AWS CLF-C02

前言

官网: https://aws.amazon.com/certification/certified-cloud-practitioner/

知识点

AWS has three fundamental cost drivers: compute, storage, and outbound data transfer.
The pricing model is pay-as-you-go and on-demand, meaning you only pay for what you actually use.
Inbound data transfer to AWS is typically free, and data transfer between AWS services within the same region is also usually free. You’re only charged for outbound data transfer when data leaves AWS to external destinations.

Types of Cloud Computing

There are three types of cloud computing models:

IaaS (Infrastructure as a Service) - You get basic infrastructure like virtual servers. Example: EC2.
PaaS (Platform as a Service) - You deploy applications without managing servers. Example: Elastic Beanstalk.
SaaS (Software as a Service) - You just use ready-made applications. Example: Rekognition.

AWS Global Infrastructure

（1）AWS Region

A region is a cluster of data centers
一个 Region 至少有三个 AZ

（2）AWS Availability Zones

Each availiablity zone (AZ) is one or more discrete data centers in the same location
AZ 组合起来就是 Region
All traffic between Availability Zones (AZ) is encrypted

（3）AWS Points of Presence (Edge Locations)

Content is delivered to end users with low latency

AWS Shared Responsibility Model

AWS负责云本身的安全 - 硬件、设施、基础设施
客户负责云里面的安全 - 你的数据、应用、配置

1. Identity and Access Management

IAM Users & Group

IAM (Identity and Access Management) is a global service for managing users and permissions.

Root account - Created with email and password. Don’t share it with anyone.
Users - Individual people in your organization.
Groups - Collections of users that share the same permissions.
Permissions - Follow the least privilege principle, meaning give users only the minimum access they need to do their job.

IAM Policies

IAM Policies - Define what actions users can perform. Inline Policy is attached directly to individual users.

Password Policy & MFA - Set password requirements for security. MFA (Multi-Factor Authentication) is a best practice, especially for the Root Account.

AWS Access Keys & CLI & SDK

有 3 种方法 Access AWS: AWS Management Console，AWS CLI，AWS SDK

IAM Roles

IAM Roles - Assign permissions to AWS services (not people). For example, an EC2 instance needs a role to access S3.

IAM Guildlines & Best Parctices

Don’t use root account for daily tasks
Enable MFA
Use groups to assign permissions
Use roles for AWS services
Follow least privilege principle

2. Elastic Compute Cloud

AWS EC2 (Elastic Compute Cloud)

60 seconds - There is a one-minute minimum charge for Linux based EC2 instances
Convertible reserved instance (RI): Purchase convertible reserved instance (RI) if you need additional flexibility, such as the ability to use different instance families, operating systems, or tenancies over the reserved instance (RI) term.

EC2 Instance Types

General Purpose - Balanced compute, memory, and networking for most workloads
Compute Optimized - High performance processors for compute-intensive tasks
Memory Optimized - Large memory for processing big datasets
Storage Optimized - High disk performance for storage-intensive tasks

Security Groups

Security Groups - EC2的防火墙，控制进出流量。
一个 Security Group 可以绑定到多个实例。

EC2 Instances Purchasing Options

On-Demand - 按需付费，用多少付多少
Reserved - 长期使用(1-3年)，价格更便宜
Savings Plans - 固定账单，超过部分按On-Demand计费
Spot Instances - 最便宜，但可能随时被收回
Dedicated Hosts - 完全控制一台物理服务器
Capacity Reservations - 短期预留容量，保证有实例可用(即使不用也付费)

3. EC2 Instance Storage

AWS EBS (Elastic Block Store)

Attach EBS to EC2 instance like a USB drive
EBS Volume tied to AZ
Persist data even after termination
Block-level storage
Charge for EBS Volumes: Provisioned IOPS，Volume type

EBS Snapshots (备份)

Make a backup (snapshot) of EBS volume
Recycle Bin 可以防止 Accidental Delete
Amazon Elastic Block Store (Amazon EBS) Snapshots are stored incrementally, which means you are billed only for the changed blocks stored

EC2 Instance Store

物理硬盘，直接连接到服务器。块级存储。超快I/O性能。适合缓存。但实例停止时数据会丢失。

AWS EFS (Elastic File System)

可以 Mount 到多个 EC2 Instance
完全托管的 NFS 文件系统

EBS只能连接到同一AZ的单个实例
EFS可以跨多个AZ、Region和VPC同时被多个实例访问

EFS Infrequent Access (EFS-IA)

Storing files in an accessible location to satisfy audit requirements
You will pay a fee each time you read from or write data stored on the Amazon Elastic File System (Amazon EFS) - Infrequent Access storage class