Certification

• IAM Credential Reports(all users + various credential + last used)
• IAM Access Advisor(services access & not & permission)

• Don't use root access except to create account
• One physical user = One access user
• Assign user to group & assign permission to group
• Create strong password
• Enforce MFA - virtual, universal, hardware FOB
• Create & use role for giving permission to AWS Service
• Use Access Key for program access (CLI, SDK)
• Audit permission of account using IAM Credential
• Never share IAM user & access key

{
                Version: 2012-10-07
                Id: "s3-access",
                Statement: [
                    {"{"}
                        "sid": 10202
                        "Effect": "Allow" // Deny
                        "Princial": {"{"}
                            "AWS": ["arn.aws..."],
                            "Canonical user": "123",
                            "Federated": []
                        "Resource": "s3:mybucket" //NOT Resource
                        {"}"}
                    {"}"}
                ]
            }

• On-Demand
• Reserved Instanced & Convertible
• Saving Plans - commit of min usage and allow convertible, get charged even not used (used to be Capacity Reserved)
• Spot Instance
• Dedicated Host
• Dedicated Instance

• Lowest Price
• Diversified
• Capacity Optimized
• Price Capacity Optimized

• Cluster - same Az
• Spread - Different region or Az, 1 Az max 7
• Partition - up to 7 partition, partition do not share rack & can be in same Az or not

• gp3 - can increate IOP to 16k, throughput 1000MBis
• gp2 - max 16k with 3 IOP per GB, 5334 max IOPs
• io1 - 4-16GB, max PIOP 64k
• io2 - max 256k with 1000:1, Support EBS multi-attached
• st1 - 125GB-16TB of HDD
• sc1 - infrequent access 250 IOP of Cold HDD

• Data is encrypted when 1) at rest, 2) snapshot and 3) in-flight between instance and volume
• To encrypt un-encrypted data -> snapshot -> copy -> create new EBS

• Provisioned
• Elastic
• Bursting

• Standard
• Infrequent Access(IA)
• Archive
• Lifecycle Policy - Standard to IA

• Application Load Balancer - routing table based on hostname, path, header or querystring. X-Forwarded-For/Port/Proto. Target group can be by ip, instance or lambda.
• Network Load Balancer - 1 EIP, TCP/UDP, NLB can have sub ALB
• Gateway Load Balancer - target group is 3rd-party. GENEVA protocol 6081.

• Only GLB no sticky
• AWSALB and AWSALBAPP is for application based cookie
• AWSALB and AWSALBTG is for duration based cookie

• Up to 15 read replica
• Free if same Az
• Sync for multi Az
• Ansync (Eventually Consistent) for same Az

• Auto Multi Az & Multi Region
• Regional cluster with 1 writer endpoint and reader endpoint
• Only 4 replica up only can write, 3 replica up only can read.
• Machine Learning by SageMaker and Comprehend
• Can have custom endpoint(a reader endpoint) to point specific instance.
• Can use serverless - Aurora Fleet
• Global Aurora - Cross Region or Global DB (1 primary region, up-to-5 secondary region, up-to 16 read replica per region)

• Redis Auth - IAM, use password token or SSL
• Memcache - supports SASL based authentication
• Redis supported sorted set guaranteed.
• Pattern
  • Lazy Loading
  • Write through(add/update db)
  • Session Store(ttl)

• Data encrypted at rest, but KMS must be defined on creation.
• Master not encrypted, replica is not
• To encrypt an unecrypted, go snapshot route
• IAM Authentication except Oracle and SqlServer, but can SSH
• Audit log can be sent to Cloud Watch
• Security Group to control network.

• A - map hostname to ipv4
• A (alias) - like CNAME but have native healthcheck, can set APEX but not TTL
• AAAA - map hostname to ipv6
• CNAME - map hostname to hostname
• NS - name server for hosted zone

• Weighted
• Simple - multiple A with random
• Latency - closest, but you need to set region yourself
• Failover - one primary, one secondary
• Geolocation - same as latency, but specify country. If default is set means have default.
• geoproximity - weighted region
• ip base routing - use CIDR
• multivalue - like simple but add health check

• Calculated Health Check - up to 256 & can be OR/AND, 30 seconds interval with 18% of 2xx or 3xx
• Private Hosted Zone - Have to go thru CloudWatch

• Userbase (IAM)
• Resource based - Bucket Policy / Object ACL / Bucket ACL
• Can be encrypted
• S3 have a Block public access and highest even from IAM and Resource control. Means this have to be enabled before Bucket policy

• When disabled all object have version = null. Important for on and off versioning.
• Suspend versioning does not delete prev version
• Delete versioning only add DELETE MARKER
• If delete a file with version (show version), it is Permanent Delete

• Same Region Replica
• Cross Region Replica
• Only new objects are replicated, but can use S3 Batch Replica to do old
• Able to replicate DELETE MARKERS but need to be enabled. NOTE: records with version are not replicated.
• No chain - do not support bucket 1 TO bucket 2 TO bucket 3

• Standard - have > 3 zones
• Infrequent Access
• Intelligent Tiering
• One Zone IA
• Glacier Storage
  • Instant Retrieval - like I/A min 90days
  • Flexible Retrieval - take 1 - 5 min, 3 - 5 hours, 5 - 12 hours
  • Deep Retrieval - 12 - 48 hours

• use Storage Class Analysis - a tool for Standard and Standard IA to help analyze a report between 24-48 hours
• Move non-current version and can set to permanent delete too.
• Can have delete non-complete multi-part objects
• Rules can be added to tags.
• Can add delete on expire.

• Organization
• Account
• Region
• Bucket

• SSE KMS - cheaper for custom with bucket key
• DSSE KMS - 2 x faster
• SSE-C - https with a key but still via kms, s3-x-ams-server-side header
• Client side encryption

• CORS
• MFA Delete
• Access logs
• Presigned URL - up-to 12 hours, can even delete or upload
• Object Lock
  • Compliance (fixed)
  • Goverenence (some can change)
  • Retention Period (can extend to indefinitely)
  • Legal Hold (with s3:PutObjectLegalHold role, one can change it)
• Access Point: Good for s3 Lambda Function

• All
• class 200 - except south america and australia
• only US and Europe