
# EBS - Elastic Block Store

An Amazon EBS volume is a durable, block-level storage device that you can attach to your instances. After you attach a
volume to an instance, you can use it as you would use a physical hard drive. EBS volumes are flexible. For
current-generation volumes attached to current-generation instance types, you can dynamically increase size, modify the
provisioned IOPS capacity, and change volume type on live production volumes.

You can use EBS volumes as primary storage for data that requires frequent updates, such as the system drive for an
instance or storage for a database application. You can also use them for throughput-intensive applications that perform
continuous disk scans. EBS volumes persist independently from the running life of an EC2 instance.

You can attach multiple EBS volumes to a single instance. The volume and instance must be in the same Availability Zone.
Depending on the volume and instance types, you can use Multi-Attach to mount a volume to multiple instances at the same
time.

![Elastic Block Store](ebs-volume.png)

### EBS Snapshots

Amazon EBS provides the ability to create snapshots (backups) of any EBS volume and write a copy of the data in the
volume to Amazon S3, where it is stored redundantly in multiple Availability Zones. The volume does not need to be
attached to a running instance in order to take a snapshot. As you continue to write data to a volume, you can
periodically create a snapshot of the volume to use as a baseline for new volumes. These snapshots can be used to create
multiple new EBS volumes or move volumes across Availability Zones. Snapshots of encrypted EBS volumes are automatically
encrypted.

When you create a new volume from a snapshot, it's an exact copy of the original volume at the time the snapshot was
taken. EBS volumes that are created from encrypted snapshots are automatically encrypted. By optionally specifying a
different Availability Zone, you can use this functionality to create a duplicate volume in that zone. The snapshots can
be shared with specific AWS accounts or made public. When you create snapshots, you incur charges in Amazon S3 based on
the volume's total size. For a successive snapshot of the volume, you are only charged for any additional data beyond
the volume's original size.

Snapshots are incremental backups, meaning that only the blocks on the volume that have changed after your most recent
snapshot are saved. If you have a volume with 100 GiB of data, but only 5 GiB of data have changed since your last
snapshot, only the 5 GiB of modified data is written to Amazon S3. Even though snapshots are saved incrementally, the
snapshot deletion process is designed so that you need to retain only the most recent snapshot.

![EBS Snapshot](ebs-snapshot.png)

# EC2 Instace Store

EBS volumes are network drives with good but limited performance, if you need a high-performance hardware disk, use EC2
Instance Store.

An instance store provides temporary block-level storage for your instance. This storage is located on disks that are
physically attached to the host computer. Instance store is ideal for temporary storage of information that changes
frequently, such as buffers, caches, scratch data, and other temporary content. It can also be used to store temporary
data that you replicate across a fleet of instances, such as a load-balanced pool of web servers.

An instance store consists of one or more instance store volumes exposed as block devices. The size of an instance store
as well as the number of devices available varies by instance type.

![EC2 Instace Store](ec2-instance-store.png)

# EFS - Elastic File System

Amazon EFS provides scalable file storage for use with Amazon EC2. You can use an EFS file system as a common data
source for workloads and applications running on multiple instances.

With Amazon EFS, storage capacity is elastic. It grows and shrinks automatically as you add and remove files. Your
applications can have the storage they need and when they need it.

![EFS](efs.png)

# FSx

Amazon FSx makes it easy and cost effective to launch, run, and scale feature-rich, high-performance file systems in the
cloud. It supports a wide range of workloads with its reliability, security, scalability, and broad set of capabilities.
Amazon FSx is built on the latest AWS compute, networking, and disk technologies to provide high performance and lower
TCO. And as a fully managed service, it handles hardware provisioning, patching, and backups -- freeing you up to focus
on your applications, your end users, and your business.

You can choose between four widely-used file systems: NetApp ONTAP, OpenZFS, Windows File Server, and Lustre.

# AMI - Amazon Machine Images

An Amazon Machine Image (AMI) is a supported and maintained image provided by AWS that provides the information required
to launch an instance. You must specify an AMI when you launch an instance. You can launch multiple instances from a
single AMI when you require multiple instances with the same configuration. You can use different AMIs to launch
instances when you require instances with different configurations.

An AMI includes the following:

-   One or more Amazon Elastic Block Store (Amazon EBS) snapshots, or, for instance-store-backed AMIs, a template for
    the root volume of the instance (for example, an operating system, an application server, and applications).
-   Launch permissions that control which AWS accounts can use the AMI to launch instances.
-   A block device mapping that specifies the volumes to attach to the instance when it's launched.

You can launch an instance from an existing AMI, customize the instance (for example, install software on the instance),
and then save this updated configuration as a custom AMI. Instances launched from this new custom AMI include the
customizations that you made when you created the AMI.


EC2 Instance Storage


Amazon EC2 is one of the most used and most basic services on AWS that lets users launch and manage server instances, at
any time and for as long as they need, with over 500 instances and choice of the latest processor, storage, networking,
operating system, and purchase model to help you best match the needs of your workload.

Using Amazon EC2 eliminates your need to invest in hardware up front, so you can develop and deploy applications faster.

# EC2 Mainly Capibilities

-   Renting Virtual Machines (EC2)
-   Storing data on virtual drives (EBS)
-   Distributing load across machines (ELB)
-   Scaling the services using an auto-scaling group (ASG)

# EC2 User Data

It is possible to bootstrap our instances using an **EC2 User Data** script, meaning we can launch commands when the
instance first starts. These commands are used to automate boot tasks such as installing updates, installing softwares,
downloading common files from the internet and doing anything you can think of.

# EC2 Instance Types

### General Purpose

-   Great for a diversity of workloads such as web servers or code repositories
-   Balance between compute, memory and networking

### Compute Optimized

-   Great for compute-intensive tasks that require high performance processors:
    -   Batch processing workloads
    -   Media Transcoding
    -   High performance web servers
    -   High performance computing (HPC)
    -   Scientific modeling & machine learning
    -   Dedicated gaming servers

### Memory Optmized

-   Fast performance for workloads that process large data sets in memory
-   Use cases:
    -   High performance, relational/non-relational databases
    -   Distributed web scale cache stores
    -   In-memory databases optimized for BI (business intelligence)
    -   Applications performing real-time processing of big unstructured data

### Storage Optimized

-   Great for storage-intensive tasks that require high, sequential read and write acces to large data sets on local
    storage
-   Use cases:
    -   High frequency online transaction processing (OLTP) systems
    -   Relational & NoSQL databases
    -   Cache for in-memory databases (for example Redis)
    -   Data warehousing applications
    -   Distributed files systems

# Security Groups

**Security Groups** are the fundamental of network security in AWS. They control how traffic is allowed into or out of
EC2 Instaces. Security Groups only contains **_allow_** rules and they can reference by IP or by security group

Security Groups acts like a **_firewall_** on EC2 instances, they regulate access to Ports, IP ranges and control
inbound and outbound network.

They can be attached to multiple instances at the same time, but they are locked down to a region / VPC combination.
They live outside the EC2 instance, if traffic is blocked the EC2 instance won't see it. All inbound traffic is blocked
by default and all outbound traffic is authorised by default.

![Security Groups](security-groups.png)

# EC2 Instace Roles

EC2 Instance Role provides the Instance access to a set of IAM Credentials and – if the associated IAM Policies permit –
access to AWS services.

# Summary

-   **EC2 Instance:** AMI (OS) + Instance Size (CPU + RAM) + Storage + Security Groups + EC2 User Data
-   **Security Groups:** Firewall attatched to the EC2 instance
-   **EC2 User Data:** Script launched at the first start of an instance
-   **EC2 Instance Rolse:** Instance access to a set of IAM Credentials and AWS services
-   **Purchasing Options:** On-Demand, Spot, Reserved (Standard + Convertible + Scheduled), Dedicated Host, Dedicated
    Instance


EC2 - Elastic Compute Cloud


With AWS Identity and Access Management (IAM), you can specify who or what can access services and resources in AWS,
centrally manage fine-grained permissions, and analyze access to refine permissions across AWS.

### What are IAM Users?

This is any identity (humans or an application) that requires long term access to AWS resources. These entities make
requests to IAM to get authenticated before any interaction with AWS resources is allowed to happen.

### IAM Groups

IAM users can be placed in an IAM groups. IAM groups makes it easier to organize a large number of users and apply
permissions on a group level instead of an individual level. Groups can only contain users, but not other groups. Users
don't have to belong to a group, and a user can belong to multiple groups.

![IAM Groups](iam-groups.png)

### IAM: Permissions

**Users or Groups** can be assigned JSON documents called policies. These policies define the **permissions** of the
users.

You can think of these policies as how AWS authenticates a user or group to ensure that they are only allowed to access
and control permissions that were granted to them.

In AWS you apply the **least privilege principle**, which means you don't give more permissions than a user needs.

![IAM Permissions](iam-permissions.png)

### IAM: Password Policy

-   Strong passwords - higher security for your account
-   In AWS, you can setup a password policy:
    -   Set a minimun password length
    -   Require specific character types:
        -   Uppercase letters
        -   Lowercase letters
        -   Numbers
        -   Non-alphanumeric characters
    -   Allow all IAM users to change their own passwords
    -   Require users to change their password after some time (password expiration)
    -   Prevent password re-use
-   Multi Factor Authentication - MFA
    -   User is granted access only after successfully presenting two or more pieces of evidence to an authentication
        mechanism
    -   If a password is stolen or hacket, the account is not compromised

### IAM Roles for Services

Some AWS service will need to aperform actions on your behaulf. To do so, we will assign **permissions** to AWS services
with **IAM Roles**

An IAM role is similar to an IAM user, in that it is an AWS identity with permission policies that determine what the
identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to
be assumable by anyone who needs it.

-   Common roles:
    -   EC2 Instace Roles
    -   Lambda Function Roles
    -   Roles for CloudFormation

![IAM Roles](iam-roles.png)

### IAM Security Tools

-   IAM Credentials Report (account-level)
    -   A report that lists all your account's users and the status of their various credentials
-   IAM Access Advisor (user-level)
    -   Access advisor shows the service permissions granted to a user and when those services were last accessed
    -   You can use this information to revise your policies

### IAM Guidelines & Best Practices

-   Don't use the root account except for AWS account setup
-   One physical user = One AWS user
-   **Assign users to groups** and assign permissions to groups
-   Create a **strong password policy**
-   Use and enforce the use of **Multi Factor Authentication (MFA)**
-   Create and use **Roles** for giving permissions to AWS services
-   Use Access Keys for Programmatic Access (CLI / SDK)
-   Audit permissions of your account with the IAM Credentials Report
-   **Never share IAM users & Access Keys**


IAM - Identity and Access Management


# How Websites Works

We have a server hosted somewhere, and we as a web browser want to get access to that server to visualize a website.
What we are going to do as a client is use a network, a network between our selfs and the server. The client will find
the network and will use it to route the data into the server, then the server will reply to us and we will get the
response and view the website.

For the clients to find the server and the server to find the client you need to have IP address. The client has an IP
address and the server has an IP address, that way you can send requests to whatever server you want and the server can
know how to find you back.

![How Websites Works](how-website-works.png)

### What is a server composed of?

-   **Compute**: CPU

    -   Responsible for doing computations and calculations.

-   **Memory**: RAM

    -   Very fast memory which allow us to store information and retrieve it quickly.

-   **Storage**: Data

    -   Long term storage data, for example files.

-   **Database**

    -   Store data in a structured way. Easy to seach and query.

-   **Network**: Routers, switch, DNS server

### IT Terminology

-   Network: cables, routers and servers connected with each other

-   Router: A networking device that forwards data packets between computer networks. They know where to send your
    packets on the internet.

-   Switch: Takes a packet and send it to the correct server/client on your network.

![Switch vs Router](switch-vs-router.png)

### Traditional IT

Traditional IT infrastructure is made up of physical hardware, like a desktop computer, which is connected to a network
via a remote server. The server is installed on the premises and gives anyone who has access to the hardware a view into
stored data and applications. When the time comes to scale up, businesses with this IT model typically need to purchase
additional hardware and upgrades which can be quite costly. Often, it is the IT department that is responsible for
installing and maintaining this hardware.

![Traditional IT](traditional-it.png)

### Problems with traditional IT approach

-   Pay for the rent for the data center

-   Pay for power supply, cooling, maintenance

-   Adding and replacing hardware takes time

-   Scaling is limited

-   Hire 24/7 team to monitor the infrastructure

-   How to deal with disasters? (earthquake, power shutdown, fire)

# What is Cloud Computing

Cloud computing is the on-demand delivery of compute power, database storage, applications and other IT resources.
Though a cloud services platform you get a **pay-as-you-go** pricing, which means you're only going to pay for what you
requested, when you requested it and as you use it, when you're done using it, you're not going to pay it anymore. You
can provision exactly the right type and size of computing resources you need. You can access as many recources as you
need. almost instalty, you don't need to order it in advance. Simple way to access servers, storage, databases and a set
of application services.

![Cloud Computing](cloud-computing.png)

### The Deployment Models of the Cloud

-   Pivate Cloud:

    -   Cloud services used by a single organization, not exposed to the public
    -   Complete control
    -   Security for sensitive applications
    -   Meet specific business needs
    -   Example: Rackspace

-   Public Cloud:

    -   Cloud resources owned and operated by a third-party cloud service provider delivered over the internet
    -   Example: Azure, Google Cloud, AWS

-   Hybrid Cloud:
    -   Keep some servers on premises and extend some capabilities to the Cloud
    -   Control over sensitive assets in your private infrastructure
    -   Flexibility and cost-effectiveness of the public cloud
    -   Ecample: On-premises and AWS

### Characteristics of Cloud Computing

-   On-demand self service:

    -   Users can provision resources and use them without human interaction from the service provider

-   Broad network access:

    -   Resources available over the network, and can be accessed by diverse client platforms

-   Multi-tenancy and resource pooling:

    -   Multiple customers can share the same infrastructure and applications with security and privacy
    -   Multiple customers are serviced from the same physical resources

-   Rapid elasticity and scalability:

    -   Automatically and quickly acquire and dispose resources when needed
    -   Quickly and easily scale based on demand

-   Measured service:
    -   Usage is measured, users pay correctly for what they have used

### Advantages of Cloud Computing

-   Trade capital expense (CAPEX) for operational expense (OPEX)

    -   Pay On-Demand: don't own hardware
    -   Reduced Total Cost of Ownership (TCO) & Operational Expense (OPEX)

-   Benefit from massive economies of scale

    -   Prices are reduced as AWS is more efficient due to large scale

-   Stop guessing capacity

    -   Scale based on actual measured usage

-   Increase speed and agility

-   Stop spending money running and maintaining data centers

-   Go global in minutes: leverage the AWS global infrastructure

### Problems solved by the cloud

-   Flexibility: change resource types when needed

-   Cost-Effectiveness: pay as you go, for what you use

-   Scalability: accommodate larger loads by making hardware stronger or adding additional nodes

-   Elasticity: ability to scale out and scale in when needed

-   High-availability and fault-tolerance: build across data centers

-   Agility: rapidly develop, test and launch software applications

# Type of Cloud Computing

-   Infrastructure as a Service (IaaS)

    -   Provide building blocks for cloud IT
    -   Provides networking, computers, data storage space
    -   Highest level of flexibility
    -   Easy parallel with traditional on-premises IT
    -   Example: Amazon EC2 (on AWS)

-   Platform as a Service (PaaS)

    -   Removes the need for your organization to manage the underlying infrastrcture
    -   Focus on the deployment and management of your applications
    -   Example: Elastic Beanstalk (on AWS)

-   Software as a Service (SaaS)
    -   Completed product that is run and managed by the service provider
    -   Example: Google Apps (Gmail), Dropbox, Zoom

![Type of Cloud Computing](type-of-cloud-computing.png)


Hi, I am Matheus

Featured Posts

EC2 Instance Storage

EC2 - Elastic Compute Cloud

IAM - Identity and Access Management

What is Cloud Computing?