Aws SnowFamily note

 //aws snowball

- petabytes-scale data transfer service

move data onto aws via physical briefcase computer

============

low cost

- cost thousand of dollar to transfer 100TB over high speed internet.

- snowball bs reduce sampe 1/5 nya

===========

// snowball feature 

- e-ink display

- tamper and weather proof

- encryption 256 bit

- use trusted platform module

- data transfer must completed in 90d for sec purpose

- can import and export from s3

comes in 2size:

50TB ( 42tb of usable space )

80TB  ( 72 tb per node ) 

===========

// snowball edge

- petabytes-scale data transfer service

move data onto aws via physical briefcase computer

++ more storage 

++ more compute capabilities

// features:

- lcd display

- local process and edge computing workload

- can use in a cluster of 5 - 10 device

3 option device :

- storage optimized   /24 vcpu

- compute optimized  / 54 vcpu

- gpu optimized / 54 vcpu

2 option size:

100 tb / 83 tb usable space

100tb clustered / 45 tb per node

==========

// snow mobile

- 45 foot long shipping container pulled y semi trailer trck

transfer 100PB per snowmobile

aws personel will help connect ur network to snowmobile and when

data transfer is complete they drive back and import

into s3 / glacier

security features:

- gps tracking

- alarm monitoring

- 24/7 video surveillence

- escort security vehicle while in transit ( optional )

=========

Amazon S3 note

// s3 simple storage service

object based storage service 

serverless storage in the cloud

ga perlu worry filesystem / disk space

==========

file system storage = manage data as file and fire hierarchy

block storage = manage data as bock within sector and track

s3 = unlimited storage. ga perlu mikirin underlying infra

s3 console provide data buat upload dan access data

s3 object= object contain ur data. kyk files.

- bs nyimpen data dengan zie 0 - 5 terabytes per object.

object consist of:

1 key  : nama object

2 value : datanya dalam bentuk sequence of bytes

3 version ID  : klo versioning enabled, ngetag version object

4 Metadata   : additional information

s3 bucket:

- bucket = berisi object.  atau bs jg dalam bentuk folder. isinya object

bucket name hrs unique.

=========

s3 storage class

1 standard

2 Intelligence tiering

3 standard-IA

4 one zone IA

5 Glacier

6 glacier deep archieve

^ semakin kbwh smakin cheap / murah

// 1 standard  ( by default )

fast, 99% availability ,  11 9's durability replicated across at least 3 AZ

// 2 intelligent tiering

use ML to aalyze ur object usage and determine appropriate storage class.

data dipindah ke most cost effective access tier tanpa impact / added overhead

// 3 standard IA / infrequent access

cheaper, klo kita access file skali sebulan.

ada additional fee buat retreival.

50% less than standard ( reduced availability )

// 4 one zone IA

cheaper than standard IA by 20% less

object cm ada di 1 AZ. 99.5% availability

data could get destroyed

ada retreival fee

// 5 Glacier

long term cold storage, tp retreival data timenya agak lama.

bs menit sampe jam. tp sangat murah dalam segi cost

// 6 glacier deep archive

the lowest cost storage class

data retreival = 12 jam

** glacier = kyk berbentuk service sendiri tp sebenernya bagian dari S3

** smuanya data di replicate lebih dari 3 AZ. kecuali one-zone IA = data cm ada d 1 AZ

** retreival fee dihitung per GB access of data

=========

// s3 security

- smua new bucket are private by default

logging per request can be turned on a bucket.

log generated in a different bucket. // bs di log di akun aws yg berbeda

access control is configured using:  1 BUCKET POLICIES and 2 ACL / Access control list

- Access control list 

legacy features of controlling access to bucket and object.

- bucket policies

use a policy to define complex use case

policy -> statement

misal bucket A cuma boleh di allow via www.toro.com/*

contoh statement policy:

{

"version": "2023-10-18",

"Statement": [

"sid": "PublicReadGetObject",

"Effect": "Allow",

"Principal": "*",

"Action": "s3.GetObject",

"Resource":  "arn:aws:s3:::www.toro.com/*"

]

}

=========

// s3 encryption

traffic between ur local pc and s3 is achieved via SSL / TLS

- Server Side Encryption ( SSE ) - Encryption at Rest

Amazon help u encrypt the object data

s3 managed keys- ( amazon manage all the key )

3 tipe SSE:

SSE-AES  = s3 handle the key, use aes-256 algorithm  ( 256 bytes of length ) 

SSE-KMS  = envelope encryption, AWS KMS and u manage the key

SSE-C    = customer provide key ( u manage key )

- Client side encryption

customer encrypt own file locally sblm diupload ke s3

** KMS = key is encrypted by another key

** security in transit = upload file is done via ssl 

==========

// s3 data consistency

new object / puts

1 read after write consistency

when upload a new s3 object = able to read immediately after writing

overwrite puts or delete object

2 eventual consistently

when overwrite or delete object s3 taes time to replicate data and version to AZ

klo langsung diread = biasana return old copy of data.

butuh waktu few second before reading updated object( setelah replikasi complete ) 

========

// s3 cross region replication ( CRR )

fitur di s3 yg ketika di enabled, smua object yg di upload ke s3 akan di replicate secara otomatis ke region yg berbeda

provides higher durability and potential disaster recovery for object.

** mesti enabling versioning on both on source and destination bucket if want this feature enabled

** customer bisa melakukan CRR replicate to another AWS Account

=========

// s3 versioning

- store all version of an object in s3

- once enabled cannot be disabled, only suspended on bucket

- fully integrates with s3 lifecycle rules

- MFA Delete feature provide extra protection against deleting of ur data

//versioning

- ditag di idnya.

key = gambar1.png

id=1111

   1112

klo accidently delete key dengan id 1112, masih bisa retreive file back dengan id 1111

** klo kita udah bikin versioning klo delete file baru yg lama auto recover.

========

// s3 lifecycle management

- automate process moving object to different storage class or deleting object all together

- bisa dipake bersama dengan versioning

- bisa diapply ke current dan previous version

contoh:

1 customer create object ke s3

2 setelah 7 hari dipindah ke glacier

3 setelah 365 hari permanent delete

** ada opsi nentuin brp X hari sblm mindahin object ke glacier 

=======

// s3 - Transfer Acceleration

fast and secure transfer over long distance between end user and s3 bucket.

- menggunakan cloudfront distributed edge location.

- instead of uploading ur data to bucket, user use distinct URL for an edge location ( nearest edge location - DC )

ketika data sampe ke edge location, automatically routed to s3 over optimized network path ( amazon backbone network )

======

// s3 - Presigned url

digunakan apabila membutuhkan temporary access / allowing user to download file from a password protected part of ur 

web APP. ur web app generates presigned url which will expired after X second.

aws s3 presign s3://mybucket/object1 --expires-in 500

^ digenerate dalam bentuk url yg ada accesskeyID  dan Expires token & signature. cm bisa diakses selama x amount sec

========

// s3 - multi factor auth delete 

memastikan user ga bs delete object dari bucket kecuali punya mfa code.

** cuma bucket owner loggin in as root user / yg punya akses ke MFA can delete object from bucket.

aws s3api put-bucket-versioning \

--bucket XXX \

--versioning-configuration Status=Enabled, MFADelete=Enabled \

--mfa " mfa-sn mfa-code " 

1 AWS CLI must be used to turn on MFA

2 the bucket must have versioning turned on

==========

// public permission object configuration

1 amazon s3 > Permission > uncentang block all public access

2 overview > make public 

object url -> access via browser

========= 

// versioning configuration

1 amazon s3 > properties > versioning

2 enable

- pilihannya cuma enable / suspend

3 cek di s3 > overview > version > show / hide

- muncul version id nya

4 test upload file dengan nama yg sama

=======

// s3 encryption configuration ( server side )

1 amazon s3 > properties > default encryption

2 turn on aes-256 / aws-kms

3 cek di s3 > overview > server-side encryption

=========

// s3 cli

aws s3 ls     // list all current bucket

aws s3 ls toro    // print output inside single bucket 

// download file from local to s3 bucket 

aws s3 cp   s3://toro/1/abc.jpg   ~/desktop/toro

// upload file from local to s3 bucket 

aws s3 cp ~/desktop/toro  s3://toro/1/abc.jpg

// create presigned url  expires in 500s

// create temporary access

aws-s3 presign s3://toro  --expires-in 500

// change s3 storage class to save fulus $ 

1 enter bucket > properties > storage class

2 ubah jadi standard / intelligent-tiering / standard-ia / one zone-ia / glacier / glacier deep archive

// add management lifecycle

1 enter s3 > management > lifecycle > + add lifecycle rule

2 add rule 45 day rule, add tag

3 select current version

- select transition to standard-ia after 45d   // minimal 30d

========

// cross region replication

copy file from 1 budget to another budget / across region / diff awas acct.

1 create another bucket for destination bucket

2 enable version di source and dest bucket

- properties > versioning

3 set replication

- s3 > properties > replication

- set source = entire bucket 

- choose destination bucket

- optional: change storage class

- optional : change object ownership to another aws acct

- create role

wait until replication complete

========

// setup bucket policies

// json document buat bikin complex control access

1 s3 > permission > bucket policy

- create policy dalam bentuk json

- bs copy dari policy generator 

- paste ke bucket policy

- save

** bs bikin policy sapa yg boleh upload ke s3 -> action : put object

AWS shield Standard vs Advanced note

 

// AWS SHIELD advanced WITH WAF

- protect against signature atk

- have ML capabilities.  // can recognize new threat as they evolve

AWS Shield is a service that protects applications against DDoS attacks. AWS Shield provides two levels of protection: Standard and Advanced.

// standard

AWS Shield Standard automatically protects all AWS customers at no cost. It protects your AWS resources from the most common, frequently occurring types of DDoS attacks. 

As network traffic comes into your applications, AWS Shield Standard uses a variety of analysis techniques to detect malicious traffic in real time and automatically mitigates it. 

// advanced

AWS Shield Advanced is a paid service that provides detailed attack diagnostics and the ability to detect and mitigate sophisticated DDoS attacks. 

It also integrates with other services such as Amazon CloudFront, Amazon Route 53, and Elastic Load Balancing. Additionally, you can integrate AWS Shield with AWS WAF by writing custom rules to mitigate complex DDoS attacks.

==========

Amazon Security note

 // security mechanism

- shared responsiblity

//customer

Customers are responsible for the security of everything that they create and put in the AWS Cloud.

When using AWS services, you, the customer, maintain complete control over your content. You are responsible for managing security requirements for your content, including which content you choose to store on AWS, which AWS services you use, and who has access to that content. You also control how access rights are granted, managed, and revoked.

 

The security steps that you take will depend on factors such as the services that you use, the complexity of your systems, and your company’s specific operational and security needs. Steps include selecting, configuring, and patching the operating systems that will run on Amazon EC2 instances, configuring security groups, and managing user accounts. 

============

// aws

AWS is responsible for security of the cloud.

 

AWS operates, manages, and controls the components at all layers of infrastructure. This includes areas such as the host operating system, the virtualization layer, and even the physical security of the data centers from which services operate. 

 

AWS is responsible for protecting the global infrastructure that runs all of the services offered in the AWS Cloud. This infrastructure includes AWS Regions, Availability Zones, and edge locations.

 

AWS manages the security of the cloud, specifically the physical infrastructure that hosts your resources, which include:

Physical security of data centers

Hardware and software infrastructure

Network infrastructure

Virtualization infrastructure

Although you cannot visit AWS data centers to see this protection firsthand, AWS provides several reports from third-party auditors. These auditors have verified its compliance with a variety of computer security standards and regulations.

=============

AWS Identity and Access Management (IAM)

AWS Identity and Access Management (IAM)(opens in a new tab) enables you to manage access to AWS services and resources securely. 

- user permission

> root account user  // can access and controla ny resource in the account

IAM users, groups, and roles

IAM policies

Multi-factor authentication

iam user by default = 0 permision.

dikasih permission br bs add ec2 instance dll.

============

// multi factor authentication

add randomized token. 

password + adding second form of authentication

===========

principle of least privilege

- user is granted on what they need

============

// IAM policy

json document that describe what API calls a user can or cannot make

effect = allow / deny

action = any aws api call

resource = aws api resource

==========

// IAM group

mempermudah policy. grouping of user policy

==========

// IAM Roles 

- associated permission

- no username or pass

- allow or deny

- assumed for temporary amounts of time 

- gain access to temporary permission

- users

- external identities

- applications

- other AWS Services

ketika dipasang roles, abandon all previous policy. dan apply policy roles.

========

// aws organization

- central location to manage multiple aws account

- combine account jadi 1

- bayar2 jadi 1.  / consolidated billing

- hierarchical group of account jadi OU / organizational unit

developer OU 

admin OU

HR OU

legal OU

// service control policies.

- restrict resource each role / individual user can access

- . An SCP affects all IAM users, groups, and roles within an account, including the AWS account root user.

In AWS Organizations, you can apply service control policies (SCPs) to the organization root, an individual member account, or an OU. An SCP affects all IAM users, groups, and roles within an account, including the AWS account root user.

=========

// compliance

- audit / follow the law

consumer data eu = GPDR / General data protection regulation

healthcare us = HIPAA / Health Insurance Portability and Accountability Act

========

// AWS Artifact

- access to compliance reports done by 3rd party with wide range of various standard

// AWS Compliance center

- compliance information all in one place 

- ada aws risk and security white paper

==========

// AWS Key Management Services (KMS)

- key management services.

encryption - securing msg or data in a way  that only authorized parties can access it

key an door.

1 encryption at rest

2 encryption in transit

encryption data at rest is enabled on all dynamodb table data.

encryption data in transit is between server and client

AWS Key Management Service (AWS KMS)(opens in a new tab) enables you to perform encryption operations through the use of cryptographic keys. A cryptographic key is a random string of digits used for locking (encrypting) and unlocking (decrypting) data. You can use AWS KMS to create, manage, and use cryptographic keys. You can also control the use of keys across a wide range of services and in your applications.

========

// Amazon Inspector

improve security and compliance of your aws deployed app.

=========

Amazon Database note

 MySQL, PostgreSQL, Oracle, Microsoft SQL Server,

========

//  Lift-and-Shift

migrate db environtment onprem to cloud

This means you have control over the same variables you do, in your on-premises environment, such as OS, memory, CPU, storage capacity, and so forth.

++ DATABASE MIGRATION SERVICE 

=========

// amazon RDS

running your databases in the cloud is to use a more managed service called Amazon Relational Database Service, or RDS

Amazon Relational Database Service (Amazon RDS)(opens in a new tab) is a service that enables you to run relational databases in the AWS Cloud.

Amazon RDS is a managed service that automates tasks such as hardware provisioning, database setup, patching, and backups. With these capabilities, you can spend less time completing administrative tasks and more time using data to innovate your applications. You can integrate Amazon RDS with other services to fulfill your business and operational needs, such as using AWS Lambda to query your database from a serverless application.

Amazon RDS provides a number of different security options. Many Amazon RDS database engines offer encryption at rest (protecting data while it is stored) and encryption in transit (protecting data while it is being sent and received).

// amazon RDS support

Amazon RDS is available on six database engines, which optimize for memory, performance, or input/output (I/O). Supported database engines include:

Amazon Aurora

PostgreSQL

MySQL

MariaDB

Oracle Database

Microsoft SQL Server

===========

// amazon aurora

support mysql

support postgresql

- price 1/10 cost of commercial db

ada data replication & 6 copy at a time

bs apply 15 read replicas. // offload read and scale performance 

ada continuous backup to s3 ,, ready to restore 

ada point in time recovery : can recover data from specific period

=========

In a relational database, data is stored in a way that relates it to other pieces of data. 

An example of a relational database might be the coffee shop’s inventory management system. Each record in the database would include data for a single item, such as product name, size, price, and so on.

Relational databases use structured query language (SQL) to store and query data. This approach allows data to be stored in an easily understandable, consistent, and scalable way. For example, the coffee shop owners can write a SQL query to identify all the customers whose most frequently purchased drink is a medium latte.

ID Product name Size Price

1 Medium roast ground coffee 12 oz. $5.30

2 Dark roast ground coffee 20 oz. $9.27

=============

// Amazon DynamoDB

- serverless database

table -> 

data organize into item.

item -> attributes

- redundant across AZ

- high performance / ms response time 

- support million of user

- noSQL database

- non relational database

- non schema

- add or remove attribute in table 

- simpler. fast.

- quick in response time and high scalable 

- fully managed

================

Nonrelational databases are sometimes referred to as “NoSQL databases” because they use structures other than rows and columns to organize data. One type of structural approach for nonrelational databases is key-value pairs. With key-value pairs, data is organized into items (keys), and items have attributes (values). You can think of attributes as being different features of your data.

In a key-value database, you can add or remove attributes from items in the table at any time. Additionally, not every item in the table has to have the same attributes. 

Key Value

1

Name: John Doe

Address: 123 Any Street

Favorite drink: Medium latte

2

Name: Mary Major

Address: 100 Main Street

Birthday: July 5, 1994

Amazon DynamoDB(opens in a new tab) is a key-value database service. It delivers single-digit millisecond performance at any scale.

==============

// rds vs dynamoDb

AWS Cloud Practitioners, welcome back to the championship chase of the database! In the relational corner, engineered to remove undifferentiated heavy lifting from your database administrators with automatic high availability and recovery provided. You control the data, you control the schema, you control the network. You are running Amazon RDS. Yes, Yeah. 

The NoSQL corner, using a key value pair that requires no advanced schema, able to operate as a global database at the touch of a button. It has massive throughput. It has petabyte scale potential. It has granular API access. It is Amazon DynamoDB. 

rds: business analytic.

============

// amazon redshift

Amazon Redshift(opens in a new tab) is a data warehousing service that you can use for big data analytics. It offers the ability to collect data from many sources and helps you to understand relationships and trends across your data.

data warehouse => buat big data.

historical analytic opposed to operational analysis.

- data warehouse as a service

-  multiple petabyte size 

- 10 times higher performance than relational db

// amazon redshift spectrum 

- run single sql query against exabytes of unstructured data running in data lakes.

Amazon Redshiftis a data warehousing service that you can use for big data analytics. It offers the ability to collect data from many sources and helps you to understand relationships and trends across your data.

=============

// AWS Database Migration Service (AWS DMS)

migrate existing db between source and target.

source tetep operational pas dipindah

downtime is minimized for app that rely on that database

source and target db ga perlu type yg sama 

mysql - amazon RDS

microsoft sql - amazon RDS

oracle - amazon RDS for oracle 

// compatible database

schema structure 

data type

database code

on premise ec2, amazon rds ------  cloud ec2, amazon rds

// heterogonous database

source dand destination berbeda databasenya.

mesti 2 step process. convert dl pake

AWS Schema Convertion Tool.

// 2 ini ke convert pake aws schema convertion tool

schme structure + 

data type -

database code  +

============

// 3 kegunaan lain DMS:

- development and test database migration  // migrate or copy data to 2nd db

- database consolidation  // gabungin beberapa db menjadi 1 

- continuous database replication   // continous db replication in multiple place

==========

// summary

dynamoDB : great for key value pair  

// amazon DocumentDB  ( with MongoDB Compatibility )

- great for small attributes

contoh: full content management system, catalog, user profile, 

// amazon Neptune

social web media tracking

fraud detection

supply chain. // track assurance that nothing is lost 

// amazon Managed Blockchain

blockchain solution 

- decentralization components.

// amazon Quantum Ledger Database  ( QLDB )

immutable ledger.  any entry can never be removed from audits.

// amazon ElastiCache 

- database accelerators.

bs dikasih caching layer. improve from milisecond to microseconds

ga perlu launch, uplift, maintenance.

comes with both memcached and redis flavors

// amazon DynamoDB Accelerator ( DAX )

- database accelrator for DynamoDB

improving read times for non relational data

=============

best for archival data:

Amazon S3 Glacier Flexible Retrieval

Amazon S3 Glacier Deep Archive

=========

========

AWS Storage note

 // storage access

block level storage = place to store  files  // bytes stores on disk. 

laptop / pc => gunain block level storage. ( hard drive )

// Instance Stores Volume

local Instance Stores Volume: hard drive di ec 2

- attached to ec2 instances 

- temporary block level storage

- lifespan = lifespan of ec2 instance

if stop / deleted ec2 instance all data written to the instance store volume will be deleted.  // dipake sama host lain ketika menjalankan ec2 instance karena sifatnya virtual.

temporary file

scratch data

data easily recreated.

- dont write important data to the drives that comes with  ecs instance.

u dont want important database deleted every time u stop ec 2 instances.

//  Amazon Elastic Block Store  ( EBS )

virtual hard drive / ebs volume.

bs di attach ke ec2 / directly attached

harddrive that is persistent

- can persist between stop and start of an ecs instances.

we define:

size 

type

config

volume that we need.

^ didalam ebs ada snapshost => incremental backup of data.

^ penting buat bikin regular snapshot backup

^ klo harddrive corrupt kita ga lost data

^ bs di restore data dr snapshot

// incremental backup

An EBS snapshot(opens in a new tab) is an incremental backup. This means that the first backup taken of a volume copies all the data. For subsequent backups, only the blocks of data that have changed since the most recent snapshot are saved. 

==================

// amazon simple storage service   

// amazon S3

- storing file

- data store that allow to store and retreive an unlimited amount of data at any scale

- store object in buckets

data that need save elsewhere.

receipt

images

excels

video

text file

maximum object size = 5 TB upload

bs dibikin version object to retain version / prevent accidental delete

bs create multiple bucket and store in diffferent classes or tiers of data

bs create permision who can see and accessing objects

bs stage data between different tiers

tiers:

data need to be used freq

audit data that need retained for several years

===================

// samazon s3  standard = 99.9999999% durability 

-11.9 of durability

remain intact of 1 years 

data stored in a ways aws can sustain 2 concurrent loss of data in 2 separate storage facilities.

> data is stored in at least 3 facilities  // multiple copy resides accross locations.

==================

// s3 static website hosting

- collection of html file, images, etc.

^ bs jd instant website

==================

// s3 standard-infrequent Access  ( s3 standard-IA)

- data accessed less frequent but need rapid access when needed.

- perfect for store backup, disaster recovery files, any object that required long term storage

===============

// s3 glacier flexible retrieval

- retain data for several years for auditing

- dont need to retreive very rapidly

bs simply move data kesini 

atau can create vault then populate them with archieves

Low-cost storage designed for data archiving

Able to retrieve objects within a few minutes to hours

S3 Glacier Flexible Retrieval is a low-cost storage class that is ideal for data archiving. For example, you might use this storage class to store archived customer records or older photos and video files. You can retrieve your data from S3 Glacier Flexible Retrieval from 1 minute to 12 hours.

// s3 glacier vault lock policy

retaining specfici period of time data.  //  lock ur vault for specific time

bs bikin rule =>  write once read many / WORM Policy di s3 glacier

^ lock policy from future edit

3 options for retreival:

- minutes

- hours 

- uploading directly to s3 glacier flexible retrieval / using s3 lifecycle policies

==============

// s3 lifecycle management / policies

- move data automatically between tiers 

1  keep object in standard 90d

2  move to s3 Standard-IA for the  next 30d

3 after 120 day total auto move to s3 glacier flexible retrieval

^ bikin config tanpa ngubah application code

^ perform those move automatically

============

// s3 one zone-infrequent

Stores data in a single Availability Zone

Has a lower storage price than Amazon S3 Standard-IA

Compared to S3 Standard and S3 Standard-IA, which store data in a minimum of three Availability Zones, S3 One Zone-IA stores data in a single Availability Zone. This makes it a good storage class to consider if the following conditions apply:

You want to save costs on storage.

You can easily reproduce your data in the event of an Availability Zone failure.

// s3 glacier instan retrieval

Works well for archived data that requires immediate access

Can retrieve objects within a few milliseconds

When you decide between the options for archival storage, consider how quickly you must retrieve the archived objects. You can retrieve objects stored in the S3 Glacier Instant Retrieval storage class within milliseconds, with the same performance as S3 Standard.

// s3 glacier deep archieve

Lowest-cost object storage class ideal for archiving

Able to retrieve objects within 12 hours

S3 Deep Archive supports long-term retention and digital preservation for data that might be accessed once or twice in a year. This storage class is the lowest-cost storage in the AWS Cloud, with data retrieval from 12 to 48 hours. All objects from this storage class are replicated and stored across at least three geographically dispersed Availability Zones.

// s3 intelligent-tiering

Ideal for data with unknown or changing access patterns

Requires a small monthly monitoring and automation fee per object

In the S3 Intelligent-Tiering storage class, Amazon S3 monitors objects’ access patterns. If you haven’t accessed an object for 30 consecutive days, Amazon S3 automatically moves it to the infrequent access tier, S3 Standard-IA. If you access an object in the infrequent access tier, Amazon S3 automatically moves it to the frequent access tier, S3 Standard.

// s3 outpost

Creates S3 buckets on Amazon S3 Outposts

Makes it easier to retrieve, store, and access data on AWS Outposts

Amazon S3 Outposts delivers object storage to your on-premises AWS Outposts environment. Amazon S3 Outposts is designed to store data durably and redundantly across multiple devices and servers on your Outposts. It works well for workloads with local data residency requirements that must satisfy demanding performance needs by keeping data close to on-premises applications.

============

// data metadata and key

In object storage, each object consists of data, metadata, and a key.

The data might be an image, video, text document, or any other type of file. Metadata contains information about what the data is, how it is used, the object size, and so on. An object’s key is its unique identifier.

when you modify a file in block storage, only the pieces that are changed are updated. When a file in object storage is modified, the entire object is updated.

==============

// EBS VS S3

ebs:

size up to 16 TiB

survive termination ec2 instance

ssd by default

hdd options

s3:

unlimited storage

individual object up to 5tb

write once / ready many

99.999999% durability

s3:

web enabled

regionally distributed

offer cost saving

serverless

object storage: doc, images, file   // everytime a change in object must upload entire file

block storage : blocks.   edit 80gb video.  edit, save. the engine only updates the blocks

==============

// amazon Elastic File System / EFS

- manage filesystem

- shared filesystem accross app

- Multiple instances can access the data in EFS at same time 

- auto scale up and scale down by system

klo ebs:

volume attach to ec2 instance

AZ level resource

need to be in the same  AZ to attach ec2 instance

volume do not auto scale -> klo 5t y 5t

klo efs:

bs multiple instance reading and writing simultaneously

linux true file system

regional resource / can edit between ec2 in same region

automaticaly scale as u write data

==============

AWS Networking note

 // amazon VPC 

amazon virtual private cloud

// amazon virtual private cloud

let u provision a logically isolated section

awas cloud.

- create virtual network environtment

- can public facing / private ( with internet or private )

public subnet

- talk to internet. 

private subnet

- ip internal

===========

public traffic --- internet gateway / IGW --- attach to vpc.

didalem vpc : 

elb

ec2 instance

db

===========

virtual private gateway --- attach to vpc.

^ allow traffic coming from approved network

- bs jg create vpn between private network dr DC ke virtual private  gateway

==========

// aws direct connect

- provide physical line that connect ur network to your aws vpc

connected dedicated fiber connection from DC1 to AWS VPC

- work with direct connect partner in ur area to establish this connection

1 vpc might have multiple type of gateway attached for multiple types of resources.

all reside in same vpc  but in different subnet

===========

// vpc network and acl.

igw --- public subnet --- private subnet 

========

// network ACL

packet yg msk IGW --> akan dicek oleh network access control list 

> The VPC component that checks packet permissions for subnets is a network access control list (ACL)(opens in a new tab).

> A network ACL is a virtual firewall that controls inbound and outbound traffic at the subnet level.

=========

// security group

- tiap ec2 instance yg di create msk kedalem security group

- by default blocking smua incoming traffic

- by default allow smua outbound traffic 

^ hrs dimodify allow certain type of traffic.

If you have multiple Amazon EC2 instances within the same VPC, you can associate them with the same security group or use different security groups for each instance. 

==========

// security group vs network acl

security group = stateful. // by default deny all inbound traffic ,, but allow all return traffic

network acl = stateless.   //  not allow return traffic. need to be specified

^ packet flow mesti didefine.

// stateful

Security groups perform stateful packet filtering. They remember previous decisions made for incoming packets.

Network ACLs perform stateless packet filtering. They remember nothing and check packets that cross the subnet border each way: inbound and outbound. 

When a packet response for that request comes back to the subnet, the network ACL does not remember your previous request. The network ACL checks the packet response against its list of rules to determine whether to allow or deny.

// acl default 

It is stateless and allows all inbound and outbound traffic.

=========

// route 53

- direct dns to public ip

- able to register domain name. can buy and manage right on aws

- direct traffic to different endpoint using several different policy such as :

latency-based routing - bs didirect ke region terkedat

geolocation dns - berdasarkan source user. bs didirect ke region terkedat /  yg berbeda

geoproximity routing

weighted round robin

========

// amazon cloudfront - cdn.

========

// flownya

user -- amazon route 53 -- amazon cloudffront -- amazon elb -- amazon auto scalling --- amazon ec2 instance

=========