with their
own current VPC
2. How would the VPCs get linked together
3. What additional services would you use?
Transit
VPC
Example
VPC’s Best Practice
▪Choose two availability zones providing high-availability
and disaster recovery
▪Different subnet types:
▪ Public subnet for external facing resources
▪ Private subnets for internal resources

▪Use Network ACLs to control subnet traffic

▪Custom routing tables for controlled traffic flow
▪Use the highly available NAT gateway service
Subnets
VPC subnet
Subnet Cheat Sheet
▪Subnets map to the availability zone where they are
created
▪Subnets do not span across availability zones
▪CIDR Ranges in VPC can’t overlap (If you want to peer
later)
▪Subnets must be associated with a route table
▪ Route table defines traffic flow
▪Public subnet – Internet gateway (IGW) is attached
▪Private subnet – Virtual Private Gateway (VGW) is
attached
▪Protected subnet – no connectivity from the outside
world
VPC
Subnet
Design
 EC2 instances are deployed in a public subnet of a
custom VPC. What tasks must be completed for the
instance to be accessible from the Internet. Choose all
that apply.
[1 Attach an elastic IP to the instance
Test Question [2] Insure that the associated NACLs restrict traffic flow
to the public subnet
[3] Attach an Internet gateway to the public subnet
[4]Create security groups for port 80 and 443 access
 EC2 instances are deployed in a public subnet of a
custom VPC. What tasks must be completed for the
instance to be accessible from the Internet. Choose all
that apply.
[1 Attach an elastic IP to the instance
Test Question [2] Insure that the associated NACLs restrict traffic flow
to the public subnet
[3] Attach an Internet gateway to the public subnet
[4]Create security groups for port 80 and 443 access
Multiple
Subnets
When to Create
Subnets?
1. You need public infrastructure subnets
(NAT, Bastion, ELB, or DMZ)
2. You need private subnets
3. Your workload needs to be distributed
across multiple availability zones for fault
tolerance
4. Security requirements mandate specific
traffic flow
VPC and NAT Instance
Design Project
1. Design a single AZ VPC / with subnets
2. Design a VPC with Failover and HA
 VPC and Subnet Solution
NAT Gateway NAT Instance

Elastic IPs (Public Route) Public subnet

/20 = 4091 IP addresses

Shared network ACL Private subnet A

/20 = 4091 IP addresses

Custom Network ACL Private subnet B

/20 = 4091 IP addresses

 VPC with HA
VPC

Availability Zone A Availability Zone B

 Developers have created a VPC with both public and private
subnets.
The VPC has CIDR notation of 10.0.0.0/16.
The private subnet uses CIDR 10.0.1.0/24 and the public subnet
uses 10.0.0/24.
Web servers will be hosted in the public subnet using port 80 and
443. The database will be hosted on the private subnet. A NAT
server will be hosted on the public subnet. A security group has
been configured for the Web server instances.
Sample AWS Which of the entries below are required when creating the Web
server’s security group? Choose two answers
Question [1] For Inbound access allow Source: 10.0.0.0/24 on port 80
[2[ For Outbound access allow Destination 0.0.0.0/0 on port 80
[3] For Inbound allow Source on 10.0.0.0/24 on port 443
[4] For Outbound allow Destination 0.0.0.0/0 on port 443
 Developers have created a VPC with both public and private
subnets.
The VPC has CIDR notation of 10.0.0.0/16.
The private subnet uses CIDR 10.0.1.0/24 and the public subnet
uses 10.0.0/24.
Web servers will be hosted in the public subnet using port 80 and
443. The database will be hosted on the private subnet. A NAT
server will be hosted on the public subnet. A security group has
been configured for the Web server instances.

Sample AWS Which of the entries below are required when creating the Web
server's security group? Choose two answers
Question [1] For Inbound access allow Source: 10.0.0.0/24 on port 80
[2[ For Outbound access allow Destination 0.0.0.0/0 on port 80
[3] For Inbound allow Source on 10.0.0.0/24 on port 443
[4] For Outbound allow Destination 0.0.0.0/0 on port 443
 Which of these statements are true when associating a
subnet with a network NCL? Choose all that apply.
[1] All subnets associated with a network ACL will have
the associated rules applied
[2] Subnets can be associated with more than one
network ACL
Sample AWS [3] Subnets can be associated with only one network
Question ACL
[4] Subnets not associated with a custom network ACL
will be associated with the default network ACL
[5] Network ACLs can’t be disassociated from a subnet
after being assigned
 Which of these statements are true when associating a
subnet with a network NCL? Choose all that apply.
[1] All subnets associated with a network ACL will have
the associated rules applied
[2] Subnets can be associated with more than one
network ACL
Sample AWS [3] Subnets can be associated with only one network
Question ACL
[4] Subnets not associated with a custom network ACL
will be associated with the default network ACL
[5] Network ACLs can’t be disassociated from a subnet
after being assigned
EC2 Design
EC2 Cheat Sheet
▪Scaling computing capacity hosted in VPC’s
▪Preconfigured templates for instances called AMIs (Amazon Machine
Image)
▪Secure logon using key pairs
▪Instance types define CPU, RAM, Storage and Networking configuration
▪Persistent storage using EBS volumes
▪Ephemeral storage uses “Temporary” volumes
▪Virtual firewalls called security groups secure your instances
▪Configuration after installation with user data scripts
▪Metadata retrieval using 169.254.169.254 from running Instance
EC2 Deployment Options
▪Core count, memory, storage size and type, network speed
▪F1 – Field programmable gate array FPGA - parallel Processing
▪R4 – Memory intensive applications
▪T2 – Baseline CPU performance with performance burst above
baseline
▪I3 – Fast SSD storage, high OPPS
▪C4 – Compute optimized access to full core control (P - C state)
 EC2 Pricing

On-Demand Instances Reserved Instances (RI)

▪Pay-as-you-go (default) (By the second) ▪One- or three-year terms, scheduled,
Convertible
▪Pay for what you use
▪Prepay for capacity requirements
▪Short-term, unpredictable workloads
▪Predictable usage
▪Pay by the second (Linux), hour (Windows)
▪Upfront payments reduce cost up to 70%
 EC2 Pricing

Spot Instances Dedicated Hosts

▪Bid on unused capacity ▪On-demand pricing by the second
▪Spot price based on supply and demand ▪Purchase as reservation
▪Flexible start / stop times ▪Predictable usage
▪Pay by second of spot price processing ▪Upfront payments reduce cost
per hour (Linux)
▪Complete access to server, control
▪Two-minute warning; must review instance placement
metadata of instance for status
Design Project
▪A customer has a successful SaaS application
that needs to be able to support a large range
of users depending on the time and day.
▪They need 6 web servers, spread across two
availability zones to provide a baseline of
availability
▪At times they require a pool of from 2-6
additional web servers based on demand
Design Solution
▪What instances should be reserved?
▪What instances should be on-demand?
▪What instances should / could be spot?
 Your company is migrating its infrastructure to AWS.
When considering the migration level effort required, a
select number of on-premise VM’s fall under the “very
low effort” category.
After looking at third-party migration options you decide
to utilize available AWS migration tools. What tools are
available for migrating VMs to the AWS cloud? Choose
two answers.
Sample AWS
Question 1. AWS Database Migration Services
2. AWS Server Migration Service
3. AWS Snowmobile
4. AWS Snowball
5. AWS S3 Import /Export
 Your company is migrating its infrastructure to AWS.
When considering the migration level effort required, a
select number of on-premise VM’s fall under the “very
low effort” category.
After looking at third-party migration options, you decide
to utilize available migration AWS tools. What tools are
available for migrating VMs to the AWS cloud? Choose
two answers.
Sample AWS
1. AWS Database Migration Services
Question 2. AWS Server Migration Service
3. AWS Snowmobile
4. AWS Snowball
5. AWS S3 Import /Export
 Failover from an application server hosted on a
dedicated subnet to another application server on
another dedicated subnet is mandated.
In order to test the failover scenario an additional
network interface must be added to each instance.
What two of the following options are correct in respect
to this scenario? Choose two answers.

Sample AWS [1] Each instance must be turned off before adding the
additional interface
Question [2] Each instance can remain running as interfaces can
be attached as a hot attach
[3] Subnets should reside in the same availability zone
[4] Subnets should reside in different availability zones
[5] Subnets must be peered together
 Failover from an application server hosted on a
dedicated subnet to another application server on
another dedicated subnet is mandated.
In order to test the failover scenario an additional
network interface must be added to each instance.
What two of the following options are correct in respect
to this scenario? Choose two answers.

Sample AWS [1] Each instance must be turned off before adding the
additional interface
Question [2] Each instance can remain running as interfaces can
be attached as a hot attach
[3] Subnets should reside in the same availability zone
[4] Subnets should reside in different availability zones
[5] Subnets must be peered together
Golden Image Options
▪EC2 Instances
1. Customize an EC2 instance and save configuration
as an AMI
Launch (many) instances from AMI

2. Update golden image and save configuration as an

AMI
Launch (many) Instances from AMI

▪Amazon RDS instances – Create golden image from a

manual snapshot
▪EBS Volumes – Snapshots of EBS volumes
 You’ve deployed an application in a custom AMI image
into the Amazon cloud. It is deployed in a separate
VPC. You would like to take advantage of being able to
failover to another instance without having to
reconfigure the application. Which of these solutions
could be utilized? Choose two answers.
[1] Use an elastic network interface for failover to
Sample AWS another instance

Question [2] Use load-balancing to balance traffic to additional

application instances
[3] Utilize CloudWatch health checks for failover
[4] Add a secondary private IP address to the primary
network interface that could then be used to move to a
specified instance
 You’ve deployed an application in a custom AMI image
into the Amazon cloud. It is deployed in a separate
VPC. You would like to take advantage of being able to
failover to another instance without having to
reconfigure the application. Which of these solutions
could be utilized? Choose two answers.
[1] Use an elastic network interface for failover to
Sample AWS another instance

Question [2] Use load-balancing to balance traffic to additional

application instances
[3] Utilize CloudWatch health checks for failover
[4] Add a secondary private IP address to the primary
network interface that could then be used to move to a
specified instance
Security
Groups
Security Group Cheat Sheet
▪Security groups are assigned to instances
▪Multiple instances can be assigned the same security
group
▪Security groups allow all outbound traffic by default
▪Security groups process “allow rules”
▪Source or destination rules can point to another security
group
▪Security groups are evaluated as a whole, not in order
 Security Group Design

(ELB Security Group) Allow: Port: 443 Source: 0.0.0.0/0

(Web Tier Security Group) Allow: Port: 80 Source: ELB Security Group

( ELB Security Group) Allow: Port: 8060 Source: Web Tier Security Group

(App Tier Security Group) Allow: Port: 8060 Source: ELB Security Group

(Data tier Security Group) Allow: Port: 3030 Source: App Tier Security Group
 SG Design: Bastion Host
Public Subnet
Security Group Security Group

Private Key Private Key

Private Key’s

Corporate Network
Security Groups Best Practice
▪Avoid allowing incoming traffic on 0.0.0.0/0
▪Control ELB ingress rules using an ELB security group
▪Restrict outbound rules – all outbound ports are open by
default
▪Manage security groups (Trusted Advisor)
▪Control security group modifications (IAM)
▪Review event tracking (CloudTrail)
▪Manage compliance (AWS Config)
Security Group Design
Load Balancing
Load-Balancing FYI
▪Classic load balancer – operates at Layer 4
▪ IP protocol data or HTTP / HTTPS
▪ Supports SSL offload

▪Network load balancer operates at the connection level 4 based on IP

protocol data
▪ NLB routes connections to targets (EC2, and containers)
▪ Integrates with Auto Scaling, Amazon EC2 Container service, and
Route 53
▪ TCP/IP protocol data

▪Application load balancer – operates at Application Layer 7

▪ Routes traffic to targets based on the content of the request
▪ HTTP / HTTPS
▪ Supports SSL offload
▪ Supports WAF (Windows Application Firewall)
ELB Cheat Sheet
▪Provides high-availability by distributing traffic across
multiple targets hosted in single or multiple availability
zones
▪Integrates with CloudWatch
▪Cross zone load-balancing supported
▪Detects unhealthy targets and stops sending traffic
▪Supports connection draining (deregistration)
▪SSL offloading (CLB / ALB)
▪Authentication (ALB)
Load
Balancer
Solution
ELB Best Practices
▪Enable cross-zone load-balancing to distribute requests
evenly across multiple availability zones
▪Terminate SSL on ALB saving CPU time and less
overhead decrypting requests at the instance
▪For multiple region failover consider global load-
balancing utilizing Route 53 and traffic routing policies
▪Monitor your ELB using CloudWatch to manage the
overall health and functionality of your application
deployment
 Monitoring your application servers that are hosted behind an
elastic load balancer you discover that the servers are always
operating between 70 and 85% of their capacity after five minutes
of operation.
In addition, there are a constant number of servers being marked
as unhealthy very early in their initial lifecycle.
Upon further analysis, you also discover that your servers are
taking between three and four minutes to become operational after
launch. What two tasks should you carry out as soon as possible?
Sample AWS Choose two answers.
Question 1. Enable detailed CloudWatch monitoring
2. Increase the length of your health check grace period
3. Decrease the length of your health check grace period
4. Reduce the size of instances in your auto scaling group
5. Increase the size of instances in your auto scaling group
6. Increase the size of instances in your launch config
 Monitoring your application servers that are hosted behind an
elastic load balancer you discover that the servers are always
operating between 70 and 85% of their capacity after five minutes
of operation.
In addition, there are a constant number of servers being marked
as unhealthy very early in their initial lifecycle.
Upon further analysis, you also discover that your servers are
taking between three and four minutes to become operational after
launch. What two tasks should you carry out as soon as possible?
Sample AWS Choose two answers.
Question 1. Enable detailed CloudWatch monitoring
2. Increase the length of your health check grace period
3. Decrease the length of your health check grace period
4. Reduce the size of instances in your auto scaling group
5. Increase the size of instances in your auto scaling group
6. Increase the size of instances in your launch config
Autoscaling
 Autoscaling Cheat Sheet
▪Autoscaling scales EC2 capacity up or down based on defined rules
▪Scale out – increasing the number of Instances
▪Scale in – decreasing the number of Instances
▪Desired state – maintain state

▪ Step scaling – by multiple %

▪Launch Configuration – parameters necessary to create new EC2
instances (Instance size and type, AMI, Key pairs)
▪Auto Scale Group – Max, Min, Desired state
▪Policy – When and how Auto Scale responds
▪Health Check – health status of each instance in auto scaling group
▪Triggers – CloudWatch alarm; scaling up, and scaling down
ELB and Autoscaling

ELB
Autoscaling with Single AZ
Autoscaling with Multi AZ
Regional Load Balancing with Route 53

Amazon
Route 53
Design Project
Scenario: Auto Scaling with CPU Utilization CloudWatch Alarms

Auto Scaling Group:

▪Minimum = 4
▪Maximum = 16

Auto Scaling Policy:

▪CPU Utilization > 60 %
▪Add 4 web servers = Double the policy
Design
Solution
Step Scaling
Add 1 instances when average CPU is
55 – 65 %
Add 2 instances when average CPU is
70 – 90 %
Remove 1 instances when average
CPU is 45 – 55 %
Remove 2 instances when average
CPU is 30 – 40 %
 Web server instances are hosted in auto scaling group.
Monitoring the load of the application over the last 12 months
reveals that 8 servers are required to handle the minimum load.
During a 24-hour period, on average 13 servers are needed.
Three weeks out of the year the number of servers might increase
to 16. What recommendations would you make to minimize
operating costs while providing required availability? Choose two
answers.

Sample AWS [1] 8 reserved instances with heavy utilization, 5 reserved

instances with medium utilization, the rest covered by on-demand
Question instances
[2] 8 reserved instances with heavy utilization, 5 on-demand
instances, the rest covered by on-demand instances
[3] 8 reserved instances with heavy utilization, 5 spot instances,
the rest covered by on-demand instances
[4] 8 reserved instances with heavy utilization, 5 reserved
instances with medium utilization, the rest covered by spot
instances
 Web server instances are hosted in auto scaling group.
Monitoring the load of the application over the last 12 months
reveals that 8 servers are required to handle the minimum load.
During a 24-hour period, on average 13 servers are needed.
Three weeks out of the year the number of servers might increase
to 16. What recommendations would you make to minimize
operating costs while providing required availability? Choose two
answers.

Sample AWS [1] 8 reserved instances with heavy utilization, 5 reserved

instances with medium utilization, the rest covered by on-demand
Question instances
[2] 8 reserved instances with heavy utilization, 5 on-demand
instances, the rest covered by on-demand instances
[3] 8 reserved instances with heavy utilization, 5 spot instances,
the rest covered by on-demand instances
[4] 8 reserved instances with heavy utilization, 5 reserved
instances with medium utilization, the rest covered by spot
instances
Multi-Tier
Design
 Multi-tier Cheat Sheet
▪IAM (User, Group, Role) Route 53, STS are Global and available
across regions
▪Most other AWS services are limited to or within region and do not
copy data across regions unless configured (S3, DynamoDB Global
Tables)
▪AMI are limited to region; can be copied to other region
▪EBS volumes are limited to Availability Zone where created; can be
migrated by creating snapshots and copying to another region
▪Reserved instances are limited to Availability Zones; can’t be migrated
to another region
▪RDS instances are limited to region where created; can be recreated
in a different region using snapshots or promoting a Read Replica
▪S3 data is replicated within the region; can be move to another region
using cross region replication
 Design Toolbox

IAM S3 S3 Glacier
User identity
Backups and storage Data archival
Management

CloudTrail CloudWatch
API audit logging Autoscaling @ Metrics
Amazon
Route 53
Route 53

Availability Zone A Availability Zone B

Public Subnets

Private Subnets
Web layer

Private Subnets
App layer

RDS Master RDS Slave

Private Subnet
CloudWatch
Monitoring
Concepts
CW Monitoring Cheat Sheet
▪Collect and track metrics with CloudWatch
▪ Alert when Instances are under load

▪Collect and monitor log files with CloudWatch logs

▪ Alarm when errors occur in your system logs

▪Monitor EC2 Instances, DynamoDB tables, and RDS

instances
▪Provide automated solutions via CloudWatch, SNS, or
Alerts with Lambda functions
 Metrics Alerts and Actions
EC2 Logs Metrics HTTP

AWS Email
Config
SNS
API Calls CloudWatch
Logs
SMS
CloudTrail

VPC Flow Monitoring Mobile

Logs data Push
 Autoscaling with CloudWatch Events
Schedule-
CloudWatch
based Event

Scale Out Event

Auto Scaling Group Instance launched Instance Attached to ASG

(ASG)

Scale In Event

Instance Terminated Instance Removed from ASG

Schedule-
CloudWatch
based Event
 Your developers have successfully deployed a three-tier
application at AWS. One of the components includes a monitoring
appliance that monitors key components and notifies CloudWatch
when failures occur.
The system works flawlessly however you need to also monitor
the monitoring appliance and be notified when it becomes
unhealthy. How can you quickly achieve monitoring of the
monitoring appliance? Choose one answer.
1. Run an additional monitoring instance that pings the monitoring
Sample AWS instance and alerts the operations team when failures occur.
2. Define a CloudWatch alarm based on EC2 instance status
Question checks for the monitoring appliance; when status checks fail, it
will be auto-recovered.
3. Have the monitoring instance send messages to an SQS
queue, and also queue these messages on another backup
monitoring instance; when the queue stops receiving new
messages, failover to the backup monitor.
4. Create an auto scaling group with a desired state of one
instance
 Your developers have successfully deployed a three-tier
application at AWS. One of the components includes a monitoring
appliance that monitors key components and notifies CloudWatch
when failures occur.
The system works flawlessly however you need to also monitor
the monitoring appliance and be notified when it becomes
unhealthy. How can you quickly achieve monitoring of the
monitoring appliance? Choose one answer.
1. Run an additional monitoring instance that pings the monitoring
Sample AWS instance and alerts the operations team when failures occur.
2. Define a CloudWatch alarm based on EC2 instance status
Question checks for the monitoring appliance; when status checks fail, it
will be auto-recovered.
3. Have the monitoring instance send messages to an SQS
queue, and also queue these messages on another backup
monitoring instance; when the queue stops receiving new
messages, failover to the backup monitor.
4. Create an auto scaling group with a desired state of one
instance
Database
Concepts
RDS Cheat Sheet
▪On-demand provisioning
▪Automated backups
▪Automated recovery
▪User initiated “manual snapshots”
▪Automated replication
▪Change instance size
▪Change storage size
▪Basic monitoring metrics provided through CloudWatch
Selecting the Right Database
▪Read-heavy, write-heavy, balanced
▪What are the read / writes per second ?
▪Is the user pool static or dynamic ? Where are your users
located ?
▪How much data will you need to store ?
▪How long will you need to store your data ?
▪What is the growth pattern over one year, five years ?
▪What is the size of each object ? ( average, minimum,
maximum)
▪How durable does your data need to be ?
Database Scalability
▪Relational databases scale well vertically
▪Upgrade to a larger RDS instance
▪ Add faster storage
▪ IOPS
▪Horizontally scale using read replicas
▪Multi-AZ deployment – synchronously replicated standby
instance in a different AZ
▪ Failure invokes automatic failover to the standby without the
need for manual intervention
▪Sharding – data split across multiple database schemas each
running in its own autonomous primary database instance (A-
E, F-J, etc.)
Database Options
▪DynamoDB
▪ Document data model supports using JSON on documents
stored in Dynamo DB tables
▪ Dynamo DB is designed with automatic synchronous data
replication across three facilities in a region
▪ DynamoDB table can be Local or Global (Across regions)
▪Aurora
▪ Relational database engine with 5 times the performance of
MySQL
▪ Fully managed – 6-way replication across 3 availability
zones
▪ MySQL and PostgreSQL compatible
▪ Database engine integrated with SSD Virtual SAN
▪ Minimal database storage is10 GB; can scale to 64 TB in 10
GB chunks
Understanding Durability
▪Data replication provides the redundant copies of data
▪S3 – multiple copies within the region, versioning, cross
region replication
▪EBS – multiple copies within the facility, manual
snapshots, manual copying between regions
▪Database
▪ Synchronous replication – the transaction is complete only
after it has been durably stored in both the primary and
secondary replicas
▪ Synchronous replication has strong consistency
▪ Asynchronous replication – changes performed on the
primary node are not immediately performed on the replicas
DB Design
 Monitoring your online sales application for the last two
weeks of holiday sales, it is apparent that the database
tier storage design is not sufficient.
Your current database storage type is magnetic and,
currently storage usage is at 70%. What modifications
should you consider for improving performance of your
database? Choose all that could apply.
Sample AWS
Question 1. Increase the number of reads replicas
2. Increase the currently allocated storage size
3. Decrease the currently allocated storage size
4. Change storage type to general-purpose SSD
5. Change storage type to provisioned IOPS SSD
 Monitoring your online sales application for the last two
weeks of holiday sales, it is apparent the database tier
storage design is not sufficient.
Your current database storage type is magnetic and,
currently storage usage is at 70%. What modifications
should you consider for improving performance of your
database? Choose all that could apply.
Sample AWS
Question 1. Increase the number of reads replicas
2. Increase the currently allocated storage size
3. Decrease the currently allocated storage size
4. Change storage type to general-purpose SSD
5. Change storage type to provisioned IOPS SSD
 Your company uses a RDS DB solution deployed
across multi availability zones.
You have defined a maintenance window for Sunday at
2 AM. What system tasks performed by AWS are
carried out during the maintenance window timeframe?
Choose one answer.
Sample AWS
Question [1] Adding additional read replicas
[2] Manual snapshots
[3] Database backups
[4] Minor version upgrades / security patching
 Your company uses an RDS DB solution deployed
across multi availability zones.
You have defined a maintenance window for Sunday at
2 AM. What system tasks performed by AWS are
carried out during the maintenance window timeframe?
Choose one answer.
Sample AWS
Question [1] Adding additional read replicas
[2] Manual snapshots
[3] Database backups
[4] Minor version upgrades / security patching
 What downtime and failover cycle will occur when an
RDS solution deployed in a Multi-AZ environment
resizes the Instance size? Choose two answers

1. The primary database will first be upgraded

Sample AWS
2. The standby database will first be upgraded
Question 3. Failover to the standby database occurs
4. Failover to the primary database occurs
5. The standby database is promoted to the master
 What downtime and failover cycle will occur when an
RDS solution deployed in a Multi-AZ environment
resizes the Instance size? Choose two answers

1. The primary database will first be upgraded

Sample AWS
2. The standby database will first be upgraded
Question 3. Failover to the standby database occurs
4. Failover to the primary database occurs
5. The standby database is promoted to the master
Application
Caching
Concepts
Application Caching
Cheat Sheet
▪Store previously calculated data for future use
▪Improve application performance
▪Store and retrieve information from fast in-memory
caches
▪ElastiCache or read replicas in front of database
servers
 ElastiCache

Reduce load on backend Reduce application latency Increase read throughput

Eliminate database hotspots Predictable performance Reduce database cost

 ElastiCache FYI
▪In-memory Key-value No SQL store
▪3rd party Proxy support for SQL
redis
▪redis and memcached support
▪Fully managed, HA design
▪Open-source compatible
memcached
ElastiCache Operation
Cache Reads

Cache
Updates
RDS Database
Database Reads
Instance
Database Writes
ElastiCache
Read
Replicas
 Session State Caching

Username – P/W
DynamoDB
EC2

Session Cookie
Username – P/W

ELB Create New Session

Session Cookie

Request with
Session Cookie Request with
Session Cookie ElastiCache
EC2 (Redis)
Get Session Info
Edge Caching with CloudFront
▪Copies of static content ( images, videos) and dynamic
content (HTML responses, streaming video)
▪Utilize CloudFront CDN with multiple worldwide edge
locations
▪Content served by cache location closest to end-users
▪Content requests are sent to S3 buckets or origin servers
▪Existing connections between origin servers are reused to
reduce latency, speeding up dynamic content requests
▪CloudFront increases performance for both upload and
download requests at the edge location
Content Delivery
with CloudFront
.php

Application Load
Balancer

S3

S3 bucket with
.jpg objects
Route 53 Amazon
CloudFront

Amazon
Route 53
Application Load
Balancer

Static Content S
stored in S3

Amazon ASG – Web Tier

DynamoDB

App Tier

ElastiCache

A Z -1 A Z -2
 External
Connectivity
 Connectivity
Cheat Sheet
▪VPN connections provide IPSec connections from on premise
data centers to AWS across the Internet

▪The AWS side of the VPN tunnel is the Virtual Private Gateway
(VPG)

▪The customer gateway (CGW) is either a hardware or software

application on the customers side of the VPN tunnel

▪The VPN tunnel is initiated from the CGW to the VPG / VPC

▪VPGs support static and dynamic routing (BGP)

▪The VPN connection on AWS’s side of the tunnel is created with

two tunnels providing high-availability to the VPC
 Hardware VPN
AWS Customer Network

Virtual Private
Gateway
Customer
Gateway
 Redundant Hardware VPN
AWS Customer Network

Customer
Gateway # 1
Virtual Private
Gateway
Customer
Gateway # 2
VPN
Cloud
Hub
 Direct Connect + VPN
Customer Network
AWS

Direct Connect
Public Logical
Connection

Virtual Private
Gateway AWS Direct
Connect Customer
WAN

AWS Direct
VPC
Connect Location
 Your company needs hybrid connectivity to the Amazon
cloud. What two components are required at the
customer site in order to connect successfully to AWS?
Choose one answer
[1] Virtual private gateway
Sample AWS
[2] Virtual private cloud
Question [3] Customer gateway
[4] VPN connection
[5] Direct Connect
 Your company needs hybrid connectivity to the Amazon
cloud. What two components are required at the
customer site in order to connect successfully to AWS?
Choose one answer
[1] Virtual private gateway
Sample AWS
[2] Virtual private cloud
Question [3] Customer gateway
[4] VPN connection
[5] Direct Connect
 Storage
Concepts
EBS Storage
Cheat Sheet
▪EBS network attached block storage
▪EBS volumes cannot be shared with multiple EC2
Instances
▪Multiple volumes can be attached to a single EC2
Instance
▪Volumes can be detached and attached to another EC2
Instance only in the same AZ
▪Snapshots cannot span across regions
▪Snapshots can be restored to a new volume in the
region
▪Snapshots can be copied to a different region and
restored as a volume in the new region
 EBS Workflow
EC2 Instance # 1 EC2 Instance # 2

EBS root Launch EBS root Create EBS root Launch EBS root
volume Instance volume Image volume Instance volume
Snapshot Snapshot

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7

 S3 Storage Cheat
Sheet
▪Object level storage providing high durability; objects stored on three facilities
within a region

▪Storage tiers include Standard, Standard IA, Reduced Redundancy

▪Pre-signed URLs can be used for sharing without requiring AWS security
credentials

▪Security provided by OAI User, signed URL’s for RTMP distribution, or signed
cookies

▪Versioning allows preserving and retrieving every stored object

▪Integrated with CloudTrail, CloudWatch, SNS, and Lambda for event notifications

▪Lifecycle policies control the archiving of S3 data to Glacier vaults

▪Glacier data is automatically encrypted; secure with vault lock policies

Sample AWS
Question
Sample AWS
Question
Stateless
Design
Concepts
Stateless Cheat Sheet
▪No single point of failure
▪SQS – Subscribe to a queue
▪SNS – Subscribe to a notification topic
▪S3 – Web server hosting
▪CloudFront
▪ Cached content from origin
▪ S3 bucket
▪ EC2 instance
▪ On-premise server
Stateless Apps
▪When you interact with an application, do you think
about the integrated back-end components?
▪Stateless components have no knowledge of any
previous activity
▪Compute resources are independent components for
processing
▪Stateless defines a “loose coupling”, or “asynchronous
integration”
Asynchronous Integration
▪Loose coupling between services
▪Useful for designs that do not need immediate response
▪ One component generates the event
▪ Another component processes the event

▪No direct point-to-point interaction between application

components
 Tight Coupling

Server – Account Check Server – Calculate Tax Server – Calculate Shipping

 Loose Coupling
Acct OK Shipping Added

Message
New Order

Check Acct Add Sales Tax

 Design Project: Image Processing
Bucket content
Ingress delivered to
Bucket CloudFront

Thumbnail

ASG Instances

Low-Res
Notification
ASG Instances
SNS Topic

High-Res
ASG Instances
SQS Queues
 Design Project: Voting
Dynamo DB
Tables

Workers Results

Verified Votes

ASG Instances ASG Instances

Queue

Spoiled Votes
AWS Scaling Cheat
Sheet
▪Vertically – Increase RAM, CPU, I/O, or networking
speeds
▪Horizontally – increase the number of resources
▪ Add more EBS hard drives to storage array

▪Scale out: 10 GiG chunks at a time with Aurora

▪Auto scale: add / remove instances to load-balancing
queue
▪Push: ELB, Auto Scaling, SNS, Global load-balancing
with Route 53
▪Pull: Message queue – Simple Queue Service
Lambda
Concepts
Lambda Cheat Sheet
▪ Run code without provisioning or managing server
▪ Upload your code, define resources, define processing time
▪ Lambda code is triggered from other AWS services, or WEB /
mobile app
▪ Code executes in response to triggers
▪ Charges apply for every 100 ms your code executes, and number of
executions
▪ When data is uploaded into bucket
▪ When data is added to a Dynamo DB
▪ When a CloudWatch alarm / alert fires
Design
Project
REPLACE AS MANY RESOURCES
AS POSSIBLE WITH AUTOMATED
SOLUTION
 Buy Concert Tickets

ALB
Synchronous
Replication
Auto Scaling
 Design
Web Site hosted in S3 Solution
S3
Browser requests
content from
CloudFront CloudFront caches Web Site

DynamoDB

Lambda – Writes to Dynamo DB

Lambda – Push notifications to SNS
SQS SNS:

Browser uses Java SDK to

Buy Concert Tickets Notification to
ticket buyers
communicate with Lambda
Automation Cheat Sheet
▪EC2 Auto Recovery – utilize CloudWatch alarm to monitor and
recover impaired EC2 Instances
▪Auto Scaling – scale healthy EC2 Instance capacity up and down,
across multiple availability zones based on your defined
conditions
▪CloudWatch Alarms - when defined metrics, exceed defined
thresholds, for a period of time.
▪CloudWatch Events – near real-time system event stream
describing changes in AWS resources. Rules throughout event
types to Lambda functions, Kinesis streams, SNS topic
▪Lambda Scheduled Events – custom Lambda functions executing
on a schedule
Solving Single
Points of
Failure
Concepts
High Availability Cheat Sheet
▪S3 – Replicated multiple times within the region = FT / HA
▪ELB – Replicated within the availability zone = FT
▪Snapshots increase availability
▪SQS – Highly available and scalable = FT / HA
▪SNS – Highly available and scalable = FT / HA
▪Route 53 – Global “Anycast” DNS service
▪RDS – Synchronous replication between Master and Slave
 Designing with
Redundancy
▪Designing with redundancy removes single points of failure
▪Redundancy designs include standby or active mode

▪Standby Redundancy
▪Functionality is recovered on secondary resources through failover
▪Failover takes time, can be a manual or automated process

▪Active Redundancy
▪Requests are distributed to multiple redundant compute resources
 Pilot Light

Web Web

Systems
off
App App

Database Database Smaller

Data Replication Instance
(Synchronous)
 Pilot Light
AWS

Web Web

Systems
off
App App

Database Database Smaller

Data Replication Instance
(Synchronous)
 Pilot Light
AWS

Web Web

Systems
on
App App

Database Resize
Data Replication Database Capacity
(Synchronous)
 Low Capacity Standby
AWS

Web Web

Low
App Capacity
App

Database Database
Data Replication
(Synchronous)
 Low Capacity Standby

Web Web

Low
App Capacity
App

Database Database
Data Replication
(Synchronous)
 Low Capacity Standby

Web Web

Grow
App App Capacity

Database Database
Data Replication
(Synchronous)
 Active - Active

Web Web

Full
App App Capacity

Database Database
Data Replication
(Synchronous)
Q and A / Wrap-up