AWS Certified Cloud Practitioner Certification Course 2026 (CLF-C02) - Pass the Exam!

[00:00] Hey, this is Andrew Brown, your favorite [00:02] tech instructor, bringing you another [00:04] certification course. And this time it's [00:05] the adabus cloud practitioner, also [00:08] known as the CLF CO2. And the way we are [00:11] going to get certified is, as always, [00:13] we're going to go through key lecture [00:15] materials to memorize key information, [00:17] doing hands-on labs in our own accounts, [00:19] and as always, I provide you a free [00:21] practice exam over on exampro.co. [00:25] And if you like the content you see [00:27] here, especially these certification [00:28] courses, the best way to support them is [00:30] to purchase the optional paid materials. [00:32] That's how you support the creation of [00:34] these courses. So, uh, we have that over [00:36] on examro.co/clfco2. [00:38] But do not forget about your publishers [00:40] as this is the way you get this content. [00:42] So, remember that you can donate to [00:44] freocamp.comdonate [00:46] uh, and help everybody out here. Um, [00:50] just if you don't know me, I've been [00:51] teaching a lot of courses over the [00:53] years. I was previously a CTO for many [00:55] years, so I'm very very technical. But [00:57] we have taught things like Adabus, [00:58] Azure, GCP, Kubernetes, data bricks, [01:00] Nvidia, and more. So you're in really, [01:02] really good hands. Um, and that's about [01:05] it. So let's jump into the course. [01:10] Hey, this is Andrew Brown and we're at [01:12] the start of our journey asking the most [01:13] important question first, which is what [01:15] is the cloud practitioner? So this is an [01:17] entry-level ad of certification teaching [01:18] you the cloud fundamentals. It gives you [01:21] a close look at Adabus core services. So [01:22] that's going to be your compute, [01:23] storage, networking, databases. It gives [01:25] you a quick look at the vast amount of [01:28] ADA services and there are a lot uh but [01:30] we will try not to go too crazy uh and [01:33] covering every single one just the ones [01:34] that matter. The course code for the [01:36] certification is CLF CO2, but people [01:38] commonly refer to this as the CCP, but [01:41] just remember what the actual course [01:42] code is as if it changes that's how you [01:44] know that there's probably a major [01:46] refresh and so make sure you look for [01:48] the latest course code content. Okay. Um [01:50] adabus is the leading cloud service [01:52] provider in the world. Um and the [01:54] starting point for everybody generally [01:56] be is the adabus cloud practitioner. So [01:58] no matter um you know what provider [02:00] you're using this one is probably the [02:02] best certification out of all the cloud [02:05] certifications. So uh if you're if [02:07] you're starting here at your starting [02:08] point you're at the best position. So [02:10] who's the certification for? consider [02:12] the ad certification. Um, if you are new [02:15] to cloud and you need to learn the [02:16] fundamentals, you're an executive [02:18] management or sales level uh person and [02:20] you're trying to acquire a strategic [02:22] information about cloud adoption for [02:24] migration or maybe you're just a senior [02:26] cloud engineer or solution architect and [02:28] you're looking to do a reset or refresh [02:30] as every few years uh the stuff changes [02:32] and you need to keep on top of it. So it [02:34] this starts for everybody. It's not just [02:36] for uh folks that are new to the cloud. [02:39] What is the value of the certification? [02:40] Well, um, this provides you basically an [02:44] expansive view of the cloud architecture [02:46] in AD as services or what I like to say [02:48] it gives you a bird's eye view or the [02:50] 50,000 ft view. And so this will give [02:54] you the idea of big picture thinking. It [02:57] allows you to zoom out and assess the [02:59] cloud and as landscape for changes, [03:01] trends, opportunities um and just being [03:04] strategic about the approach and process [03:06] um for your journey. Okay. Uh so what is [03:10] the value of the certification? Well, [03:11] it's not a hard exam and it's not going [03:13] to validate that you can build cloud [03:15] workloads. Um but for technical [03:17] implementation roles, it's still not [03:19] going to be enough uh to basically get [03:21] you a job. But the point is is that it's [03:24] something that you do need to cover and [03:25] it is essential content. So no matter [03:28] what, you need to do this certification. [03:30] Okay? And I find that a lot of other um [03:33] content creators, they will actually [03:34] skip content until you go right to the [03:36] solution architect, but you are missing [03:38] key information. So make sure you start [03:41] at the starting block here um which is [03:43] the ads cloud practitioner. So let's [03:45] just take a look at our road map. And so [03:46] the idea here is that uh the ads cloud [03:49] practitioner is obviously the starting [03:50] point. There is now another uh [03:52] foundational certification the AI [03:54] practitioner but I would say that you [03:56] still need to have adabus uh cloud [03:58] practitioner knowledge before you move [03:59] on to that. But the most common path [04:01] after cloud practitioner is a solution [04:02] architect associate with the cloud ops [04:04] engineer being second, developer being [04:06] third. Some people swap those two as [04:08] some people find the cloud ops engineer [04:10] being more difficult. So maybe it's [04:11] third in line there. Uh but yeah, the [04:14] most common line I'm just going to get [04:15] my pen tool out here is going to be [04:17] cloud practitioner, solution architect, [04:18] and essay pro. Okay, but it really just [04:21] depends on what uh role you're [04:23] targeting. So you can see here I've I've [04:25] labeled a bunch of possible roles that [04:27] you might be considering. There's even [04:28] newer titles out now like production [04:30] engineer and things like that that I [04:32] don't have on here. Uh but generally, [04:34] you know, all knowledge is good [04:36] knowledge. So, whatever path you take, I [04:37] think you're going to be in good shape. [04:39] Okay. I do want to point out that ADA [04:41] certifications do not validate [04:42] programming, technical diagramming, code [04:43] management, and many other technical [04:45] skills that are required for obtain [04:46] technical roles. But lucky for you, I [04:49] try to sneak this stuff in the course [04:50] because I know that uh some folks just [04:52] want to pass, but uh there's also other [04:54] people that need to know how to do the [04:56] job. And so I try to uh put that stuff [04:58] in without making the course too long or [05:00] too bloated. Uh so hopefully you [05:02] appreciate uh that extra effort there. [05:05] How long will it take to study for this [05:06] certification? Well, it depends. If [05:08] you're a beginner, 30 hours. Um if you [05:11] have experience, you can get this done [05:12] in 6 hours, even less if you watch it on [05:14] two times speed. So I'd probably say 24 [05:17] hours is the average study time. [05:18] Splitting your time between lectures and [05:20] labs and practice exams, studying for [05:22] one or two hours a day for 14 days. Um, [05:25] what does it take to pass this exam? [05:27] Well, watch the video lecture, memorize [05:29] key information, do the hands-on labs in [05:30] your own accounts, and go get some [05:33] online practice exams. Over Exam Pro, we [05:35] give you a free one, but we also have [05:37] paid ones uh there as well. We do not [05:40] use AI to generate them out. They are [05:42] made by hand. We go sit the exams. So, [05:44] you're going to get quality uh exam uh [05:47] exam uh practice exams on our site. Uh, [05:50] I should just point out that for this [05:52] certification, you can get away without [05:54] doing the hands-on labs, but I would [05:57] strongly recommend that you do it [05:58] because it does help cement the [05:59] knowledge. Most people do not fail this [06:01] exam if they uh stick to the course [06:05] curriculum here. Okay. Uh there are four [06:07] domains in the certification. We have uh [06:09] cloud concepts, security, compliance, [06:11] cloud technologies and services, [06:13] billing, pricing and support. So the [06:15] most of the knowledge is going to be in [06:16] that cloud technology services. So [06:18] that's why we cover so many so many [06:21] different services. Okay. Uh where do [06:23] you take this exam? Well, before there [06:25] used to be two different test sites, but [06:26] now it's just Pearson View. You can do [06:28] it online or at a partnered uh test [06:31] center. I prefer the test centers as I [06:33] find them less stressful if you are near [06:35] one because the whole environment is [06:37] controlled. Whereas at home uh if [06:39] somebody walks in or your kid makes a [06:41] noise or whatever that could cause you [06:43] to fail the exam. But you know if you [06:44] are not near a test center then do what [06:46] you can. Okay. These exams are [06:48] proctored, meaning that someone is [06:50] supervising them. Maybe it's using AI as [06:52] well. Um, but the idea here is that you [06:55] aren't just able to get up and walk [06:57] around. You have to make sure that you [06:59] show people your desk and that you are [07:01] set up uh in a way that you aren't [07:03] cheating. Um, just to ensure that these [07:06] uh certifications um people aren't just [07:08] cheating and getting them. Okay. Uh, the [07:10] passing grade here is 70%. So, we say [07:12] around 70% because you could get exactly [07:14] 70% and fail. So, always aim about 15% [07:17] more. So, um I would say that uh if [07:21] you're getting 85% on our practice [07:23] exams, then you're probably going to get [07:24] 75% on the exam. That's what I find. [07:25] It's like a 10% difference. Um so, aim [07:28] for that 85% and then you'll probably [07:31] get 75% and you'll have that 5% uh [07:33] buffer margin. There is no reason to try [07:36] to target to get 100%. That's not going [07:38] to be good for you. It's best to just [07:40] pass this and move on to the next [07:41] certification. So, that's that 8020 [07:43] rule. Okay, folks. There are 65 [07:45] questions on this exam. There are 50 [07:47] that are scored, 15 that are unscored. [07:49] You can afford to get 15 wrong. There's [07:51] no penalty for wrong questions. So, [07:53] absolutely make sure that you choose [07:56] uh uh any possible option that you can. [07:58] We have multiple choice and multiple [08:01] answer for these unscored questions. The [08:03] reason why they have them is is that [08:04] they're just making sure that nobody is [08:07] cheating. Okay. So, um it also allows [08:09] them to evaluate the introduction of new [08:10] questions. Um making sure that the exam [08:13] is not too easy. And of course to [08:14] prevent uh dumps and stuff like that. So [08:16] if you encounter questions you've never [08:18] studied for that seem really hard, keep [08:20] your cool and remember that they may be [08:21] unscored questions. The duration of the [08:24] exam is 1.5 hours. So that gives you 1.5 [08:26] minutes per question. The exam time is [08:29] 90 minutes, but the seat time is 120 [08:31] minutes. Seat time is the amount of time [08:32] you should allocate for the exam. This [08:34] includes time to review the [08:35] instructions, show online proctor your [08:37] workspace, read and accept the NDA, [08:39] complete the exam, provide feedback at [08:41] the end. Um the certification is valid [08:43] for 36 months or three years before [08:45] reassertification. Um and that is it. [08:48] Okay. [08:54] Hey, this is Andrew Brown from Exam Pro [08:56] and we are at the start of our journey [08:57] asking the most important question [08:58] first, which is what is cloud computing? [09:01] So cloud computing is the practice of [09:03] using a network of remote servers hosted [09:05] on the internet to store, manage, and [09:07] process data rather than a local server [09:10] or personal computer. And so when we're [09:12] talking about on premise, you own the [09:14] servers, you hire the IT people, you pay [09:16] or rent the real estate, you take all [09:18] the risks. But with a cloud provider, [09:21] uh, someone else owns the servers, [09:23] someone else hires the IT people, [09:24] someone else pays or rents the real [09:26] estate, and you are responsible for [09:28] configuring cloud services and code, and [09:30] someone takes care of the rest of it for [09:32] you. Okay. [09:38] So to understand cloud computing, we [09:39] need to look at the evolution of cloud [09:41] hosting going all the way back to 1995 [09:44] where if you wanted to host your website [09:46] or web app, you'd have to get a [09:48] dedicated server. So that would be one [09:50] physical machine dedicated to a single [09:52] business running a single project, a [09:54] site or an app. And as you can imagine, [09:56] these are expensive because you have to [09:58] uh buy outright the hardware, have a [10:01] place to store it, the network [10:02] connection, having a person to maintain [10:04] it. um but it did give you a guarantee [10:06] of high security um and they still do as [10:09] of today. So this model hasn't gone away [10:11] but it's been specialized for a [10:13] particular use case. Then came along the [10:15] virtual private server. So the idea is [10:17] we still had one physical machine but [10:19] now we were able to subdivide um our [10:22] machine into submachines via [10:24] virtualization. [10:25] And so essentially you're running a [10:27] machine within a machine. And so you had [10:29] better utilization of that machine um [10:32] running multiple web apps as opposed to [10:34] having a physical machine per project. [10:36] So you got better utilization and [10:38] isolation of resources. And so uh these [10:42] two options still required you to [10:43] purchase a machine, a dedicated machine. [10:46] And so that was still kind of expensive. [10:48] But then came along shared hosting. And [10:50] so if you remember uh the mid 2000s like [10:53] with GoDaddy or HostGator or any of [10:55] those sites where you had really cheap [10:57] hosting, the idea is that you had this [10:59] one physical machine shared by hundreds [11:01] of businesses. And the way this worked, [11:04] it relied on uh tenants underutilizing [11:06] their resources. So you know, you [11:08] wouldn't have a sub machine in there, [11:10] but you'd have a folder with permissions [11:11] that you could use. Um and so you would [11:14] really share the cost. And this was [11:16] very, very cheap. Um but you were [11:18] limited to whatever that uh machine [11:20] could do and you were very restricted in [11:22] terms of the functionality you had and [11:24] there was just poor isolation meaning [11:26] that you know if one person decided to [11:28] utilize a server more they could hang up [11:30] all the all the websites on that single [11:32] server. Then came along cloud hosting [11:35] and the idea is that you have um [11:36] multiple physical machines that act as [11:38] one system. So this is distributed [11:40] computing and so the system is [11:42] abstracted into multiple cloud services [11:44] and the idea is that you basically get [11:46] the advantages of a lot of the things [11:48] above. So it's flexible. You can just [11:51] add more servers. Um it's scalable, it's [11:54] very secure because you get that uh [11:56] virtual isolization. You get it [11:58] extremely at a low cost because you're [12:00] sharing that cost with the users. Where [12:02] in the shared hosting it might be [12:03] hundreds of businesses, we're looking at [12:05] thousands of businesses. And it was also [12:07] highly configurable because it was a [12:09] full virtual machine. Now uh cloud [12:11] actually uh still includes all of these [12:14] types of hosting. They haven't gone [12:15] away. Uh but it's just the idea that you [12:18] now have more of a selection for your [12:20] use case. Uh but hopefully that gives [12:21] you an idea uh what cloud hosting looks [12:23] like and it really has to come down to [12:25] distributed computing. Okay. [12:31] Hey, this is Andy Brown from Exam Pro [12:33] and before we talk about AWS, we need to [12:35] know what is Amazon. And so Amazon is an [12:37] American multinational computer [12:38] technology corporation headquartered in [12:40] Seattle, Washington. And so this is the [12:43] Seattle skyline with the Space Needle. [12:45] And Amazon was founded in 1994 by Jeff [12:48] Bezos. And the company started as an [12:50] online store for books and expanded to [12:52] other products. So as you can see, this [12:54] is Jeff Bezos a long time ago, and he [12:57] has this interesting spray painted sign, [12:59] and his desk is held up by cinder [13:01] blocks. and it looks like his uh desk is [13:04] like an old uh table or something and [13:07] he's working really late and he used to [13:09] be a millionaire at this time and he [13:11] would be driving into work in his Honda [13:13] Accord because you know he just his [13:16] motivation was always to put all the [13:17] money back into the company. So, it [13:19] really shows that he worked really hard [13:21] and it did pay off because Amazon has [13:23] expanded uh beyond just an online [13:25] ecommerce store into a lot of different [13:27] things such as cloud computing, which is [13:29] Amazon Web Services, digital streaming [13:31] such as Amazon Prime Video, Prime Music. [13:34] They bought Twitch.tv. They own the [13:37] Whole Foods Market grocery store. They [13:39] have all this artificials intelligence. [13:41] They own low orbit satellites. Uh, and a [13:44] lot more stuff. It's hard to list it [13:46] all. And so Jeff Bezos today is not the [13:51] um the CEO. It's actually Andy Jasse is [13:54] the current CEO of Amazon. He was [13:55] previously the CEO of AWS. So Jeff Bezos [13:57] can focus on space travel. So there you [14:00] go. [14:06] Hey folks, it's Andrew Brown and we are [14:07] taking a look at what is Amazon Web [14:10] Services. It's what Amazon calls their [14:12] cloud provider service commonly referred [14:14] to just as AWS. [14:17] Um, and we can see this name change [14:19] reflected in the old logo to the new [14:21] one. So, uh, they used to use the full [14:22] name. Now it's just AWS and everyone [14:24] knows what AWS is. I like the little [14:27] yellow boxes, but sometimes you will see [14:28] at reinvent people with those shirts and [14:31] it tells you they've been using ASUS a [14:32] long time. So, those are people you want [14:34] to listen to. Um, but anyway, AWS um, [14:37] basically became a cloud service [14:39] provider in 2006 and has been the [14:42] leading provider ever since. Um, and [14:45] cloud service provider is a term that [14:47] you're going to want to remember, [14:48] especially in its initialized form, CSP. [14:51] We'll cover more in detail what makes a [14:54] cloud service provider, but you can [14:56] guess it means that they have a [14:57] collection of cloud services together. [14:59] Um, so you saw that asterct on that 2006 [15:02] because AWS existed before 2006. Um, and [15:06] their first service became available in [15:08] 2004. Can you guess what service it was? [15:10] Was it virtual machines? Was it uh cloud [15:13] storage? No, it was SQS uh the simple Q [15:16] service. So this launched in 2004 which [15:19] was followed by um simple storage [15:21] service S3 in 2006 of March and then [15:24] elastic compute um cloud which was their [15:27] virtual machines in August of 2006. And [15:29] so now we are starting to see a [15:31] collection of services. We can call it a [15:33] cloud service provider. Technically uh [15:35] if you want to say who was first as a [15:37] cloud service provider, it probably was [15:39] Google. But um what everybody was really [15:41] using especially in the startup scene [15:43] was AWS. I remember in the uh late 2000s [15:47] that if your startup was using Amazon [15:49] web services even though it was more [15:51] expensive than virtual private servers [15:53] that was a strong indicator that uh you [15:55] were doing the right thing um for [15:58] whatever reason but at that time I did [15:59] not enjoy using adabus. Now I I know it [16:02] very well. So uh once you know something [16:04] it's great but that time I did not enjoy [16:06] it. Um, but anyway, in 2010, that was [16:10] the time when Amazon said that, hey, [16:13] we've migrated all of our infrastructure [16:14] over uh to AWS. Okay. Um, I believe [16:18] though they were still running Oracle [16:20] servers, but on their infrastructure, [16:22] but then eventually they would move over [16:24] to DynamoB, which was also very [16:25] impressive. But anyway, the point is is [16:28] that um they had migrated over and so [16:30] that was a very impressive feat. Uh, [16:33] another thing that kind of uh, started [16:35] this whole cloud certifications thing [16:37] was Adabus because they started offering [16:40] uh, their certification programs um, in [16:44] 2013. So, you know, I got into [16:46] certifications for Adabus in 2016. [16:50] That's how long I've been doing it for, [16:51] but uh, obviously they're around before [16:53] that, but Adabus really did standardize [16:56] and make uh, cloud certifications really [17:00] really useful. Um, but uh, yeah, there [17:04] you go. [17:10] All right. So, what I want to do here is [17:11] expand on what is a cloud service [17:14] provider, also known as a CSP, just [17:16] because there's a lot of things out in [17:17] the market there that might look like a [17:19] CSP, uh, but they actually are not. So, [17:22] let's go through this list and see what [17:24] makes a CSP. So this is a company which [17:27] provides multiple cloud services ranging [17:30] from tens to hundreds of services. Those [17:32] cloud services can be chained together [17:34] to create cloud architectures. Those [17:36] cloud services are accessible via a [17:38] single unified API. So in Adabus's cases [17:41] that is the AWS API. Um and from that [17:44] you can access the CLI, the SDK, the [17:46] management console. Those cloud services [17:49] utilize metered billing based on usage. [17:51] So this could be per second, per hour, [17:53] uh VPCUs, memory, storage, things like [17:57] that. Those cloud services have rich [17:58] monitoring built in. So you know, every [18:01] API action is tracked and you have [18:04] access to that. So in Ados's case, it's [18:06] AOS cloud trail. And the idea here is [18:09] those cloud services have infrastructure [18:11] as a service offering. So AAS, that [18:14] means they have networking, compute, uh [18:17] storage, databases, things like that. [18:19] Those cloud services offers automation [18:22] via infrastructure as code. So you can [18:24] write code to set everything up. And so [18:26] here's just kind of a example of an [18:28] architecture where we have a very simple [18:31] uh web application running on EC2 behind [18:33] a load balancer with the domain with [18:35] R53. But the idea is just to show you [18:37] that you know you're chaining these [18:38] things together. If a company offers [18:41] multiple cloud services under a single [18:43] UI but do not meet most of or all of [18:45] these requirements, it would just be [18:46] referred to as a cloud platform. So when [18:49] you hear about Twilio or Hashi Cororp or [18:51] Data Bricks, those are cloud platforms [18:54] and AWS, Azure, GCP are cloud service [18:58] providers. Okay. [19:03] All right. Let's take a look here at the [19:05] landscape of cloud service providers. [19:06] This is generally broken down into tier [19:08] one, tier two, tier three. But I've [19:10] modified it to give each tier its own [19:12] name as I don't like to think of them as [19:14] rankings and more so that uh these cloud [19:16] service providers are specialized uh for [19:19] a particular thing. Um and I've also [19:21] added a fourth tier because you know the [19:22] internet has always talked about three [19:24] tiers but there really is a fourth tier [19:25] and I wanted to make sure we had uh the [19:27] full scope here included. So in the top [19:30] tier you're going to recognize uh some [19:33] common names there. Amazon Web Service, [19:35] Microsoft Azure, Google Cloud Platform, [19:37] and Alibaba Cloud. In North America and [19:40] Europe, uh AWS, Azure, and GCP are known [19:42] as the big three. Um but Alibaba Cloud [19:45] is huge as well if you're in the Asia [19:47] region, specifically China. So, it's [19:49] really just going to be dependent on [19:51] where you live, where uh which are [19:53] considered the most um commonly known or [19:55] popular. Uh but we'll talk about that [19:57] here in a moment. But the reason um I [20:00] call tier one top tier is that these are [20:03] you know very well-known providers. [20:05] They're early to market. They have [20:07] strong synergies between their services. [20:09] Um they're just really good cloud [20:11] service providers. You cannot go wrong [20:13] with uh these providers. Then we have [20:15] our tier 2 or I would call our midtier. [20:18] Uh these are backed by really well-known [20:20] tech companies. But I would just say [20:22] that um their ability to become top tier [20:25] uh did not work out the way they [20:27] planned. So IBM at one point was looking [20:29] to be a top tier provider. Um but they [20:32] just did not keep up with um AWS and [20:35] they just slipped into this mid-tier and [20:38] kind of specialized at least for a while [20:40] into ML AI services and now they're just [20:43] more like very expensive um enterprise [20:47] managed infrastructure [20:49] for their existing clientele. Oracle um [20:53] very very inexpensive. That's their [20:55] play. They try to uh be the cheapest, [20:58] but their uh service um overall is not [21:03] uh fun to use. Interestingly enough, I [21:05] believe Microsoft Azure was just signing [21:07] a contract to use Oracle Cloud. So, it's [21:09] not unusual for some of these cloud [21:10] service providers or these organizations [21:12] to use other providers because they want [21:15] to use their global infrastructure. But, [21:18] uh yeah, Oracle Cloud is uh not doing [21:21] that great. There are other ones in the [21:24] uh Asia region like uh Hawaii cloud and [21:27] 10-centent cloud. I honestly don't know [21:29] a whole lot about them, but they do show [21:30] up on the magic quadrant. So, it's [21:33] possible in the Asia region that these [21:35] are the big three. and uh AWS, Azure, [21:38] and GCP do not play a larger role, but [21:40] from our perspective, I put them into [21:43] that mid tier because they just don't [21:44] have global uh awareness or global um [21:48] market dominance like the other three uh [21:51] up there. Looking at the elite tier, uh [21:54] these were traditionally virtual private [21:57] servers. So, they just specialized in [21:58] that and they turned to offer more core [22:01] infrastructure service offerings. So, we [22:04] have a vulture. I always thought it was [22:06] pronounced Voltater but it's actually [22:07] Vulture Digital Ocean and Akami [22:10] connected cloud which was formerly known [22:11] as Lenoid or Leno. Um so they merged [22:15] their companies together and I mean they [22:18] want to be like a cloud service [22:20] providers but they're very very light in [22:22] terms of their offering. So um you know [22:25] they'll have things like serverless and [22:28] being able to run a Kubernetes cluster [22:30] and some cloud storage and stuff but [22:32] they won't have things like um the the [22:35] same level of event driven um metered [22:38] billing or or other kinds of uh [22:41] functionality that you you come to [22:43] expect in the top tiers. But you know if [22:45] you're working with a smaller [22:46] organization they are a lot simpler to [22:48] uh to utilize. So they are a great [22:51] introduction to cloud for companies that [22:52] find the top tier uh too complex. And [22:55] then looking at the fourth tier, I call [22:57] this the private tier. This is uh [22:59] basically software that you can deploy [23:01] onto your own uh machines in your data [23:04] centers to get the same kind of um [23:07] functionality that you would if you were [23:09] using let's say AWS or any of these [23:11] other providers. And um you know [23:13] previously I would put OpenStack into [23:15] the mid tier because in a sense that it [23:17] was kind of like a cloud service [23:19] provider that was using uh uh quite a [23:21] bit but I didn't feel like it h had good [23:23] fit there. So that's why we made this a [23:24] fourth tier and we have a few different [23:26] softwares. We have OpenStack Apache [23:29] Cloud Stack those are both open source [23:30] and there's VMware vSphere. I have an [23:33] asterk there because it's not really the [23:36] same thing but it is used a lot [23:38] everywhere to manage a lot of virtual [23:40] machines. And so I I kind of feel like [23:43] it should fit in there. But that gives [23:45] you kind of an idea of the landscape of [23:47] cloud. And we'll see you in the next [23:48] one. [23:54] All right, let's talk about how do we [23:56] know that AWS is the uh leader in cloud [24:00] service providers? Well, some folks [24:02] would say look at the Garter magic [24:04] quadrant for cloud. Um Garter is a [24:07] company that produces reports. Um and so [24:11] basically they are industry analysis [24:13] trying to predict the future. And so [24:15] they came up with this thing called the [24:16] magic quadrant. It's a series of market [24:19] research reports uh published by IT [24:21] consulting firms that rely on [24:23] proprietary uh qualitative data analysis [24:27] methods to demonstrate market trends [24:29] such as directions, maturity, and [24:32] participants. Okay. And so here you can [24:34] see uh AWS and they're right at the top. [24:37] um they used to sit way more over here [24:39] and the other providers were over here. [24:41] We'll talk about that uh when we go [24:44] through the history of this stuff. Um [24:46] but look up here we have leaders, [24:48] challengers, niche players, and [24:51] visionaries. So it gives you an idea of [24:52] if you fall in one of these things, what [24:54] you are. What's really interesting is [24:56] there are no visionaries right now. Uh [24:58] and notice that this says for May 2025. [25:01] So it is 2026 but the timing of the [25:04] stuff is when they release it and um you [25:08] know even though we are in the future [25:10] we'll have to wait um to see that new [25:13] stuff. And so these um uh these reports [25:18] are based on a set of questionnaires [25:20] that are answered by their marketing [25:21] teams composed of uh self-certified [25:23] metrics, case studies and client [25:25] testimonials. But generally these [25:27] reports if you want them you have to pay [25:30] gardener to uh download them. I don't [25:32] know how much they cost but generally um [25:34] you know if a provider is marketed as [25:38] something uh you know like adabus as the [25:40] leader of it they're going to take a [25:41] screenshot of this image or take this [25:43] image make a blog post about it and [25:45] that's how I'm always checking this uh [25:47] stuff. So I try to always capture uh [25:49] these when they come out because [25:50] sometimes you'll have gaps if you do not [25:52] capture them. But let's go back in time [25:54] and just see how the needle's been [25:56] moving. So, if we go here, and I'm just [25:58] trying to find my pen tool. Here it is. [26:00] But I didn't mean to scribble that [26:01] there. So, now I got to get that out of [26:03] there. Whoops. Um, so we'll just erase [26:05] that out of there. There we go. So, if [26:07] we come back here, let's take a look [26:08] where Amazon Web Services is. So, it's [26:10] very clear that they're the leader. And [26:11] if you even go further back, the gap is [26:13] larger and Microsoft is the closest [26:15] thing with Google over here, Alibaba in [26:18] the middle, and then Oracle 10-centent, [26:20] IBM. So it's very easy to say okay well [26:22] these are the first tier um cloud [26:26] service providers. Okay then a year [26:29] later in 2022 you're noticing that [26:31] Microsoft is catching up. Um Google is [26:34] getting closer. Alibaba cloud is going [26:38] down here into the visionary track for [26:40] whatever uh reason. Um Oracle is [26:42] catching up. So Oracle was all the way [26:44] down over here niche players but they're [26:46] coming back here. And then we move over [26:49] to uh 2023. [26:51] Uh yeah, 2023. Just 2022 and 2023 look [26:54] very similar. But notice Oracle is now [26:57] over here. I think they're getting [26:58] government contracts and that's the [26:59] reason why. And then Amazon Web [27:01] Services, Microsoft and Google are [27:03] getting close. I don't have 2024. [27:05] Normally Adabus will post it. And [27:07] actually the last video um when we [27:09] recorded this was in 2024 and I was just [27:12] waiting a month or two for this to come [27:15] out and I never caught it. So, I almost [27:18] kind of wonder, did Adus not make it as [27:20] the lead that year? But, um, normally [27:22] they have a blog post every year and [27:24] they've said that they've been the lead [27:25] for x amount of years. So, I just don't [27:27] have that, which is a shame. Uh, but [27:30] let's see what happens when we go to [27:31] 2025. And notice like um things are [27:36] really catching up to Amazon Web [27:37] Services. And you can tell like it looks [27:39] like Microsoft and Google have gotten [27:41] really close, but you can tell the [27:42] reason for that is because of [27:45] uh AI, right? So we have completeness of [27:47] vision and notice here uh you know not [27:52] exactly the same and then over here [27:53] ability to execute um Amazon still near [27:56] the top. So that's really interesting [27:58] and then again Oracle is uh catching up [28:00] because of their government contracts. I [28:02] don't find them to be uh a particularly [28:05] good cloud. I do not rate them as a [28:07] first tier cloud provider but again if [28:10] the money is coming to them then uh [28:11] that's why they're where they are. Um [28:14] but yeah, so hopefully that gives you an [28:16] idea of it. I would just take this stuff [28:17] with a grain of salt as again it's [28:19] proprietary information. We do not know [28:21] how they're calculating this [28:22] information. Uh and you know their [28:24] business model can be the fact that [28:26] these companies want to utilize this [28:28] stuff for marketing and so there is a [28:31] bit of a money exchange there. So just [28:32] consider that. Okay. [28:39] So a cloud service provider can have [28:41] hundreds of cloud services that are [28:43] grouped into various types of services. [28:45] But the four most common types of cloud [28:48] services for infrastructure as a [28:49] service. Uh and I call these the four [28:52] core would be compute. So imagine having [28:55] a virtual computer that can run [28:57] applications, programs and code. [28:59] Networking. So imagine having virtual [29:01] network defining internet connections or [29:03] network isolation between services or [29:05] outbound to the internet. Storage. So [29:08] imagine having a virtual hard drive that [29:09] can store files, databases. So imagine a [29:12] virtual database for storing reporting [29:14] data or a database for general purpose [29:17] web applications and uh AWS in [29:20] particular has 200 plus cloud services [29:23] and I want to clarify what cloud [29:25] computing means because notice that we [29:27] have uh cloud computing, cloud [29:28] networking, cloud storage, cloud [29:30] databases but the industry often just [29:33] says cloud computing to refer to all [29:36] categories even though it has comput in [29:38] the name. So just understand when [29:39] someone says cloud computing they don't [29:41] just generally mean the subcategory [29:43] they're talking about all of cloud. [29:44] Okay. [29:50] So Adabus has a lot of different cloud [29:52] services and I just want to kind of go [29:54] quickly over the types of categories [29:56] that we can encounter here and just [29:58] mention the four core. So any CSP that [30:01] has IAS will always have these four core [30:03] service offerings. We have compute. So [30:05] in ads this would be EC2VMs storage this [30:08] could be something like EBS virtual hard [30:10] drives database so that could be RDSQL [30:12] databases networking and content [30:14] delivery but really it's networking uh [30:17] and this would be VPC so private cloud [30:19] network okay so uh let's just look at [30:22] all the categories that are outside the [30:24] four core so there could be analytics [30:26] application integration AR VR ads cost [30:29] management blockchain business [30:30] application containers customer [30:32] engagement developer tools and user [30:35] computing, game tech, IoT, machine [30:38] learning, management and governance, [30:40] media services, migration uh and [30:42] transfer, mobile, quantum technologies, [30:45] robotics, satellites, security, [30:48] identity, and compliance. If there was [30:49] more, I would not be surprised, but you [30:51] can see there's a lot of stuff that's [30:52] going on here. [30:57] So, let's take a look at all the Adabus [30:59] services that are available to us. So if [31:01] you're on the marketing website which is [31:02] adabus.amazon.com [31:04] what you'll see in the top left corner [31:06] is products and so these are all the [31:09] categories and for whatever we want if [31:11] it's like ec2 we can go into here and we [31:14] can read all about it. So, usually we'll [31:16] have our overview. All right. And that's [31:20] not very useful. And then we'll go over [31:21] to features. And so, this is can be kind [31:24] of useful to get some basic information [31:26] and pricing, which is something you'll [31:28] do a lot in AWS is you're always going [31:30] to be going to a service and looking up [31:32] its price. And so, you'll make your way [31:34] over uh here. Every single one is [31:36] different. A very important page would [31:38] be like getting started. So, this will [31:40] give you basic information. But what I [31:42] do is I like to go all the way down to [31:43] the bottom here and find my way over to [31:46] the documentation. So I'll go here to [31:47] documentation to get that deeper [31:50] knowledge about that service. And as you [31:51] can see things get pretty deep with AWS [31:54] in terms of the information they have. [31:56] So hopefully that gives you an idea of [31:58] the scope. Also when you're logged into [32:00] AWS and this will be when we create our [32:02] account uh you can explore all the [32:04] services this way as well. So these are [32:05] all the as services. Uh but you just [32:08] notice that there's two ways to uh [32:10] explore them where this is actually you [32:12] just actually utilizing the services and [32:14] then the marketing website is you [32:15] reading about them and learning all [32:16] about them. Okay. [32:22] Hey, this is Andrew Brown from Exam Pro [32:23] and we are looking at the evolution of [32:25] computing. Your cloud service provider [32:27] has all of these offerings and the idea [32:29] is that you need to choose the one that [32:30] meets your use case. A lot of times this [32:33] all has to come around the utilization [32:34] of space. That's what we're trying to [32:36] illustrate here in this section here and [32:38] the trade-offs of why you might want to [32:40] use some of these offerings. Okay, for [32:42] dedicated, we're talking about a uh a [32:45] physically uh a physical server wholly [32:47] utilized by a single customer. That's [32:48] considered single tenant. And uh for [32:52] Google Cloud, we're talking about um [32:54] single node clusters and bare metal [32:57] machines where you have control of the [32:59] virtualization. So you can install any [33:00] kind of hypervisor or virtualization you [33:02] want on the system. The trade-off here [33:04] though is that you have to guess upfront [33:06] what your capacity is going to be and [33:08] you're never going to 100% utilize that [33:10] machine because it's going to have to be [33:11] a bit under in case the utilization goes [33:13] up. That's you choosing the CPUs and the [33:15] memories. You're going to end up [33:16] overpaying because you're uh you'll have [33:18] under underutilized server. Uh it's not [33:21] going to be easy to vertically scale. [33:22] It's not like you can just say resize it [33:24] because the machine you have is what you [33:26] have, right? You can't add more. I mean, [33:28] I suppose they can insert more memory [33:30] for you, but that's a manual migration. [33:32] Uh so it's very difficult. Um and [33:35] replacing the server is also very [33:37] difficult. Okay. So you're limited by [33:39] the host operating system. It's not [33:41] virtualized. So whatever is on there is [33:43] on there. Um and that's what your apps [33:45] are going to have access to. Uh if you [33:47] decide to run more than one app, which [33:49] is not a good practice for these kind of [33:50] machines, uh you're going to end up with [33:53] uh resource sharing where one machine [33:54] might utilize more than the others. [33:56] Technically with a dedicated machine, [33:58] you have a guarantee of security, [33:59] privacy, and full utility of the [34:00] underlying resources. I put an asterk [34:02] there because yes it's more secure but [34:05] but uh but it's up to you to make sure [34:07] that it's more secure. So you have [34:09] that's up to your skills of security [34:11] right whereas if you had a virtual [34:13] machine or anything above that there's [34:15] more responsibility on the cloud service [34:17] provider to just provide a sec secure [34:20] machine and they can do a better job [34:21] than you. So why would you use a [34:23] dedicated machine? Well, maybe you're [34:24] doing high performance computing where [34:26] you need these machines like very close [34:28] together and you have to choose what [34:30] kind of virtualization you need to have. [34:32] Okay, so then we're looking at virtual [34:35] machines. The idea here is you can run a [34:36] machine within a machine. The way that [34:38] works is we have a hypervisor. This is a [34:41] a software layer that lets you run the [34:42] virtual machines. Uh and the idea here [34:44] is now it's multi-tenant. You can share [34:46] the cost with multiple customers. You're [34:48] paying for a fraction of the server. uh [34:50] you'll still end up overpaying for the [34:51] underutilized virtual machine because a [34:53] virtual machine is just like you have to [34:55] still say how many vCPUs, [34:57] how much memory, and your app is you [35:00] don't want an app that uses 100%, right? [35:02] You want to use exactly the amount you [35:03] need, but you can see here, you know, [35:05] there's still going to be some [35:06] underutilization. [35:07] Uh you're limited by the guest operating [35:10] system now, but now it's virtualized. [35:11] So, at least it's very easy to uh [35:14] possibly migrate away. If you choose to [35:16] run uh more than one app on a virtual [35:19] machine, it it can still run into [35:20] resource sharing conflicts. Uh it's [35:23] easier to export or import images for [35:25] migration. It's easier to vertically or [35:27] horizontally scale. Okay. And virtual [35:30] machines are the most common and popular [35:32] offering for compute because people are [35:33] just very comfortable with those. Then [35:35] you have containers. And the idea is you [35:37] have a virtual machine running these [35:39] things called containers. The way they [35:41] do that is similar to a hypervisor, but [35:43] instead you have um like here it's a [35:45] docker demon. So it's just a um a [35:48] container uh software layer, okay, to [35:50] run those containers. There's different [35:51] kinds. Docker is the most popular. Uh [35:53] and the great thing is you can maximize [35:55] the uh the the capacity because you can [35:58] easily add new containers, resize those [36:00] containers, use up the rest of the [36:02] space. It's a lot more flexible. Okay. [36:05] uh your containers will share the same [36:07] underlying OS but they are more [36:09] efficient than multiple VMs. Uh multiple [36:12] apps can run side by side without being [36:13] limited uh by the same OS requirements [36:15] and not cause conflicts during resource [36:17] sharing. So containers are really good [36:19] but you know the trade-off is there a [36:21] lot more work to maintain. Then you have [36:23] functions and functions go even step [36:26] further and the idea is that you uh the [36:29] the containers where we where we talked [36:32] about that's a lot of work to maintain. [36:33] Now the uh cloud service provider is [36:36] taking care of those containers [36:37] generally sometimes not it depends if [36:39] it's serverless or not but the idea is [36:41] that you don't even think about this is [36:43] called serless compute but you don't [36:44] even think about uh the OS or anything [36:47] you just know that what your runtime is [36:49] you run or python or node and you just [36:52] upload your code and you just say uh I [36:54] want this to be able to run uh uh for [36:57] this long uh and use this amount of [36:59] memory. Okay, you're only responsible [37:01] for your code and data nothing else. [37:03] It's very cost- effective. You only pay [37:04] for the time the code is running. Uh and [37:07] VMs only run when there is code to be [37:09] executed. But because of that, there is [37:11] this concept of cold starts and this is [37:13] uh where the virtual machine has to spin [37:16] up and so sometimes requests can be a [37:18] bit slow. So there's a bit of trade-off [37:19] there. But functions or serverless [37:21] compute is generally one of the best [37:22] offerings as of today. But most people [37:25] are still getting kind of comfortable [37:26] with that paradigm. Okay. [37:31] Hey, this is Andrew Brown from Exam Pro [37:33] and we are taking a look at the types of [37:35] cloud computing. The best way to [37:37] represent this is a stacked pyramid and [37:39] we'll start our way at the top with SAS [37:42] also known as software as a service. So [37:44] this is a product that is run and [37:46] managed by the cloud service provider. [37:48] You don't have to worry about how the [37:49] service is maintained. It just works and [37:51] remains available. So examples of this [37:53] and actually uh the first uh company to [37:55] coin this was actually Salesforce. Um [37:58] then there's things like Gmail, Office [38:00] 365, so think Microsoft Word, Excel, [38:03] things like that and they run in the [38:04] cloud. Okay. And SAS is generally [38:07] designed for customers in mind. Then [38:10] came along platform as a service um also [38:12] known as pass and these focus on the [38:15] development or sorry the deployment and [38:16] management of your apps. So you don't [38:19] worry about provisioning, configuring or [38:21] understanding the hardware or operating [38:23] system. And so here we'd have things [38:25] like Elastic Beantock, Heroku, which is [38:28] very popular among developers that just [38:30] want to launch their code, or Google App [38:33] Engine, and that is the old logo, but [38:35] that's the logo I like to use because I [38:36] think it looks cool. And so these are [38:38] intended for developers. The idea is [38:40] that you just deploy your code um and [38:43] the platform does the rest. Then there [38:45] is infrastructure as a service. There's [38:48] no way to say that like it's easy to say [38:50] SAS or pass but there's no easy way to [38:52] say IAS. So this is the basic building [38:55] blocks for cloud IT. It provides access [38:58] to networking features, computers and [39:00] data storage space. And the idea here is [39:02] you don't worry about the IT staff, data [39:04] centers and hardware. And so that would [39:06] be like Microsoft Azure, AWS, Oracle [39:10] Cloud, things like that. And these are [39:12] for administrators. Okay. So there you [39:14] go. [39:20] Hey, this is Andrew Brown from Exam Pro [39:22] and we are taking a look at cloud [39:23] computing deployment models starting [39:25] with public cloud. And the idea here is [39:27] that everything when I say everything, [39:29] I'm talking about the workloads, the [39:30] projects, the code is built on the cloud [39:33] service provider. So here is a diagram [39:35] where we have a EC2 instance, a virtual [39:38] machine running our application and then [39:40] we have our database in RDS and we have [39:43] the internet coming into our ads account [39:46] and so everything is contained all of [39:47] our infrastructure is within AWS. All [39:50] right. Uh and so this is known as being [39:53] cloudnative or cloud first. And I put an [39:56] asterk beside cloudnative because that [39:58] was a term uh that was uh used prior to [40:01] cloud providers to refer to containers [40:03] or open- source um uh models being [40:07] deployed and being mobile other places. [40:09] So just understand that it has two [40:10] meanings. But in the context of this [40:12] cloud native just being like native to [40:14] the cloud like using cloud to begin [40:16] with. Okay. Then we have private cloud. [40:18] So everything built on a company's data [40:20] center. Uh and being built on a data [40:23] center is known as being on premise [40:25] because that is where the data center [40:26] resides near where you work. And so here [40:30] you could be using cloud but you'd be [40:31] using OpenStack which would be a private [40:33] cloud. So here we have our on-remise [40:35] data center and uh the internet's coming [40:38] into our data center and we're running [40:39] on OpenStack where we can launch virtual [40:41] machines and a database. Okay. Then [40:45] there's the concept of a hybrid cloud. [40:47] So using both on premise and a cloud [40:49] service provider together and so the [40:52] idea here is we have our onremise data [40:54] center and then we have an established [40:56] connection maybe it's a VPN connection [40:58] maybe it is a direct connection um but [41:01] the idea is that we're bridging that [41:03] connection and uh utilizing both our [41:05] private and our public uh stuff to uh [41:09] create a cloud workload. Then there is a [41:12] fourth one called crosscloud. Um [41:14] sometimes it's known as multicloud uh [41:16] and sometimes it's erroneously referred [41:18] to as hybrid cloud but it generally is [41:20] not uh hybrid cloud. Okay. The idea here [41:23] is when you're using multiple cloud [41:25] providers and so one example here could [41:28] be using services like Azure Arc. So, [41:30] Azure Arc allows you to extend your um [41:33] control plane uh so that you can deploy [41:36] containers for Kubernetes in um Azure [41:39] within Amazon EKS within GCP Kubernetes [41:43] Engine. But, you know, being crosscloud [41:46] doesn't necessarily mean that you're [41:47] running a using a service that use works [41:50] across the cloud and manages it. It [41:52] could just mean using multiple providers [41:53] at the same time. Uh another service [41:55] that is similar to Azure Arc but is for [41:58] uh Google cloud uh platform is also [42:00] known as Anthos. Um Adabus has [42:02] traditionally not been um crosscloud uh [42:06] friendly and so we haven't seen any kind [42:08] of developments there where we see uh [42:10] these other services that are be or [42:12] cloud service providers behind AWS [42:13] trying to promote it to uh grab more of [42:16] the market share. Okay. [42:23] So let's talk about the different [42:24] deployment models and what kind of [42:25] companies or organizations are still [42:27] utilizing uh for these particular [42:29] categories. So for cloud again this is [42:31] where we're fully utilizing cloud [42:33] computing. Hybrid is a combination of [42:35] public cloud and on-rem or private cloud [42:38] and then on-rem is deploying resources [42:40] on premise using virtualization resource [42:42] management tools sometimes called [42:43] private cloud or could be utilizing [42:45] something like OpenStack. So for [42:47] companies that are starting out today or [42:49] are small enough to make the leap from a [42:51] virtual private server to a cloud [42:53] service provider, this is where we're [42:54] looking at cloud. So we're looking at [42:55] startups, SAS offerings, new projects [42:58] and companies. Um so maybe this would be [43:00] like base camp, Dropbox, Squarespace. [43:02] Then for hybrid, these are organizations [43:04] that started with their own data center [43:05] but can't fully move to cloud due to the [43:07] effort or migration or security [43:09] compliance. So we're talking about [43:11] banks, fintech, investment management, [43:13] large professional service providers, [43:14] legacy onrem. So maybe CIBC which is a [43:17] bank, Deote, uh the CCP or CPP [43:21] investment board and then for on premise [43:24] these are organizations that cannot run [43:25] on cloud due to strict regulatory [43:27] compliance or the sheer size of the [43:29] organization or they just have like an [43:31] outdated uh idea of what cloud is. So [43:33] they just have a lot of uh difficulties [43:35] in terms of politics adopting cloud. Um, [43:38] so this would be public sector like [43:39] government, super sensitive data like [43:41] hospitals, large enterprise with heavy [43:44] regulation, insurance companies. Um, so [43:46] again, hospitals, maybe EIG, the [43:48] government of Canada. And so I shouldn't [43:50] say that they aren't using cloud, but [43:53] um, you know, because uh, AWS and all [43:56] the cloud service providers have um, uh, [43:59] public sector offering. So um, you know, [44:02] I'm just trying to stage as an example [44:04] of things that could be still using on [44:06] premise. So, you know, I know the [44:08] government Canada definitely uses uh [44:10] cloud in a lot of ways. Same with AIG [44:12] and hospitals, but you know, generally [44:14] these are the the last holdouts of onrem [44:16] because there really isn't a a good [44:18] reason to be fully on premise anymore. [44:20] Uh but again, there are some things that [44:22] are still doing that. Okay. [44:28] Hey, this is Andrew. We are on the [44:30] adabus.amazon.com [44:31] account. I just want to show you where [44:33] you go and create your account. So click [44:35] the create your account button and this [44:36] is where you'll sign up. You absolutely [44:38] need a credit card in order to uh [44:40] utilize ads or you're not going to get [44:43] very far with it. Um but uh just [44:46] understand that what you're creating [44:48] here is going to be your root account. [44:50] And so uh just make sure that you're [44:52] using email that is going to be [44:54] accessible through uh for your entire [44:55] team. So for example, we have our own [44:57] email called accounts@acamppro.co and [45:00] that's what manages our main account. So [45:02] that's something you might consider. [45:03] It's totally possible you could get [45:04] stuck in the process um with your credit [45:07] card and signing up here and you have to [45:08] reach out to support. It doesn't happen [45:10] often, but we do hear about it from time [45:12] to time. So, that is an issue there. Uh [45:14] you could try to use a um credit card [45:16] like COO or something to if you let's [45:18] say you don't have necessarily um a Visa [45:21] or something. There are these prepaid [45:22] credit cards that sometimes do work. Um [45:24] but it's going to really vary based on [45:26] your country and where you are. Um but [45:28] anyway, this is where you sign up. It's [45:30] not a hard process. Um, I would love to [45:32] show it to you, but I've done it so many [45:34] times I've ran out of emails to show [45:36] show you with. Um, so you'll have to [45:38] work through it yourself here, but it's [45:39] very, very easy. And I'll see you on the [45:41] other side. Okay. [45:47] All right. So, now that you've created [45:49] your account, you should be here in the [45:51] management console. And so, what you [45:53] should really do is not use your root [45:55] account, which is what we're utilizing [45:57] right now. And we should go ahead and [45:59] create ourselves um a user that is an IM [46:04] that we will use to log in. So this is [46:06] already an account that I obviously am [46:07] using and already have users in it. Um [46:10] but that's fine. This will still work. [46:11] So we'll go here at the top and we'll [46:13] type in IM for um identity access [46:16] management. And on the lefth hand side [46:18] here you will see I am users. And the [46:20] idea is that we want to create ourselves [46:21] a new user that we will use to log into [46:24] this account. So we'll go ahead and [46:25] create user. I'll call this Andrew Brown [46:28] 2 because of course I already have one. [46:30] So it's fine. We'll just make another [46:31] one here. And we're going to want to [46:32] checkbox this on because we are human. [46:34] We want to be able to log into the [46:36] console. Notice here it's going to say [46:38] automated or autogenerated password or [46:40] custom password. Uh so it's up to you [46:42] what you want to set here, but I'm going [46:43] to leave it autogenerated for now. It [46:45] says the user must create a new password [46:46] when they sign in next. That's a good [46:48] idea. We'll go ahead and hit next. And [46:50] so you'll have no groups here. And so [46:52] what you'll want to do is create your [46:53] first group. Often people make an admin [46:55] group. So you'd say admin and we would [46:58] provide administrator access. Now this [47:00] is the most permissive that you can [47:02] utilize. So only give this to maybe [47:04] yourself um or your most trusted people. [47:07] Um but the next level down is power [47:09] user. Effectively we drop this down here [47:11] to custom manage or maybe it's by job [47:13] function. Here this kind of gives you a [47:15] broader breakdown of stuff. So if [47:16] administration access is too much, the [47:18] next level is power user, which I [47:20] believe does not have access to um uh [47:23] billing and other information. So that [47:26] would be probably the next best thing. [47:27] But anyway, we'll go here and I'm [47:28] calling it an admin too because I [47:30] already have an admin. And so I'll just [47:31] create that. And you can see that it's [47:33] exactly the same thing. I'm just going [47:34] to delete that since I don't need to [47:36] have um two groups here. So I'll just [47:39] delete that. But that just gives you an [47:41] idea of what you need to do there. So, [47:44] um, once you have your [47:47] groups, and I I kind of messed this up, [47:48] so I'll start over again. We'll type in [47:51] Andrew Brown 2. Of course, I don't need, [47:52] if you were doing this first time, you [47:54] wouldn't put two. We checkbox this on, [47:56] autogenerate, and we'll go next. And I [47:58] will choose the admin group. And we'll [48:00] go to next. And we'll go ahead and [48:01] create. And so now we have the username [48:04] and password. So, we can use this [48:05] information to log in. And this is the [48:08] address that we're going to have. Yours [48:09] might look a little bit different. you [48:10] might see the I uh the account ID uh up [48:13] here. Okay, the reason why mine shows a [48:16] little bit different is that if you go [48:18] over to IM here, you can set up an [48:20] alias. Okay, so if you had no alias [48:23] here, then it would be the account [48:25] number. Uh but I would strongly [48:27] recommend putting in an alias because it [48:29] makes it so much easier to log in, which [48:30] you'll see in just a moment. Um but what [48:33] I want to do is just copy this password [48:34] off screen for a moment because I'm [48:36] going to forget it. And uh is that [48:38] really the password? [48:40] This is this is the temporary password. [48:42] I just want to show how silly this one [48:43] looks. It has a lot of um pipes in it [48:45] and parenthesis. But anyway, so I have [48:47] that saved off screen here. And I'm just [48:49] going to grab that username and then [48:51] we're going to log in and take a look at [48:52] what this one looks like. So we'll go [48:54] ahead and sign out. Okay. And we'll sign [48:58] back in. Um but notice that we have more [49:02] than one option. So right now like if we [49:04] didn't see this sometimes we see the [49:06] option of root user and IM. So root user [49:08] is what when you put in an email in and [49:11] that is the highest level of of access [49:14] to your account. This is not something [49:16] you should be using for daily use. You [49:17] should only ever use the root user when [49:19] you absolutely need to. Um and there are [49:22] very specific things that require it [49:24] which I cannot remember off the top of [49:25] my head but when it does it'll tell you [49:27] hey you need your root user right. But [49:28] we are going to use an IM user to log in [49:30] here. And here it says the account ID or [49:32] account alias. And so I know mine is [49:34] developers at Exam Pro. [49:38] Okay. And I can go ahead and just hit [49:40] next. And so that fills it out there. [49:41] And then I can say Andrew Brown 2. All [49:44] right. And then I can bring in that [49:47] password we just saw a moment ago. Show [49:50] the password. Make sure I I can see what [49:51] I'm doing. And we have a little bit of [49:53] an issue here. I can't remember. It's [49:54] Exam Pro developers. I can't remember to [49:56] be honest. Uh so but we'll try this one [49:59] more time. I also might be copying a [50:00] paste by accident. So, just make sure [50:02] you're not doing that. Yeah, it's [50:04] developers exam row. [50:08] Try this one more time. I think it's [50:10] because I had a space there. And so, now [50:11] we enter the old password in. And I'm [50:13] going to put a new one here in here. [50:14] Temporary testing 1 2 3 4 5 6 [50:16] exclamation mark. Testing 1 2 3 4 5 6 [50:20] exclamation mark. Don't worry, I'm going [50:21] to delete this user so it's not going to [50:22] matter. And we're going to go ahead and [50:24] confirm that password. And so now we can [50:25] continue to sign in. And so now we are [50:28] in this account. Uh what you should be [50:31] doing is going over to IM with this new [50:33] user and making sure that you set up [50:35] MFA. Um so here you can see there's no [50:38] MFA on the root user and we should add [50:39] it for ourselves. So you can go ahead [50:41] and do that. Um this is just a [50:43] playground account and I'm not really [50:44] worried about it. So that's why I don't [50:46] set this stuff up. Um but you generally [50:48] should and that's all I wanted to show [50:50] you. Okay, there you go. Cha chia. [50:58] Okay, so now that we have the proper [51:00] user account to log in, I just want to [51:02] point out uh about regions. So in the [51:05] top right corner, you'll notice it says [51:07] North Virginia here. It possibly will [51:09] say something completely else for you. [51:11] But what you'll do is you'll click and [51:13] drop that down and you'll see a big list [51:15] of regions. And so sometimes when I log [51:18] in as it likes to default me to U east [51:21] uh US East Ohio, but I honestly like to [51:23] launch all my stuff in US East North [51:25] Virginia. Even though I'm in Canada, I [51:27] probably should be using the Canada [51:29] Central region down here. Um but the [51:31] default region is going to be based on [51:33] your locality. Okay? So just understand [51:36] that it might be different. I strongly [51:38] recommend for um all of our follows you [51:41] run in US- East1 because US East1 is the [51:44] original um the original region and it [51:47] also has the most access to ad services [51:51] and some ad services um such as like [51:54] billing and and cost and things like [51:55] that are only going to show up in US [51:58] East uh North Virginia. So just to make [52:00] our lives a lot easier, we're going to [52:02] set it there. But I want you to [52:03] understand that some services are global [52:05] services, meaning that it doesn't matter [52:07] what region you're in. It's going to [52:08] default to global. And one example could [52:10] be CloudFront. So if I jump over to [52:12] CloudFront here for a moment, [52:15] and uh we do seem to have uh some [52:18] CloudFront distributions here from a [52:20] prior uh followalong. But notice up here [52:22] that it now says global. So CloudFront [52:24] does not require a region selection. [52:26] Let's make our way over to S3. [52:31] All right. And this one's also global. [52:33] So again, this one does not require a [52:36] region selection. But if you go over to [52:38] something like EC2, [52:41] okay, this has a a region dependency. So [52:44] just be really careful about that [52:46] because a lot of times you'll be doing a [52:48] follow along and you'll be like, why [52:50] aren't these resources here or whatever? [52:51] And it's because this got switched on [52:53] you. And it can happen at any time. So [52:54] just be uh cautious or aware of that. [52:56] Okay. [53:01] So one of the major advantages of using [53:03] AWS or any cloud service provider is [53:06] that it utilizes metered billing. So [53:08] that is different from a fixed cost [53:10] where you'd say okay I want a server for [53:12] X amount of dollars every month. But the [53:14] way AWS works is that it's going to bill [53:16] you on the hour on the second based on a [53:19] bunch of factors. And so you're going to [53:21] be able to get services at a lower cost. [53:23] However, if you choose an expensive [53:26] service and you forget about it or [53:28] there's misconfiguration where you [53:30] thought you were launching something [53:32] that was cost-effective but turned out [53:34] to be very expensive, you could end up [53:35] with a very large bill very very [53:37] quickly. And so, uh, that is a major [53:40] concern for a lot of people utilizing [53:42] cloud. But there's a lot of great [53:43] toolings built into AWS to allow you to [53:46] catch yourself if you happen to make [53:49] that mistake. And before we go ahead and [53:52] learn how to do that, I want to show you [53:54] uh some place where you could end up [53:56] having excessive spend without knowing [53:58] it. So one example, and this is actually [54:01] happened to me when I first started [54:02] using AWS uh before I even knew about [54:05] all the billing tools, is I wanted to [54:07] launch a Reddus instance. And so you you [54:10] just have to watch. You don't have to do [54:11] this, but um Elasticash is a service [54:14] that allows you to launch either a [54:15] memcache or reddis uh database. and I [54:18] just wanted it to store a single value. [54:21] And so I went here and I scrolled down. [54:23] It looked all good and I hit create. But [54:26] I wasn't paying attention because [54:27] apparently Adabus likes to default the [54:29] node type here to the cache R6G.Large. [54:34] All right. And you know, you might think [54:36] that Adabus has your best interest in [54:38] play. And most services are pretty good. [54:40] they they make sure that they're either [54:41] free or very low spend. But some of [54:43] these and Elasticash is an older service [54:45] where they just have these weird [54:47] defaults. So, um you know, if we were to [54:50] go look up this the RG6 [54:54] uh large, [54:55] all right, and look at its spend. [55:00] All right. And we would go over here. [55:03] Whoops. I think I went to the China one. [55:05] But if we were to go over here and look [55:07] for that instance, I'm just trying to [55:09] find it here for cost. This one [55:13] down below. Um, this doesn't say [55:16] pricing. Does it say our pricing here? [55:20] Here it is. So, this one cost um, [55:24] this one costs about 2 cents per hour. [55:26] It doesn't sound like a lot, but if we [55:28] go here and we do the math, we say 730. [55:31] 730 is the amount of hours in a month. [55:33] That is $150. Okay. So, if you don't [55:36] know about that and forget about that, [55:37] that's going to be $150. And I'm going [55:39] to tell you that it used to be a lot [55:41] higher. I'm pretty sure they used to [55:43] have it defaulted to something like like [55:45] this or that because I remember I did [55:47] this and I had a bill that came in that [55:50] was like $3,000 USD and I'm in Canada so [55:53] like $3,000 USD is like a million [55:55] dollars up here. And so I remember um it [55:58] was a big concern and I freaked out. But [56:01] that was okay because all I had to do [56:02] was go to support and what I had done is [56:05] I went to the support center [56:10] and I had opened a support case and I [56:14] just said, "Hey, I have this really big [56:16] bill." So you go here, right? and you [56:19] look for billing and uh you look for [56:22] something like charging query or [56:24] misspend and you say you know um you [56:29] know like help my bill's too high [56:33] and you just say like you explain the [56:34] problem saying hey you know I was using [56:36] elastic cache and it was set to a large [56:39] default and I wasn't aware about it can [56:40] you please give me back the money and [56:42] the great thing is that AWS is going to [56:44] give you a free pass if it's your first [56:46] time where you've had a misspending [56:48] they generally will say okay um you know [56:51] don't do it again and if it happens [56:53] again you will get build but go ahead [56:54] and learn how to set up billing alerts [56:56] or things like that. Okay so just so you [56:58] know don't freak out if you do have a [57:00] really high bill you're going to get a [57:02] single free pass but now that we know [57:03] that let's go learn uh how to set up a [57:06] budget. Okay. [57:12] All right. So, now that we've had a bit [57:14] of a story about um over spend for [57:17] misconfiguration, let's learn how to [57:19] protect ourselves against it. And we're [57:21] going to go ahead and set up a budget. [57:24] So, go to the top here and type in [57:25] budget. And what that will do is bring [57:28] us over to the billing dashboard. [57:30] Another way to get here is to go click [57:32] the top here and go to my billing [57:33] dashboard. And then you'll see the [57:35] lefthand menu here. And so, the great [57:37] thing about budgets is that the first [57:39] two are free. It says there is no [57:41] additional charge for adab budgets. You [57:42] pay for configured US usage. But I'm [57:45] pretty sure that that's not true [57:48] because it used to be ABS budget [57:51] reports. Okay, so that costs something. [57:54] It used to be that ads budgets um after [57:56] success enabled will incur 10 cents [57:59] daily. So in addition to budget monitor, [58:01] you can add actions to your budgets. The [58:03] first two action enabled budgets are [58:06] free. Okay. So, just be aware that just [58:08] because it says there's no additional [58:10] charge, read into it because sometimes [58:12] the the fine line will tell you it does [58:14] cost something. But I know that the [58:15] first two are free. What we'll do is go [58:17] ahead and create a budget. Just going to [58:19] close these other tabs here since we [58:20] have no need for them. And we're going [58:22] to be presented with a bunch of budget [58:23] types. Uh we're concerned about cost [58:25] today, so we're going to go with a cost [58:26] budget. [58:28] And notice we can change the period from [58:29] monthly to daily to quarterly to [58:31] annually. If you change it to daily, um [58:33] you won't get forecasting. So, I don't [58:35] want that today, but a monthly is pretty [58:37] good. You can have it reoccurring, which [58:39] is strongly recommended. And then you [58:41] can put a fixed cost. Notice that I [58:42] already have some spend on this account. [58:44] So, it was like 25 bucks last month. I'm [58:47] going to set it my uh budget here to [58:49] $100. [58:51] And you could add filters here to um uh [58:54] filter that cost out. So, if you want to [58:56] say only for this region or things like [58:58] that, you could do that. Uh notice that [59:00] this is my spend over here. Um so, this [59:02] is my budget and that's the actual cost. [59:04] Notice my cost has been going up the [59:05] last few months because I've been doing [59:07] things with this account. And so what [59:09] I'll do is say simple budget here. We'll [59:12] hit next. [59:15] And so now it's asking us if we want to [59:16] configure alerts. We probably do. So [59:18] you'd hit add alert and then you'd set a [59:21] threshold like 80%. Or you could say an [59:24] absolute value. And then you'd put in [59:26] your emails like Andrew@acamppro.co. [59:29] And I want to point out that this is [59:30] using um it was SNS [59:35] or it should be anyway. So Amazon SNS [59:37] has no upfront cost based on your stuff [59:38] here. So even though you're filling out [59:40] an email, you know, and maybe it doesn't [59:43] show it, but I'm pretty sure that this [59:44] would create an SNS [59:46] topic, but what we'll do is hit next. [59:48] Here we have an alert. So we're just uh [59:52] reviewing. Actually, this is for [59:53] attaching any action. So maybe we want [59:55] some kind of follow-up thing to happen [59:57] here. So we say add action and uh [60:01] requires specific IM permissions on your [60:03] behalf. [60:05] Okay, sure. So I guess you could follow [60:08] up actions. That's no different than um [60:11] a building alarm, but we're not really [60:13] worried about that right now. I'm not [60:15] going to bother with an action. And [60:18] we'll go ahead and create a budget. And [60:20] so here it's going to say that our [60:22] budget is $100. It's going to show us [60:24] the amount used, forecast amount, [60:25] current budget. Sometimes this takes [60:27] time to uh show up. So I'm going to hit [60:29] refresh and see if it shows up yet. [60:33] There we go. So notice we have [60:34] forecasted amount $23, current budget, [60:36] etc. forecasted budget, uh forecasted [60:39] versus budget. So it's pretty [60:41] straightforward on how that works. U I'm [60:44] just curious if it actually created an [60:45] SNS event. So I'm going to go over here [60:48] because a lot of services utilize SNS. [60:51] So if I go over here, default Cloudatch [60:53] alarm. Um, so I think this is something [60:56] I had created before. So I'm going to go [60:58] ahead and just delete it. Says default [61:00] cloud watch alarms. Actually, I'm I'm [61:03] going to just click into here and see [61:04] what I have. [61:06] Confirmed. [61:08] So I think it might have used this when [61:10] we created it. But um, the reason I'm [61:12] bringing up SNS is that there's a lot of [61:14] services that allow you to uh, email [61:17] yourself for alerts and always [61:18] integrates with this service. And so I [61:19] just want kind of want to point that out [61:20] so that you remember what SNS is for. [61:23] Um, but yeah, so setting up a budget is [61:25] not too hard. So there you go. [61:31] All right. So now that we've set a [61:33] budget, what I want to talk to you about [61:35] is the free tier. And the free tier is [61:37] something that is available to you uh [61:38] for the first 12 months of a new account [61:40] and allows you to utilize it services [61:43] without incurring any cost to you. And [61:46] so it's in your advantage to utilize [61:47] this free tier um as you are [61:49] experimenting and learning cloud. So if [61:52] you want to learn about all the [61:53] offerings, what you do is go to Google, [61:55] type in adabus free tier and you'll get [61:56] this page that explains all the sorts of [61:58] things here. So you can get uh 750 hours [62:02] on EC2 RDS things like that. There are [62:05] stipulations in terms of what it would [62:07] be. So here this is a T2 or T3 micro mic [62:10] uh micro running Linux, Red Hat um or [62:13] other type of OSS. Okay. So there are uh [62:17] details and you have to read the fine [62:18] print. Some services are only available [62:20] for the first two months, things like [62:23] that. So, it's going to highly vary [62:25] based on service, but it's worth giving [62:27] this a read in areas that you are [62:29] interested in. Now, the thing is is how [62:31] do you know that you are still in the [62:33] free tier or you go outside of it and [62:35] that's what I want to talk to you about [62:36] right now. So, I am actually in another [62:38] Adabus account. So, notice in the top [62:40] right corner it says brown.lap or hyphen [62:42] laptopro.co. [62:44] Sometimes I will switch into different [62:45] AIS accounts during these follow alongs [62:47] so I can best show you um you know the [62:50] settings. So, if you make your way over [62:52] to billing [62:54] and actually I should show you uh up [62:55] here if we go to my dealing bash [62:57] dashboard just trying to be consistent [62:59] here and you go to the lefth hand side [63:00] to billing preferences. What you can do [63:03] is enable receive free tier usage alerts [63:06] and then put your email in there and [63:07] save that. And so turn on this feature [63:09] to receive email alerts when your adus [63:12] uh service usage is approaching or [63:13] exceeded the adabus free tier usage [63:15] limits if you wish to receive these [63:16] alerts etc etc etc right and while [63:20] you're there I want you to also check [63:22] box receive billing alerts so I can show [63:25] you how to set a billing uh a billing [63:27] alert and adabus says you know budgets [63:29] are a new thing but billing alerts are [63:32] still something that we use as of today [63:34] so if you checkbox that on we'll be able [63:36] to see your cost if we go back here. Uh [63:39] it should show you um and it's because [63:41] I'm out of the free tier on this [63:43] account, but it would show you in the [63:45] alerts, you know, your usage there. So, [63:47] example here is if we scroll down, this [63:49] is in the documentation tracking your AI [63:51] is free tier usage. You would see like a [63:53] box like this and it would say, hey, [63:55] your free tier usage limit is here and [63:57] you're over it. Okay. So, that generally [64:00] would show up on this panel here, but [64:02] again, I'm outside of the free tier, so [64:04] I'm not seeing it here um today. Okay. [64:09] So, you know, hopefully that is clear. [64:11] Um, but yeah, there you go. [64:18] All right. So, we created ourselves a [64:20] budget. We're monitoring our free tier, [64:23] but there's another way that we can [64:24] monitor our spend, and that is through [64:26] building alerts or alarms. And it is the [64:29] old way. Before uh we had it was [64:31] budgets, this was the only way you could [64:33] do it. But I still recommend it because [64:35] there is a bit more flexibility here [64:36] with this service. And so I wanted to [64:38] teach you uh early on so that you know [64:40] it's available to you or if you want to [64:42] play around with it in the future. So [64:44] what you'll do is go to the top here and [64:45] type in Cloudatch. [64:48] And Cloudatch is one of those services [64:49] where it's actually a collection of [64:51] services. So there's Cloudatch alarms, [64:53] Cloudatch Logs, Cloudatch Metrics. Those [64:55] are all individual services. And loves [64:58] to update their interface. So, sometimes [65:01] you'll be presented with this option to [65:03] uh change to the latest interface. I'm [65:05] going to try out the new interface here. [65:06] Um, and that is one challenge with AWS [65:08] is you always have to expect that [65:10] they're going to change the UI on you [65:12] and you're going to have to work through [65:13] it. So, just understand that I try to [65:15] keep my videos up to date as best I can, [65:17] but part of the challenge is getting [65:18] used to that. So, this is what they have [65:20] today. I don't know if they're going to [65:22] stick with this, but this is what it [65:23] looks like. But what I want you to do is [65:24] make your way over to alarms on the [65:26] lefth hand side. And notice that we [65:28] actually have a section just for billing [65:30] which is interesting. I don't remember [65:32] them having that before. So it's new. So [65:34] uh here it says cloud watch help can [65:36] help you monitor the charges of adabis [65:38] bill. Remember that we had to turn that [65:40] on. Get 10 free alarms with a thousand [65:42] free email notifications each month as [65:45] part of the free tier. So understand [65:47] that if you create billing alarms they [65:48] do cost money um as well if you go over [65:51] that limit, but you sure get a lot. 10 [65:53] free alarms is quite a bit. But what [65:55] we'll do is go ahead here and create [65:56] ourselves alarm. We're going to go and [65:58] choose a metric. And so here are the [66:00] options we could choose from. And so we [66:03] I think would like um billing. And so we [66:08] can do by service or total estimated [66:10] charge. We're going to do a total [66:12] estimated charge. We can only select [66:14] USD. I've never seen any other currency [66:16] ever there. And so here we kind of get [66:18] this little graph where we can see [66:19] stuff. Um, but this is a lot more [66:21] powerful than budgets because you can do [66:23] anomaly detection. Uh, so like here it [66:26] will actually check based between a [66:27] range as opposed to just going through a [66:30] particular value. But what I'll do is [66:31] just set a value here like uh $50, [66:34] right? So notice that it sets the line [66:37] up here and this is my current spend [66:39] here. Right? And so back to anomaly [66:41] detection, this is a lot smarter. So uh [66:44] the idea is that if something is outside [66:46] this band of a certain amount um then it [66:48] would alert. Okay. [66:50] But I'm going to go back here. I'm just [66:52] going to set this to $50. [66:54] And that looks okay to me. You can [66:56] change the period. Six hours is fine. Um [67:00] there's additional configuration. That's [67:01] fine as well. We're going to go ahead [67:03] and hit next. Uh and so the idea is that [67:06] um you know, if it passes that red line, [67:08] it will go to an in alarm state. And [67:10] then what it will do is uh we want to uh [67:14] have it to trigger an SNS topic. So I [67:17] would generally just create a new one [67:18] here. We'll just say my billing alarm. [67:22] Okay. And then here we'll just set the [67:24] email andrewexampro.co. [67:27] And we will go ahead and create that [67:29] topic. And so that is now set. I don't [67:33] know if it would uh confirm it. We might [67:34] have to go to our email to confirm it. [67:36] So notice it says pending confirmation. [67:38] So what it has done is it sent me out an [67:40] email and it wants me to click that link [67:42] to confirm um that I want to subscribe [67:45] to it. So I might just do that offscreen [67:47] to show you here. Okay. [67:50] So, I'm just going to pull up my email [67:51] here. Just give me a moment. [67:56] Okay. And so, if I come back here, this [67:58] is the email that came in. So, I'm just [67:59] going to confirm that subscription says [68:01] I'm confirmed. Good. And if I refresh [68:04] this page, we can now see that that is [68:07] confirmed. All right. So, we'll scroll [68:10] down here. So, we can uh trigger an [68:12] autoscaling action. So, maybe you know [68:14] if you have too many servers, you say, [68:15] "Hey, the cost is too much. shut down [68:17] those servers. There's EC2 actions, [68:19] things like that. So, these are kind of [68:20] similar to um budgets, right? There's [68:24] system manager actions. I imagine all [68:26] these things are available in budgets as [68:27] well, but budgets just makes it a little [68:29] bit easier to look at. So, I'm going to [68:30] just say my simple billing alarm here. [68:36] We'll hit next. [68:38] All right. We'll hit create alarm. And [68:40] there you go. So, building alarms don't [68:42] have like forecasting and things like [68:44] that. Um, but you know they are they do [68:47] have their own kind of special utility [68:48] and so I utilize both. Okay, so there we [68:51] go. We'll go back to our management [68:52] console and move on to the next one. [68:59] So one of the strongest recommendations [69:00] that Adabus gives you is to say to set [69:03] MFA on your Adabus root user account. So [69:06] that's something we're going to do right [69:07] now. So make sure you're logged into the [69:09] root user account. So I'm going to go [69:10] log out as my IM user. I'm going to go [69:13] back and log in and I'm going to log in [69:16] as my uh root user here. So to do that, [69:20] notice sometimes it will be expanded as [69:22] the IM user. Click and sign into root [69:24] user. Here we'll have root user. I'm [69:26] going to go ahead and enter my email [69:28] that I used. And if you do switch [69:30] accounts frequently, they will ask you [69:32] these silly captions which drive me [69:34] crazy, but uh you know it happens. You [69:37] probably won't encounter it as much as I [69:38] do. And so I'm going to go ahead and [69:40] grab my password here and paste it on [69:43] in. And so now that I'm in, what I want [69:45] to do is make my way over to AM. [69:49] And I'm going to go and look for users. [69:53] Actually, sorry, just right here. Add an [69:54] MFA root user. We're going to go ahead [69:57] and hit add MFA. [69:59] All right. And so that's going to bring [70:00] us to this screen. And so here we can [70:03] activate our MFA. And so we have a few [70:05] options here. So we have virtual MFA [70:08] device, U2F security key, other hardware [70:11] like a gem gem gimmal token. So you know [70:16] I generally use this because I have a [70:19] security key and I want to show you what [70:20] I'm talking about. So this is how I log [70:23] into my machine or my ads account. This [70:27] is a security key, an UBI key that sits [70:28] on my desk. I tape it so it doesn't fall [70:30] fall off the cord. But the idea is that [70:33] when I log in, I have to press this [70:35] little button here to double confirm [70:37] before I get into my account. Uh, but if [70:39] you don't have a security key, you can [70:40] just use a virtual MFA. And all that [70:42] means is you're going to um use [70:45] something on your phone to log in. So, [70:47] we'll click continue here. And so, it [70:50] says install a compatible app on your [70:52] mobile phone or device. And so, if you [70:54] click and open this, what it will do is [70:56] tell you about some things that you can [70:57] use. Um so if we scroll down to virtual [71:02] here they suggest uh if you have Android [71:04] iPhone so auth dual mobile last path [71:07] Microsoft authenticator Google [71:09] authenticator so Google authenticator [71:11] Microsoft authenticator and author I [71:13] have all those three installed um [71:15] honestly authy has the the nicest [71:17] simplest um UI but I'm using Microsoft [71:20] authentic authenticator quite a bit so [71:22] anyway whichever you want to do it's [71:24] fine but what we'll have to do is go [71:26] back here and then it says use your [71:28] virtual MFA app on your device camera to [71:31] scan your QR code. So once you have one [71:33] of those apps installed like authy or [71:36] whatever one you want. What you're going [71:38] to do is open up the application and I [71:42] can't tell you exactly where it is, but [71:43] you'll have to hit add account in your [71:45] in your app. And then from there it will [71:48] ask you to scan your QR code. And so uh [71:51] once you're ready you hit show the QR [71:53] code. You hit scan the QR code on your [71:55] phone. I'm holding my phone up to my my [71:58] um uh my computer screen here and it's [72:01] going to find it. And I'm just going to [72:03] take a moment here to rename the account [72:05] so I can tell what it is. So I'm just [72:07] name it AWS [72:09] Sandbox because that's what I call this [72:11] account. [72:14] And I'm going to go ahead and save that. [72:16] And so now what I can do is enter uh two [72:18] consecutive MFA codes. Now this always [72:20] confused me what they wanted here, but [72:22] the idea is that you're going to see one [72:24] code, right? whatever's on the screen [72:26] right now. So, I'm going to type in it. [72:27] It says 734 [72:29] 051. And I'm going to wait until the new [72:33] code shows up. So, there's like a timer [72:35] in all these apps and they go across the [72:37] screen or they countd down. And so, you [72:39] have to wait for that to happen. And so, [72:40] I'm just going to wait here a little [72:42] bit. [72:48] And once I get the new number here, this [72:50] one is 071 [72:53] 530. I'm going to hit assign MFA. And [72:56] there we go. And I can't tell you how [72:58] many times I like messed that up because [72:59] I didn't understand the consecutive [73:01] numbers. But you're just waiting for uh [73:03] the number that's on the screen to enter [73:04] it in and then enter the next one in to [73:06] turn on MFA. And so now your account is [73:09] protected. And every time you log in, [73:11] you're going to have to enter in MFA. So [73:13] let's log out and see what that looks [73:15] like. [73:17] So we'll go ahead and sign in. [73:20] And uh again, we'll put in our root user [73:23] account here. We'll type in 74M32T. [73:28] Submit. [73:30] And I need to go grab my password. So [73:32] that's in my password manager. Just give [73:34] me a moment here. [73:38] And now it wants the MFA code. So this [73:40] is in my phone. And so I'm going to go [73:42] enter it in. So this one says 475 [73:45] 841. [73:47] All right. We'll hit submit. [73:50] Okay. And there we go. So, that's going [73:51] to happen every single time we want to [73:53] log in. Uh, I'm going to tell you that [73:55] if you get one of these, they're so much [73:57] easier to use because you just press the [73:58] button. Okay. So, that's why I have this [74:01] because I cannot stand entering the code [74:02] in time and time again. Um, but you [74:05] know, those are your options there. [74:07] Okay. [74:12] Hey, this is Andrew Brown from Exam Pro [74:14] and we're looking at the concept of [74:16] innovation waves. So when we're talking [74:18] about innovative waves, we're talking [74:19] about condraatia or K-waves which are [74:22] hypothesized cycle-like phenomena in the [74:25] global world economy and the phenomenon [74:27] is closely connected with technology [74:29] life cycles. So here is an example where [74:32] each wave is irreversibly changes the [74:34] society on a global scale and if you [74:37] look across the top we can kind of see [74:39] what they're talking about. So we have [74:40] steam engine, cotton, uh railway and [74:43] steel, electric engineering, chemistry, [74:45] prochemicals, automobiles, information [74:48] technology. And so the idea is that uh [74:51] cloud technology is the latest wave. And [74:54] I'm not sure if you'd fit web 3 in there [74:56] as well, ML, AI, but maybe they're all [74:59] part of the same wave or they're [75:00] separate waves, but generally they're [75:02] broken up based on this P RDE here where [75:06] it says perspective, recession, [75:07] depression, and movement. uh [75:09] improvement, sorry. And so this is the [75:11] common pattern of wave where we see a [75:13] change of supply and demand. And so if [75:15] we're seeing this, we know that we are [75:16] in a wave and where we are in a wave. [75:19] Okay. [75:24] Hey, this is Andy Brown from Exam Pro [75:26] and we are looking at the concept of a [75:27] burning platform. So a burning platform [75:29] is a term used when a company abandons [75:31] old technology for new technology with [75:34] the uncertainty of success and can be [75:36] motivated by fear that the [75:37] organization's future surv uh survival [75:39] hinges on digital transformation. And [75:41] just to kind of give you a visualization [75:43] here is a literal burning platform. So [75:45] imagine you have to jump to it jump from [75:48] it to make a change. So um you know [75:51] burning platform could be you know stop [75:53] using on-prem and start using cloud or [75:55] maybe it going from cloud to web 3. Um [75:58] and that's generally the idea when we [75:59] talk about a burning platform. [76:06] So let's see if we can find where [76:08] they're listing out all these products [76:10] and services. So I'm on the [76:11] adabus.mamazon.com [76:13] homepage. That is the main place that [76:15] you want to be. Um and they're always [76:18] changing the UI on me. It used to be a [76:19] nice square orange button. Now it's a [76:22] black circle. Almost every year they're [76:24] changing on me. It's just it is what it [76:25] is. But um before there used to be a [76:28] drop down for services, but maybe it's [76:30] under products now. Here we go. They [76:32] just called it products. And so this is [76:34] all of the offerings uh that we have [76:36] here. So you can see EC2. If we click [76:38] into EC2, we can read all about it. Um [76:41] find about its its um paid tier. One [76:45] thing you're going to want to check all [76:46] the time is pricing. So I usually go to [76:48] this pricing tab and uh through here we [76:50] will find our pricing information. [76:52] Sometimes it's a bit tricky to find it. [76:54] Yes, there is a calculator but honestly [76:56] it's much easier just to look at the [76:57] pricing directly. So here I went to on [76:59] demand pricing and I'm starting to get [77:02] pricing information. Uh another thing [77:04] that you're going to want to navigate to [77:06] often is the documentation. So often if [77:09] you scroll on down below they used to [77:10] have it here. Um, and so I'm not seeing [77:15] in the normal location. Maybe we be in [77:17] the overview page. Yeah, they changed it [77:19] on me. So under resources, developer [77:22] resources. [77:26] No. So I guess if we want to find [77:27] documentation, we're just going to have [77:28] to type in EC2 documentation. [77:32] And if we scroll on down here, here it [77:34] is. There we go. So that's what I was [77:36] trying to find for you. If we're also [77:38] logged into the adabus console and again [77:39] this UI has been changed again um as [77:42] well we have the 49 square the numpad [77:47] thing here and here we can see all of [77:48] our services. Honestly I just usually [77:51] type in the name of the service that I [77:52] want uh and jump right to it. So if I [77:54] want to go to EC2 I type in EC2. Okay [77:57] but anyway you can see that they have [77:59] that expanded information. I do not want [78:01] Q. We have that expanded information and [78:03] so there are two different ways we can [78:04] find the service we want. So there you [78:07] go. [78:12] Hey, this is Andrew Brown from Exam Pro [78:13] and we are looking at the evolution of [78:15] computing power. So what is computing [78:17] power? It's the throughput measured at [78:19] which a computer complete computational [78:22] tasks. And so uh what we're pretty much [78:24] used to right as of these days is [78:26] general computing. So a good example [78:28] here would be a Xeon CPU processor. uh [78:31] that's more of a high-end processor, not [78:32] something you'd find your home computer. [78:34] But when we're talking about data [78:35] centers, specifically uh um you know, [78:38] Inabus data centers, Xeon CPU processors [78:40] are what you're going to come across. Uh [78:42] then came along a new type of compute, [78:44] which is GPU computing. Um when we're [78:47] talking about Google uh cloud, they have [78:50] tensor computing. And so this is where I [78:51] get the 50 times faster based on that [78:53] metric. And so I didn't have an exact [78:55] metric here for AWS uh um solution for [78:58] this mid-tier of computing power. So I [79:00] just borrowed that 50 times there. But [79:02] the idea is that GPU computing or tensor [79:05] computing uh is is 50 times faster than [79:09] traditional CPU. And generally that's [79:11] going to be used for uh very specialized [79:13] tasks when you're doing machine learning [79:15] or AI. So it's not something you're [79:17] going to uh be doing for your regular uh [79:19] web workloads. But just understand that [79:22] all of these fit. So we're not getting [79:24] rid of general computing, we're just [79:25] adding uh new levels of compute. Then [79:28] there's the latest which is uh quantum [79:30] computing. And so here we have an [79:32] example of the rig rig riyetti 16q Aspen [79:38] 4. And so it literally looks like it's [79:40] out of um science fiction. And this [79:43] thing is like 100 million times faster. [79:45] It is super cutting edge. And we don't [79:47] even know exactly how it works. And [79:49] there's not even anything that's very [79:51] applicable that we can use this for. But [79:53] the idea is that we're not done with the [79:55] evolution of of computing power. Things [79:57] are going to get a lot faster once we [79:59] solve this last one here. And so ad [80:02] service offering here would be for [80:03] general computing. You're looking [80:05] elastic compute cloud EC2. So we have a [80:07] variety of different uh instance types [80:09] and they're all going to have different [80:10] types of hardware with different types [80:12] of general computing. um for GPU [80:15] computing. This is a specialized chip [80:17] that AWS has produced called the Adabus [80:20] um and I don't know how to say it, but [80:21] we'll just abbreviate it to infer. So [80:23] Adabus infer chip. Um and this was [80:26] designed as a direct competitor to GCP's [80:29] uh tensor computing uh unit, the TPU. Um [80:33] and so this is intended for AIM ML [80:35] workloads, but it works with not just um [80:38] TensorFlow, but it works with any [80:40] machine learning framework. So that is [80:42] one advantage it has over uh TPUs. Um [80:45] and then the last one here is Adabus [80:47] brackets. So you can actually use [80:48] quantum computing as a service on [80:50] Adabus. You could uh as of even today um [80:53] the way Adabus is able to do this is [80:55] they work with Caltech. So that's the [80:57] California technology um university or [81:00] institute. I'm not sure the name of it [81:01] there. Um so it's not exactly Adabus [81:04] producing this but Adabus is doing this [81:05] as a partnership to give quantum [81:07] computing accessible to you. Okay. [81:14] All right. So, in this video, I want to [81:16] just show you that Amazon Bracket is [81:18] accessible to you. And if you want to [81:20] play around with it, you can kind of [81:21] experiment for research into quantum [81:24] computing. We're not going to really do [81:25] anything here. I just want to show you [81:27] that uh you can access it. And so, I've [81:29] actually typed in Amazon Bedrock, but [81:31] you want to go to the top here and type [81:32] in bracket or you can type in uh quantum [81:35] quantum computing and it will bring you [81:37] to the service. There might be a [81:39] different screen that you're seeing here [81:42] as you might have to accept some terms [81:44] in order to get over to here. Um but the [81:47] idea is that we have different devices [81:49] that are accessible to us. So you can [81:51] see u we have a variety of uh cubits [81:55] that we can operate on with different [81:57] types of uh devices. They've definitely [81:59] changed this interface from the last [82:00] time I was here. They used to have tasks [82:01] and other things here. U but they have [82:03] an algorithm library that you can play [82:06] around with. they can launch a notebook [82:08] that is already are ready to go um [82:10] connected to those devices. Yeah. So [82:13] tasks are now just called quantum tasks. [82:15] So same thing um and here you can see [82:19] the variety like where we could get [82:21] access to getting um uh expert help uh [82:26] so to speak. So you know if you're [82:28] trying to uh do something they're going [82:30] to help you connect to those locations. [82:32] So nothing really interesting that we [82:34] can do. Um, but if you want to take a [82:36] look at the pricing here, it should be [82:38] per shot. That's how it was before. Um, [82:42] so here, yeah, we have per shot pricing. [82:44] So that means for each uh run, that's [82:47] what's going to going to cost. And we [82:48] have per task. And you can see based on [82:51] the cube, the cube family, uh, the cost [82:54] there. The only thing I didn't see in [82:56] here was the, uh, simulator. So there [82:58] used to have like a simulator here on [83:01] the lefth hand side, but maybe they've [83:02] just moved that around. Um, [83:06] yeah, I'm not sure exactly where it is, [83:08] but again, this is not something we [83:09] really want to play with. It's just more [83:11] the fact that you can access it if you [83:13] want to do it for research as the [83:15] applications here are extremely limited. [83:17] Um, but yeah, I just wanted to show you [83:19] that it's there. Okay, cha chiao. [83:26] Hey, this is Andrew Brown from Exam Pro [83:28] and we are looking at the benefits of [83:30] cloud and this is a summary of reasons [83:32] why an organization would uh consider [83:34] adopting or migrating to utilizing [83:36] public cloud. And so we'll quickly go [83:38] through the list here uh because in the [83:40] follow-up slides we actually go into [83:42] them a bit more detailed. So we have [83:43] agility, page you go, economy of scale, [83:46] global reach, security, reliability, [83:48] high availability, scalability um and [83:52] elasticity. So the thing is is that [83:55] Adabus had this before. It was called [83:57] the six advantages of cloud. But they [83:59] have reworked it to include additional [84:00] items. Um and so where you see these uh [84:04] sub bullets here, those are the original [84:06] six as you see 1 2 3 4 5 six. And so I [84:09] kind of just put them where they kind of [84:11] uh fall under the new categories there. [84:13] And you'll notice that ABS has included [84:15] high availability, elasticity, [84:17] reliability, and security as uh new ones [84:20] here. Okay. And so the thing is is that [84:24] um I have always always even in my [84:27] original uh uh I think in my original [84:29] cloud practitioner had cloud [84:31] architecture as a separate section and [84:33] included all these things in here. So [84:35] it's a great thing to see that ALS has [84:36] included it. Um but in terms of how I [84:39] organize this course, we're not going to [84:41] cover them in this section because I [84:43] have the cloud architecture section. So [84:44] just understand that we will come to [84:46] those eventually. And I would just say [84:48] that adabus is still missing something [84:49] on this list which is fault tolerance. [84:52] So you know my list looks like this [84:54] except I would add fault tolerance uh to [84:56] it. So you have everything there um and [84:59] disaster recovery. Okay. So the benefits [85:01] of cloud is a reworking expansion of the [85:03] six advantages of the cloud and we will [85:05] look at the original six advantages um [85:07] and then look at another one that is [85:10] more of a generalized one that I I've [85:12] used across my courses so that we fully [85:14] understand the benefits. Okay. [85:20] All right. So, this is the seven [85:22] advantages to cloud. I said six, but I [85:24] meant to say seven. And so, um, you [85:26] know, since I've created fundamental [85:28] courses for all the cloud service [85:29] providers, I started to notice kind of a [85:31] trend. And so, what I did is I [85:33] normalized it into my own seven [85:35] advantages. And this actually maps up [85:38] really well to the new benefits of the [85:40] cloud. So it looks like was [85:42] thinking the same as I was um with the [85:44] exception of those cloud architect stuff [85:46] which I keep in a separate section but [85:48] let's go through it and see what is [85:49] here. So the first is cost effective. [85:51] You pay for what you consume. No upfront [85:54] cost on demand pricing. So pay as you go [85:56] P A Y with thousands of customers [85:58] sharing the on uh sharing the cost of [86:00] resources. Adabus used to refer to this [86:03] always as ondemand pricing and Azure [86:05] always said pay as you go. And so it [86:08] looks like Adabus now uses both on [86:10] demand and pay as you go to describe [86:11] them which is great. Um but there you [86:13] go. Then we have global. So launch [86:15] workloads anywhere in the world. Just [86:17] choose a region. It's secure. So cloud [86:19] provider takes care of physical [86:21] security. Cloud services can be secure [86:23] by default or you have the ability to [86:25] configure access down to a granular [86:26] level. Uh it's reliable. So data backup, [86:30] disaster recovery, data replication, [86:31] fault tolerance. It's scalable. Increase [86:33] or decrease resources and services based [86:35] on demand. uh elastic so automate [86:37] scaling during spikes and drop in demand [86:40] current so the underlying hardware and [86:42] and managed uh software is patched [86:44] upgraded and replaced by the cloud [86:46] provider without interruption to you so [86:47] I think this is one that isn't on the [86:49] benefits of the cloud which is a really [86:51] good one um but uh yeah that's the seven [86:59] hey this is brown and we are taking a [87:02] look at global infrastructure so the [87:05] global infrastructure [87:06] is basically the backbone uh to AWS. [87:10] It's the physical network that connects [87:13] all this stuff together. Um and it [87:15] represents the globally distributed [87:17] hardware and data centers. Um so and it [87:20] acts just like one big thing to the end [87:22] customer and that's basically the reason [87:24] why you want to utilize cloud. Um and so [87:27] the ads globe infrastructure is made up [87:29] of many different types of resources [87:31] such as regions, availability zones, [87:33] direct connection locations, point of [87:35] presence, local zones, wavelength zones [87:39] and things like that. Uh and has [87:41] millions of active customers and tens of [87:43] thousands of partners globally always [87:46] using this system. And if you look at [87:48] the globe on the right hand side, there [87:50] used to be a website where they had an [87:52] interactive globe and it was really [87:54] really cool and they got rid of it. But [87:56] luckily I saved the screenshot and I put [87:57] it there and they've kind of brought it [87:59] back and you'll probably see it when we [88:01] do the follow along that they've brought [88:02] it back. But it's not as cool as this [88:04] one. Um, and every time I have to update [88:07] this course, I have to update these [88:08] numbers. And so I think the last time I [88:10] did it, they only had 32 launched [88:12] regions. And so now they have 39. [88:15] They're running out of regions because [88:16] there's only so many regions in the [88:17] world. Um, but for the most part, it's [88:20] been slowing down. It used to be a lot [88:22] more regions per per year, but uh we got [88:24] what we got. Um but there you go. Okay. [88:32] All right. So, I just want to show you [88:33] where you can find more information [88:35] about AD as global infrastructure. So, [88:36] you just Google it, you'll end up on [88:38] this page. And uh I mean, they just keep [88:41] changing this page on me. One thing [88:43] that's really nice is that they've [88:44] brought back the globe. It's not as cool [88:46] as the old one, but um it is good. I [88:48] think the last time I even looked at [88:50] this, there wasn't even Calgary on here. [88:52] So, it is here now. There actually used [88:53] to be a map um a flat map that made it [88:56] really easier for us to see all of the [88:59] stuff that's coming out. Um but we're [89:01] looking around on these dots. I'm trying [89:02] to find if there's any new locations. It [89:04] looks like maybe in Saudi Arabia there [89:06] is a location coming soon, but for the [89:09] most part, uh Adabus has covered the [89:12] globe pretty thoroughly. Oh, we got one [89:14] down here in Chile that they have yet to [89:17] uh launch, but for the most part, a lot [89:19] of locations. I'm not sure how many more [89:21] they can really add at this point. Uh, [89:23] but you can see that we can go around [89:25] here. So, I'm in Canada Central and you [89:27] can see how many availability zones and [89:29] when it was launched. For the most part, [89:31] they're always launching everything with [89:32] three. I can't imagine them ever [89:34] launching any without three anymore. Um, [89:37] and I don't know if they've ever [89:38] actually launched any with three without [89:40] three. So I think that's always been a [89:43] consistent thing for AWS, but it's been [89:44] so long I I couldn't even tell you [89:46] anymore. One interesting thing that is [89:48] different is data sovereignty. So [89:50] obviously um there's been some changes [89:52] in the world and there are some concerns [89:54] over in Europe about the sovereignty of [89:56] their data. So at this time um they now [89:59] have adabus European data sovereignty [90:01] which we'll be talking about in a [90:02] separate um in a separate video and [90:06] that's just to make it so that if you're [90:08] in Europe you are comfortable running on [90:10] AUS infrastructure. We used to get [90:12] breakdowns in here like availability [90:14] zones and things like that but they've [90:15] really simplified this. I'm just trying [90:18] to find it here. [90:20] Yeah, it's just not the same as it used [90:21] to be on here. So I guess they just [90:23] really simplified that information but [90:25] that's okay. Hey, we're going to still [90:26] get that information through um the [90:29] lecture content as it's captured uh that [90:32] information there. But I used to be able [90:33] to go in to a very specific location and [90:36] get very specific information about each [90:38] availability zone, [90:41] but they're not showing us that anymore. [90:43] This is definitely new as AI factories [90:46] and it looks like it's AI generated. [90:48] This is literal garbage. I cannot [90:50] believe they have this as a page. But [90:52] anyway, um obviously these things are [90:54] always changing. One thing I probably [90:55] would show you is regional services. So [90:57] it just shows you what service is [90:58] available in what region. So um for the [91:01] most part most is most stuff is [91:03] available wherever. But like if you are [91:04] in a very particular location like I'm [91:06] in Canada, you might want to go down [91:08] here and just see if all the services [91:09] you want to utilize are in that list. [91:12] But there you go. Okay. Chowo chia. [91:20] Hey, this is Andy Brown from Exam Pro [91:22] and we are taking a look at [91:23] regions. And regions are geographically [91:25] distinct locations consisting of one or [91:28] more availability zone. And so here is a [91:31] world map showing you all the regions [91:32] that Adus has in the world and the blue [91:34] ones represent regions that are already [91:37] available to you and the orange ones [91:39] represent ones that Adabus is planning [91:40] to open. So Adabus is always expanding [91:42] their infrastructure uh in the world. So [91:45] always expect there to be uh more [91:46] upcoming ones. Every region is [91:48] physically isolated from independent of [91:50] every other region in terms of location, [91:52] power and water supply. And the most [91:55] important region that you should give [91:56] attention to is US East one uh in [91:59] particular. So this is Northern [92:00] Virginia. It was ADOS's first region [92:02] where we saw the launch of SQS and S3. [92:05] Uh and there are a lot of uh special use [92:08] cases where things only work in US- [92:10] East1. And we'll find that out here in a [92:12] moment. What I do want to show you is [92:13] what it looks like for an architectural [92:15] diagram when you are seeing a region. So [92:18] notice that we have this um uh little [92:20] flag here. It says US East one, US West [92:22] one and inside of it we have an EC2 [92:24] instance. So that is going to represent [92:26] a region in our architectural diagrams. [92:28] Uh but let's look at some of the facts [92:30] here and understand why US East or US [92:32] East1 is so important. So each region [92:34] generally has three availability zones [92:36] and that is by intention and we will [92:38] talk about that when we get to the [92:40] availability zone section. Some new [92:42] users are limited to two or uh to two uh [92:45] but generally there's always three. [92:46] Okay. New services almost always become [92:48] available first in US East and [92:50] specifically US East one. Not all [92:52] services are available in all regions. [92:54] All your billing information appears in [92:56] US East1. So that's a US East1 [92:58] particular thing. Uh the cost of ADAS [93:00] services vary per region. And so if you [93:02] were on the marketing website or uh for [93:04] global infrastructure you can see uh [93:07] here in North America they'll say like [93:09] when it launched how many availability [93:10] zones and there might be some [93:11] conditions. So you'll notice there's [93:13] like aster uh beside these things here [93:15] or um in this one particular there's an [93:17] asterisk saying hey there are three [93:19] zones but generally you're limited to [93:21] two. Okay. When you choose a region [93:24] there are four factors you need to [93:25] consider. Uh what are the regulatory [93:27] compliance does this region meet? What [93:30] is the cost of this inab service in this [93:32] region? What services are available in [93:34] this region? And what is the distance uh [93:36] distance or latency to my end users? And [93:38] those are those four factors that you [93:39] should remember. Okay. [93:45] All right. So, we just talked about [93:47] adabus regions. Now, let's talk about uh [93:49] how that affects our services versus [93:52] regional and global services. So [93:54] regional services are scoped based on [93:56] what is set in the ad as management [93:57] console on the selected region. So you [94:00] have this dropdown and that's what [94:01] you'll do. You'll say okay I want to [94:03] have resources in Canada or in Europe. U [94:06] so this will determine where an adabus [94:08] service will be launched and what will [94:10] be seen within the adabus services [94:12] console. You generally don't explicitly [94:14] set the region for a service at the time [94:16] of creation. I explicitly mention this [94:18] because when you use something like GCP [94:20] or Azure when you create the resource [94:22] that's when you select the region but [94:24] AWS is it has this kind of global thing [94:26] which is unique to their platform. Um [94:28] then there's the concept of global [94:30] services. So some ads services operate [94:32] across multiple regions and the region [94:34] will be fixed to the word global and for [94:37] these that's services like S3 cloudfront [94:39] 53 AM. So the idea is if you were to go [94:42] over to CloudFront and go into the [94:44] CloudFront console, you'll notice that [94:46] it will just say global and you can't [94:47] switch out of that. Uh for these global [94:49] services um at the time of creation, [94:51] it's a bit different. So we were saying [94:53] up here for regional ones that you don't [94:55] select the region, but when you are [94:57] creating global services, if you're [94:59] using something like AM, there is no [95:01] concept of region because they're just [95:02] globally available. So you don't have to [95:04] determine a subset of regions. If you're [95:06] using S3 bucket, that has to be in one [95:09] region. So you actually do have to [95:11] select a region at time of creation. Um [95:13] and then there's something like platform [95:14] distributions where you are choosing a [95:16] group of regions. So you either say all [95:17] of the world or only North America which [95:20] is more like geographic distributions. [95:22] So you don't say the region in [95:23] particular but you know hopefully that [95:25] gives you a distinction between regional [95:26] services and global services. [95:33] Hey, this is Andrew Brown from Exam Pro [95:35] and we are taking a look at availability [95:36] zones. So availability zones commonly [95:39] abbreviated as a and I will frequently [95:41] use be using the term a is physical [95:44] locations made up of one or more data [95:46] centers. So a data center is a secured [95:48] building that contains hundreds or [95:50] thousands of computers. Uh and this is [95:53] one of my favorite graphics I like to [95:54] show. Of course uh you know would [95:56] never have a dog um in their data center [95:59] but I just thought that would be fun. A [96:01] region will generally contain three [96:03] availability zones. And I say generally [96:05] because there are some cases where we [96:07] will see uh less than three. So there [96:09] might be two u data centers within a [96:11] region will be isolate from each other. [96:13] Um so there will be in different [96:15] buildings but they will be close enough [96:16] to provide low latency and that is [96:18] within the uh 10 milliseconds or less. [96:21] So it's very very low. Uh it's common [96:24] practice to run workloads in at least [96:25] three A's to ensure services remain [96:28] available in case one or two data [96:29] centers fail. And this is known as high [96:31] availability. And this generally is [96:34] driven based on regulatory compliance. [96:36] So a lot of companies uh you know they [96:38] have to at least be running in three A's [96:40] and that's why AWS tries to always have [96:42] at least three A's within a region. Uh [96:44] AS are represented by a region code [96:46] followed by a letter. So here you know [96:49] you'd have US East1 which would be the [96:50] region and then the A would represent [96:53] the particular availability zone in that [96:55] region. Um, so a subnet which is related [96:59] to availability zones is associated with [97:01] a uh two availability zones. So you [97:03] never choose an a when launching [97:05] resources. You always choose a subnet [97:08] which is then associated uh to an a. A [97:10] lot of services um you know don't even [97:13] require you to choose a subnet because [97:15] they're fully managed by AWS. But in the [97:17] case of like virtual machines, you're [97:18] always choosing a subnet. Okay. So here [97:21] is a graphical uh representation or a [97:23] diagram that's representing two [97:25] availability zones. So here we have the [97:28] region US east one and US west two and [97:31] then we have our two A's. So here's 1 A [97:33] and 1B. And so these are effectively the [97:36] subnets. Okay. And so within those [97:39] subnets then you can see or availability [97:41] zones you will see that we have uh two [97:44] virtual machines. Okay. So the US East1 [97:46] region has six A's. And I thought that's [97:49] just kind of like a fun fact because it [97:50] is the most out of every single one. Um [97:53] I don't think anyone comes close to US [97:55] East one, but of course it is the most [97:57] popular. It is the uh first uh um region [98:01] or so it's not a surprise that that one [98:03] has that many. [98:10] Okay, so we just covered regions and [98:11] availability zones, but I really want to [98:13] make it clear uh what they look like so [98:15] I kind of have a visual representation. [98:17] So let's say we have our adabus region [98:19] and in this particular one we have [98:20] Canada central which in particular is [98:22] Montreal. So CA central one. Uh and the [98:26] idea here is that a region has multiple [98:28] availability zones. So here you can see [98:30] that we have uh 1 A, 1 B and 1 D. For [98:35] some reason Adabus decided to uh not [98:37] launch 1 C. Maybe it's haunted. Who [98:39] knows you know. Um and then within your [98:42] um availability zones they are made up [98:45] of one or more data centers. So just [98:47] understand that an A is not a single [98:48] data center but could be a collection of [98:49] buildings and that these A's um are [98:52] interconnected with high bandwidth low [98:54] latency networking. They're fully [98:56] redundant dedicated to metro fiber [98:58] providing high throughput low latency [99:00] networking between so just very fast [99:02] connections in between and all traffic [99:04] between AZ is encrypted and these AZ are [99:07] within 100 kilometers so about 60 miles [99:10] uh of each other. Okay. [99:17] Hey, this is Andrew. In this video, I [99:18] want to cover regions and availability [99:20] zones, specifically selecting them. So, [99:22] in the top right corner, we have this [99:24] drop down, and this determines what [99:25] region we're currently in. So, right [99:27] now, we're in North Virginia, US East 1, [99:29] which is the most popular region and [99:30] where all services and uh features are [99:33] launched first. So, um if you're [99:35] learning, it's the best region to learn [99:37] in. But if you want to be in a region [99:39] that's closer to you, look at your [99:40] geographical location. So here we have [99:42] US East or US West. So if you're in the [99:45] west of North America, then you want to [99:48] run things in US West one. Okay. And the [99:52] thing is is that anything that has a one [99:53] in it is generally going to be um the [99:56] primary u data center where everything [99:59] is launched uh and and has the most [100:01] availability, right? Uh where the other [100:03] ones will vary. Some of them have the [100:05] same, but generally it varies. And so it [100:06] just makes it for a better learning [100:08] experience. Notice in Canada it says CA [100:10] center 1. Technically there is uh data [100:12] centers in Calgary. It doesn't show up [100:13] here because down below it says there [100:14] are 17 regions that are not enabled for [100:16] this account. Um and so if we go into [100:19] that and click there I can go ahead and [100:20] enable it. I just didn't click through [100:22] there. I think it shows my phone number [100:24] here. That's why I was doing that. But [100:25] here I can enable the Calgary one and [100:27] then be able to launch resources in [100:29] here. Maybe newer accounts don't do [100:30] that. They might you might already see [100:32] Calgary. This is an older account. I'm [100:34] not making a new account for this video. [100:36] Um, so understand that there could be a [100:38] bit difference here uh in what is [100:40] showing for you by default. Um, so [100:43] anyway, everything is scoped right now [100:44] to US East1. But if we were to go over [100:47] and pretend that we're going to launch a [100:49] virtual machine over in EC2, [100:51] okay, we want to see what kind of [100:54] options we have for selection. So again, [100:55] if you're using another provider, you [100:57] would drop down and possibly uh change [100:59] the region at this step. Here we are [101:01] bound to North Virginia. And so if we go [101:04] down below under network settings, this [101:07] is the thing that is really tied to the [101:09] region is uh you know where what VPC it [101:12] is. And so the VPC here is bound to [101:15] um this region. Okay. But then it comes [101:18] down to selecting our um availability [101:21] zone. So it's not showing here. We have [101:23] subnets as no preference. But if we [101:24] click into here, you'll notice now we [101:26] have an option for availability zone. [101:28] Okay? because a virtual machine is going [101:30] to launch within a VPC within a specific [101:32] availability zone. So if I go here and [101:34] choose US East 1 A, that's where it's [101:36] going to launch. Now if I choose no [101:37] preference, it'll launch anywhere. But [101:39] what's more interesting here is subnet. [101:41] So subnet have to belong to a specific [101:43] availability zone. So if I choose this [101:45] one here, uh this one, this one has to [101:48] launch in availability zone five. Okay? [101:52] So just understand that there are [101:54] relationships between this and sometimes [101:55] things are choosing availability zones [101:57] or providing you options. Um but that's [102:00] example of these regionally specific um [102:04] services like EC2. Let's go over to S3. [102:06] S3 is interesting because it's a global [102:07] service. Um but it shows all regions at [102:11] the same time. Okay. So it shows all [102:13] regions but when you go ahead here um it [102:16] used to allow you to do this but it [102:17] doesn't anymore. used to be able to [102:18] choose the region in here I believe but [102:20] now it's just fixed at the top which is [102:21] totally fine u but notice here we have [102:24] global namespace and then regional [102:26] namespace this wasn't even a feature um [102:29] uh prior I can't remember when they [102:30] added this not even maybe a few years [102:31] ago or something maybe last year but uh [102:34] before it used to be global namespace so [102:35] when you named a bucket um like I'd say [102:38] examro co if I had a bucket name there [102:41] there could only be one exampro co in [102:43] the world named that but now they made [102:45] it regional so that you can have bucket [102:47] names that are scoped per region. Still, [102:50] again, there could only be one in US [102:52] East here, but now that is a new option. [102:55] So, you're seeing that play between [102:56] availability zones, regions, things like [102:58] that. Let's go over to our last example [103:00] here. So, CloudFront, which is also a [103:03] global service. [103:05] Okay? And notice here literally says [103:07] global. Okay. So, when we went to S3, it [103:10] shows the region. So, you choose what [103:11] you want to go in here. Technically, [103:13] still a global service. Uh but you go [103:15] over to here and this one is a truly [103:17] truly global service as notice there's [103:19] locks here you do not change what you [103:21] want to go on and so the idea here and [103:23] again we're not going to create one for [103:25] real I'm just going to show you here but [103:26] when we go through the process of [103:28] creating a distribution which oh wow [103:30] they really changed this on me wow they [103:33] changed this well go free this is [103:35] totally new I mean every time I do this [103:38] it's new but that's really really new [103:40] but what I'm looking for here is uh you [103:42] know how we are setting what region it's [103:45] This is super confusing. Can I I can't [103:47] even really proceed properly. They used [103:49] to have everything in one page. So I [103:52] could just scroll down and show you. And [103:54] so what I'm looking for here is that [103:56] regional information. [103:58] Wow, this is different. Um and so here [104:01] if it's bound to an S3 bucket, that is [104:03] one thing. [104:06] Um and so that would determine where it [104:08] would go is choosing its region. But [104:10] here based on the resources it's going [104:11] to just be dependent on what resource [104:12] you're attaching it to because that's [104:14] going to live somewhere. So S3 you've [104:16] already created it so it lives in a [104:18] specific region. Same thing with load [104:19] balancer. Same thing with API gateway. [104:21] Same thing with any other thing. So [104:23] that's how the bounding is going to work [104:24] in terms of region. We're not selecting [104:26] availability zones. Generally with [104:28] global services we don't care about [104:30] availability zones. They just kind of [104:31] decide and it's managed and you're not [104:33] seeing it. But there you go. That is uh [104:36] selecting regions and availability [104:38] zones. Okay. [104:44] Hey, this is Andrew Brown from Exam Pro [104:46] and let's take a look here at fault [104:48] tolerance specifically for global [104:49] infrastructure. And so before we jump [104:51] into that, let's just define some fault [104:53] terminology here. Uh so let's describe [104:56] what a fault domain is. So a fault [104:57] domain is a section of a network that is [105:00] vulnerable to damage if a critical [105:02] device or system fails. And the purpose [105:04] of a fault domain is that if a failure [105:06] occurs, it will not cascade outside that [105:08] domain limiting the possible damage. And [105:11] so, uh, there's this very popular meme [105:13] called this is fine where, uh, there's [105:15] obviously a serious problem, but, uh, [105:17] the person's not freaking out. And I [105:19] gave it some context to say, well, the [105:20] reason they're not freaking out because [105:22] they know that is a fault domain and [105:23] nothing outside of this room is going to [105:25] be affected. Okay? So, you can have [105:27] fault domains nested inside of other [105:29] fault domains. Uh, but generally, [105:31] they're grouped in something called [105:32] fault level. So a fault level is a [105:33] collection of fault domains. Um and the [105:36] scoping of a fault domain could be [105:37] something like a specific specific [105:39] servers in a rack, an entire rack in a [105:41] data center, an entire room in a data [105:43] center, the entire data center building. [105:45] And it's really up to the cloud service [105:47] provider to define those boundaries of a [105:48] domain. Adabus abstracts it all away. So [105:51] you don't have to think about it. But [105:52] just to compare it against something [105:53] else, when you're using Azure, you [105:55] actually define your fault domain. So [105:57] you might say like okay uh make sure [105:59] that this workload is never running on [106:01] the same VM on the same rack for these [106:02] things. Uh and you know you might like [106:04] to have that level of control but I [106:06] really like the fact that just abstracts [106:07] it away. I'm not sure how they segment [106:10] their uh their their fault domains but [106:12] they def they definitely are some [106:14] broader ones which we'll describe right [106:15] now. So when we're looking at an ABS [106:18] region, this would be considered a fault [106:20] level. And then within that fault level, [106:22] you would have your uh availability [106:24] zones and these would be considered [106:25] fault domains. And of course, those data [106:27] centers can have uh fault domains within [106:30] them. Okay? Like maybe you know they [106:32] have everything in a particular room and [106:33] that room is secure. So like if there's [106:34] a fire in that room, it's not going to [106:35] affect the other room. Things like that. [106:37] Um so each Amazon region is designed to [106:40] be completely isolated from the other [106:42] Amazon region. the uh they achieved this [106:45] with the greatest possible fault [106:46] tolerance and stability. Uh each availab [106:48] availability zone is also isolated but [106:50] the availability zone in a region are [106:52] connected through low latency links. [106:54] Each availability zone is designed as an [106:56] independent failure zone. And so here we [106:59] have uh some kind of different language [107:00] that Adabus is using. Um I've never [107:03] experienced this terminology in other [107:05] any other cloud service provider. So I [107:06] kind of feel like it's something that [107:07] Adus made up. But basically a failure [107:09] zone. They're just basically saying a [107:11] fault domain. But let's kind of expand [107:13] on their fault uh failure zone [107:15] terminology. So availability zones are [107:17] physically separated within a typical [107:19] metropolitan region and are located in [107:21] lower risk uh flood planes. Discrete [107:24] uninterruptible power supply so UPS and [107:27] an on-site backup uh generation [107:28] facilities. uh data centers located in [107:31] different AES are uh designed to be [107:34] supplied by independent substations to [107:36] reduce the risk of an event on the power [107:38] grid impacting more than one [107:40] availability zone. Availability zones [107:42] are all redundantly connected to [107:44] multiple tier one transit providers and [107:46] we'll talk about what those are uh in an [107:48] upcoming slide. And just one thing I [107:51] want to note here is that when you adopt [107:52] multi-AZ you get high availability. So [107:55] if an application is partitioned across [107:57] as companies are better isolated and [107:59] protected from issues such as power [108:01] outages, lightning strikes, tornadoes, [108:04] earthquakes and more. So that's the idea [108:06] behind you know why we want to run in [108:08] multi-AZ. Okay, because of these fault [108:10] domains. [108:15] Hey, this is Andy Brown from Exam Pro [108:17] and we're talking about the ads global [108:18] network. So the global network [108:20] represents interconnections between AWS [108:23] global infrastructure and it's commonly [108:25] referred to as the backbone of AWS. So [108:28] is EC2. So just understand that that [108:30] could be used in more than one way. But [108:32] think of it as a private expressway [108:33] where things can move fast between data [108:35] centers. And uh one thing that is [108:38] utilized a lot to get data in and out of [108:41] uh AWS very quickly is edge locations. [108:44] They can act as on and off ramps uh to [108:46] the ads global network. Of course, you [108:47] can uh get to the network through POPs, [108:50] which we'll talk about um you know in [108:52] the upcoming slides here, but let's just [108:53] talk about edge locations and what [108:54] services use them. So, uh when we're [108:57] talking about things that are getting [108:58] onto the Adabus network, we're looking [108:59] at things like ABS global accelerator, [109:01] Adabus S3 transfer acceleration. And so, [109:05] uh these use edge locations as an [109:08] on-ramp to quickly reach ads resources [109:10] and other regions by traversing the fast [109:11] ads global network. Notice that the [109:13] names in it say accelerator [109:16] acceleration. The idea is that they are [109:17] moving really fast. Okay. On the other [109:20] side, when we talk about like an [109:21] off-ramp, we're looking at Amazon [109:22] CloudFront, which is a content [109:23] distribution network. This uses edge [109:25] locations to uh as an off-ramp to [109:27] provide an at the edge storage and [109:30] compute near the end user. Uh and one [109:33] other thing that is kind of always [109:34] utilizing the global network are VPC [109:36] endpoints. Now, these aren't using edge [109:38] locations, but the idea here is that [109:40] this ensures your resources stay within [109:41] the ads network and do not traverse over [109:44] the public internet. So, you know, if [109:46] you have uh you know, a resource running [109:48] in US East1 and one in uh EU, it would [109:51] and they never have to go to the [109:52] internet, it would make sense to always [109:54] enforce it to stay within the network [109:55] because it's going to be a lot faster. [109:57] So, there you go. [110:04] Hey, this is Andrew Brown from Exam Pro [110:05] and we are taking a look at point of [110:07] presence, also known as POP. And this is [110:09] an intermediate location between a [110:11] native region and the end user. And this [110:13] location could be a data center or a [110:15] collection of hardware. So for AWS, a [110:17] point of presence is a data center owned [110:19] by AWS or trusted partner that is [110:21] utilized by ads services related for [110:24] content delivery or expediated upload. [110:27] So a pop resource could be something [110:28] like an edge location or regional edge [110:30] cache. So as an example over here we see [110:32] an S3 bucket and it has to go through a [110:35] regional edge cache and then get to an [110:36] edge location. Let's go define what [110:38] those are. So an edge location are data [110:40] centers that hold cache copies on the [110:42] most popular files. So web pages, images [110:45] and videos so that the delivery of the [110:48] distance to the end users are reduced. [110:50] Then you have regional edge locations [110:52] and these are data centers that hold [110:54] much larger caches of less popular files [110:56] to reduce a full round trip and also to [110:59] reduce the cost of transfer fees. [111:06] So to kind of help put pops more in [111:08] presence just in the general sense, here [111:11] is a diagram I got from Wikipedia that [111:13] kind of just shows a bunch of different [111:14] networks. And notice where the pop is, [111:16] it's on the edge or the intersection of [111:19] uh two networks. So here you know we [111:21] have um you know tier three and then [111:23] there's tier two and there's this pop [111:25] that is in between them. Okay. So tier [111:28] one networks is a network that can reach [111:30] every other network on the internet [111:31] without purchasing IP transit or paying [111:33] for peering. And so the ad of [111:35] availability zones or a redundantly [111:38] connected to multiple tier one transit [111:39] providers. Okay. [111:46] All right. So let's take a look at some [111:47] ADA services that are utilizing POPs or [111:50] edge locations for content delivery or [111:52] expediated upload. So Amazon CloudFront [111:54] is a content delivery network service [111:56] and the idea here is you point your [111:58] website to CloudFront so that it will [112:00] route requests to the nearest edge [112:01] location cache. It's going to allow you [112:03] to choose an origin. So that could be a [112:05] web server or storage that will be the [112:07] source of the cache and caches the [112:09] content of what origin would return to [112:11] various edge locations around the world. [112:13] Then you have Amazon S3 transfer [112:14] acceleration. This allows you to [112:16] generate a special URL that can be used [112:18] by the end users to upload files to a [112:20] nearby edge location. Once a file is [112:23] uploaded to an edge location, it can [112:24] move much faster within the ads network [112:26] to reach S3. Then at the end here you [112:29] have ads global accelerator. you can [112:31] find the optimal path from the end user [112:33] to your web servers. So global [112:35] accelerators are deployed with an edge [112:37] location. So you send user traffic to an [112:39] edge location instead of directly to [112:40] your web application. This service is [112:42] really really great for if let's say [112:44] you're running a web server in US East1 [112:47] and you just don't have the time uh to [112:50] set up infrastructure in other regions. [112:52] You turn this on and you basically get a [112:53] boost. Okay. [112:59] Hey, this is Andrew Brow from Exam Pro [113:01] and let's take a look at it was direct [113:03] connect. So this is a private or [113:04] dedicated connection between your data [113:06] center office colllocation and AWS. And [113:09] so the idea here is imagine if you had a [113:11] fiber optic cable running from your uh [113:13] data center all the way to your ads so [113:15] that it feels like uh when you're using [113:17] your stuff on your data center like your [113:20] local virtual machines that uh there's [113:22] like next to no latency. Okay. So direct [113:24] connect has two very fast network [113:26] connection options. We have the lower [113:28] bandwidth which is at 50 to 500 [113:30] megabytes per second. And then you have [113:32] the higher bandwidth which is 1 [113:34] gigabytes to 10 gigabytes per second. So [113:38] using direct connect helps reduce [113:39] network costs, increase bandwidth [113:41] throughput, so great for hightra [113:42] networks. It provides a more consistent [113:45] network experience than a typical [113:46] internet-based connection. So reliable [113:48] and secure. I do want to point out the [113:50] term collocation. If you never heard of [113:52] that before, a collocation or a carrier [113:54] hotel is a data center where equipment, [113:56] space, and bandwidth are available for [113:58] rental uh to retail customers. And I do [114:01] want to also point out that even though [114:02] it says private up here, and this is the [114:04] language that AWS use, I usually just [114:06] say dedicated, but the connection is [114:08] private, but that doesn't necessarily [114:09] mean it's secure. Okay? So, uh we'll [114:12] talk about that when we reach adsvpns [114:14] and how we can use that with direct [114:15] connect to make sure our connections are [114:17] secure. Okay? [114:22] All right, so let's take a look at what [114:24] a direct connect location is. So a [114:26] direct connect location are trusted [114:28] partner data centers that you can [114:29] establish a dedicated high-speed low [114:32] latency connection from your on premise [114:35] to AWS. So an example of a partner data [114:37] center would be one like here in [114:38] Toronto, the Allied data center. So you [114:41] can tell that's right down in uh the [114:42] Toronto center. And so you would use [114:44] this uh uh as part of direct connect [114:47] service to order and establish a [114:49] connection. Okay. [114:55] Hey, this is Andrew Brown from Exam Pro [114:57] and we are taking a look at local zones [114:58] which are data centers located very [115:00] close to densely populated areas to [115:02] provide singledigit millisecond low [115:04] latency performance. So thinks like [115:06] seven milliseconds for that area. So [115:09] here is a map of uh local zones that [115:11] exist and ones that are coming out. I [115:12] believe the orange ones are probably [115:13] ones that are on their way. And so to [115:15] use a local zone, you do need to opt in. [115:17] So you got to go talk to AWS, probably [115:18] open a support ticket to get access to [115:20] it. The first one to ever be launched [115:22] was uh the LA one. Uh and so um you [115:26] know, when you want to see it, it looks [115:28] just like a an availability zone. It's [115:30] going to show up under whatever region [115:32] that is because these are always tied to [115:33] existing regions. So the LA1 is tied to [115:35] US West uh region and the A would look [115:39] like US West 2-phen LAX hyphen 1A. Okay. [115:44] So only specific AA services have been [115:46] made available. So there's particular [115:48] EC2 types EBS, Amazon FSX, application [115:52] load balancer, Amazon VPC. They probably [115:56] have extended it to more services. Do [115:58] you need to know that for the exam? No. [115:59] But you know the point is is that [116:01] there's a limited subset of things that [116:03] are available. The purpose of local zone [116:05] is to support highly demanding [116:07] applications sensitive to latency. So [116:08] media and entertainment, electronic [116:10] design and automation, ad tech, machine [116:13] learning. So it kind of makes sense. [116:14] Like you look at LA, they're in the [116:16] media entertainment and so they're [116:17] dealing with lots of media content. So [116:19] it has to be really low for them. Okay. [116:25] Hey, this is Andrew Brown from Exam Pro [116:27] and we are taking a look at Abis [116:29] wavelength zones and these allow for [116:31] edge computing on the 5G networks and [116:34] applications will have ultra low latency [116:36] being as close as possible to the users. [116:38] So, Abis has partnered with various [116:40] telecom companies to utilize their 5G [116:42] networks. So, we're looking at Verizon, [116:44] Vodafone, KDDDI, SK Telecom. And so the [116:48] idea here is that you will create a [116:49] subnet tied to a wavelength zone and [116:52] then and just think of it as like an [116:54] availability zone but it's a wavelength [116:55] zone and then you can launch your VMs to [116:57] the edge of the targeted 5G network. So [117:00] that's the network you're using uh AWS [117:03] to uh deploy an EC2 instance and then [117:05] when users uh connect to you know those [117:08] radio tower those um the cell towers [117:10] they're going to be routed to um you [117:12] know nearby hardware that is running [117:14] those virtual machines. Okay. And that's [117:17] all it is. It's just it's just uh EC2 [117:19] instances. Um but you know the advantage [117:21] here is that it's like super super low [117:23] latency. Okay. [117:29] Hey, this is Andy Brown from Exam Pro [117:31] and we are taking a look at data [117:32] residency. So this is the physical or [117:34] geographical location of where an [117:37] organization or cloud resources reside. [117:39] And then you have the concept of comp uh [117:41] compliance boundaries. So a regulatory [117:43] compliance. So legal requirement by [117:45] government or organization that [117:46] describes where data and cloud resources [117:48] are allowed to reside. And then you have [117:51] the idea of data sovereignty. So data [117:53] sovereignty is the jurisdictional [117:55] control or legal authority that can be [117:57] asserted over data because its physical [117:59] location is within a jurisdictional [118:02] boundary. And so the reason we care [118:04] about this stuff is that if we want to [118:05] work with the Canadian government or the [118:07] US government and they're like hey you [118:09] got to make sure that you know if you [118:10] want to work with us all the data has to [118:12] stay in Canada and you need to give them [118:14] that guarantee. So data residency is not [118:16] a guarantee. It just says where your [118:18] data is, right? And compliance [118:20] boundaries are those um controls that [118:22] are in place to say, okay, this is going [118:24] to make sure that data stays where we [118:25] want it to be. And data sovereignty is [118:27] just like the idea of the scope of the [118:29] the legal the legal stuff that ties in [118:31] with compliance boundaries. So how do we [118:34] do that on AWS? Well, there's a few [118:36] different ways, but um let's just take a [118:38] look at some ways that we can meet those [118:40] compliance boundaries. one uh which is [118:42] very expensive but also very cool is [118:44] adabus outposts. So this is a physical [118:47] rack of servers that you can put in your [118:48] data center and you'll know exactly [118:50] where the data resides because you know [118:52] it's physical if it's in your data [118:54] center and you're in Canada that's where [118:55] it's going to be. Okay. Uh and I believe [118:58] that you know there is only a subset of [119:00] uh adabus services that are available [119:01] here but you know that is one option to [119:03] you. Another is using like um services [119:06] for governance. So like one could be [119:08] adabus config. This is a policy as a [119:10] code service. So you can create rules to [119:12] continuously check adabus resource [119:14] configuration. So if they deviate from [119:16] your expectations, you're alerted or [119:18] adus config can in some cases autored [119:20] remediate. So if you were expecting you [119:22] know um you know you had an adus account [119:24] and you're saying this account is only [119:26] to be used for candid resources and [119:28] somebody launches let's say something in [119:30] another region then you could get an [119:31] alert or tell ads config to go delete [119:34] that resource. Okay. Now if you want to [119:37] prevent people from doing it uh [119:38] altogether that's where IM policies come [119:40] into play. So these can be written [119:42] explicitly to deny access to specific [119:44] adabus regions. And you know this is [119:46] great if you're applying it to users or [119:48] roles. But if you wanted to have it [119:50] organizationalwide across all of your um [119:53] ads accounts you can use something [119:54] called a service control policy that is [119:56] just an IM policy that is used within [119:58] ads organizations that makes it [120:00] organizationalwide. Okay. [120:07] Hey, this is Andrew Brown from Exam Pro [120:09] and we are looking at AD as 4 [120:10] government. So to answer that we first [120:12] have to understand what is public [120:14] sector. So public sector includes public [120:16] goods and government services such as [120:18] military, law enforcement, [120:20] infrastructure, public transit, public [120:23] education, healthcare and the government [120:25] itself. So ABS can be utilized by the [120:27] public sector or organizations [120:28] developing cloud workloads for the [120:30] public sector. And IS achieves this by [120:32] meeting regulatory compliance programs [120:34] along with specific governance and [120:36] security controls. So this could be [120:39] meeting the requirements with HIPPA, Fed [120:40] ramp, um CJIS and FIPS. Okay. So AIS has [120:45] a special regions or special regions for [120:48] US regulation called GovCloud which [120:50] we'll talk about next. Okay. [120:56] Hey, this is Andy Brown from Exam Pro [120:57] and we are taking a look at GovCloud. [120:59] And to understand what GovCloud is, we [121:01] need to know what Fed Ramp is. So [121:02] Fedramp stands for federal risk and [121:04] authorization management program. It's a [121:06] US governmentwide program that provides [121:08] a standardized approach to security [121:10] assessment, authorization, continuous [121:12] monitoring for cloud products and [121:13] services. So now that we know what [121:15] FedRAP is, what is GovCloud? Well uh and [121:19] again it's not particular to AWS because [121:21] Azure has GovCloud as well but a cloud [121:23] service provider like ads or Azure gener [121:25] will offer an isolated region to run fed [121:28] ramp workloads and so in AWS it's called [121:31] govcloud and these are specialized [121:34] regions that allow customers to host [121:35] sensitive controlled unclassified [121:37] information and other types of regulated [121:39] workloads. So gov cloud regions are only [121:41] operated by u uh by US citizens on US [121:44] soil. They're only accessible to US [121:46] entries and root account holders who [121:48] pass a screening process. Customers can [121:51] architect secure cloud solutions that [121:53] comply with Fed Ramp. Uh DO the DOJ's uh [121:57] criminal justice information systems uh [122:00] security policy the US international [122:02] traffic and arms regulation uh uh export [122:06] administration regulations the [122:08] department of defense cloud computing [122:10] security requirements and guides. So if [122:12] you want to work with the US government, [122:13] you want to uh engineer and use [122:16] GovCloud. Okay. [122:22] Hey, this is Andrew Brown from Exam Pro [122:24] and we're taking a look at uh running [122:26] Adabus in China. So Adabus China is the [122:29] Adabus cloud offering in mainland China. [122:31] Adus China is completely isolate [122:33] intentionally from Adabus Global to meet [122:34] regulatory compliance for mainland [122:36] China. So that means that if you make a [122:38] workload on the ads global uh you can't [122:41] uh interact with it within the ads China [122:43] one. Okay. It's basically treated like a [122:46] a completely separate service like ads [122:48] has its own Chinese version. Uh and so [122:50] ads China is on its own domain at [122:53] amazon.cn [122:55] and for everybody else that's what's [122:56] considered ads global. So when I'm using [122:58] adabus from Canada or use it from the US [123:01] or from India or from Europe or wherever [123:04] that is the adabus global. Okay. So in [123:07] order to operate in adabus China regions [123:10] you need to have a Chinese business [123:12] license. So ICP license not all services [123:15] are available in China. So uh you will [123:17] not have the use of route 53. Uh and you [123:20] might say well why not just run in [123:22] Singapore and it was global and you [123:24] could do that but the advantage of [123:26] running in mainland China means that you [123:28] would not have to traverse the great [123:30] firewall. Okay? So all your traffic is [123:32] already within China. So you don't have [123:34] to uh deal with that. Adabus has two [123:36] regions in mainland China. So uh there's [123:39] this one here which is the northwest [123:41] region operated by NSW WCF. And then you [123:44] have the one in Beijing, North One [123:46] operated by uh Synnet. So you know [123:48] Adabus just could not meet the the [123:51] compliance requirements. So they had to [123:52] partner with local providers uh or data [123:55] centers. And so that is how that works. [123:57] Okay. [124:02] Hey, this is Andrew. This video I just [124:04] want to show you where to go if you're [124:06] interested to seeing the Chinese version [124:08] of AWS. So, up here we're on [124:10] adabus.amazon.com. That is the one that [124:13] we all know. But if you go to Amazon [124:15] adabus.cn, this is where you're going to [124:17] get the one where um it's uh adabus [124:20] infrastructure hosted on mainland China. [124:22] Um notice here that they do not have the [124:25] name Adabus here. And there's a good [124:26] reason for that. It's because there was [124:28] a trademark um thing where Adabus is not [124:32] allowed to use the name AWS specifically [124:37] um for whatever reason. I'm not going to [124:40] get into the politics as to why. But [124:42] anyway, over here, if you go ahead and [124:44] create an account, you're going to [124:45] notice that there is uh basically a [124:47] bunch of onboarding instructions. So, [124:48] you can't just simply make an account, [124:51] right? you have to um you know basically [124:55] pass whatever their business [124:57] registration certificate and other stuff [124:59] here. So there's a lot of steps involved [125:01] but it's just kind of interesting to see [125:04] u that there is another version and you [125:06] know there's those little things that [125:08] tell you that it's different. Okay. [125:15] Hey, this is Andy Brown from Exam Pro [125:17] and we are looking at sustainability for [125:19] Adabus global infrastructure. And before [125:20] we talk about that, let's talk about the [125:22] climate pledge. So, Amazon co-founded [125:24] the climate pledge to achieve net zero [125:26] carbon emissions by 2040 across all of [125:29] Amazon's businesses, which includes AWS. [125:32] If you want to find out more [125:33] information, go to to [125:34] sustainability.aboutazon.com. [125:37] There's a lot of great information [125:38] there, and you'll learn exactly how uh [125:41] AWS is achieving this in particular like [125:43] their data centers. It's very [125:44] interesting. Okay, so Adabus cloud [125:46] sustainably goals are composed of three [125:48] parts. The first is renewable energy. So [125:50] Adabus is working towards having their [125:51] Adabus global infrastructure powered by [125:54] 100% renewable energy by 2025 and ABUS [125:58] purchases and retires environmental [126:00] attributes to cover the non-renewable [126:02] energy for Abas global infrastructure. [126:04] So they would purchase things like [126:06] renewable energy credits also known as [126:08] RECC's guarantees of origin so the [126:11] second point here is cloud efficiency. [126:13] So AIS infrastructure is 3.6 6 times [126:15] more energy efficient than the medium of [126:18] US enterprises data centers surveyed. So [126:20] that's going to really rely on that [126:22] survey. Surveys are not always that [126:23] great. So you know take that with a [126:25] grain of salt. Okay. Then we have water [126:28] uh stewardship. So uh direct evaporative [126:30] technology to cool our data centers. Use [126:33] of non uh portable uh water for cooling [126:36] purposes. So, they're recycling water. [126:38] On-site water treatment allows us to [126:39] remove us them to remove scale forming [126:43] minerals and reuse waters uh for more [126:45] cycles. Water efficiency metrics to [126:48] determine and monitor optimal water use [126:50] for each Adabus region. And you'll find [126:52] that water plays a large part on uh [126:55] making these um uh these data centers [126:59] very efficient. Okay. [127:05] So, I just wanted to show you where you [127:06] get to that sustainability information. [127:08] So, I just went to Adabus Global [127:09] Infrastructure. You click sustainability [127:12] and that's going to bring us over to [127:14] Whoops, I have my Twitter open there to [127:15] the sustainability in the cloud. So, if [127:18] you want to uh read a bunch of stuff [127:19] here about things that are going on that [127:21] Adus is up to see uh how they are [127:24] progressing with renewable energy. Um [127:26] there's cloud efficiency up here. So, [127:28] you know, how are they being efficient? [127:30] It's worth the read to really understand [127:32] that there's a lot of water involved, [127:34] like reducing water in data centers. I [127:36] thought that was really interesting. Um, [127:38] I mean, they have the podcast, but I [127:41] don't think there's really much to it. A [127:43] bi-weekly podcast of byite-size stories [127:45] about how tech makes the world better. [127:47] That's not necessarily a sustainability [127:49] podcast. It's just the podcast in [127:52] general. There's a download center, um, [127:54] Amazon's 2020 sustainability report. So, [127:57] I guess you can download the reports to [127:58] see what is going on there. So, we could [128:00] download the progress here and see what [128:02] they've been up to. [128:05] Okay. So, there's a bunch of numbers, [128:06] things like that. Okay. Very short [128:08] reports, but hey, at least you can [128:10] download them. Okay. So, just in case [128:12] you're uh very interested in [128:14] sustainability. All right. [128:19] Hey, this is Andrew Brown from Exam Pro [128:21] and we are taking a look at ABA's ground [128:23] station. And so this is a fully managed [128:25] service that lets you control satellite [128:27] communications, process data, and scale [128:30] your operations without having to worry [128:31] about building or managing your own [128:33] ground station infrastructure. And so [128:36] when we're talking about ground station, [128:37] a really good way to cement what the [128:39] service is is just think of a big [128:41] antenna dish that's pointing into the [128:43] sky trying to communicate with [128:45] satellites because that's essentially [128:46] what the service is doing. So the use [128:48] cases here could be for weather [128:50] forecasting, surface imaging, [128:52] communications, video broadcasts, and to [128:54] use ground station, the idea is that you [128:56] would schedule a contact. So that's [128:58] where you're selecting a satellite, a [128:59] start and end time, and the ground [129:01] location. And then you use an adus [129:03] ground station EC2 AMI, an Amazon [129:05] machine image to launch EC2 instances [129:08] that will uplink and down link uh data [129:10] during the contact or receive down link [129:13] data in an Amazon S3 bucket. A use case [129:16] could be something like you are a [129:18] company, you've reached an agreement [129:19] with a satellite image provider to use [129:21] their satellites to take photos for a [129:23] specific region or time or whatever. And [129:25] so the idea is that you are using Adabus [129:27] ground station to communicate uh to that [129:30] company satellite and download that S uh [129:32] that image data to your S3 bucket. Okay. [129:42] Hey, this is Andrew Brown and we are [129:44] looking at ABOS Outposts. And this is a [129:46] fully managed service that offers the [129:47] same AOS infrastructure, services, APIs, [129:50] tools to virtually any data center, [129:52] collocation space or on premise facility [129:54] for a truly consistent hybrid [129:55] experience. And just to kind of [129:57] summarize it, it's a rack of servers [129:58] running ads stuff on your physical [130:01] location. Okay, so before we jump into [130:03] the service or technology itself, uh [130:06] let's talk about what is a rack server [130:08] or just a rack. So, it's a frame [130:10] designed to hold and organize it [130:12] equipment. So, here's an example of a [130:14] 42U rack. Uh, and there's a concept of [130:18] rack heights. So, the U stands for rack [130:20] units or U spaces. Uh, with it equal to [130:24] 1.75 in. And the industry standard rack [130:27] is a 48 U. Um, so that is a 7 foot rack. [130:32] So, a full uh size rack cage is commonly [130:36] the 42 high. Okay. And uh in it you [130:40] might have equipment that is of [130:41] different sizes. So there could be one [130:43] U, 2 U, 3 U, or 4 U high. So here's an [130:46] example of, you know, of an interior of [130:48] Iraq. And notice that like 1 U, 2 U, 4U, [130:52] they're all a little bit shaped [130:52] differently. Uh but they give you kind [130:54] of an idea of um you know what those [130:57] are. So Outpost comes in three form [131:00] factors. The 42U, the 1 U, and the 2U. [131:03] So the uh the first one here, the 42U, [131:06] this is basically a full rack of servers [131:09] provided by Adabus. So you're not just [131:10] getting the frame. It actually comes [131:12] with, you know, servers. Uh and so [131:14] Adabus delivers it to your preferred [131:16] physical site, fully assembled and ready [131:17] to be rolled into the final position. It [131:19] is installed by Adabus and the rack [131:21] needs to be simply plugged in to the [131:23] power and network. And there's a lot of [131:25] details about um the specs on this on [131:27] the Adabus website, so you know, I'm not [131:29] going to go through them all here. Um [131:31] then there are servers that you can just [131:32] place into your existing racks. So we [131:34] have the one UU. So this is suitable for [131:36] 19inch wide 24 in deep cabinets. It's [131:39] using uh gravitron 2 um CPUs and it can [131:44] have up to 64 uh virtual CPUs. We have [131:48] 128 gigabytes uh 4 terabytes of local [131:51] NVM [131:52] storage. Um and then you have the U or [131:55] sorry the 2U. So, suitable for 19inch [131:59] wide, 36 inch deep Intel processors up [132:02] to 128 virtual CPUs, 256 GB of memory, 8 [132:06] terabytes of local NVMe storage. So, [132:09] there you go. [132:15] Let's take a look at cloud architecture [132:17] terminologies. Before we do, let's talk [132:19] about some of the roles that are around [132:20] uh doing cloud architecture. So, the [132:22] first is solutions architect. This is a [132:24] role in a technical organization that [132:26] architects a technical solution using [132:28] multiple systems via researching, [132:30] documentation and experimentation. And [132:33] then you have the cloud architect. This [132:35] is a solutions architect that is focused [132:37] solely on architecting technical [132:38] solutions using cloud services. [132:40] Understand that in the uh actual [132:42] marketplace a lot of times solutions [132:44] architect is used to describe both a [132:46] cloud architect and a solutions [132:47] architect. And you know these are going [132:50] to uh highly vary based on your locality [132:52] and how companies want to use these [132:54] terms. But this is just me broadly [132:55] defining them here. So just don't take [132:57] them as uh perfect word in terms of what [132:59] they're representing. So a cloud [133:01] architect needs to understand the [133:03] following terms and factors uh and [133:05] factor them into their designed [133:06] architecture based on the business [133:08] requirements. So we have the idea of [133:10] availability, your ability to ensure a [133:11] service remains available. Scalability, [133:13] your ability to grow rapidly or [133:14] unimpeded. elasticity, your ability to [133:17] shrink and grow to meet the demand. [133:18] Fault tolerance, your ability to prevent [133:20] a failure, disaster recovery, your [133:22] ability to recover from a failure. And [133:24] there are a couple other things that uh [133:26] that should be considered. They're not [133:28] terminologies, but they're definitely [133:29] important to a solutions architect or a [133:31] cloud architect. And uh these are things [133:34] you always need to consider uh as well. [133:37] And this is just me talking to my [133:39] solutions architect friends where [133:40] they'll always ask me these two [133:41] questions after presentation. They'll [133:43] say how secure is the solution and how [133:45] much is this going to cost. All right. [133:47] And so for the terminologies up here, [133:50] we're going to define these right away [133:52] and we're going to figure these out [133:54] throughout the course. We have two giant [133:55] sections just on cost and security [133:57] alone. Uh so there we go. [134:03] The first term we're looking at is high [134:04] availability. And this is your ability [134:06] for your service to remain available by [134:08] ensuring there is no single point of [134:10] failure and or you ensure a certain [134:12] level of performance. So the way we're [134:15] going to do that on AWS is you'd want to [134:17] run your workload across multiple [134:19] availability zones to ensure that if one [134:21] or two availability zones became [134:23] unavailable, your servers or [134:24] applications remain available because [134:26] those other um those other servers are [134:29] going to be there. And the way we would [134:30] accomplish that is via elastic load [134:32] balancer. So a load balancer allows you [134:34] to evenly distribute traffic to multiple [134:36] servers in one or more data center. If a [134:38] data center or server becomes [134:39] unavailable or unhealthy, the load [134:41] balancer will route the traffic to only [134:43] the available data centers within the [134:46] server. And understand that just because [134:48] you have additional servers doesn't mean [134:49] that you are uh you're available. You [134:51] have to you might need to meet a [134:53] particular threshold of availability. So [134:55] you might need to have at least two [134:56] servers always running to meet the [134:58] demand. So it's based on the the demand [135:00] of traffic. Okay. [135:06] Let's take a look here at high [135:07] scalability. So this is your ability to [135:09] increase your capacity based on the [135:11] increasing demand of traffic, memory, [135:13] and computing power. And we have the [135:15] terms vertical scaling. So scaling up. [135:18] Um this is where you upgrade to a bigger [135:20] server. And then there's horizontal [135:21] scaling. Scaling out. This is where you [135:23] add more servers of the same size. And [135:26] the great thing about scaling out or [135:27] adding additional servers is that you're [135:29] also going to get um high availability. [135:30] So if you do need two servers, it's [135:33] always better to, you know, add an [135:34] additional server as opposed to having a [135:36] larger server, but it's going to be very [135:37] dependent on a lot of factors. Okay, [135:45] so scalability and elasticity seem very [135:47] similar, but there is a crucial [135:49] difference and this is your ability to [135:50] automatically increase or decrease your [135:53] capacity based on the current demand of [135:55] traffic, memory, and computing power. [135:56] Again, it's the it's the fact that it [135:58] happens automatically and you can go [136:00] both ways, increase or decrease. So for [136:02] horizontal scaling, we have the concept [136:04] of scaling out. So add more servers of [136:06] the same size and then scaling in [136:08] removing underutilized servers of the [136:11] same size. And vertical scaling is [136:13] generally hard for traditional [136:15] architectures. So you'll usually only [136:17] see horizontal scaling described with [136:18] elasticity. Um and the way we would [136:21] accomplish uh being highly elastic is [136:23] using autoscaling groups, ASGs. And this [136:26] is a native feature that will [136:27] automatically add or remove servers [136:29] based on scaling rules you define based [136:31] on those metrics. Okay, [136:37] let's talk about being highly fault [136:39] tolerant. So this is your ability for [136:41] your service to ensure there is no [136:42] single point of failure preventing the [136:44] chance of failure. And the way we could [136:46] do that is with failovers. So this is [136:49] when you have a plan to shift traffic to [136:51] a redundant system in case the primary [136:53] system fails. A very common example is [136:55] having a copy or secondary uh uh uh of [136:59] your database where all ongoing changes [137:01] are synced. The secondary system is not [137:03] in use until a failover occurs and it [137:06] becomes the primary database. So when [137:09] we're talking about databases on AWS, [137:10] this is the concept of RDS multi-AZ. So [137:13] this is when you run a duplicate standby [137:16] database in another availability zone in [137:18] the case your primary database fails. [137:24] And last here is high durability. So [137:26] this is your ability to recover from a [137:28] disaster and to prevent the loss of [137:29] data. So solutions that recover a [137:31] disaster uh from a disaster is known as [137:33] disaster recovery. So do you have a [137:35] backup? How fast can you restore the [137:37] backup? Does your backup still work? How [137:39] do you ensure current live data is not [137:41] corrupt? And so maybe a solution on ads [137:43] would be using cloud endure which is a [137:44] disaster recovery uh service which [137:46] continuously replicates your machines in [137:48] a lowcost staging area in your target as [137:50] a account and preferred region enabling [137:52] fast and reliable recovery in the case [137:54] of an IT data center fails. Okay. [138:02] So to understand disaster recovery we [138:04] need to know more about uh things around [138:06] it like business continuity plans BCPs [138:10] and RTO's and RPOS's. So uh a BCP is a [138:14] document that outlines how a business [138:16] will continue operating during an [138:17] unplanned disruption in services. So [138:19] it's basically the plan that you're [138:20] going to execute uh if that happens. And [138:23] so here we have a disaster and you can [138:26] see that there's a chance of data loss [138:27] and downtime. And these two um uh [138:30] factors as RPO and RTO are going to [138:33] define the length of these durations. So [138:35] recovery point objective is the maximum [138:37] acceptable amount of data loss after an [138:39] unplanned data loss incident. Express [138:41] this amount of time. So how much data [138:43] are you willing to lose? And then [138:45] recovery time objective. So the maximum [138:47] amount of downtime your business can [138:49] tolerate without incuring a significant [138:51] financial loss. So, how much time you're [138:53] willing to go down. Okay, so those are [138:56] the two there. And now let's go take a [138:58] look at the disaster recovery options [138:59] that we can use to define in our uh our [139:02] BCP. [139:08] So now let's take a look at our disaster [139:09] recovery options. Uh and based on what [139:11] you choose, they're going to be a trade [139:13] of cost versus time to recover based on [139:15] the RPOS's or RTO's, of course. And so [139:17] sometimes this is rep represented [139:19] vertically like a uh a thermostat or you [139:22] can do it horizontally here. Um both are [139:24] valid ways of displaying this [139:25] information but I just have it [139:27] horizontally here today. And so we have [139:29] low or high or you could say um even [139:32] though I don't have it written here. [139:34] This could be cold or this could be hot. [139:36] Okay. So um on the lefth hand side we [139:39] got backup and restore pilot light warm [139:42] standby multi-active site. Notice we're [139:44] using the like the words like pilot, [139:45] light, warm, things that are relating to [139:47] temperature. So again, cold and hot. All [139:50] right. So let's just walk through what [139:53] each of these things conceptually do uh [139:55] in terms of architecture. So when you're [139:57] doing a backup and restore, you're back [139:59] you basically back up your data and uh [140:02] at the time of disaster recovery, you're [140:04] just going to restore it to new [140:04] infrastructure. Uh for a pilot light, [140:07] the data is replicated to another region [140:08] with the minimal services running to [140:11] keep on replicating that data. And so [140:13] you might have some core services [140:14] running. A warm standby is a scaled down [140:17] copy of your infrastructure. So you [140:18] basically have everything that you would [140:20] absolutely need to run an application, [140:22] but the idea is it's not at scale. And [140:24] so at any time when there's an incident, [140:26] you're going to scale up to the capacity [140:28] that you need. And then you have [140:29] multi-sight active active where you you [140:32] have a scaled up copy of your [140:33] infrastructure in another region. So [140:34] basically everything you have [140:36] identically in another region. And so in [140:39] terms of the RPOS's and the RTO's for [140:41] back and restore you're looking at hours [140:43] uh with the pilot light you're looking [140:44] at 10 minutes with a warm standby you're [140:46] looking at minutes and multi-sight uh [140:48] active active you're looking at uh real [140:50] time. So you know hopefully that gives [140:52] you an idea of you know the difference [140:54] in terms of scale but let's just look at [140:56] more detail. So for a backup and restore [140:58] this is for low priority use cases [141:00] restore data after event deploy [141:02] resources after an event and it's very [141:04] cost-effective. Uh for pilot light you [141:07] this is where you have less stringent [141:09] RTO's and RPOS's so that you're going to [141:11] be just running your core services. Uh [141:13] you're going to start and scale [141:14] resources after the event and this is a [141:16] little bit more expensive. This is uh [141:18] very good for warm standby is good for [141:20] business critical services. So you scale [141:22] resources after the event. Uh and it's [141:25] uh almost very it's very it's costly but [141:28] it's not as expensive as a multi-sight [141:30] active active. So you get zero downtime [141:32] near zero loss. uh you have it's great [141:35] for mission critical services and it's [141:37] just as expensive as your original uh [141:40] infrastructure. So you're basically [141:41] doubling the cost there. Okay. [141:47] So we already defined RTO but let's [141:49] redefine it again based on what Adabus [141:52] describes in their white paper and just [141:54] look at how it maps against um the [141:56] disaster recovery option. So re recovery [141:59] time objective is the maximum acceptable [142:01] delay between the interruption of [142:02] service and restoration of service. This [142:04] objective determines the uh what is [142:06] considered an acceptable time window [142:08] when service is unavailable and is [142:10] defined by the organization. And so this [142:12] is the diagram found in the white paper. [142:14] And so on the left hand side we have [142:16] cost and complexity here and then [142:18] lengths of service interruption. And [142:20] what you can see here is that the cost [142:22] and complexity for a multi-sight active [142:24] active is very high but the length of [142:27] service interruption is zero. And then [142:29] as we go down we have warm standby. So [142:32] it's significantly like at least half uh [142:35] the complexity of that one. Then we have [142:37] our pilot light down here and backup and [142:39] restore. But notice backup restore takes [142:41] the longest amount of time. And notice [142:44] here we have a recovery time objective. [142:45] So in your BCP you kind of define where [142:48] that is based on the cost of business [142:49] impact. So you might have to calculate [142:51] that saying okay what is our cost over [142:53] time based on the length of service [142:54] interruption. Where do we want our RTO [142:56] to be? What is the acceptable recovery [142:59] cost? And this is where you're going to [143:01] decide what you want to do. So here we [143:03] have pilot light and backup and restore. [143:05] And so this company you has to decide [143:07] whether they want to do a pilot light or [143:09] they're going to do a backup and [143:10] restore. But it sounds like this is [143:12] where they're going to be, which is at [143:13] the pilot uh light for what is [143:15] acceptable in their business use case. [143:17] Okay. [143:22] Well, let's do the same for RPO. So, [143:24] recovery point objective is the maximum [143:25] acceptable amount of time since the last [143:27] data recovery point. The objective [143:29] determines what is considered an [143:30] acceptable loss of data between the last [143:32] recovery point and the interruption of [143:34] service and is defined by the [143:35] organization. Again, we pulled this from [143:37] the AWS white paper for disaster [143:39] recovery and uh we have cost and [143:42] complexity, but this time it's replaced [143:44] with data loss before service [143:45] interruption. [143:47] So, uh for multicight again, it's going [143:50] to be very expensive and high up here. [143:51] As you noticed, it's not like a perfect [143:54] um uh curve. It's just it's a bit [143:56] different in terms of what it looks [143:58] like. So, here we have warm standby [144:00] pilot light. Um, and so you'll see that [144:03] the data loss is um, not a big deal, but [144:05] for backup and restore, it really juts [144:08] out there. So you can see that you can [144:09] get pretty good results just with a [144:11] pilot light and the cost and complexity [144:13] is very low. Again, we have to look at [144:15] our cost and business impact. So we got [144:16] to follow that line and we need to see [144:19] where our acceptable uh, recovery cost [144:21] is. And so uh, you're going to notice [144:24] that uh, we have a bit of an [144:26] intersection here. Okay. Okay. And so we [144:29] need to determine, you know, like are we [144:31] going to be doing a warm standby? It [144:32] looks like we have the cost to do it. [144:34] Um, but you know, it just really [144:36] depends, you know, do we want to be down [144:38] here or down there. Okay, so hopefully [144:40] that helps and visualize that [144:41] information for you. [144:47] Hey, this is Andrew Brown from Examro [144:49] and what I want to show you here is a [144:50] real world architectural diagram. I [144:52] created this a while ago. This is a [144:53] previous version of the um exam pro or [144:56] technically teacher seat platform uh [144:58] that powers the learning experience uh [144:59] for by cloud certifications. And so I'm [145:02] hoping that by giving you some exposure [145:03] you'll absorb some information here uh [145:06] and that will carry through to really [145:07] help you cement what these services do [145:09] and how they work together. Um now you [145:11] might be asking how did I make this? [145:12] Well I'm in Adobe XD. It's by Photoshop [145:14] or sorry Adobe. It's free to download [145:16] but there's a lot of options out there [145:18] and but the first thing you'll need is [145:19] those ads architectural icons. So these [145:22] are free on AWS. You can download them [145:24] in PowerPoint, download them as assets [145:25] as SVGs and PGs, which is what I have [145:28] done and start using them in your um uh [145:30] whatever software you like. There's also [145:32] thirdparty providers out there. So like [145:34] there's Lucid Charts. I love Lucid [145:36] Charts, but I don't use it to make [145:37] architectural diagrams uh for AWS. Um [145:40] but you know, you can drag drop and [145:42] stuff and they already have the library [145:43] there. And there's a bunch of them that [145:45] you can choose from. So uh you know, [145:47] that's interesting. But let's take a [145:49] look at one that we can download. Maybe [145:50] everyone's familiar with PowerPoint. So [145:53] here is the Adabus architectural icons. [145:55] And the reason I'm showing you this is [145:56] not because it just contains icons, but [145:58] it also suggests how you should build [146:00] them. So if I go through here, they'll [146:02] give you a definition of those system [146:04] elements, uh how they would look like [146:06] here. So we have our group icons, our [146:08] layer group, our service icons, resource [146:10] icons, where they should go. Uh and then [146:12] they have some interesting guidelines of [146:14] like dos and don'ts. So here's like a [146:16] simple example of a get to an S3 bucket. [146:19] Um, here's an example of using VPC, [146:22] subnets, and things like that on the [146:23] inside. Um, and then you can see kind of [146:26] like all the groups that we have. And [146:30] it'll show all like the uh the um [146:32] arrows. It's a big faux paw to make u [146:35] diagonal arrows. That's just something [146:37] that Adabus defined, but you'll see a [146:38] lot of people do them anyway. And then [146:40] you'll see all the icons. So, do you [146:43] have to make them like Adabus suggests? [146:44] No. But, you know, if if you like the [146:46] way they look, that is fine. Everyone [146:48] just does whatever they want honestly. [146:50] So anyway, now that we've seen, you [146:52] know, how we can go get the resources to [146:54] make our own. I have Adobe XD open up [146:56] here. And so I just kind of want to walk [146:57] you through what's going on here. So [146:59] again, I said this is a traditional um [147:03] uh architecture, meaning that it's [147:04] powered by virtual machines. And so what [147:06] we need to look for uh is EC2 because [147:09] that's where it's going to start. That's [147:10] our virtual machine. And you'll notice [147:12] we have one here. So there's a T2 um uh [147:15] that's running over here. And then over [147:17] here we have a T2. Okay, so uh we have a [147:20] blue and a green environment. So this is [147:22] our running environment. So I'm just [147:23] going to zoom on in here. Okay, so the [147:26] web app would be running on this. And um [147:29] and then on the outside here we have an [147:31] autoscaling group. And so autoscaling [147:33] groups allow us to um manage a group of [147:35] EC2 instances. And they will [147:37] automatically scale if the demand [147:39] increases or or or decline. So if this [147:42] machine can't handle it, it will just [147:44] automatically provision a new one. And [147:45] so I've contained it in this environment [147:47] here because I'm representing a blue [147:49] green deploy meaning that when I deploy [147:51] this will get this will be the [147:53] environment that replaces things. And so [147:55] you can see I have a lot of lines being [147:56] drawn around here. So um over here we [147:59] have uh um parameter store. So parameter [148:02] store is a place where we can store our [148:04] environment variables um or application [148:07] configuration variables. And so I have [148:09] this line going here and it's just [148:11] saying we're going to take these [148:12] environment variables and put them into [148:15] the application. Okay. Uh and then [148:18] there's also uh the database [148:19] credentials. So here we are using [148:21] Postgress over here. So and then we need [148:24] the database credentials. So we're [148:25] grabbing those database credentials. [148:26] Those are stored in secrets manager and [148:28] we're giving to the application. So the [148:30] app knows how to connect to the database [148:32] and this one knows how to uh configure [148:34] it. Okay. Then we have um a bunch of uh [148:38] buckets here for different [148:39] organizations. And so you know S3 is for [148:42] storage. So this is a way we're going to [148:44] um store a variety of things. So like [148:46] user data, assets, artifacts, [148:48] cloudformation templates. So some of [148:50] this is for the app, some of them is for [148:52] the infrastructure. So that's one thing [148:54] there. Okay. Then over here we have u a [148:57] CI/CD pipeline. So we have code [149:00] pipeline. And so code pipeline is [149:02] triggered by GitHub. So we put our code [149:04] in GitHub and when that happens it's [149:06] going to do a code build. So that's [149:08] going to build out a server. [149:10] Um and then from there it's going to run [149:12] another code build server and then from [149:15] there it's going to then um uh uh use [149:19] code deploy. And so code deploy is going [149:21] to trigger a deploy. What it will do is [149:23] create a new environment. So it's going [149:24] to create a copy of this [149:27] um sorry it's going to create a cop this [149:29] is actually the environment that's [149:30] running. So we'll copy that and that [149:32] will be our new environment, right? [149:34] Okay. And so when the deploy is done, it [149:37] will swap it and then that environment [149:38] will become this new one. Um and so you [149:41] know again this is actually really the [149:43] the running server. It's just kind of [149:45] easy to get hung up on this one. But the [149:47] idea here is that um you know that's how [149:49] deployment works. But let's say uh you [149:51] know we want to get uh traffic to this [149:54] actual instance. This is going to come [149:56] through the internet and the internet's [149:58] going to probably go to ref. case of [150:00] ref3 is used for domain names. So this [150:02] be like examro.co teachersseek.com. [150:05] We pass that over to our elastic load [150:06] balancer which in this case is an [150:09] application load balancer. That's why [150:10] it's called ALB and that's going to [150:12] distribute the traffic there. If we [150:14] wanted to run the server in another um [150:17] in another availability zone so that we [150:20] make it highly available um you know ALB [150:22] the elastic load balancer application [150:24] load balancer is going to uh have some [150:26] traffic go here and some traffic go [150:27] there. So this is just uh the blue [150:29] environment or whichever the current [150:31] environment is over here. Now when we [150:33] want to deploy new versions, we're going [150:35] to use launch templates and launch [150:38] templates um uh are necessary when using [150:41] autoscaling groups. So um you know you [150:43] do have to define launch template. It [150:44] just says like what is the shape of this [150:46] instance type like what's this family? [150:48] What should it be? And then we need an [150:50] Amazon machine image. So our Amazon [150:52] machine image is customuilt because we [150:54] are installing all the stuff that we [150:55] want on it. And so in order to automate [150:58] that process, we are using um SSM [151:01] automation documents. So SSM stands for [151:04] systems manager and automation allows [151:06] you to automate that step. So what it's [151:08] going to do is launch an instance, [151:09] install Ruby, install Postgress, [151:10] download the codebase, then it's going [151:12] to create that AMI and then um it will [151:16] do a bunch of other stuff here as well. [151:18] And this is going to run weekly or [151:20] actually at the time uh it was running [151:22] nightly. So, we're doing nightly builds [151:24] so that we would always get the latest [151:26] um updates to our server. Um because [151:28] it's a virtual machine, there could [151:30] always be uh new updates for that Linux [151:32] version or Amazon machine limit Linux [151:34] version we were using. And then there's [151:37] a bunch of other stuff here. So, you [151:39] know, um hopefully that kind of gives [151:40] you an idea like the complexity of it [151:42] and you know, this is how I like to make [151:43] my architectural diagrams very in [151:45] detailed so that we can um look at them. [151:48] But yeah, if that was too much, that's [151:49] fine. But, you know, that's just the [151:51] complexity of it. If you build your own, [151:53] you'll start to really grasp this stuff [151:54] pretty well. Okay. [152:00] So, what I want to do is just show you [152:01] how high availability is built into some [152:03] ads services where in other cases you [152:05] have to explicitly choose that you want [152:07] something to be highly available. Uh, so [152:09] what I'm going to do is make my way over [152:10] to S3. And so with S3, this is where you [152:14] can create S3 buckets. And this allows [152:16] you uh to store things. And so the great [152:18] thing about S3 is that it's basically [152:20] serverless storage. So the idea is that [152:22] you're just going to choose your region [152:24] and by default it's going to replicate [152:26] your data across multiple um uh data [152:29] centers or a so this one's already [152:31] highly available by default with the [152:33] standard tier and so that is something [152:35] that's really nice but other services uh [152:38] you know like EC2 the idea is that you [152:41] are going to launch yourself an EC2 [152:43] instance so we would launch that one and [152:45] the problem with this is that if you [152:46] launch a single EC2 [152:48] that is not highly available because [152:50] it's a single server running in a single [152:55] um a so here you know we would choose [152:57] our subnet our subnet is our [152:59] availability zone but you'd have to [153:00] launch at least two additional servers [153:02] and then you'd have to route um uh you'd [153:05] have to uh have something that would [153:07] balance uh the traffic to the to the [153:09] three which is a load balancer and so in [153:11] this case you have to construct your [153:12] high availability then you have services [153:15] like elastic beantock this is a platform [153:17] as a service um and we'll go to [153:20] environments here. I'm not sure it [153:21] wasn't showing up there. And so the idea [153:24] is that with elastic beantock, [153:26] I'm just going to click on the main [153:27] service here. You're going to go ahead [153:29] and uh create your application or create [153:31] your environment. You probably want to [153:32] create an environment first here. Okay. [153:35] And so I would choose a web server. And [153:38] then the idea is I just name it so my [153:40] application here. My uh environment. And [153:44] then down below you go configure more [153:46] options. Whoops. It wants me to choose [153:48] everything. That's totally fine. [153:51] and we say configure more options. We're [153:53] not going to create it because um we [153:55] don't want to create one. But the idea [153:57] is that uh you you could choose whether [153:59] you want this to be high highly [154:01] available or not. So see it's a single [154:02] instance. So free tier uh and then if [154:05] you choose this what it's going to do is [154:07] set up a bunch of stuff for you. So it's [154:08] going to set up an application load [154:10] balancer for you. It's going to set up [154:11] autoscaling groups for you to make it [154:13] highly available. It's going to run at [154:15] least uh between one to four instances. [154:18] So this does everything that uh EC2 [154:20] you'd have to do manually setting up. So [154:22] that's really nice. Okay. So you know [154:25] some options have that. If we make it [154:27] our way over to RDS and again we're not [154:29] creating anything. We're just looking at [154:31] the options it gives us when we uh start [154:33] things these up here. [154:35] We'll make our way over to RDS when it [154:37] gives us a moment here. [154:41] And if we go ahead and create ourselves [154:42] a new database [154:46] and we look at something like a [154:48] Postgress database, notice that we have [154:50] a production option and a dev test [154:53] option. And so I mean usually it shows [154:55] us the price down here. So even test dev [154:57] is $118, which is not true. It can get [155:00] cheaper than that. But the idea is that [155:02] when you choose between these two [155:03] options, um it's going to set up uh [155:06] multi-AZ. It's going to that means that [155:09] it's going to run an additional um uh [155:12] database in another availability zone, [155:14] replicate that data over so that it [155:16] stays highly available. Um you know, [155:19] it's going to have autoscaling uh uh [155:21] part of it. And so some services you [155:23] just choose it abstractly. So you just [155:26] have to understand what high [155:27] availability is going to mean [155:28] underneath. So hopefully that kind of [155:30] gives you a picture of high availability [155:31] on AWS. [155:37] Hey, this is Andrew Brown from Exam Pro [155:39] and we are looking at Adabus application [155:41] programming interface also known as [155:43] Adabus API. So before we talk about uh [155:46] the API, let's describe what application [155:48] programming interface is. So an API is [155:50] software that allows two applications or [155:53] services to talk to each other and the [155:55] most common type of API is via HTTP [155:58] requests. And so the ads API is actually [156:01] an HTTP API and you can interact with it [156:04] by sending HPS requests using an [156:07] application interacting with APIs like [156:09] Postman. And so here's kind of an [156:11] example of what a request would be that [156:13] would be sent out. And so the way it [156:15] works is that each ad service generally [156:18] has a service endpoint. So see where it [156:20] says monitoring, that's going to be [156:21] Cloudatch. So sometimes they're named [156:23] after the services, sometimes the name [156:24] is a bit obscure. And of course, you [156:26] can't just call uh call an API request [156:30] without authenticating or authorizing. [156:32] And so you have to sign your request. [156:34] And so that's a process of making a [156:36] separate request uh with your ad [156:38] credentials to get back a a temporary [156:40] token uh in order to authorize that. And [156:43] I don't have room to show it, but the [156:45] thing is is that what you'd be uh also [156:47] going along with this request would be [156:49] to provide an action. So when you look [156:51] at um the AWS API, it will show you a [156:55] bunch of actions that you can call. [156:57] They're basically the same ones you'll [156:58] see in the IM policies. So it could be [157:00] like describe EC2 instances or list [157:03] buckets. Um and they can also be [157:06] accompanied with parameters. Okay. So [157:08] you know, we're probably not going to [157:10] show you how to uh make an API request [157:12] directly because that's not something [157:14] that you would generally do. Um, but [157:16] what you would do is you'd probably use [157:19] the ads management console which is [157:21] powered by the API. Use the ads SDK [157:23] which is powered by the API or using the [157:25] ads CLI. So we'll cover all those three. [157:28] Okay. [157:33] Hey, this is Andrew. I want to show you [157:35] um a little bit about the Adabus API. So [157:38] if we go here to the top and type in [157:39] docs.adus.amazon.com, [157:41] we get the documentation. Uh, last time [157:43] I recorded this was about a few years [157:45] ago and they've dramatically changed [157:46] this. It's actually gotten worse as I [157:48] think that they've uh gotten rid of [157:49] their technical writers and have been [157:51] using AI to reorganize it. And I would [157:53] just say it's very hard to find stuff um [157:55] where I used to be able to find things [157:57] extremely easily like things were [157:58] grouped really really well together. But [157:59] that's okay as I did go and hunt them [158:02] down and find stuff. So the first thing [158:03] I want you to know about with the AWS [158:05] API is the fact that it has endpoints [158:07] and we have regional endpoints and [158:08] global endpoints. These are uh basically [158:11] URL addresses where you're sending [158:12] payloads and those and if you're [158:14] authenticated it's going to send stuff [158:16] back to you and so obviously we have [158:17] regional endpoints and global endpoints. [158:19] Regional you're going to specify the [158:21] region code so exactly what region [158:23] you're in. And then there's obviously [158:25] service code going to let's say Dynamob [158:27] EC2 wherever it needs to go. there are [158:29] global endpoints for global services, [158:32] right? Um, so that should be pretty [158:34] pretty clear like we know CloudFront is [158:36] a global service. Um, other ones like [158:38] that. And so I think we talked about uh [158:40] when we talked about region availability [158:42] zone selection that S3 I call it like a [158:44] global service, but it's not a true [158:46] global service as uh obviously you you [158:49] still pick the region as to what your [158:50] buckets um buckets exist in. But anyway, [158:53] having this URL is great and sending it [158:55] a payload to it is great except uh you [158:57] do need to have some way to authenticate [159:00] and so or authorize and so that's where [159:02] you're going to be signing. So signing [159:04] is where you um basically provide a [159:07] signature and it allows uh ads to know [159:10] that it's coming from you. And so [159:12] there's a spot where you enter in your [159:15] um access key and secret or information [159:17] and then it turns it into a signature [159:18] and then it sends it along here to [159:21] authorize access and get data back. Uh [159:23] if you really want to know exactly how [159:25] to hit a very specific service, let's [159:27] say we want to go to I don't know [159:29] CloudFront, we'll go down here. We'll [159:31] get more additional information in terms [159:32] of um uh you know the endpoint [159:35] information um and things like that. And [159:38] so previously what I would do is I'd [159:39] show you Postman and we would hit an [159:41] endpoint that way. But now since we have [159:43] AI, I figured that this might be a great [159:44] opportunity to see if it can go ahead [159:46] and do that. So I'm opening chat GPT. [159:48] You can use whatever you want. And I'm [159:50] going to just say here um and just [159:51] collapse this here on the side here. Uh [159:53] can you create me an um API [159:59] uh request to a service endpoint? [160:02] I just want to demonstrate how to use [160:05] the um AWS API directly. Um [160:10] and we'll see if it can generate us some [160:11] code. [160:14] Okay, be back here in just a moment. So [160:16] here it's showing us the concept. So [160:18] it's going to be sending a get request [160:19] with HTTP 1.1. It's saying to the host [160:22] and then we have this authorization [160:23] value. You can see our signatures over [160:25] here. Um and so that's good. But here we [160:28] are going to see if we have any kind of [160:29] practical demo. So look at how much code [160:31] is going on here. And so generally [160:35] generally doing this stuff like you [160:36] don't really want to do it this way [160:38] directly unless you're really going [160:40] lowle and you want to have full control. [160:41] But let's just take a look at what we [160:43] have. So no so we have access key secret [160:44] as I told you we have the region the [160:46] service um and then as we go down here [160:50] we can see that we are we have to put in [160:52] the Amazon date um and then the host [160:54] here would be S3. So that is where it's [160:56] going. [160:57] And then we have whatever our payload [160:59] is. So it looks like whatever we are [161:01] sending there is going to be turned into [161:04] um our end payload. [161:07] Okay. And we'll scroll on down here. [161:08] We're setting the algorithm. And so that [161:10] I believe that's how it creates the [161:12] signature. [161:13] Okay. And then we have to sign it. And [161:17] then we create our signature. And then [161:19] in our authorization header, our [161:20] signature should get passed somewhere [161:22] here. Here it is. Yes. Okay. And then [161:24] we've passed our authorization header. [161:26] So that is the whole process. All right. [161:28] I'm and for the most part that looks [161:30] correct. Um but again, you know, this is [161:32] not something that you would necessarily [161:34] be doing unless you need to do something [161:36] extremely lowle. There SDKs or other [161:38] layers that make it easier. But it's [161:40] just nice to see that um you know, [161:42] you're literally using your access key [161:43] and secret. You're creating a signature. [161:45] You're passing in the authorization [161:46] header and you're working with that [161:48] stuff directly. Okay. [161:54] Hey, this is Andrew Brown from Exam Pro [161:56] and we are looking at the Adabus [161:57] management console. So the Adabus [161:59] management console is a web-based [162:00] unified console to build, manage and [162:02] monitor everything from simple web apps [162:04] to complex cloud deployments. So when [162:06] you create your Adabus account and you [162:08] log in, that is what you're using, the [162:10] Adabus management console. And I would [162:12] not be surprised if you're watching this [162:14] video and they've already changed um the [162:16] default page here since loves to [162:18] change the UI on us all the time. Uh but [162:21] uh the way you would access this is via [162:23] console.abus.amazon.com. [162:25] When you click sign in or go to the [162:27] console that's the link that it's going [162:29] to uh and so the idea here is that you [162:31] can point and click to manually launch [162:33] and configure adabus resources with [162:34] limited programming knowledge. This is [162:36] known as click ops since you can perform [162:38] all your system operations via clicks. [162:40] Okay. [162:45] Hey, it's Andrew. We are taking a look [162:47] at the adabus management console. get [162:49] there. We're going to sign in. And here [162:51] it is. Um, it's called the AS management [162:54] console because it controls the [162:56] management of AWS. Sometimes we short it [162:58] to console. The word console can be [163:00] confusing as some people might expect to [163:02] see something that looks like this, a [163:03] terminal. But a terminal can be a [163:05] console and a web UI, a web user [163:08] interface can be a console as well [163:10] because if we come over to here, I'll [163:11] just show you if you were to ask [163:13] TouchBT, you know, it describes it as [163:16] here and then a dashboard. But the the [163:18] the clear thing is that a console is a [163:20] place that controls the system. So this [163:22] thing controls the system. So don't get [163:24] thrown off by that single word there. Um [163:27] and the interesting thing is that every [163:29] single service has their own console. So [163:30] if I was to go to S3, this is the S3 [163:34] console. So I might say S3 management [163:35] console or S3 console. Same thing with [163:37] EC2. We might go over here and say this [163:40] this is the EC2 management console. But [163:43] often we will also say EC2 dashboard or [163:45] S3 dashboard. So dashboard, management [163:47] console are going to be interchangeable [163:49] terms. Um they keep changing this. So [163:52] almost every few years they change it [163:54] and I'm always really surprised. Up here [163:56] we actually have a cloud shell which is [163:59] a terminal. Uh and in itself it's also a [164:02] console. If we drop this down here we [164:03] get our notifications. So generally when [164:05] there are health health changes or any [164:07] additional information that we care [164:09] about um we can see that there. This is [164:11] not the same as Azure's notifications. [164:13] Azure notifications tell you about every [164:16] little thing that changes. That's not [164:17] what this is here. Um, if we go over to [164:20] here, this is how we can get to the [164:22] support center. It used to be called [164:23] support, but now it's a little question [164:24] mark. But yeah, if you need to open up [164:26] tickets and you have like a business [164:27] plan, you can do that over there. If we [164:29] drop down the cog, we now actually have [164:30] options to change uh the visuals. It [164:33] says beta, but it's in beta for I don't [164:35] know, like two years or something. So, I [164:37] mean, you can do this and change it to [164:39] dark mode. I leave it on light mode as I [164:41] think it's a bit easier on people's [164:42] eyes. You can obviously change the [164:43] language but really this is the only [164:45] Whoops. [164:46] It's the only it's the only change that [164:49] um uh we have seen which is the light [164:52] and dark mode but it's appreciated. [164:53] Okay. Uh we have obviously the drop down [164:55] for our regions and then over here is [164:57] our accountant information. Generally uh [164:59] you want to know where your account ID [165:01] is. Very very useful to get. Right now [165:03] I'm logged into not a root account but a [165:06] another account that is tied to my [165:08] organization. So it looks a little bit [165:10] different uh which is totally fine. Um [165:12] but yeah, there you go. Nothing [165:14] confusing about it. Just remember [165:15] console does not necessarily mean [165:17] terminal. It just means a place where [165:18] you control things. Okay. [165:25] All right. So I just want to describe [165:26] what a service console is. So an ad [165:28] service each have their own customized [165:30] console and you can access these [165:32] consoles by searching the service name. [165:34] So, you would go ahead and type in EC2. [165:36] And then what we refer to this screen as [165:38] as the EC2 console. The reason I'm [165:40] telling you this is that when you're [165:41] going through a lot of labs or [165:43] followalongs, you'll hear the instructor [165:44] say go to the EC2 console, go to the [165:46] SageMaker console, go to the RDS [165:48] console. And what they're telling you is [165:49] to go type the the name of the service [165:52] and go to um that particular services uh [165:55] console. Okay. Uh some ads service [165:58] consoles will act as an umbrella console [166:00] containing many ads services. So uh you [166:03] know VPC console, EC2 console, systems [166:06] manager console, SageMaker console, uh [166:08] Cloudatch console, these all contain [166:10] multiple services. So you know for um [166:14] for EC2 you might say okay well I need a [166:17] security group. There's no security [166:18] group console. It's under the EC2 [166:20] console. Okay. Uh so just be aware of [166:22] that. [166:27] Hey, this is Andrew. I want to explore [166:29] service consoles with you really [166:31] quickly. um and just distinguish them [166:33] from the management console or how [166:34] they've changed over time and how they [166:37] map over to SDKs. So um obviously this [166:40] is the management console. If we go over [166:42] to the EC2 service console, uh what's [166:44] interesting here is that back in the day [166:46] when it was EC2, all there was in here [166:48] was virtual machines. We just had [166:49] instances. You just launch them up. But [166:51] over time they started adding more [166:53] features or services depending on how [166:55] you want to frame it. And so these uh [166:59] these services like EC2 became not just [167:01] a service in itself but an umbrella term [167:03] for other services and features that [167:05] live underneath. And so EC2 obviously [167:07] has images uh elastic block store load [167:10] balancing autoscaling. And so some of [167:12] these feel like they should be really [167:13] their own service consoles like load [167:15] balancing but others are so tightly [167:17] coupled that it makes sense that they'd [167:18] be under here and they feel more like [167:20] features. This has happened with so many [167:22] services like so like cloudatch is a [167:24] really good example of this. Okay. So [167:27] Cloudatch used to just be Cloudatch logs [167:29] and then they started adding metrics and [167:30] all this other other crazy stuff. Uh [167:33] VPCs have been around for a very long [167:35] time. And so here it makes a little bit [167:37] more sense because everything is [167:39] networking related. Um so that's pretty [167:42] clear there. Also when I did this video [167:45] last like a few years ago, Adabus was [167:47] still going through this process of [167:49] unifying their uh interface which they [167:51] appear to have completed. I used to show [167:53] this and there'd be like four different [167:55] styles of interface because each team [167:57] had autonomy over how they would um uh [168:00] implement their interface and I I [168:02] believe they still do but I think there [168:03] is stronger uh requirements for them to [168:06] use this unified uh interface. It has a [168:08] specific name I can't remember what it's [168:10] called and so the experience is now [168:12] pretty much unified which is nice. One [168:15] thing that's interesting is if we go [168:16] over to the SDK I really like Ruby so [168:18] we'll look at that one. um you know each [168:21] um part of the SDK will have a client [168:24] for like let's say EC2 but let's say you [168:26] wanted to use VPC you would expect there [168:29] to be uh VPC under here right and I'm [168:32] looking for it and notice that we cannot [168:34] find it so where is VPC so if we type in [168:37] VPC [168:39] okay and this might be the slowest way [168:41] to find it I I know where it is so I'm [168:43] just going to find it manually here uh [168:45] and it's under EC2 [168:48] so if we go here and expand and it you [168:50] will find [168:52] here VPC and so this has to do with the [168:55] historical history of these things [168:57] because VPCs EC2s existed before VPCs [169:01] and then when they added VPCs they put [169:03] it under here and so for historical [169:05] legacy reasons the SDK will often not [169:08] map um uh to the service consoles or [169:12] things like that. So, if you're trying [169:13] to use your logic here to find this in [169:15] other places, you're going to find [169:16] discrepancies. And that's pretty normal [169:18] for all providers as that's just how [169:20] they grow. But I thought that was one [169:22] worth pointing out. Um, but there you [169:24] go. Okay. [169:30] So, every Adavis account has a unique [169:33] account ID and the account ID can be [169:35] easily found by dropping down the [169:36] current user in the global navigation. [169:39] So, what I'm going to do is pull up my [169:40] pen tool here and just show you. It's [169:41] right there. Uh the ABIS account ID is [169:43] composed of 12 digits. And so it could [169:46] look like this or this or this. The ADUS [169:48] account ID is used when logging in uh [169:50] with a nonroot user account. Uh but [169:53] generally a lot of people like to set [169:54] their own alias because it's tiring to [169:56] remember your account uh ID. The uh you [169:58] use it when you're creating cross [169:59] account roles. So you'd have the target [170:01] account, the source account ID to gain [170:03] access to resources in another account. [170:06] When you're uh dealing with support [170:08] cases, ads will commonly ask you what [170:10] your account ID is so they can identify [170:13] the account that they want to look at. [170:16] And it is generally good to keep your [170:17] account ID private as it is one of the [170:19] many components used to identify an [170:21] account for attack by malicious actor. [170:23] Uh so you don't have to be overly [170:24] sensitive with it, but you know try to [170:26] hide it when you can when it's easy. [170:28] Okay. [170:33] Hey, this is Andrew and I just want to [170:34] show you a few places where the account [170:36] ID is used. So in the top right corner [170:38] if you drop down there is our account [170:40] ID. Um and notice also over here it says [170:43] development and then my account ID [170:44] repeated. Uh I am right now in a sub [170:47] account within my organization. So if [170:48] you're in your main account, this might [170:50] not show up exactly the same way. Um but [170:52] it's nice that you can drop down and see [170:53] it. Um you really shouldn't be sharing [170:55] your account ID. It's not like a big [170:57] deal, but um you know that's one thing [170:59] you can um keep secret. That'd be really [171:01] really good. Um, but let's go over to IM [171:04] because I want to show you a few places [171:05] where it shows up and where you can use [171:07] it. So, here in IM, you'll notice that [171:09] it also uh shows up over here. So, [171:11] they've kept it here since last time. [171:12] And yes, I know I don't have MFA turned [171:14] on. You should have MFA turned on for [171:16] root accounts and your yourself. Um, [171:18] this is just because this is a um [171:20] teaching account. So, I'm trying to keep [171:22] things simple for me here. So, one place [171:24] would be creating a RO. And so if we [171:26] created a role and we wanted to make a [171:27] cross account role to have access to [171:29] another account, uh we would say okay I [171:31] want access to a account and I would [171:33] specify that other key. Now of course [171:36] specifying my own key is a bit silly [171:39] right um but here it's expecting it but [171:41] notice that it just says the digits. So [171:42] we'll have to take out the hyphens. I [171:43] don't know why they put the hyphens here [171:45] and you paste it here. It doesn't make [171:46] sense but this is one example where you [171:49] would utilize it across account rule to [171:51] access another account. Another place [171:52] would be when you're creating policies. [171:54] So let's say we wanted to create access [171:57] to I don't know EC2. Um and we wanted to [172:01] say uh I don't need all actions. We'll [172:04] just say list actions. All right. [172:08] And if we go all the way down here, we [172:10] might have a request permission a [172:13] condition. And this is where we are [172:14] saying it has to come from a specific [172:16] location. And so principal ID is [172:18] normally thing principal AR and [172:20] principal account. So, principal count [172:21] here, we would say it equals [172:25] uh string equals that number. And of [172:27] course, you take that out there. And so, [172:29] that would be a way for you to make it. [172:31] Now, it'd be nice to preview this. If we [172:33] go over to here, we can No, it doesn't [172:35] show it because we have to build out the [172:36] entire uh one. If you don't select all [172:38] the options, they won't show it. So, [172:39] maybe we'll do something simpler with [172:40] like S3. [172:42] All right. And then we will just choose [172:44] a very very simple action like list [172:46] buckets for the entire account. That way [172:48] it's not going to specify that I have to [172:50] add all these things here which is kind [172:51] of annoying but I'll drop it down here. [172:53] We'll go here. We'll try this again. Say [172:54] principal account. [172:58] And we'll go here and say um string like [173:01] and paste that in here and take out uh [173:04] those hyphens. [173:06] Add the condition. If we go here to the [173:07] top. Oh, it's still not showing it to [173:10] us. Well, what does it want? Uh you'd [173:12] think I'd have this down by now, but it [173:14] just happened. So, we'll go ahead and [173:15] try this one more time. [173:18] list buckets. Sometimes you have to [173:20] specify I'll just say all. That was [173:21] probably the reason why that was [173:22] happening as if something is missing it [173:25] won't show it to us. And so we'll go [173:27] here principal uh principal account and [173:30] we will say string equals and place in [173:33] this value. And I'll take this out here. [173:35] And so now [173:38] it should be valid. [173:41] There we go. So now it's chosen. See [173:43] here we have the condition. And this is [173:45] where our ID shows up. So there are [173:47] going to be various places. Another [173:48] place would be um specifically for an [173:51] instance. So if if you have a resource [173:54] or something um it will show [173:57] uh maybe in its AR or its account that [173:59] value. And I need a previous one [174:02] running. I guess I haven't launched one [174:04] in a while. So what I'm going to do, [174:05] don't do this. I'm just going to do this [174:07] as an example, but I'm going to launch [174:08] an Amazon Linux and just say whatever [174:10] here does not matter. I'm just choosing [174:12] the smallest one, T3 Micro. And I just [174:15] want to go ahead and launch this. Okay, [174:17] you don't have to do this. I'm just [174:18] showing you so you can see where we [174:21] might see the account ID. All right, so [174:23] we'll wait a moment for that to launch. [174:25] It might already have the information [174:26] here even if it's not done launching. [174:28] And so somewhere here it might say owner [174:30] or something. They keep moving it on me, [174:32] so I have to kind of look around. Um, [174:34] and so we're looking for maybe owner. [174:38] Here it is. Okay. But you can also see [174:41] them in ARS. So I'm not sure if we get [174:43] an AR here. Is there any AR? Here's the [174:46] AR. And notice here there is the um [174:49] account ID. So it's used in quite a few [174:51] places, but just get kind of used to [174:53] seeing it. I'm going to go ahead and [174:54] terminate this as I do not actually want [174:56] to terminate it. But there you go. [175:04] All right, let's take a look at it tools [175:05] for PowerShell. So what is PowerShell? [175:08] PowerShell is a task automation and [175:10] configuration management framework is a [175:12] command-like shell and a scripting [175:14] language. So here it is over here. Uh if [175:16] you are a Windows user, you're used to [175:18] seeing this because it has a big blue [175:20] window. So unlike most shells which [175:22] accept and return text, PowerShell is [175:24] built on top of the .NET common language [175:26] runtime CLR accepts and returns the net [175:29] objects. So uh AdSools [175:34] for PowerShell and this lets you [175:35] interact with the ads API via PowerShell [175:38] commandlets. Commandlets is a special [175:40] type of command in PowerShell in the [175:42] form of the capitalized verb and noun. [175:44] So in this case it' be new hyphen S3 [175:47] bucket. So, you know, we looked at the [175:49] ad as CLI and that is generally for bash [175:52] um uh you know, shells and so PowerShell [175:55] is just another type of shell that's [175:57] very popular and I just wanted to [175:58] highlight it for those people that are [176:00] uh you know used to using Microsoft [176:02] workloads or Azure workloads uh that [176:04] this actually exists. Okay. [176:10] Hey, this is Andrew. In this video, I [176:12] want to show you PowerShell. So, [176:13] PowerShell, um, if I go type in [176:15] PowerShell on my Windows computer here, [176:18] uh, you can't see me typing it, but I'm [176:19] typing it here. It'll bring up a console [176:22] window. Normally, it's blue. I'm not [176:23] sure why it's not blue anymore. U, but [176:25] generally in past versions, it would [176:26] show the blue screen, and that's how you [176:28] would know that you're in PowerShell. [176:30] But in CloudShell, we can launch it up, [176:31] and it will start up in um a an [176:35] environment that is just uh bash or [176:38] Linux. And so, um, we can use PowerShell [176:41] here. And so, there's a command. It's [176:42] like pwnsh [176:44] maybe. I can't remember what it is. So, [176:46] we'll go here and just say uh start [176:49] PowerShell [176:50] um from cloud shell AWS. [176:54] Okay. And it's not specific to AWS. It's [176:57] just the general command that you [176:59] utilize. Yeah. PWSH PowerShell. Okay. [177:02] So, any Linux version, you can get it [177:03] installed and then do this. And then now [177:05] you can operate in PowerShell. [177:07] PowerShell is really really good. If [177:08] you're in the Azure ecosystem, um, uh, [177:11] then you're probably used to it because [177:13] it's the thing that's mostly heavily [177:14] used. But here it says ads version 5 is [177:16] now enabled by default. This includes [177:18] better performance. U whatever, [177:19] whatever. I'm not sure why that's saying [177:21] there. And it's just saying that it's [177:22] deprecated, which is totally fine. I [177:23] don't care about that. So now that we're [177:25] in PowerShell mode, um, the only issue [177:27] is that we need to also install [177:30] Adabus tools as I do not believe that it [177:32] comes pre-installed. [177:35] And so here what we're going to do is [177:36] install the commandlet from AWS. We'll [177:39] go ahead and do this and hit enter. Um [177:42] and so that will give us the ability to [177:45] almost start using um PowerShell here. [177:49] It's funny because it says untrusted [177:50] repository, but it's from AWS, but we'll [177:52] go ahead and give it a Y and that will [177:54] go ahead and install all of that. I [177:56] should have said A for Y to all, but [177:58] that's okay. And so now that's [177:59] installed. If we want to use a very [178:01] specific provider, I believe that we [178:03] have to install the module. So here it [178:05] says install module name the inst uh AWS [178:08] tools installer right and now if we want [178:10] to use specifically let's say um uh S3 [178:14] or another one we'll do this. So I'll [178:16] just install EC2 and S3 and we have the [178:18] cleanup command just cleans up any junk [178:20] files afterwards. We'll go ahead and do [178:22] that. I'm going to do a this time to [178:24] accept all of them. [178:27] Okay. And we'll go ahead and say a. And [178:29] so that's going to go ahead [178:32] and [178:34] install those modules. Yep, there it [178:36] goes. And notice it's installing more [178:38] than just um [178:41] uh EC2 S3. It's whatever it needs along [178:44] there. Seems like it's installing [178:46] everything. [178:48] I just wanted very specific ones. No, [178:50] no, no. What are you doing? I don't want [178:52] all that. So, I'm going try this again. [178:54] I'm just going to go ahead and specify [178:56] Whoops. [178:58] Oh, it's not deleting. [179:00] What is going on here? [179:04] Oh, that's funky. [179:07] I'm not sure why it's acting kind of [179:08] strange. I guess it's kind of showing us [179:09] what it can delete, but I just really [179:10] want S3. So, I'm going to go ahead and [179:12] try this [179:15] because all I want to do is install this [179:17] very specific one here. So, install tool [179:18] on target adus tool. So, we'll say uh [179:21] yes, and let's see if it tries to [179:23] install everything. Before I just [179:24] installed the one, but I'm following the [179:26] instructions. [179:28] You can now install the module for each [179:30] service. Yeah, that's what I'm trying to [179:31] do. It's installing all of them. It's [179:33] not listening. So, we'll wait here until [179:35] it's done. We really shouldn't have to [179:37] install them all. Like, it's very clear [179:39] that it should only install the single [179:40] one there, but we will give it a second. [179:43] Okay. Okay. And so now it's basically [179:45] installed all the tools. And so, I just [179:47] need to do a very simple check like list [179:50] um uh S3 bucket. So what I'm going to do [179:52] is go a ad aus powershell s3 list [179:56] buckets and try to find the exact [179:58] command. [180:00] Um so we'll go over to here is we might [180:03] have some examples and we'll go ahead [180:05] and do we have less list list buckets. I [180:07] just want to list buckets list [180:11] list. [180:13] No but we do have other options here. [180:16] Get um get a bucket. [180:21] How about make a new bucket? New bucket. [180:23] Create new. I know we can make a new [180:25] bucket. So, we'll go ahead here. I'm [180:27] just going to grab this command and [180:30] we'll go ahead and paste it in. I'm just [180:32] going to call uh PowerShell new bucket [180:36] and just put some random numbers here on [180:38] the ends just so I'm not conflicting [180:39] with anybody. We'll go ahead and hit [180:40] enter. And so, that's now created a [180:42] bucket. So, the reason why people like [180:44] PowerShell is that it creates very [180:46] consistent inputs and outputs. Um, and [180:49] it's just really good at chaining these [180:50] things together. Um, again, if you're [180:52] from a uh a Microsoft Azure ecosystem, [180:54] you know the power of these tools. Uh, [180:56] so if you're an administrator, then this [180:58] can make your life really, really easy. [180:59] Though, it is a bit heavy to get [181:00] installed, but once you get it [181:02] installed, it's really, really good. Um, [181:03] I just want to get you exposure to it. [181:05] Okay? That's the reason why I do this [181:06] video. U, but we're done. You can delete [181:08] that bucket if you want. I'm not going [181:09] to. It's not going to hurt me. Um, but [181:11] yeah, there you go. [181:18] So Amazon resource names uniquely [181:20] identify adabus resources and ARS are [181:22] required to specify resource and [181:24] ambiguously across all of all of AWS. So [181:27] the AR has the following format [181:29] variations. So there's a few different [181:31] things here but just notice here that [181:33] sometimes it has a resource ID or it has [181:35] a path so with a resource type or could [181:37] be separated by a colon. So the [181:39] partition um could either be adabs, [181:41] China or gov cloud because this is [181:44] basically the ads uh portal or URL that [181:47] are completely separated from each [181:48] other. Uh as we talked about those [181:50] earlier in the course uh then there's [181:52] the service identifier. So EC2, S3, AM [181:56] pretty much every service has their own [181:58] uh service that uh name here that would [182:00] be identified. Then the region would be [182:02] pretty obvious US East1, CA1. You'd have [182:05] account ID which would be 12 digits. Uh [182:08] the resource ID uh could be a name or a [182:10] path. So like for um IM users, we have [182:14] user Bob. This is an EC2 instance. And [182:17] most of the ARs are accessible via the [182:19] ads management console. And you can [182:21] usually click the AR to copy to your [182:22] clipboard. So here is it is for um an S3 [182:25] bucket. And notice that it's a little [182:27] bit different because it is a global [182:29] service AWS. There's no reason to [182:31] specify the region or the account ID or [182:34] uh anything else there like the resource [182:36] type. So straight away we already know [182:38] it's a bucket. So we can just say my [182:39] bucket. So that one's really short. But [182:41] in other cases it's really long. So here [182:43] it is for a load balancer and it has all [182:45] the information there. And notice that [182:47] like this has a pass is load balancer [182:49] app my serverb and then it has the ID. [182:52] Okay for paths and arms they can also [182:55] include a wildcard asterct and we'll see [182:58] these like with IM policies or or paths. [183:00] These are really useful when you are [183:02] doing um uh policies where you have to [183:05] specify n you want to say a group of [183:07] things and things like that. So there [183:08] you go. [183:13] All right. So now let's take a look at [183:15] Amazon resource name or also known as [183:17] AR. Um and so ARS are used to reference [183:20] objects. They're very commonly used when [183:21] you're using the CLI or the SDK to [183:24] reference to something. Um the easiest [183:26] example is S3, right? Okay. So, if we go [183:28] over to S3 here and we create ourselves [183:30] a new bucket. Um, so I'll go ahead and [183:32] create ourselves a new one here. We'll [183:35] say my new bucket. I'm just going to put [183:38] a bunch of numbers in here. It doesn't [183:39] matter. We'll hit create bucket. And [183:42] what we will see if we click into this [183:45] is the AR should be under properties. [183:48] And there it is. Okay. So there are many [183:51] cases where you might want to use the AR [183:53] and a lot of times you'll just copy it [183:55] and uh a very common example would be [183:58] again with IM policies. So we go over to [184:00] IM policies, right? [184:03] And I want to get to policies here to [184:05] save myself some trouble and we create a [184:07] policy. [184:09] You know, I might want to restrict [184:10] someone to use only that bucket. So I [184:11] say S3. [184:13] Okay. And then I'm going to say um I [184:16] want to be able to read and write from a [184:18] particular bucket. we go drop down these [184:20] resources here. And so here we have a [184:23] lot of options. U maybe I'll just get [184:26] rid of the read option. [184:30] And I'm going to actually expand right [184:31] because it's just creating too much work [184:33] for me here. And I just want to have [184:36] um put put object. That's that's the [184:38] what we use to put something into a [184:40] bucket. So we expand the resource here. [184:42] And notice this says add the AR. So we [184:44] go here and we could type the bucket [184:46] name. So do that or we just paste it on [184:49] in here at the top. So it's probably [184:51] easier just to grab it sometimes. [184:53] But if you don't know an AR, a lot of [184:55] times you can just expand this and then [184:56] fill it in and that's how you get an AR. [184:58] So I'll put that there. It's list. Oh, [185:00] you could also do it that way which is [185:02] easier too. And so now if I go to JSON, [185:04] is it valid? There we go. So here it's [185:06] saying um this policy allows somebody to [185:09] put an object into this particular [185:11] bucket. And so that would be an example [185:13] where we would use um an AR. Okay. Okay. [185:16] Or if you're doing uh if you're using uh [185:18] adabus support, you might have to use an [185:20] AR to um to get help from support [185:23] saying, "Hey, look at this particular [185:25] resource exactly here." And then the the [185:27] cloud support engineer can help you. [185:28] Okay. [185:33] Hey, this is Andrew Brown from Exam Pro [185:35] and we are looking at the ADAS command [185:37] line interface. But before we do that, [185:38] we got to define some terms. So what is [185:40] a CLI? So a command line interface [185:42] processes commands to a computer program [185:44] in the form of lines of text operating [185:47] system implement a command line [185:48] interface in a shell. Okay. So we have a [185:51] terminal. So terminal is a text [185:53] interface. So it has input output [185:54] environment. Then you have a console. [185:56] This is the physical computer to [185:57] physically input information into a [186:00] terminal. Then you have the shell. A [186:02] shell is the command line program that [186:04] users interact uh with uh to input [186:06] commands. Popular shell programs are [186:08] bash zshell [186:11] and you might remember this one ms doss [186:14] prompt. So this has been around for [186:16] obviously a very long time. So maybe [186:17] this kind of primes your mind for what [186:20] is a shell. And just so you know people [186:22] commonly erroneously use terminal shell [186:24] or console generally describe [186:26] interacting with a shell. So if we say [186:28] shell or console or terminal, we're just [186:29] talking about the same thing. But there [186:31] is technically a difference between [186:32] these three things, but most people do [186:34] not care and I wouldn't worry about it [186:36] too much. Okay. So now let's take a look [186:38] at the ads command line interface, which [186:40] allows you to programmatically interact [186:41] with the ads API via entering single or [186:44] multi-line commands into a shell. And [186:46] then here I say or terminal, but really [186:48] it's just the shell. Okay, so uh here is [186:51] an example of one. So we're trying to [186:52] describe uh EC2 instances and then we're [186:55] getting the output because we asked to [186:56] have it back in this table like view. So [186:59] the ad CLI is a Python executable [187:01] program. So Python is required to [187:03] install the ad CLI. The CLI can be [187:06] installed on Windows, Mac, Linux, Unix. [187:08] The name of the CLI program is AWS. [187:10] You'll notice that up here in the top [187:12] left corner. There's a lot more to this, [187:13] but this is all we need for now. Okay. [187:20] Hey, this is Andrew Brown from Exam Pro [187:22] and we are taking a look at the Aless [187:25] CLI and the easiest way to get started [187:27] with this is actually via the cloud [187:28] shell. So, you'll notice this little [187:30] icon here in the top right corner that [187:32] is cloudshell and it's going to allow us [187:34] to um uh programmatically do things [187:36] without having to set up our own [187:38] environments. So, if I just click that [187:39] there. Okay. Uh and I say do not show [187:43] again. Close. And by the way, if you [187:45] don't see CloudShell here, it could be [187:48] your region. So like if I go to Canada [187:49] Central, it doesn't have it there. And [187:52] so if I was to search CloudShell here, [187:56] okay, it's going to say it's only [187:58] supported in those regions. So that's a [187:59] bit annoying. But once CloudShell loads, [188:01] it already has our uh credentials loaded [188:04] within our account. And so this is going [188:06] to save us a lot of time in terms of [188:09] uh you know trying to get set up with [188:10] the exception that you have to wait for [188:12] this environment to create. So it takes [188:13] a little bit of time, but it's not that [188:15] bad. Um, and while that is waiting, what [188:17] I'll do is show you actually how you [188:19] would install the CLI yourself. So, if [188:20] we typed in ads CLI install, [188:23] all right, and uh, we went here. The way [188:26] you would install, I believe it's a [188:28] Python library, but if we went to [188:29] version two, and we just said Linux, uh, [188:32] you go down here, they'll have [188:33] instructions. So, you just curl it, [188:35] unzip it, and do that. Um, so, you know, [188:39] if it's this, and then once it's [188:41] installed, you'll have the CLI commands. [188:43] This is still going. So, you know, maybe [188:45] I can show you what it would be like to [188:47] install the CLI by hand. So, if we [188:49] wanted to do that, one easy way to do [188:51] this is if we just go to GitHub. Doesn't [188:53] matter what repository. I'm just looking [188:55] for anything here. And if I open up Git [188:57] Pod. So, if we go on the top here and [188:58] type in githpod [189:00] uh.com [189:02] maybe that [189:05] I just want to see. Whoops. [189:08] Maybe it's gitpods. [189:11] that. [189:14] Oh, Gip Pod, you're not giving me Oh, [189:15] you know what? It's io. That's why. [189:17] Okay. So, if we go back here, sorry. And [189:20] we type in. IO. [189:23] What this will do is launch me a [189:24] temporary environment. And so, this is [189:26] outside of AWS. So, I'd actually have to [189:28] install the CLI. So, this would be a [189:29] great opportunity to show you how to [189:31] install the CLI. I'm just doing it this [189:33] way because GitPod is free to use. and [189:36] um you know it's going to set up an [189:37] environment and how let us simulate [189:39] installing the CLI. So here is the CLI [189:42] here. I'm going to see if I can bump up [189:43] the font. Um let's make the font as [189:46] large as we can go. Light or dark. Dark [189:48] sounds good to me. And so if we type in [189:51] AWS [189:54] and give it a moment, we can see that we [189:56] have uh the command here. So if I say [189:58] AWS S3 ls, whoops, it should be able to [190:03] list things out in a bucket. So, this is [190:04] what's currently in the bucket. If [190:06] you're wondering how do I know what [190:07] these commands are, I can just type in a [190:08] CLI commands. [190:11] Okay. And if we go here um and we go to [190:13] the CLI reference, [190:15] then we have um anything we want here, [190:18] right? So, we go down here and I just [190:20] want to see what's running in S3. And I [190:22] go here and I scroll on down. It's going [190:25] to show me commands like copy, move, [190:27] remove, sync, uh MB, RB, uh list, right? [190:33] And if you're looking for a particular [190:36] command, you go down and say, "Okay, [190:37] I'll look at ls here." And it will [190:39] explain to me all the little options [190:41] that we can do with it. And then it will [190:43] always give me examples, right? So I can [190:45] see examples like that. So if I wanted [190:47] to move something into an S3 bucket. So [190:48] let's say I want to create a new S3 [190:50] bucket. Um we'll type in AWS S3 and just [190:54] hit enter. And it should tell us um the [190:57] subcomands. Maybe if I do like help like [190:59] this [191:04] and if we scroll on down. So I guess it [191:06] just pulls up documentation. I was [191:08] hoping it would give us like a tiny [191:09] summary. [191:12] Okay. So what we can do here because I [191:15] want to create a bucket. [191:17] Type in like buckets. [191:19] If you don't know something, you just go [191:20] ads S3 CLI create bucket. We'll go here. [191:27] Um, and then what I do is I always just [191:28] go to examples here. So here have ads S3 [191:32] API create bucket. And I know it's [191:34] unusual. There's an S3 and there's an S3 [191:36] API. I don't know why that is, but it's [191:38] always been that way and I I just don't [191:39] question it anymore. And so here I can [191:41] go ahead and create a new bucket. So [191:43] I'll just go ahead and paste that [191:44] command in. I do want to change it up a [191:46] bit here because this name could be that [191:48] has to be unique. So just to make sure I [191:50] get what I want, I'm putting random [191:51] numbers in here. We're going to choose [191:52] the region as US East one. If I wanted [191:55] to do other things here, I could scroll [191:57] up and look at some flags here. So, [192:01] uh, it looks all fine to me. So, I think [192:04] I'll to go back here and just hit, uh, [192:07] paste. Okay. And so, it created that [192:10] bucket for me. If I go over to S3, [192:18] and we'll wait here a moment, we can see [192:21] that bucket now exists. If I wanted to [192:22] place something in that bucket, what I [192:24] can do is just like touch a file. So [192:25] I'll just say um touch. Touch is a Linux [192:27] command to make just an empty file. So [192:29] we'll say um hello.txt [192:33] and then it would be as S3 um [192:37] it would be SP to copy it. And I'm going [192:39] to give it the local path hello.txt and [192:41] then I need to give it the bucket [192:43] address. So it' be S3 col/ [192:47] the bucket name. So we named it this. [192:50] I'm not even going to try to type that [192:51] in by hand because it's too hard. And [192:53] then I want to say where I want to put [192:54] this file. So I'm going to say [192:55] hello.txt. And if I'm right, that should [192:57] work as expected. And so it says I [193:00] uploaded that file. I make my way back [193:01] over to S3. I refresh. There is the [193:04] file. If I want to copy this file back [193:06] locally. Um, all I have to do I'm just [193:09] going to remove I'm going to delete the [193:11] original hello txt file. ls to show you [193:14] that there's nothing there. And what I [193:16] need to do, oops, is just revert this. [193:20] So instead of saying the address here, [193:24] we can go and type in hello.txt. [193:29] And if I do ls, there's the file. If you [193:31] don't know what the address is of the [193:33] bucket, um, a lot of times you can go [193:34] here and find it. So it should be [193:38] because they're always changing this UI [193:39] on me. But we'll go to properties here. [193:40] And there that's the AR. [193:44] Uh, usually a good way to find it is if [193:46] you go into an actual object. So if you [193:48] go here, it'll give you the full URL. So [193:49] I could have grabbed that and I could [193:51] have just pasted that in there. Um, but [193:53] you know, you learn after time. It's not [193:56] hard to remember this. S3/ [193:58] the unique name. I do want to show you [194:00] how to install it by hand. So here I'm [194:02] in Git Pods. Um, I'm not sure how I can [194:05] change this to a dark theme because I [194:07] really don't like this on my eyes. We'll [194:09] go down below here to color theme [194:12] and we'll say get pod dark. There we go. [194:15] And so this is a temporary workspace. So [194:18] when I close it, it'll be gone. So [194:19] that'll be totally fine. And so I'm [194:20] going to type in as to see that it's not [194:22] installed. We're going to go over here. [194:24] This runs Linux by default. So I already [194:26] know that I'm going to use Linux. We [194:28] want to use version two here. Um so [194:32] for the latest version, use this [194:34] command. For a specific version, no, we [194:36] just want the generic one. So, I'm going [194:37] to go ahead and copy this. Whoops. Yes. [194:40] Allow. We'll paste that in. We'll hit [194:42] enter. Okay. Then we'll take the next [194:44] command. [194:48] Paste that in. Hit enter. We'll go take [194:50] the next command here. [194:53] We'll hit enter. [194:56] You can now run uh AWS. So, we type AWS. [195:00] And there's the command. So uh the only [195:02] thing is that if we do ads s3 ls it's [195:05] not going to work because we don't have [195:06] any credentials set. So we'll give it a [195:09] moment to think. So it says unable to [195:11] locate credentials. You can configure [195:12] credentials by running ads configure. So [195:14] we type in configure. And by the [195:17] way this font is too small. I believe I [195:20] can bump it up like this. [195:23] Not a great way to do it but um it [195:24] works. [195:27] And so it says ads access key ID. So, [195:30] what we can do is go over to IM [195:35] and what I'm looking for is my [195:36] particular user over here. [195:40] And if you remember when we first [195:41] created our account, it generated out [195:43] access key. So, I go to security [195:44] credentials. And so, we have a key here, [195:47] but I need the secret. So, this key is [195:49] useless to me. So, I'm going to go ahead [195:50] and deactivate it [195:53] just because I don't even want this key. [195:55] And I'm going to create myself a new [195:57] key. So, I'm going to have an access ID [195:58] and secret. Whenever you generate these [196:00] out, never ever ever ever ever show [196:03] anyone what these are. These are your [196:05] yours and yours alone. Okay, so this is [196:08] cloud shell. We're fine. We're just [196:10] going to close that for now. And I'm [196:12] going to go back over to get pods here [196:14] and hit enter. So that's the ID. I'm [196:17] going to go grab the secret. Hit enter. [196:20] Paste. And I want it to go to US East1 [196:23] to save myself some trouble. Uh you can [196:26] change the output from JSON to tables. [196:27] I'm going to leave it as the default [196:28] here. And so now if I type A as S3 LS, [196:34] I get a list. And so if I want to grab [196:36] that file there, I'm going to grab that [196:37] S3 URI and we type in as S3 API or [196:42] sorry, it's just ls, sorry, or sorry, [196:43] cp. And we're going to paste that link [196:45] in. And we're going to say hello.txt. [196:49] And I must have done the command wrong. [196:51] It's because we're missing S3 here. I [196:53] just hit up on the keyboard to get that [196:55] command back. And so I type in ls for [196:57] list. And I mean I have some other code [196:59] here. So, you know, again, any repo you [197:01] want on GitHub. It doesn't really [197:02] matter. Uh but you'll see there is that [197:05] file. Probably shouldn't use this one [197:06] because it makes a bit of a mess. Um but [197:09] yeah, it's pretty straightforward. Just [197:11] to one thing to show you is where those [197:13] credentials are stored. So, by default, [197:16] they're going to be stored in um it's [197:19] going to be in the a hidden directory in [197:22] your root or your home directory called [197:24] ads.credentials. [197:25] So if I just do like ls here, you can [197:27] see there's a config file and a [197:29] credentials file. CAT lets me print out [197:30] the contents of that file. So I go here [197:33] and it's saying the default region is US [197:35] East1. This is a TOML file. Even though [197:37] it doesn't have a TOML on the end of it, [197:39] I just know by looking at that's what it [197:40] is. Config lets you set uh defaults that [197:43] are going to apply to all of your [197:44] credentials. And then uh within the [197:46] credential file here is the actual [197:48] credentials. So if you wanted to just [197:51] set them, you could go in here and just [197:52] set them in here. You can also set [197:54] multiple credentials. So if I go here [197:56] and I'm going to open up and buy because [197:58] I'm not sure how to open it up here in [198:00] the main one. But if you wanted multiple [198:02] accounts, you would do like exam pro and [198:04] then you just repeat these with [198:06] different keys, right? And then when you [198:08] wanted to use an a CLI command, actually [198:11] I'm going to go back here for a second. [198:15] Okay. And if you want to um and by the [198:20] way, I'm using VI. You never use Vim. [198:22] It's a bit tricky to use. Uh you might [198:24] want to use nano instead if you're if [198:26] you're kind of new to this uh because [198:28] this will use like regular key key cuts. [198:30] And then down below it shows you what it [198:32] is. So this is like controll x or alt x [198:34] alt x. Nope. Control x. There we go. Um [198:38] but anyway, so if I go into this file [198:40] and I delete the original one, right? [198:41] And now I try to do [198:46] um this command here. Even though we [198:48] already have that file, it should either [198:51] hang or complain. I could just kill that [198:54] by doing control C. If I do ads S3 LS, [198:59] notice that it's hanging. So, unable to [199:01] locate credentials because there's no [199:02] default one. But if I go and I put [199:04] profile and I say exam pro, [199:09] right, it it'll now use that profile. [199:11] So, that's the way we do it. Um, but [199:13] hopefully that gives you kind of a a [199:15] crash course into the CLI. Um, so yeah, [199:19] there you go. Okay, so I'm just going to [199:21] go ahead and close these off. You can [199:23] delete this bucket if you don't want it. [199:26] It's probably a good idea to delete this [199:28] here. And I'm just going to say [199:30] permanently delete. Okay, [199:33] very very good. Okay, close that off. [199:35] And yeah, that's the introduction to the [199:37] CLI. So yeah, there you go. [199:45] Hey, this is Andrew Brown from Exam Pro [199:47] and we are taking a look at software [199:49] development kits. Uh, so a software [199:51] development kit or SDK is a collection [199:53] of software development tools in one [199:55] installable package. So you can use the [199:58] AWS SDK to programmatically create, [200:01] modify, delete or interact with AWS [200:03] resources. So the AWS SDK is offered in [200:06] a variety of programming languages. So [200:08] we have Java, Python, Node.js, Ruby, [200:11] Go.NET, PHP, JavaScript, C++, and so [200:16] here would be an example of uh some Ruby [200:19] code where we are creating ourselves um [200:21] an S3 bucket. So we're just uploading a [200:23] file there. Okay. [200:30] Okay. So now what I'm going to do is [200:31] show you how to use the Adabus SDK. And [200:34] so, uh, to do that, we're going to need [200:36] some kind of IDE, um, a a basically code [200:39] editor. And so, we had looked at Git [200:41] Pods, which is a thirdparty service, and [200:43] that's fine, but let's take a look at [200:44] Cloud9 because that is built into AWS. [200:47] So, if I just type in Cloud9 here and go [200:49] over to IDE, I'm going to launch myself [200:51] a new environment. So, I'll hit create. [200:53] I'm going to just say my SDK [200:55] environment, [200:58] envying [201:00] environment like me. And we have some [201:02] options. So, create an EC2 instance for [201:04] direct access. Create it via systems [201:06] manager. Run a remote with SSH. I'm [201:08] going to leave it as the default. Then [201:09] we have the option to choose what size. [201:11] I want to leave it on T2 Micro because [201:13] that is the free tier. Then we're going [201:15] to scroll on down. We have Amazon Linux [201:17] 2, Linux AMI. I'm going to stick with uh [201:20] Amazon Linux 2. And we can have it turn [201:22] off after 30 minutes. A great option for [201:24] us here. And we'll go ahead and hit [201:26] next. And we'll hit create environment. [201:29] And so we're going to have to wait a [201:31] little bit for this to launch. It'll [201:32] take a few minutes. As that is going, [201:34] let's go to Google, type in ads SDK [201:38] um to get to the main page. And so the [201:40] idea here is that there are a bunch of [201:42] different languages you can use. C++, [201:44] Go, Java, JavaScript.NET, Node.js, PHP, [201:47] Python, and Ruby. Uh and so I'm a really [201:50] big fan of Ruby. I've been using Ruby [201:52] since 2005. And so that's what we're [201:53] going to do it in. It's also really easy [201:55] to use and it's a really great language. [201:58] So um you know down below it's just [202:01] showing you that there's all these [202:02] different things but if we go down to [202:03] the SDK here and we click on Ruby we'll [202:07] we have examples where we have the [202:08] developer guide the API reference and so [202:11] this tells you how to get started even [202:12] here it's saying like hey go get started [202:15] with cloud9 which is great as well I [202:17] suppose um and so here it might show you [202:20] how to install it um and when we open up [202:24] the API references this is what it looks [202:26] like so a lot of times when I want to do [202:27] something. I know it's like I want to do [202:29] something with S3. So I scroll on down [202:32] here and I look for S3, right? [202:36] And then I just kind of like uh scroll [202:38] around and look, you know what I mean? [202:40] Sometimes you have to expand it, go into [202:41] the client. Every API is slightly [202:43] different, so you do have to kind of [202:45] figure out how to navigate that. I am [202:47] actually under S3 right now, so I'm [202:48] looking for the client. And I just know [202:51] this from memory that this is where it [202:52] is. So first you create yourself a [202:53] client, and then you can do API [202:55] operations. So, if I wanted to like list [202:57] buckets, [202:59] I just search the word list and I just [203:00] scroll on down and there it is. I click [203:02] into that and I have an example of how [203:04] to list a bucket. So, I'm going to go [203:06] back to Cloud9 and it is ready and it [203:08] started in dark mode. Um, if yours is [203:10] not in dark mode, which really honestly, [203:12] why wouldn't you want dark mode? Um, if [203:14] we go up to I think it's like file, [203:17] where is it? Preferences here. Got the [203:19] Cloud9 option. And [203:22] I'm just seeing if it like remembers my [203:24] settings. I really like two two soft [203:26] tabs here, but uh there should be [203:28] something for themes down below. And so [203:32] um [203:34] that doesn't seem like that's it. There [203:36] used to be like a Oh, here it is. If you [203:38] go here and just choose like whatever [203:40] you want. I'm on jet dark here. And so [203:42] if it's on classic light or something [203:44] you don't like, you can fix that there. [203:46] Um but I'm just going to go here and [203:48] just fiddle with my settings because I [203:51] really like to use Vim uh keys. I don't [203:54] recommend this if you are uh to change [203:56] this if you are not a programmer. But [203:58] I'm just going to change it so that I [203:59] can type here efficiently. So I'm just [204:01] looking for the option here. [204:05] And they moved it on me. Where did they [204:06] move it? [204:08] It probably be like key bindings. [204:10] Ah, bin mode. There we go. Again, don't [204:12] do that. This is just for me so I can uh [204:15] move around in a different way. So what [204:17] I want to do, and by the way, it looks [204:19] like this default screen. We could have [204:20] just changed it here. I just clicked [204:22] through all that for nothing. It was [204:23] here the entire time. But um what we [204:26] need is we need to make sure that we [204:28] have our credentials. So if you type in [204:29] as um S3 LS, that's like my sanity check [204:33] that I always like to do to make sure I [204:35] have credentials. Notice that we didn't [204:36] have to set up any credentials. It was [204:38] already on this machine, which was [204:39] really nice. And so I'm going to create [204:42] a new file here. And it's okay if you [204:44] don't know anything about Ruby. We're [204:45] just going to have fun here and just [204:47] follow along. So I'm going to do [204:48] example.rb. I'm going to make sure [204:49] Ruby's installed by doing Ruby V. So, it [204:52] is installed, which is great. Uh, you [204:54] need a gem file. So, we'll say new gem [204:56] file here. [204:59] And if we go back to the installation [205:02] guide, uh, we need the gem SDK here. [205:06] Actually, I'm going to look at how to [205:07] generate a gem file. Gem file because [205:09] there's some stuff that goes to the top [205:11] of those files like this here. [205:15] I think we just need this line here. So, [205:16] I'm just going to grab that. [205:19] Whoops. Paste that in. Allow. Good. [205:23] And uh I you can do gem ads SDK that [205:27] will install everything. But uh we only [205:29] want to work with [205:32] S3. And so this is going to vary based [205:34] on each language. But I know that if we [205:35] type in S3, we'll just get S3. And [205:37] that's all we really need. And so once [205:39] we have that, what we'll need to do is [205:41] use a bundle install. So we're going to [205:43] make sure we're in the correct [205:44] directory. I'm going to type in ls down [205:45] below. Notice the gem file is there. And [205:48] by the way, if the fonts are too small, [205:49] I should probably bump those up. Let's [205:52] see how we can do that. [205:55] Uh, editor size, font, user settings. [206:04] Good luck trying to find it, eh? [206:07] Um, project. No, [206:11] you'd think it'd have to be under user [206:12] settings, right? [206:14] Ah, here it is. Okay. So, um, this is [206:17] for [206:18] probably the editor. So, we'll go to 18 [206:20] here. Co code editor here. [206:24] I'm I'm trying to find the one for the [206:26] terminal. Probably over here. [206:29] There we go. Much easier. Okay. So, [206:32] notice we have example.rb and gem file. [206:34] So, we're in the correct directory. Make [206:36] sure I save that. I'm going to type in [206:38] bundle install. [206:40] That's going to install the gems. Give [206:42] it a moment there. It's going to fetch. [206:44] Notice that it installed um the uh AdSk [206:48] and everything that it was dependent on. [206:50] And so now if we go over to our [206:51] example.rb file, really when you're [206:53] coding for the cloud, you can pretty [206:55] much copy paste everything. So over here [206:58] we found this code here for S3 list [207:00] buckets. Um and so I'm going to go ahead [207:02] and paste that on in. Okay. And I know [207:06] it looks really complicated, but we can [207:08] quickly simplify this. So I know that [207:11] this is just the output, so I don't need [207:12] that. Okay. And in Ruby, you don't need [207:15] parenthesis or curlies if uh if you [207:18] don't have any things there. And so all [207:19] I need to do is define a client. So if I [207:22] click uh I go to the top here of this [207:24] file. I think we're in the client right [207:26] now. [207:27] All the way to the top. All the way to [207:29] the top here. That's what we need. Okay. [207:34] And so I'm going to paste that in. Now, [207:37] uh we can set the region here. So I'm [207:39] going to say US East1, [207:41] right? And then you'd have your [207:42] credentials. Um because the credentials [207:45] are on the machine in the um uh [207:48] credentials file, they're going to [207:50] autoload here, I believe. So I don't [207:52] think I need to set them. So I'm just [207:54] going to take that out here for a [207:55] second. [207:57] Okay. And I can do this if I want. This [207:59] is just slightly different syntax. It [208:00] might be easier to read if I do it this [208:02] way for you. [208:04] Okay. And I don't need double client [208:07] there. So we have the client. I like to [208:08] name this like S3 so I know what it is. [208:11] And I put puts for the response. I'm [208:14] going to do inspect. [208:16] And so puts is like print. Okay. And so [208:18] now if I type in bundle exec, let's just [208:21] make sure that it's in the context of [208:22] our bundler file. Ruby example.rb. [208:26] Um, we have a syntax error on this line [208:29] here. Unexpected thing here. [208:32] Oh, it's because of this. It's because I [208:34] commented out. So I'm just going to do [208:35] curly parenthesis comment out here. [208:39] Okay. Actually [208:41] to make it a bit easier, I'm just going [208:43] to bring this down like this. [208:46] Okay. And we'll paste that there. [208:50] Okay. And we'll try this again. [208:53] Uninitialize constants AWS. Oh yeah, we [208:55] have to require it. So we have to [208:56] require AWS SDK S3. I think we'll hit [209:01] up. [209:04] And uh we got a struck back. So it is [209:06] working. We are getting an object back. [209:09] If we want to play around with this a [209:10] bit more, I'm just going to install [209:11] another gem called Pry. Pry allows us to [209:14] um inspect code. So, we're going to do [209:16] bundle install. And I'm going to go back [209:18] to Ruby here. I'm going to put a binding [209:21] pry in here. [209:23] And then if I hit up, and I do bundle [209:26] exec Ruby example.rb. [209:28] Um, I installed it, right? Bundle [209:32] install. Yes. [209:36] undefined method pry. [209:39] Oh, because I have to require it again. [209:41] Bad habit here. [209:44] Okay, we'll hit up. And so now I have an [209:48] interactive shell and I can kind of [209:49] analyze that object. So we have a [209:50] response. So if I type in RSP here, I [209:52] have the structure object. I can type in [209:55] buckets here. Okay. And it's showing me [209:57] a bucket. I can give it get its name. [210:01] Um, [210:03] oh, I think it's an array. So I think [210:05] I'd say like I'd say like zero here or I [210:08] could say first. This is just the how [210:09] the Ruby language works. We say name. I [210:11] get the name creation date. Okay. So you [210:15] get the idea. Whatever you want to do, [210:18] you know, you search for it. You just [210:19] say I want to delete a bucket. I want to [210:20] create a bucket, right? And you look for [210:22] it. So I say create bucket. Here I click [210:25] on this and I can see the options and [210:28] they are always really good about giving [210:30] me example. And then down below they [210:32] always tell you all the parameters that [210:33] you have there. So that's how the SDK [210:36] works. Uh but yeah, the credentials were [210:38] uh softloaded here, but you could easily [210:40] provide them yourself. I should just [210:41] show you that before anything else just [210:44] because there's some variations there. [210:46] Um [210:48] and I'm just trying to look for it [210:49] because it is separate code. [210:54] So you could do this. This is one way of [210:56] doing it. So you could do it separate [210:57] from the code. So if you only wanted to [210:59] configure it once, [211:01] right? Because you could you could have [211:02] a lot of clients. you wouldn't want to [211:03] keep on like for each client, you [211:05] wouldn't want to put region in every [211:06] time. So I could take this and put this [211:08] right here. Okay? [211:12] And this is the file here where we have [211:14] the credentials. So this would be our um [211:17] our access key and our ID. And so you [211:21] never want to put your code directly [211:23] just in here. So if I open up, if we go [211:25] cat, you would never want to do this, [211:28] but I'm just going to show as an example [211:29] here. Uh, credentials. [211:32] Oops. I got to get out of this exit. [211:35] AS credentials. [211:39] Oh, did they not even show it on this [211:41] machine, which would be smart. We [211:42] wouldn't really want to see our [211:43] credentials here. [211:45] Hit up. Say ls. [211:47] Oh, no, it's there. Okay. [211:50] Cat. Whoops. [211:53] Credentials. [211:56] There it is. Okay. So, you know, if we [211:58] look here, we can see that there are [211:59] credentials set. It's a little bit [212:01] different. We have this like session [212:02] token. I guess it's to make sure that [212:04] this expires over time. But if I was to [212:06] take these, okay, and I was just to [212:08] paste them in here, [212:17] that's one way you would do it. Um, you [212:19] never ever want to do this ever, ever, [212:22] ever. You never want to do this because [212:23] you'll end up committing that to your [212:24] code. Um, so this is really dirty to do, [212:27] so I don't ever recommend to do it. Um, [212:30] if you wanted to have this apply to [212:32] everything, you could put it up here. [212:33] And so now when we call the client, we [212:36] don't have to do it. Um, of course, if [212:38] the they're loaded on the machine, you [212:40] don't have to do it. The other thing is [212:41] like if you if you want, you could load [212:43] them in via environment variables. [212:45] That's usually what you want to do. So [212:47] you say as uh access key, [212:51] right? And then we say environment ads [212:55] access secret. [212:57] And so you'd set those by doing I think [212:59] it's like an export [213:01] um environment variables [213:04] set in Linux. You think I know after [213:07] like 15 years of doing this, but I never [213:09] remember. So you type in export. So you [213:11] go down into Whoops. Here you type in [213:14] export and you just say something like [213:16] I'm going to just show an example to see [213:18] if it works. So I'm going to say hello [213:19] world. [213:20] Okay. Okay. And if I do uh hello like [213:23] that echo, see it prints it out. So [213:27] that's how you would set it. You'd set [213:28] those there. But there's actually very [213:30] specific ones that AWS uses for um the [213:33] API and it's these ones here. So you [213:35] always want to use those. Okay? So you'd [213:38] put that in there [213:42] and that in there. But of course, you [213:44] know, like if they're already set on [213:45] your machine, you don't have to even [213:46] specify those because it would autoload [213:48] those environment variables. I don't [213:50] think they're set right now. If we type [213:51] in echo, just take a look here. Is are [213:53] they going to get autoloaded here? [213:56] No. So, but anyway, so we could go here [214:00] just as an example [214:03] and well actually they just show them [214:04] right here. So, you see your access key, [214:06] but we go and we type in um export [214:10] and I'm going to paste the key in there. [214:11] And I'm going to go to the front of it [214:12] and we're going to type adabus access [214:15] key ID equals [214:18] enter. And so now if I did echo on this [214:21] ad as access key ID, okay, it shows up. [214:24] But I just want to show you how it can [214:26] kind of vary and those conditions around [214:28] it. So yeah, that is the ads SDK. Um, [214:31] and yeah, a lot of times you're just [214:32] copying and pasting code and just kind [214:33] of tweaking it. You're not really [214:34] writing uh real programming. Okay, so [214:37] hopefully that is less intimidating. So [214:38] I'm just going to close these off and I [214:40] want to close down this Cloud9 [214:42] environment. Um, [214:45] I might have to reopen this up in [214:46] another tab. [214:48] and go to the management console here [214:50] and then go over to Cloud9 and just [214:53] close this tab and then I'll go ahead as [214:56] and delete this environment. Oops, I'll [214:57] just type delete here. Even if you [214:59] didn't, it would turn off after 30 [215:01] minutes and you have that free tier. So, [215:02] it's not that big of a deal. It's up to [215:04] you whether you want to use Cloud9 or [215:06] Git Pods. Cloud9's really good because [215:08] it allows you to um uh it allows you to [215:13] uh use it runs on a virtual machine, [215:15] right? So you have a a container runtime [215:19] there and so it's very easy to run [215:21] containers on it. Um whereas in like [215:23] I've had some issues with git pods but [215:25] um yeah those are the two. Okay [215:31] let's take a look at ads cloud shell [215:33] which is a browserbased shell built into [215:35] the ads management console. And so [215:37] cloudshell is scoped per region. It has [215:39] the same credentials as the loggedin [215:41] user and it's a free service. So this is [215:42] what it looks like. And the great thing [215:44] about this is that, you know, if you [215:46] have a hard time setting up uh your own [215:49] shell or terminal on your computer, um [215:51] or maybe you just don't have access or [215:53] privilege to do so, it's just great that [215:55] Adabus makes this uh available to you. [215:58] And so what you can do is click the [215:59] shell icon up at the top and that will [216:01] expand this here. Some things to note [216:03] about cloud shell is that it has some [216:04] pre-installed tools. So it has the CLI, [216:07] Python, NodeJS, Git, Make, PIP, Pseudo, [216:10] Tar, T-Max, Vim, Wget, Vim, and more. It [216:13] includes one gigabyte of storage free [216:15] per adabus region. It will save your [216:18] files in a home directory available for [216:20] future sessions for the same ad as [216:22] region. Uh and it can support more than [216:24] a single shell environment. So it has [216:26] bash, powershell, and zsh. Um and so [216:30] adamus cloud shell is available in [216:32] select regions. So when I was in my [216:34] Canada region, I was like where's the [216:35] little shell icon? But I realized it's [216:37] limited for some areas. Okay. [216:44] Hey, this is Andrew Brown from Exam Pro [216:46] and we are taking a look at [216:47] infrastructure as code, also known as [216:49] IA. And this allows you to write a [216:51] configuration script to automate [216:53] creating, updating or destroying your [216:55] cloud infrastructure. The way you can [216:57] think of IC, it's a blueprint of your [216:59] infrastructure and it allows you to [217:01] easily share, version or inventory your [217:03] cloud infrastructure. [217:04] So, Adabus has two different offerings [217:07] for IA. The first is cloud formation uh [217:11] abre common commonly abbreviated to CFN [217:14] and this is a declarative IA tool and [217:16] then you have adabus cloud development [217:18] kit commonly known as CDK which is an [217:20] imperative IA tool. So let's just talk [217:22] about the difference between declarative [217:24] and imperative and then we'll look at [217:25] these tools a little bit closer uh each. [217:28] Okay, so declarative means what you see [217:30] is what you get. It's explicit. It's [217:32] more verbose but uh there is zero chance [217:34] of misconfiguration unless the file's so [217:36] big that you're missing something. uh uh [217:38] commonly declarative files are written [217:40] in things like JSON, YAML, XML. So for [217:42] cloud form, it's just JSON and YAML. Uh [217:45] and so that's that side there. So for [217:47] imperative, you say what you want and [217:49] the rest is filled in. So it's implicit. [217:51] Uh it's less verbose. You could end up [217:53] with some misconfiguration. That's [217:54] totally possible. Uh but it does more [217:57] than declarative. And you get to use [217:58] your favorite programming language, [218:00] maybe Python, JavaScript. Actually, CDK [218:02] does not support Ruby right now, but I [218:04] just have that in there just as a [218:06] general description of what imperative [218:07] is. Okay. [218:13] All right. So, just a quick look at [218:14] cloud for. So, cloud form allows you to [218:16] write infrastructurees code as either [218:17] JSON or YAML. The reason why was AD as [218:20] started with JSON and then everybody got [218:22] sick of writing JSON and so they [218:24] introduced YAML which is a lot more [218:26] concise which you see on the right hand [218:27] side. So cloud formation is simple but [218:29] it can lead to large files or is limited [218:32] in some regards to creating dynamic or [218:34] repeatable infrastructure compared to [218:35] CDK. Cloud form can be easier for DevOps [218:38] engineers who do not have a background [218:40] in web programming languages. A lot of [218:41] times they just know scripting and this [218:43] basically is scripting. Since CDK [218:45] generates out cloudformation, it's still [218:47] important to be able to read and [218:48] understand cloudformation in order to [218:50] debug IA stacks. Knowing cloud form is [218:53] kind of a cloud essential. When you go [218:55] into the other tiers of AWS um like [218:58] solutions architect, associate, [218:59] professional or any of the associates, [219:01] you need to know cloudformation inside [219:02] and out. Okay. [219:09] Hey, this is Andrew Brown. In this [219:10] video, I want to show you cloudformation [219:12] so that you can learn how to deploy [219:14] infrastructure as code. So, we're going [219:16] to go to the top right corner to create [219:18] stack and new resources. And here is [219:20] where we can either upload an existing [219:22] template or use infrastructure composer. [219:25] I wonder if they're going to keep this [219:26] thing around just because AI is getting [219:27] very good at generating out templates. [219:29] So I'm not really sure why we would ever [219:31] need to visually create one, but we'll [219:32] go over here and give it a try just so [219:34] we can visually understand. And so let's [219:36] say we wanted to create an S3 bucket. We [219:38] could drag it out here. If you go over [219:40] to template, this is going to provide us [219:42] um the actual template that we would [219:44] upload uh and utilize. So here you can [219:46] see resources and we have an individual [219:48] bucket and then the bucket policy. Now I [219:51] don't need a bucket policy. So you can [219:53] see here that it's adding a lot of [219:55] additional information that I do not [219:56] need. In fact, I don't need any of this. [219:58] All I need is the name, right? And so [220:00] here um would be the minimal thing that [220:03] we would need to create an S3 bucket. [220:05] But if we wanted to take a look at where [220:07] all this documentation come comes from. [220:09] If we go over to as cloudformation um [220:11] documentation, we go to template [220:12] reference. we can basically search up [220:14] any kind of resource we want and get uh [220:17] information for it. So I'm just looking [220:19] for yeah over here and if I just search [220:22] S3 and we go to Amazon S3 um here we can [220:25] go to bucket and this will tell us [220:27] exactly what the structure is and what [220:30] exact fields that we have. So back in [220:32] the day I would literally walk through [220:35] every single of these options and say [220:37] okay I need uh this is required this is [220:40] not required. See how they're [220:41] individually required or not required. [220:42] But now that we have AI, we basically [220:44] can just go over to something like [220:46] chatbt and I'll just provide it a [220:48] reference to this link. And I'm just [220:50] going to go here and say um I uh I am [220:53] showing a uh example a simple example of [220:59] creating an S3 bucket. What is what is [221:03] the minimal [221:07] um CFN template I need to deploy? And I [221:10] already know what it is, right? It's [221:12] just going to be the name as we see [221:14] here. But we will uh take take a look [221:17] here. And so it comes out with this. But [221:19] the one thing that we absolutely have to [221:20] have is this Adabus template um format [221:23] version. Now this hasn't changed since [221:24] 2010. But the idea here was that if [221:26] Adabus made any dramatic changes to the [221:29] cloud for structure, then we could uh [221:32] bring in another one to reference it. [221:34] But it just hasn't seemed to change in a [221:36] very very long time. But again, this is [221:38] the minimal template that we need. Okay. [221:40] And we could download this and then [221:42] upload it. Um, so what I'm going to do [221:44] is I'm just going to copy this and using [221:47] any kind of editor. I'm going to open up [221:49] an editor here like Visual Studio Code. [221:51] If you do not have Visual Studio Code, [221:52] you really should get it. It's free. [221:54] It's easy. It's over here. But I'm going [221:56] to open that up quickly and save that [221:58] template locally. Okay. All right. So, I [222:00] just have Visual Studio Code open here. [222:02] I'm just going to make a new file. We'll [222:03] call this template.yaml. [222:05] Um, and sometimes it does matter if it's [222:07] YML or YML. Oh, to say does it does AWS [222:11] prefer [222:13] prefer uh YAML or YAML? I'm pretty sure [222:16] it's YAML. Um, but it depends on what [222:18] you're using. So, well, they say that, [222:20] but basically it it usually has always [222:22] been YM [222:24] YAML and then when uh we had SAM SAM [222:28] templates, which is for serverless, it's [222:30] like a serverless version of [222:31] cloudformation, it prefers the YML. But [222:34] here it's saying it doesn't matter, but [222:35] I I don't believe it. um as I know from [222:37] history which one actually does matter. [222:40] Okay. And so now what we we will do is [222:43] we will go ahead and [222:46] um I'm just looking for the screen here. [222:50] I think we just got to zoom out here. [222:52] There we go. And so if we go over to [222:53] here, we can copy our template [222:57] over to here [222:59] and we'll drop it in. And then we'll go [223:01] all the way over to here to uh back over [223:05] to chatbt as it was providing us some [223:07] useful information. [223:09] Again, this is all stuff we can find in [223:11] the docs. It's nothing's a secret here, [223:12] but it takes a little bit of time and [223:14] work to dig them up. And to be honest, I [223:16] used to drive everything from the docs. [223:18] So when I make these videos, I used to [223:19] go and show you exactly where everything [223:21] is. It's becoming harder because adas [223:23] again has changed their documentation. [223:25] It's not as good as it used to be. [223:26] They've replaced technical writers with [223:28] AI AI people. And so just naturally [223:31] trying to find stuff is is quite [223:32] frustrating. We'll go into user guide [223:34] here and it might be under working with [223:37] templates template format. And so [223:39] somewhere here it will describe that [223:40] there's an ads template format version. [223:43] So you can see that everything is uh uh [223:46] possible for us to find in the [223:47] documentation. And so I'm just going to [223:49] add a description here. say description [223:53] uh deploy simple S3 bucket. [223:59] Okay, I'm gonna just save that. Um and [224:02] just notice here under the bucket name [224:04] that it has some fancy stuff. So here [224:06] you can actually inject um I don't know [224:09] we they're like global variables. It's [224:11] basically variables like your the actual [224:13] stack name. So whatever we call the [224:14] stack, it'll be injected into here. And [224:16] then you have the ads account ID. That's [224:18] really good when you want to have uh [224:19] resources that have dynamically [224:21] generated names so it's not conflicting [224:22] with stuff. And so I need to get this [224:23] template uploaded um into cloud form. So [224:26] we'll go back over to here and I'm not [224:28] going to use infrastructure composer as [224:30] I I don't think that's the way you [224:31] should build honestly. And so here we [224:33] can see say choose an existing template [224:35] provide it from S3 or upload it. I'm [224:37] just going to go ahead and upload this [224:38] directly. So let me go ahead and select [224:40] that file. I've now selected that file. [224:43] It will also validate it making sure [224:45] that it's a correct format. We'll go [224:47] ahead and hit next. And we'll just say [224:49] create um simple [224:52] cloudformation or create simple bucket. [224:56] We'll go ahead and hit next. And we have [224:59] some other options. Sometimes there's a [225:02] option here that you do have to check. [225:03] Um maybe it's on the last one. Could [225:06] have swore it was here. [225:08] Oh, there used to be like a roll [225:11] permission one that you used to have to [225:12] select all the time, [225:15] but I'm not seeing it. So, that's fine. [225:18] But we'll go ahead and just hit next. Go [225:21] all the way down on the ground and hit [225:22] submit. And so, now we're going to watch [225:24] that deploy. [225:26] Now, this is going to be relatively [225:28] fast. Oh, we ran into an issue. Um, but [225:32] um what is our issue here? So, failed [225:35] likely root cause. And so it's trying to [225:37] show us where it failed. And we kind of [225:40] expand that and take a look. [225:42] So resource handled uh return message [225:45] bucket name should not contain upper [225:46] characters, which is crazy because this [225:49] code [225:51] here came from uh infrastructure [225:54] composer. So that's really interesting [225:56] that it had an issue with that. Um but [225:59] anyway, we can see well we had the [226:01] analysis over there. [226:03] Oh yeah, events. We were on events. I'm [226:05] used to this this uh table table view, [226:07] but anyway, we go down here. We can see [226:09] that this is the issue it's having. So, [226:11] we'll go back and compare this. I think [226:13] the issue is that um you know, it's [226:15] whatever the stack name is, right? So, [226:17] if this stack name uh has title casing, [226:19] it does. That's where it's running into [226:21] that issue. So, what I'm going to do is [226:22] go ahead and delete that stack. But, you [226:24] see how you can run into like little [226:26] issues like that. [226:29] And we'll tear that down. And I'll go [226:32] back over to here. And I'm just [226:33] refreshing, making sure that is deleted. [226:35] We'll go ahead and create ourselves a [226:36] new stack. And I'm going to go ahead and [226:38] upload that again. So, just make sure [226:41] you select this. Okay. All right. And [226:43] so, now we'll go ahead and hit next. And [226:45] we'll say uh simple S3 bucket. I'm going [226:48] to just put some numbers here just so [226:50] there's no conflicts with anybody else. [226:52] And we'll go ahead and hit next and [226:55] submit. And by the way, you know, like I [226:57] mean, you shouldn't have that issue [226:58] because it's using the account ID as the [226:59] bucket name. Um, but you know, I just [227:02] always add numbers in there at random [227:04] just so I I don't have those issues. And [227:06] so again, this should go very very [227:08] quickly. We can even go to the timeline [227:09] view here, which is really nice. [227:12] And this is new for me. I've never seen [227:14] the timeline before. So it's it's very [227:15] nice. I'm just done this table view, [227:19] but we will Oh, it's done. Okay. And so [227:21] we can go over [227:24] and take a look and see if that bucket [227:26] exists, which it will. Um, [227:30] and I'll just sort by creation date [227:33] here. And so there is that bucket. Now, [227:35] if you delete this out, then it's no [227:37] longer being managed by cloudformation. [227:38] So, you really don't want to be uh [227:40] deleting resources and modifying [227:43] resources directly after you've changed [227:45] them. What you should be doing is [227:46] updating the code here and then [227:48] repushing it. And this would be normally [227:50] managed within a uh repository like [227:52] GitHub or something. Um, but anyway, [227:55] what we'll do is go over to cloud form [227:58] and we'll go here and then we'll just [228:01] delete that stack and clean up. Now, if [228:02] there was something in that bucket, we'd [228:04] have to empty that bucket first, which [228:05] can be kind of annoying. So, that's why [228:07] we didn't put anything in it. But again, [228:08] we're just doing the most simple [228:09] demonstration of cloud for here. Um, but [228:13] normally I will teach like a whole [228:14] section, basically a whole course on [228:16] cloudformation, um, which is in our more [228:18] advanced certifications. But anyway, [228:21] there you go. Cha chia. [228:28] Let's take a look here at CDK. So CDK [228:30] allows you to use your favorite [228:32] programming language to write [228:33] infrastructure as code. And technically [228:35] that's not true because they don't have [228:36] Ruby and that's my favorite. But anyway, [228:39] uh some of the languages include [228:40] Node.js, TypeScript, Python, Java.NET. [228:44] And so here's an example of TypeScript. [228:45] Typescript was the first language that [228:47] was um introduced for CDK. It's usually [228:50] the most up-to-date. So not always does [228:52] CDK reflect exactly what's in cloud form [228:55] but I think they're getting better at [228:56] that. Okay. So CDK is powered by [228:59] cloudformation. It generates out [229:00] cloudformation templates. So there is an [229:02] intermediate step. Uh it does sometimes [229:04] feel a bit slow. So I don't really like [229:05] that but you know it's up to you. Uh CDK [229:08] has a large library of reusable cloud [229:09] components called CDK constructs at [229:11] constructs.dev. This is kind of the [229:13] concept of Terraform modules and is [229:15] really really useful. uh and they're [229:17] really well written um and they can just [229:19] reduce a lot of your effort there. CDK [229:22] CDK comes with its own CLI um and I [229:24] didn't mention this before but [229:26] cloudformation also has its own uh CLI. [229:29] Okay, CDK pipelines uh are are allow you [229:32] to quickly set up CI/CD pipelines for [229:34] CDK projects. That is a big pain point [229:36] for cloudformation where you have to [229:38] write a lot of code to do this. Whereas [229:40] um this the CDK has that off the bat [229:43] makes it really easy for you. CDK also [229:45] has a testing framework for unit and [229:47] integration testing. I think this might [229:48] be only limited to TypeScript because I [229:50] didn't see any for the rest of the [229:51] languages, but um you know I wasn't 100% [229:54] sure there. Uh this one thing about CDK [229:57] is it can be easily uh confused with SDK [230:00] because they both allow you to [230:02] programmatically work with AWS uh using [230:05] your favorite language. But the key [230:06] difference is that CDK ensures uh it [230:09] potent of your infrastructure. So what [230:12] that means, this is such a hard word to [230:14] say, but what that means is that um you [230:18] know if you use this CDK to say give me [230:21] an virtual machine, you'll always have a [230:23] single virtual machine uh because it's [230:26] trying to manage the state of the file [230:27] whereas uh when you use SDK if you run [230:30] it every time you'll end up with more [230:31] and more servers uh and it's not really [230:33] managing state. So hopefully that is [230:35] clear between the difference there. [230:38] All [230:42] right, let's take a look here at the [230:43] Adabus Toolkit for VS Code. So, Adabus [230:45] toolkit is an open source plugin for VS [230:47] Code to create, debug, deploy adus [230:49] resources since VS Code is such a [230:51] popular uh editor uh these days. I use [230:54] Vim, but it's very popular. Um I figured [230:56] I should make sure you're aware of this [230:58] um plugin. So, it can do four things. [231:01] You get the Adabus Explorer. This allows [231:02] you to explore a wide range of Adob [231:04] resources linked to your Adobus account. [231:07] uh and sometimes you can view them, [231:08] sometimes you can delete them. It's [231:10] going to vary per service and what's [231:12] available there. Then you have the ads [231:14] CDK explorer. This allows you to explore [231:16] your stacks defined by CDK. Uh then you [231:19] have Amazon elastic cont uh container [231:21] service ECS. This provides intellisense [231:23] for ECS task definition files. [231:25] IntelliSense means that when you type uh [231:27] and you uh you'll get like autocomp [231:29] completion, but you'll also get a [231:30] description as to what it is that you're [231:32] typing out. Then there is serverless [231:34] applications and this is pretty much the [231:36] main reason to have the adabus toolkit [231:38] allows you to create debug deploy [231:40] serverless applications via samp and cfn [231:43] and so uh there you can see the command [231:45] pallet and you can kind of access stuff [231:46] there. Okay, [231:52] let's take a look here at access key. So [231:54] an access key is a key and secret [231:56] required to have programmatic access to [231:58] adabus resources when interacting with [232:00] the ads API outside of the adabus [232:02] management console. So uh access key is [232:05] commonly referred to as adabus [232:07] credentials. So if someone says ads [232:08] credentials you generally are talking [232:09] about the access key not necessarily [232:12] your um username and password to log in. [232:15] So a user must be granted access to use [232:18] access key. So when you're creating a [232:19] user you can just checkbox access key. [232:22] Um, you can always do this after the [232:24] fact, but it's good to do that as you're [232:26] creating the user. And then you can [232:27] generate an access key and secret. So, [232:30] you should never share your access keys [232:32] with anyone. They are yours. If you give [232:34] them to someone else is like giving them [232:35] the keys to your house. It's dangerous. [232:37] Uh, never commit access keys to a [232:38] codebase uh because that is a good [232:41] placeh for it to get leaked at some [232:43] point. You can have uh two active keys [232:46] at any given time. You can deactivate [232:48] access keys, obviously delete them as [232:50] well. Access keys have whatever access a [232:53] user has to ad resources. So uh you know [232:55] if you can do it in the adabus [232:56] management console so can the key. So [232:59] access keys are to be stored in the ads [233:03] credentials uh file. So um and if you're [233:06] not familiar with Linux, this tilda [233:08] here, this actually represents your home [233:10] folder. So whether you're on Windows or [233:12] Linux, that's going to be your home [233:14] folder. And then you have this period [233:15] AWS. That means that it's a hidden [233:17] folder, but you can obviously access it. [233:19] And so in the it's just a toml like [233:22] file. I think it's toml um but I never [233:25] 100% verified that it's toml. It looks [233:27] just like toml. Uh and so what you'll [233:29] have here is your uh default profile. [233:32] And so this is what you would use um or [233:35] this is what uh any of your tools you [233:37] use like the CLI or anything else would [233:39] automatically use if um if you did not [233:42] specify a profile. You can of course [233:45] store multiple access keys and then give [233:47] it a profile name. Um, so if you are [233:50] doing this for the first time, you might [233:51] just want to type in ads config and [233:53] it'll prompt you and you'll just enter [233:54] them in there as well. I think that sets [233:56] the default one. When you're using the [233:58] SDK, uh, you would rather probably use [234:01] environment variables because this is [234:03] the safest way to access them when you [234:06] are writing code. All right. Um, so [234:08] there you go. [234:14] Hey, this is Andrew. In this video, [234:15] we're going to take a look at access [234:17] keys. So, we're going to make our way [234:18] over to IM. Um, and from here, I will [234:21] close out these other tabs from before, [234:22] but we'll go over to our users. I mean, [234:24] you should, as a user exists, if you [234:26] have yet to do so, you should go ahead [234:28] and create one. You can see we have a [234:29] variety of ones. Apparently, Bedrock has [234:31] been making their own, uh, which I don't [234:33] really want. So, I'll go ahead and [234:34] delete those. Um, which it will probably [234:37] just make new ones later on. But, you [234:39] can see we have some accounts in here. [234:41] So, I'm just deleting old ones out of [234:43] here. They're just not being utilized. [234:46] But the idea is that we can go ahead and [234:48] create a new user. So I'm going to go [234:49] ahead and do that. And a lot of times um [234:53] uh you will create users just for [234:54] programmatic access. So if I have a [234:56] specific project I'm working on, I will [234:58] create a user for it. Um and so let's [235:01] say it was for my language learning app [235:02] called Hajimari, I'll go Hajimari [235:04] machine user. And that lets me know that [235:06] this person or this user is not a real [235:08] person. And so here it says provide user [235:11] access to the management console. [235:12] They're not a real person. So they don't [235:13] need an account. And we'll go ahead and [235:15] hit next. And I'm going to give them [235:17] admin access, which is pretty crazy, but [235:20] we will uh keep that access despite um [235:22] it being very um permissive. Just so [235:25] that's very easy. We'll go ahead and [235:26] create that user. So now what we can do [235:28] is go down into this machine user and go [235:31] into our security credentials and we can [235:33] generate out security credentials for [235:34] them. Okay. And so you can only have two [235:36] at a time over here. API keys, access [235:39] keys, access keys. Sorry. These are [235:41] named very similarly. [235:44] and I don't want to get too confused [235:45] about it. So, what I meant to say was [235:47] access keys. And so, right off the bat, [235:50] they are showing us a list of options. [235:52] Now, they've added this thing just so [235:54] that you know you know exactly what [235:56] you're doing with it to give you [235:57] recommendations. But all this stuff [235:59] basically does the same thing. So, I [236:01] just always choose the first one. I kind [236:02] of ignore it and I just hit next. And [236:04] then it'll just say like um uh [236:07] production server. So, we know what this [236:10] key is for. And so now we have an access [236:12] key and an access secret, right? And so [236:14] you generally don't want to share the [236:15] secret with anybody. And I mean [236:17] generally I mean never share it with [236:18] anybody. Um the access key is not really [236:21] a secret as you can plainly see it here. [236:23] But again you don't want to be sharing [236:24] these pairs regardless and you want to [236:26] keep these out of your repository. Uh [236:28] you can download it as a CSV file which [236:30] I never do. Uh but once you've generated [236:33] you cannot see it again, right? So you [236:35] see here there's no way for me to see [236:37] it. So, if I forgot it, then I'm just [236:39] going to have to create a new key. We'll [236:42] go ahead and do that. And this would be [236:45] we'll just say backup key. [236:48] Okay. And you can see here, you know, [236:52] same thing. But if you go here, like now [236:55] we're we can't make any more keys. [236:56] You're only allowed to have two. And so [236:57] some strategies that people do is that [236:59] even if you do not plan on using uh two [237:01] keys, some people will fill up the uh [237:03] this one here and and have the second [237:05] one just so that if someone was to get [237:06] into your account, they wouldn't be able [237:08] to uh create a new key as there as all [237:11] the spaces are used. That's a strategy [237:12] for security. Um but just look here that [237:15] we can deactivate the key um and keep it [237:18] around. So maybe I don't know why you'd [237:20] want to deactivate not delete u but I'm [237:22] sure there's a security reason for that. [237:24] Oh, you can reactivate it. Oh, okay. So [237:26] maybe if you suspected something was [237:27] wrong with it, you know, I never noticed [237:29] there was an an a reactivate feature. I [237:32] always just thought it was deactivated. [237:33] I never actually noticed this for years, [237:35] which is funny. But anyway, I guess [237:37] maybe, you know, if you're utilizing it [237:38] and then you you suspected something was [237:41] wrong, you want to investigate, you [237:42] deactivate it and then reactivate it [237:44] later on. But we'll go ahead and just [237:45] delete those keys. And you'll notice you [237:47] have to provide the full name. So we [237:49] always just copy and paste here. um [237:52] which is annoying but again it just [237:54] helps people prevent uh them deleting [237:56] things by accident. Oh, and notice we [237:58] have to deactivate first before we can [237:59] delete. All right. And so those are your [238:01] keys. Um I've showed you somewhere else [238:04] in this course how these keys are [238:05] utilized. But um you know for this I [238:07] just wanted to show you the management [238:09] of those keys. And I'm going to go back [238:11] over to my users as I already have [238:13] enough users that I'm not utilizing [238:15] right now. So we'll go ahead and delete [238:17] the Hajimari user. [238:19] There we go. and I will see you in the [238:21] next one. Okay, chowo chia. [238:29] Let's take a look here at Adabus [238:30] documentation which is a large [238:32] collection of technical documentation on [238:33] how to use Adabus services which we can [238:35] find at doc.adabus.amazon.com. [238:38] Uh and so this is kind of like the [238:40] landing page where you can see all the [238:41] guides and API references. If you expand [238:43] them in there uh into EC2 and you click [238:46] on the user guide, you can see HTML in [238:48] PDF format, Kindle, and you'll notice [238:51] there's a link to GitHub and that's [238:52] because all of these docs are open [238:54] source and you can contribute to them if [238:55] you choose to do so. I've done so [238:57] multiple times in the past. It's quite [238:59] fun. So, Adabus is very good about [239:01] providing detailed information about [239:02] every Adabus service and the basis of [239:04] this course and any Adabus certification [239:06] will derive mostly from uh the Adabus [239:08] documentation. So, I like to say that [239:11] I'm not really coming up with new [239:13] information. I'm just uh taking what's [239:15] in the docs and trying to make it more [239:16] digestible. And I think that's the thing [239:17] is like the docs are really good. You [239:20] can read them end to end, but they are [239:21] very dense. Um and so it can be a bit [239:24] hard to figure out what you should read [239:25] and what you should not. Um but uh they [239:28] are a really great resource and you [239:29] should spend some time in there. Okay. [239:36] Hey, this is Andrew Brown. In this [239:37] video, I just want to show you where the [239:38] docs All right. I don't know why they [239:40] have a video here. Every day the um [239:42] homepage changes. So, we'll just kind of [239:43] ignore that. But if we go up to here [239:45] into the top, we'll type in docs. [239:47] Whoops. Keep that lower case. Docs. [239:50] Amazon.com. And this is where the [239:52] primary documentation is. Um it's [239:54] changed over the years. Um I think it's [239:56] kind of gotten worse. I think with AI, [239:58] they have um maybe been using less [240:01] technical writers because I noticed that [240:02] the human navigation isn't as good. But [240:04] let's just make sure we understand it. [240:06] So that if you do need to utilize it, [240:08] you can go over here and find stuff. So [240:10] you can see that things are uh very [240:12] servicedriven. So if there's a very [240:13] specific service you need to go [240:15] investigate, you will type it in. So I'm [240:17] looking for elastic uh compute. Um and [240:20] we have different kinds of guides. So [240:21] there's the user guide and then [240:22] sometimes there's just direct reference [240:24] information. Uh but here you see user [240:26] guide, developer guide, and then API [240:28] reference. So um you know, again, it [240:30] depends on what you are into, but we [240:32] will go ahead and just open up two. [240:34] notice you can download them as PDFs. So [240:36] that is um interesting as well. Um but [240:39] it's pretty darn straightforward. Like [240:41] there's not much to say, but I do spend [240:42] a lot of time in the documentation as [240:45] it's very very valuable. Adabus out of [240:48] all providers has the best documentation [240:50] and often what is in here does match [240:53] expectations. So even from a study [240:55] standpoint, if you're just reading the [240:56] docan, they're pretty darn good. Um, but [240:59] again, you know, things change over time [241:01] and there's all this see this AI stuff [241:03] creeping in that's not as uh good as it [241:05] used to be, which is fine. Um, but [241:08] that's about it. Uh, the only other [241:09] thing that I would say is that in the [241:11] past you used to be able to contribute [241:13] to the doc. So, it used to be on GitHub [241:15] and I actually used to provide like code [241:18] references especially for Ruby. And so, [241:20] if you see Ruby code, it's probably from [241:22] me. But, uh, they changed that practice [241:25] a few years back. Um and so now it's I [241:27] don't know this just inter internally [241:29] managed but yeah that's about it. Okay. [241:36] Hey this is Andrew Brown from Exam Pro [241:38] and we are taking a look at the shared [241:40] responsibility model which is a cloud [241:42] security framework that defines the [241:43] security obligations of the customer [241:45] versus the cloud service provider. In [241:47] this case we're talking about AWS and [241:49] they have their own shared [241:50] responsibility model. It's this big ugly [241:52] blob here. Um, and the thing is is that [241:54] every single CSP has their own variant [241:57] on the model. Uh, so they're generally [241:59] all the same, but some visualizations [242:01] make it a little bit uh easier to [242:03] understand or they kind of uh include a [242:06] little bit more information at different [242:07] parts of it. And so just to get make [242:09] sure that you have well-rounded [242:10] knowledge, I'm going to go beyond the [242:12] AWS's shared responsibility model and [242:14] just show you some variance. Uh there's [242:16] also variance not just per uh CSP, but [242:19] also the type of cloud deployment model. [242:21] And sometimes these are also scoped uh [242:23] based on a cloud service category like [242:24] compute or machine learning. Uh and [242:26] these can uh result in specialized [242:28] shared responsibility models. So that's [242:30] what we'll look at in this section. [242:31] Okay. [242:36] All right. So let's take a look at the [242:37] ad shared responsibility model. And so [242:40] I've reworked the graphic because it is [242:42] a bit hard to uh digest. And so I'm [242:44] hoping that this way will be a little [242:46] bit easier for you. I cannot include the [242:48] in and of here just because we're [242:49] limited for space. But don't worry, [242:50] we'll follow that up with the next slide [242:52] here. So there are two people that are [242:54] responsible or two um organizations that [242:56] are responsible, the customer and AWS. [242:58] And on AS's side, they're going to be [243:00] responsible for uh anything that is [243:02] physical. So we're talking about [243:04] hardware, global infrastructure. So the [243:06] regions, the availability zones, the [243:08] edge locations, the physical security. [243:10] So think of all that hardware that's [243:12] there, those data centers, um everything [243:14] like that. Then there's also software, [243:17] the services that they're offering. And [243:18] so um you know this extends to all their [243:21] services but generally it breaks down to [243:22] the four core. And so we're talking [243:24] about compute, storage, database and [243:26] networking. Okay. And when we say [243:28] networking we're talking about like [243:29] physically setting up the wires and also [243:32] you know the software to set up the [243:33] routing and all that kind of stuff [243:34] there. Uh now looking at the customer [243:36] side of it they're responsible for [243:38] configuration of managed services or [243:40] thirdparty software. So the platforms [243:43] they use. So whether they choose to use [243:45] a particular type of OS uh the [243:47] applications so if they want to use like [243:49] Ruby on Rails uh AM so identity and [243:52] access management so if you uh create a [243:55] user and you grant them permissions if [243:57] you give them things they're not [243:58] supposed to have access to that's on you [243:59] right then there's configuration of [244:01] virtual infrastructure and systems so [244:03] that would be choosing your OS that [244:05] would be uh the networking so there [244:07] could be networking on the um uh the [244:10] virtual machines themselves or we could [244:12] be talking about cloud networking in [244:14] this case. Then there are firewalls. So [244:16] we're talking about virtual firewalls. [244:17] Again, they could be on the virtual [244:18] machine or it could be configuring like [244:20] knackles or security groups on AWS. Then [244:23] there's security configuration of data. [244:25] Uh and so there is client side data [244:27] encryption. So if you're moving [244:28] something from S3 from your local [244:30] machine to S3, you might need to encrypt [244:32] that first before you send it over. Then [244:34] there's server side encryption. So that [244:36] might be turning on serverside [244:38] encryption within S3 or turning it [244:40] encryption on your EBS volume. Then [244:42] there's networking traffic protection. [244:44] So you know that's turning on VPC flow [244:47] log so you can monitor them. Turning on [244:49] uh adabus guard duties so that it can [244:51] detect anomalies with your traffic or or [244:53] activities within your um adabus [244:56] account. And then there's customer data. [244:58] So that's the data that you uh upload on [245:00] the behalf of your customers or yourself [245:02] and what you decide to um you know like [245:05] what levels of sensitivity that you want [245:07] to lock it down. Do you want to use [245:09] Amazon Macy to see if any there's any [245:11] public facing uh personal identifiable [245:13] information? That's up to you. So [245:15] there's a lot here and honestly it's a [245:18] lot easier than you think. Um instead of [245:20] thinking about this big diagram, what I [245:22] do is I break it down into this. And so [245:24] we have the in and the of and that's [245:25] what I said I could not fit on the um [245:28] previous slide there. The idea is [245:29] customers are responsible for the [245:31] security in the cloud. So that's your [245:34] data and configuration. So if it's data [245:36] that's residing on there or just [245:37] something you can configure, you are [245:39] responsible for it. On the ads side, [245:41] they are responsible for the security of [245:44] the cloud. So if it's anything physical [245:46] or hardware, the operation of managed [245:47] services or global infrastructure, [245:49] that's going to be on them. And this in [245:52] and of thing is very important for the [245:53] exam. So you should absolutely know the [245:55] difference between the two. This is kind [245:57] of an adabus concept. I don't see any [245:58] other cloud service provider talking [246:00] about in and of. Uh so you definitely [246:02] need to know it. Okay. [246:08] So one variant we might see for the uh [246:11] shared responsibility model would be on [246:13] the types of cloud computing. This could [246:15] also be applicable to the types of uh [246:17] deployment models but we're doing types [246:19] of cloud computing here. And so we have [246:21] the customer's responsibility and then [246:23] the cloud service provers [246:24] responsibility. So we're seeing on [246:26] premise infrastructure as a service, [246:28] platform as a service and software as a [246:31] service. And so when you are on prem, [246:34] you're basically responsible for [246:36] everything. Apps, data, runtime, [246:38] middleware, OS, virtualization, servers, [246:41] storage, networking, basically [246:43] everything. And just by adopting the [246:45] cloud, you're almost cutting your [246:47] responsibilities in half here. So now [246:49] the cloud service provider is going to [246:51] be responsible for the physical [246:53] networking uh the physical storage those [246:56] physical servers and because they're [246:58] offering virtual machines to you they're [247:00] setting up a hypervisor uh on your [247:02] behalf. So virtualization is taken care [247:04] of for you. And so um you know if you [247:07] launch an EC2 instance you know you're [247:09] going to have to choose the OS that's [247:10] why you're responsible whatever [247:12] middleware there the runtime so whatever [247:14] kind of programs you install on it uh [247:16] the data that resides on it and any kind [247:18] of like major applications. Okay then we [247:21] have platform as a service uh and so you [247:24] know the cloud service provider is going [247:26] to take even more responsibility there. [247:27] So when we're talking about this we're [247:29] thinking like ads elastic beantock [247:30] right? So you know the o you just choose [247:33] what you want and it's all managed. So [247:35] you might say I want a Ruby on real [247:36] server but you're not saying what OS you [247:39] need. Um you're not uh saying exact you [247:42] might say what version of Ruby you want [247:43] but you don't have to manage it if it [247:45] breaks uh or it might be managed updates [247:47] and things like that. The last thing [247:49] here is like software as a service and [247:52] this is something where the CSP is [247:54] responsible for everything. So if you're [247:55] thinking of a of a software as a [247:56] service, think of like Microsoft Word [247:59] where uh you're just writing uh you know [248:02] writing stuff in there and you know you [248:05] are responsible for where you might [248:07] choose to store your data but the data [248:09] is like still handled by the cloud [248:11] service provider because you know it's [248:12] on the cloud so on their servers right [248:15] um so yeah hopefully that gives you kind [248:17] of an idea across types of cloud uh [248:19] computing responsibilities. [248:26] All right. So, what I want to do here is [248:28] just shift the lens a bit and look at [248:30] the share responsibility model if we [248:31] were just uh observing a subset of cloud [248:35] services such as compute. And so, we're [248:37] going to see infrastructure as a [248:39] service, platform as a service, software [248:41] as a service, and now we have function [248:42] as a service. And so, that's what I mean [248:44] when we shift the lens, we get new [248:46] information. Uh and so you can just see [248:48] that you really don't want to look at [248:49] this uh from one perspective. Okay. So [248:52] starting at the top here we have bare [248:53] metal. Uh and so Adabus is offering is [248:55] called the EC2 bare metal instance. And [248:58] this is where you basically get the [249:00] whole machine uh you can configure the [249:02] entire machine with with the exception [249:04] of the physical machine itself. So as [249:06] the customer you can install the host OS [249:08] um uh the host OS. So the operating [249:11] system that runs on the physical machine [249:13] and then you can install your own [249:15] hypervisor. Um and then as is going to [249:17] be responsible for the rest the physical [249:19] machine. Now normally the next step up [249:21] would be dedicated but dedicated doesn't [249:24] exactly give you more responsibility. It [249:26] gives you more assurance because it's a [249:28] single tenant uh virtual machine and [249:30] that's why I kind of left it out here [249:32] but we'll see it in the next slide that [249:33] it is kind of on the model and shares [249:35] the same spot as uh EC2. Um but EC2 is a [249:39] virtual machine and so um here the [249:42] customer is responsible for the guest [249:44] OS. So that means that you can choose [249:46] what OS you want whether it is Ubuntu or [249:49] Debian or Windows but that's not the [249:52] actual OS that is running on the [249:54] physical machine and so you're not going [249:56] to have control of that. AWS is going to [249:57] take care of that. Then there's the [249:59] container runtime. So you know you you [250:02] can install Docker on this or any kind [250:04] of container layer that you want. Um, so [250:06] that's another thing that you can do. So [250:08] ads is going to be responsible for the [250:10] hypervisor, uh, the physical machine and [250:12] the host OS. All right. Then looking at [250:15] containers, ads has more than one [250:17] offering for containers, but we'll just [250:18] look at ECS here. And so um, this is [250:22] where you are going to uh have uh you [250:25] don't you don't install the guest OS, [250:27] right? The guest OS is already there for [250:29] you. What you are going to do is choose [250:31] your configuration of containers. You're [250:34] going to uh deploy your containers. [250:36] You're going to determine where you need [250:38] to access storage for your containers or [250:40] attach storage to your containers. And [250:42] Adabus is going to be responsible for [250:44] the guest OS. It the and there might not [250:48] even be a guest OS, but there the host [250:50] OS, the guest OS, the hypervisor, the [250:53] container runtime. Uh and you're just [250:55] responsible for your containers. Okay. [250:57] Then going to the next level here, we [250:59] have platform as a service. And so this [251:02] one also is a little bit odd where it [251:04] fits. Um because the thing is is that [251:06] this could be using anything underneath. [251:08] It could be using containers. It could [251:10] be using virtual machines. Um and so [251:12] that's where it doesn't exactly fit well [251:14] on a linear graph. But let's just take a [251:16] look at some things here. So this is [251:18] where you're just uploading your code. [251:20] Uh you have some configuration of the [251:22] environment. You have options of [251:23] deployment strategies. Um the [251:25] configuration of the associated [251:27] services. And then adabus is going to be [251:28] responsible for the servers, the OS, the [251:31] networking, the storage, the security. [251:33] So it is taking on more responsibility [251:35] than infrastructure as a service. Um [251:37] whereas you know adabus is just going to [251:40] be responsible for that. So if it's a [251:41] virtual machine that's been under uh [251:43] under the use is going to be responsible [251:45] for this customer stuff. Okay, you're [251:47] not. If it's containers, then ads is [251:49] going to be responsible for this. But it [251:50] just depends on how that platform as a [251:52] service is set up. Actually, the way [251:53] Elastic Beantock is set up is that you [251:55] actually have access to all that [251:57] infrastructure and you can fiddle with [251:58] it. And so, in that case, um whereas [252:00] like if you were to use Heroku, which is [252:02] a a third party provider, um you know, [252:05] they would take care of all this stuff [252:06] up here. Um and so you would not have to [252:08] worry about it. But on AWS, you actually [252:10] are responsible for uh the underlying [252:13] infrastructure because you can you can [252:15] configure it, you can touch it. So [252:16] that's where you know again these do not [252:18] fit perfectly and you can't look at [252:20] platform as a service meaning that um [252:22] you're not responsible for certain [252:24] things. It really comes down to the [252:25] service offering. Okay. Then we're [252:27] taking a look at software as a service. [252:28] So on AWS um this is going to be [252:31] something like um Amazon workdocs which [252:33] is I believe a competitor not a very [252:36] popular competitor but a competitor to [252:38] Microsoft SharePoint and this is for [252:40] content collaboration. So as the [252:42] customer, you're responsible for the [252:43] contents of the document, management of [252:45] the files, configuration of sharing, [252:47] access controls, and the database is [252:49] responsible for the servers, the OS, [252:50] networking, the the storage, the [252:52] security, and everything else. So you [252:54] know, if you use a Microsoft Word doc [252:55] and you type stuff in it, you say where [252:57] to save it. That's what you're [252:58] responsible for. Okay. Then the last one [253:00] here on the list is our uh functions [253:02] here. And so ads is offer is [253:04] lambda. And so as a customer, all you're [253:06] doing is you're uploading your code and [253:08] adabus is going to take care of the [253:09] rest. So deployment, container runtime, [253:11] networking, storage, security, physical [253:13] machine, basically everything. Um, and [253:16] so you're really just left to uh [253:18] develop. Okay, so you know, hopefully [253:20] that gives you kind of an idea. And [253:22] again, you know, we could have thrown in [253:23] a few other services like what we could [253:25] not fit on this slide here was um uh it [253:29] was Fargate, which is a serverless [253:32] container as a function or sorry [253:34] serverless uh serverless container as a [253:36] service or container as a service. So uh [253:38] you know that has its own unique [253:40] properties in the model as well. Okay. [253:42] So let's just have kind of a [253:43] visualization on a linear graph here. So [253:45] we have the customer's responsibility on [253:47] the lefth hand side and adabus' [253:48] responsibility on the right. And we'll [253:49] look at our broad categories. So we got [253:51] bare metal dedicated virtual machines, [253:53] containers and functions. And so no [253:57] matter uh which uh type of compute [254:00] you're using, you're always responsible [254:01] for your code for um containers. you [254:05] know if uh you know like uh the [254:07] functions when you're using functions [254:09] there are pre-built containers so you'd [254:11] say I want to use Ruby and there's a [254:14] Ruby container and you don't have to [254:15] configure it but obviously um you know [254:17] when you are using container service you [254:19] are configuring that container you are [254:20] responsible for it for um virtual [254:23] machines you know you're responsible for [254:25] the runtime so you can install a [254:27] container runtime on there or install a [254:29] bunch of different packages like Ruby [254:30] and stuff like that uh the operating [254:32] system you have control over in the [254:34] virtual machines for the dedicated and [254:36] we saw with bare metal you have both uh [254:38] controls of the host OS and the guest OS [254:41] and then only bare metal allows you to [254:43] have control of the virtualization where [254:45] you can install that hypervisor. So [254:47] hopefully that gives you an idea of [254:49] compute and as offering there and also [254:51] kind of how there's a lot of little [254:52] caveats when we're looking at the share [254:54] responsibility model. Okay. [255:00] All right. Right. So I have one more [255:02] variant of the share responsibility [255:03] model and this one is actually what is [255:05] used by Google. So um we're going to [255:07] apply to AWS and uh see how it works. So [255:10] let's just kind of redefine share [255:11] responsibility model or just in a [255:12] slightly different way so we fully [255:14] understand it. So the share [255:15] responsibility model is a simple [255:17] visualization that helps determine what [255:19] the customer is responsible for and what [255:21] the CSP is responsible for related to [255:23] AWS. And so across the top we have [255:25] infrastructure as a service, platform as [255:27] a service, software as a service, but [255:29] remember there's other ones out there [255:30] like function as a service. It's just [255:32] not going to fit on here. Um, okay. So, [255:35] and then uh along the side here we have [255:37] content access policies, usage, [255:40] deployment, web application security, [255:42] identity, operations, access and [255:45] authentication, network security. [255:47] Remember that's cloud networking [255:48] security, the guest OS, data and [255:50] content, audit logging. Now we have the [255:53] actual traditional networking or [255:54] physical networking storage and [255:56] encryption and here we're probably [255:58] talking about the physical storage [256:00] harden kernel IPC uh the boot the [256:04] hardware and so then here we have our [256:06] bars so we have the CSP's responsibility [256:08] and the customer's responsibility so [256:10] when we're looking at a SAS software as [256:12] a service uh the customer is going to be [256:14] responsible for the content remember [256:16] like think of like a word processor [256:17] you're writing the content the access [256:18] policies like say I want to share this [256:20] document with someone the usage like how [256:22] you utilize it. Can you upgrade your [256:24] plan? Things like that. Then next on our [256:27] list here is platform as a service. So [256:29] generally uh you know platform as a [256:31] service is for developers to de develop [256:33] and deploy applications and so they will [256:36] generally have more than one deploy [256:37] strategy and uh you know there might be [256:40] some cost-saving measures to choose like [256:42] uh you might have to pay additional for [256:44] security uh or you it's up to you to [256:46] configure in a particular way or you [256:48] might have to integrate it with other [256:49] services uh and you know we saw that [256:52] pass is not a perfect uh definition or [256:54] fit because you know when we look at [256:56] elastic beantock if you have access to [256:58] those resources and you can change them [257:00] underneath then you might have more [257:02] responsibility there than you think that [257:04] you would. Okay. The next one here is [257:07] infrastructure as a service and so this [257:09] is extending to identity. So who's [257:11] allowed to uh you know log into your [257:14] adabus account uh operations the things [257:17] that they're allowed to do in the [257:18] account access and authentication do [257:20] they have to use MFA uh things like that [257:22] network security obviously you can [257:24] configure the security of your uh cloud [257:27] infrastructure or cloud network um you [257:29] know so you know do you isolate [257:31] everything as single VPC how do you set [257:33] up your security groups things like that [257:35] uh we know with virtual machines you can [257:36] set up the guest OS there's data and [257:38] content but remember that bare metal is [257:41] part of the uh infrastructure as a [257:42] service offering and and so that's where [257:44] we'd see hardware or not hardware but [257:46] you'd have the host o the host OS or [257:49] virtualization and so this again is not [257:51] a perfect representation uh but it [257:53] generally works okay and then last on [257:55] the list there or just looking at what [257:58] the AWS is responsible for audit logging [258:01] so of course ads has cloud trail which [258:03] is for uh uh logging uh API um events [258:08] but auto logging could the things that [258:09] are uh internally happening with those [258:11] physical servers then the networking the [258:14] physical storage uh hardering the kernel [258:16] ads has I think what's called the nitro [258:17] system where they have like a security [258:19] chip that's uh installed on all their [258:22] servers then it's the the boot OS uh and [258:25] then the hardware itself okay so just [258:28] remember the customer is responsible for [258:29] the data and configuration of access [258:32] controls that reside in AWS so if you [258:34] can configure it or you can put data on [258:36] it you're responsible for it Okay, the [258:39] customer is responsible for the [258:40] configuration of cloud services and [258:42] granting access to users via [258:44] permissions, right? So if you give uh [258:46] one of your employees access to do it. [258:49] Um you know even if it's their fault, [258:51] it's your fault. So remember that. Um [258:53] and again the CSP is generally [258:55] responsible for the underlying [258:56] infrastructure. We say generally because [258:58] you know there's edge cases like bare [259:00] metal and coming back to AWS's in the [259:03] cloud and of the cloud. [259:04] in the cloud. So if you configure it or [259:06] store it then you the customer are [259:08] responsible for it and of the cloud. If [259:10] you cannot configure it then the CSP is [259:13] probably responsible for it. Okay. [259:20] Hey this is Andrew Brown from Exam Pro [259:22] and we are looking at the share [259:23] responsibility model from the [259:24] perspective of architecture. And if [259:27] you're getting sick of shared [259:27] responsibility model don't worry I think [259:29] this will be the last slide in this [259:31] section but let's take a look here. So [259:33] uh we have uh less responsibility more [259:36] responsibility at the bottom. So what we [259:38] have down here is traditional or virtual [259:40] machine architecture. So global [259:42] workforce is most familiar with this [259:44] kind of architecture and there's lots of [259:45] documentation frameworks and support. So [259:47] maybe this would be using elastic [259:48] beantock with platform as a service or [259:50] using EC2 instances alongside with [259:53] autoscaling groups uh code deploy uh [259:56] load balancers things like that. The [259:58] next level here is microservices or [260:00] containers. This is where you mix and [260:01] match languages, better utilization of [260:03] resources. So maybe you're using Fargate [260:05] which is serverless containers or [260:06] elastic container service or elastic [260:08] kubernetes service for containers. And [260:11] at the top here we have serverless or [260:13] commonly with functions as a service. So [260:15] there are no more servers. You just [260:17] worry about the data or uh and the code, [260:19] right? So literally just functions of [260:21] code. And so you could be using the [260:23] amplify serverless framework or maybe a [260:25] lambda for creating serverless [260:27] architecture. So there you go. [260:32] Hey, this is Andy Brown from Exam Pro [260:34] and we are looking at computing [260:36] services. And before we jump into uh the [260:38] entire suite of computing services ads [260:41] have, let's just talk about EC2 for a [260:43] moment which allows you to launch [260:44] virtual machines. So what is a virtual [260:47] machine? Well, a virtual machine or VM [260:49] is an emulation of a physical computer [260:51] using software. Server virtualization [260:53] allows you to easily create, copy, [260:55] resize, or migrate your server. multiple [260:57] VMs can run on the same physical server. [261:00] So you can share the cost with other [261:01] customers. So imagine if your server or [261:03] computer was an executable file on your [261:05] computer. Okay, so that's the kind of [261:07] way you want to think about it. When we [261:09] launch a VM, we call it an instance. And [261:12] so EC2 is highly configurable server [261:14] where you can choose the AMI. the Amazon [261:16] machine image that affects options such [261:18] as amount of CPUs or vCPUs, virtual [261:21] CPUs, the amount of memory, so RAM, the [261:24] amount of network bandwidth, the [261:26] operating system, so whether it's [261:28] Windows, Zubuntu, Amazon 2, uh the [261:31] ability to attach multiple virtual hard [261:33] drives for storage, so elastic block [261:35] store. Um, and so the Amazon machine [261:38] image is a predefined configuration for [261:40] a VM. So just remember that. And so EC2 [261:43] is also considered the backbone of [261:45] adabus because the majority of adabus [261:47] services are using EC2 as the underlying [261:49] servers whether it's s3rds dynamob or [261:52] lambdas that is what it's using. So um [261:55] when I say also it's just because when [261:57] we talk about the network that is the [261:58] backbone for uh global infrastructure uh [262:01] and the networking at large and so EC2 [262:04] is for the services. Okay. [262:12] Hey, this is Andrew Brown from Exam Pro. [262:14] So, we just looked at what EC2 is, but [262:16] let's look at more of the broader [262:17] services for computing. And these are [262:19] the more uh common ones that you'll come [262:21] across. There's definitely more than [262:22] just what we're going to see on this [262:24] single slide here. So, we'll break this [262:25] down with virtual machines, containers, [262:27] and then serverless. For virtual [262:28] machines, remember that's an emulation [262:30] of a physical computer using software. [262:32] And EC2 is the main one. uh but for our [262:35] VM category we have Amazon light sale [262:38] this is a managed virtual server service [262:40] it is the friendly version of EC2 [262:42] virtual machine so when you need to [262:43] launch a Linux or Windows server but you [262:46] don't have much knowledge you could [262:47] launch a WordPress here and uh you could [262:50] hook up your domain and stuff like that [262:52] um so this is a very good option for [262:54] beginners we have containers so [262:56] virtualizing an operating system or OS [262:58] to run multiple workloads on a single OS [263:01] instance so containers are generally [263:02] used in micros service architecture [263:04] when you divide your application into [263:06] smaller applications that talk to each [263:08] other. So here we would have ECS elastic [263:11] container service. This is a container [263:13] orchestration service that supports [263:14] Docker containers. Launches a cluster of [263:17] servers on EC2 instances with Docker [263:19] installed. So when you need Docker as a [263:20] service or you need to run containers, [263:23] we have elastic container registry ECR. [263:26] This is a repository of container [263:28] images. So in order to launch a [263:29] container, you need an image. An image [263:32] just means a save copy. A repository [263:34] just means a storage that has version [263:37] control. We have ECS Fargate or just [263:40] Fargate. Now people are kind of [263:42] forgetting that it's it runs on ECS [263:44] these days. That's why I have it in [263:45] there. It is a serverless orchestration [263:48] container service. It is the same as ECS [263:51] ex except you pay on demand per running [263:54] container. So with ECS you have to keep [263:56] a EC2 server running even if you have no [263:59] containers running. So it manages the [264:01] underlying server. So you don't have to [264:03] scale or upgrade the EC2 server. So [264:05] there's the advantage over ECS. Okay. [264:08] Then we have elastic kubernetes service [264:10] EKS. This is a fully managed Kubernetes [264:12] service. Kubernet or so Kubernetes [264:15] commonly abbreviated to K8 is an [264:17] open-source orchestration software that [264:19] was created by Google is generally the [264:21] standard for managing microservices. So [264:23] when you need to run Kubernetes as a [264:25] service. Then we have serverless [264:27] category. So when the underlying servers [264:29] are managed by adus, you don't worry or [264:32] configure servers. Sabus lambda is a [264:34] serverless function service you can run [264:36] code without provisioning or managing [264:37] servers. You upload small pieces of [264:39] code, choose much uh how much memory, [264:42] how how long you want the function to [264:43] run is allowed to run before timing out [264:45] and you are charged based on the runtime [264:47] of the serverless function rounded to [264:48] the nearest 100 milliseconds. So there [264:50] you go. [264:55] Hey, this is Andrew Brown. In this [264:57] video, I want to show you some of the [264:58] different compute options within AWS. [265:00] So, I think it'd be great to launch a [265:02] virtual machine, uh, launch some kind of [265:04] container compute and a llama function. [265:07] You can just watch here as I'm just [265:09] really trying to show you something. Uh, [265:10] or you can follow along. It's up to you. [265:12] I try to utilize the free tier as best I [265:14] can, but, you know, make sure that you [265:16] do have a little bit of spend just in [265:18] case. Uh, but we're going to go ahead [265:19] and launch an EC2 instance. I've made my [265:21] way over to EC2. I just typed it up here [265:23] on the top. And from here, we will go in [265:26] and launch a new instance. And I'm going [265:28] to go ahead and just launch a we'll say [265:31] my web server. And we're going to choose [265:33] Amazon Linux. Um, and we're going to [265:36] stay with the free tier, which is going [265:38] to be a T3 micro. I do not want to use a [265:40] key pair. I do not care. I'm not going [265:42] to do anything with this, so it's not [265:43] that big of a deal. And we'll go ahead [265:45] and launch this instance. And so, that's [265:47] going to go ahead and launch that [265:48] instance. If we go over to here, the [265:50] instance is now launched. So, we have a [265:52] virtual machine. and we would be able to [265:54] connect to it, but I didn't make a way [265:56] for us to log into it. So, you know, but [265:59] it is launched, so we could do something [266:01] with this if we wanted to. Um, I suppose [266:03] we should. So, if we wanted to get into [266:06] this machine, like if we go here and we [266:07] try to connect, I mean, this might work. [266:09] Let's see. Does this work? [266:12] Because I didn't give it permissions. [266:14] Oh, yeah, we're in. Okay, never mind. [266:16] The reason why I was a bit confused here [266:17] is that Adabus keeps adding all these [266:19] other methods and usually sessions [266:20] manager is the way that we get in and [266:22] you need permissions to do so. But we [266:24] just use the EC2 instance to connect to [266:26] get in here. And so now I'm within a [266:28] server, right? So lwd I can say who is [266:32] me. So who is or usually it's who is or [266:36] who am I? Sorry, who am I? So I'm the [266:38] ECT user which is the default user. Um [266:40] and so if I wanted to let's say serve a [266:43] web server from here, I could do that. [266:44] So it's a um Amazon Linux uh to install [266:49] Apache HTTPD. That's usually the [266:52] standard one here. Um so we have uh [266:56] yeah, something like that. Pseudo yum [266:58] install like that. We might have to do [267:00] an update first. I'm going to go ahead [267:01] and grab that and give that a try. [267:05] All right. Again, if this is too much, [267:06] just watch as we're just kind of getting [267:09] a little bit of experience here. But all [267:11] I'm doing is setting up a very very [267:12] simple uh web server. So go ahead and [267:15] grab this [267:17] and we'll wait for that update to [267:19] complete and we'll go ahead and paste [267:20] that in. Um I don't usually often use [267:23] the Amazon Linux distribution anymore. I [267:25] usually just use Abuntu. Um but I used [267:27] to really like the Amazon one, but they [267:28] fiddled with it too much and it [267:29] frustrates me. So now we should have an [267:32] HTTP server running here. So, if I was [267:34] to say curl localhost, maybe 80 curl [267:39] localhost, I should be able to get [267:41] something. If that doesn't work, I might [267:43] have to start it up. So, pseudo system [267:46] ctl uh http [267:49] Oh, I don't remember what it is. So, I'm [267:51] going to go ahead and just ask it. Uh [267:54] folks, we got chatbt these days, so [267:56] leverage what you got. Okay, I'm just [267:58] going to go over here to chatbt [268:01] and we'll just say, "Hey, I just started [268:02] up [268:04] I just started I just installed [268:07] this on Amazon Linux 2. How do I check [268:10] if it is running? Usually it's pseudo [268:13] systemctl something. It's just they have [268:15] two different names. So it depends on [268:17] which one it is. It's httpd. Okay. Uh [268:20] and did I get close to that or no? I was [268:23] pretty close. I just I just kind of gave [268:25] up. So I just had to put status there. [268:27] And so you can see it's not running. So [268:28] I go here and say um start httpd. And [268:33] then we can go ahead here and give it a [268:34] status. [268:36] And I don't mean to make the text small, [268:37] but it's kind of hard to bump that up. [268:39] And so now it's currently running. So if [268:41] I was to curl local host [268:45] like this, um, I'm getting back a [268:47] website. And if I wanted to kind of [268:49] expose this to the internet, so I could [268:50] actually see that uh, we do have a [268:52] public IP address that's assigned to us. [268:54] I need to open up our ports. So I'm [268:56] going to go my networking tab, uh, or [268:58] security tab, I suppose. And here we [269:00] have a sec security group. I'm going to [269:02] click into this one. Um, I'm going to go [269:05] ahead and edit the inbound rules. Add a [269:06] rule here. And we will open up uh HTTP [269:09] port AD. This would be to the web. And I [269:12] could just say to my local computer, but [269:14] I'm going to say from anywhere. I don't [269:15] plan to keep this around for very long, [269:17] so it's not a big deal. Um, and if we go [269:19] back over to our instance and we go to [269:23] networking or even the details here, [269:25] we'll grab the public IP address, go to [269:26] a new tab, and we should see a website [269:28] because it's serving on port 80, right? [269:30] And so there it is. It works. So we have [269:33] successfully deployed a simple um web [269:36] server. Let's go see if we can do [269:38] something similar with uh ECS or [269:40] Fargate. So there's a thing called [269:42] Elastic Container Service. Uh but [269:44] there's also Fargate. Fargate is serless [269:46] containers where um where you don't have [269:50] to manage the the layers underneath. Um [269:53] or we can do it the other way here. But [269:54] it seems like they've actually separated [269:55] them out as separate services. They're [269:57] always changing things on me here. here. [269:59] If I go over to Fargate, oh, where is [270:01] it? It should be under here. So, maybe [270:03] when we launch it, we will see. [270:06] The confusion I'm getting is because I [270:08] often use the uh Adabus CLI and the SDK [270:11] and everything else to work with it. And [270:13] I try to stay out of the console, but [270:14] for this beginner course, we wanted to [270:16] try to do that as much as we can. So, [270:17] here I'm going to create a cluster. Oh, [270:19] here it is. Fargate only. So, they used [270:20] to have it separated and you type it in [270:22] here and now it's just all again [270:23] seamlessly in here. And so we have a [270:25] cluster name and we have Fargate only, [270:28] Fargate managed instances or Fargate and [270:30] self-managed instances. So I'm going to [270:32] go with Fargate only as that's going to [270:34] be probably the easiest thing for us to [270:35] do. And we'll go ahead and create that [270:37] and we'll and we'll create that cluster. [270:39] Now we haven't launched anything. So [270:41] with Fargate, it is serverless in the [270:45] sense that whatever you use is is [270:46] whatever um you consume. Uh whatever you [270:50] can like whatever is running is what is [270:51] what you're going to pay for. uh but um [270:54] there's nothing running within the [270:56] cluster right now. Now if you used um a [270:57] manage cluster then you'd be paying for [271:00] whatever virtual machine is powering it [271:02] the entire time which is uh different [271:04] but we'll go into here and so I want to [271:06] go ahead and launch a new service. Oh [271:09] they have a express mode now they just [271:11] keep changing things on me here but here [271:13] the idea is that we would normally need [271:15] a task definition but I guess with this [271:17] express mode they're kind of skipping [271:18] that for us here. Let's go see if we can [271:20] browse any ECR images. And we don't have [271:23] any ECR images within our our repository [271:26] here. But we might be able to provide a [271:27] public URL. So I'm gonna go over to [271:29] DockerHub. And this is where we can get [271:32] all sorts of containers. A good one [271:34] would uh for beginners is hello world. [271:36] As you can imagine, it's a very basic [271:39] one. And so all Hello World does, I'm [271:42] just making sure this is from Docker. [271:43] Yeah, it's official Docker image. All it [271:45] does is print out Hello World. And so [271:47] all I want is the actual URL path here. [271:52] And I guess the name's kind of strange [271:54] because it has this underscore. I'm not [271:55] used to seeing that underscore there. [271:56] They must have changed that as well. [271:58] They're always changing things on us. [271:59] But the idea is that we can provide the [272:02] URL path here. And normally it's like [272:04] latest like this. So we'll see if that [272:06] works. Um but we might just take out the [272:10] protocol like that. We'll see if that [272:12] will create [272:16] and we'll see what happens. [272:19] But before before this express thing, [272:21] I'd have to create a task definition. [272:22] It's a lot of work. So if this just [272:24] works, that'd be really really nice. [272:26] I It looks like it's working. Yep. So [272:28] we're going to wait for that deployment. [272:29] Now this um thing, it should just launch [272:33] and probably shut down right away as [272:35] there are different kinds of things that [272:36] we can launch. Um so if we go over to [272:38] here into our cluster notice that we [272:41] have a service Damian or task. So task [272:43] means that it runs and that it stops. A [272:45] service is intended to run uh long term [272:48] like an actual web server uh or like an [272:50] application. [272:52] Uh but here it's really just a task even [272:55] though we deployed it as a service. So [272:57] my expectation is going to run and then [272:58] it's going to stop, right? And so I'm [273:01] just trying to observe uh where that [273:03] might be occurring. [273:05] And so I'm seeing if we're getting any [273:07] logs. We'll take a look at our [273:08] deployment. No deployment information. [273:11] So nothing as of yet. [273:14] We'll go back over to here. [273:17] And it's still in progress. Okay. So [273:19] we're just chilling out here waiting for [273:20] this to do something. So I'm going to [273:22] pause and see what happens. Okay. Oh, by [273:25] the way, uh to get it deployed, what [273:27] it's trying to do if we go to view here, [273:29] it's probably trying to look for a [273:30] healthy health check here when it when [273:32] it runs. Uh but we'll see what happens. [273:35] And we can always just keep clicking [273:36] through and seeing if anything's [273:39] happening here. So nothing as of yet. [273:42] Okay, but this might not work. Oh, it is [273:44] active. Wait, hold on here. But still [273:47] nothing here. Okay, we'll just chill. So [273:49] I think the problem with this tab or [273:51] this service that I launched is that [273:52] it's supposed it's supposed to expect to [273:54] see something. And so I think it's just [273:56] never going to execute. So, what I'm [273:58] going to do is just stop this here as [274:00] this is probably just a mistake uh uh [274:02] for me actually doing this. So, I'll go [274:05] into it and we'll just delete the [274:07] service because it doesn't take that [274:09] long. It it should have already uh been [274:11] working here. And so, I'm going to go [274:13] back over into our cluster and we're [274:15] going to ignore this express mode. I'm [274:17] going to go ahead and just um [274:20] I guess we could go ahead and run a [274:21] task. [274:23] But again, then we need a task [274:24] definition. So we'll go ahead and I [274:25] guess we're just going to go the old way [274:27] and create a new task definition. [274:29] And here we're saying that it's AWS [274:31] Fargate. We'll just say hello world [274:32] task. [274:34] And then down below we have a bunch of [274:37] additional information like how much [274:38] memory and stuff. We need the least [274:40] amount of everything. So I'm going to go [274:41] ahead and reduce it as low as I can [274:44] here. Um we have an execution task [274:46] already here. And then this is the thing [274:48] that we actually want to run. So I'm [274:50] going to go ahead and grab [274:53] uh this address here. So, I'm going to [274:54] grab um this. So, I believe it should be [274:58] that. [275:02] Okay. And [275:04] um this will just be hello world. [275:08] And we can open port 80. It doesn't [275:10] really matter for this. [275:14] And then we go down below. [275:16] Everything else looks fine. This should [275:18] be just enough for us to get this to [275:19] work. So, we'll go ahead and create [275:20] that. And so now we are deploying that [275:23] task. Well, we just created our task [275:25] definition. So now we got to go into our [275:27] cluster. And then we'll drop this down [275:29] and run a task. And now we can choose [275:31] the hello world task. [275:34] Uh I don't know if we have to name that [275:36] there. And then we have our capacity [275:38] provider strategy. So we want to launch [275:40] with Fargate with one which is totally [275:42] fine. We'll go ahead and create that. [275:45] But you know working with containers can [275:47] get really really complex. Um and so you [275:50] know I like either virtual machines or [275:53] functions and when I can avoid [275:54] containers um I generally do or if I do [275:58] use containers I like to utilize them [275:59] with virtual machines directly as I [276:01] don't find this management layer to be [276:03] useful but if you're a large [276:04] organization you uh might like that. So [276:06] it looks like that it might have [276:08] executed here and finished. It's already [276:10] deprovisioning it. [276:13] And so I think that that worked. But [276:16] here it says failed to create the uh [276:18] container model, failed to normalize the [276:20] image reference here. So it's saying [276:21] that the um uh the name of it might be [276:24] wrong. So I'm going to go ahead here and [276:28] uh go and create a new revision. [276:32] And so I think it didn't like the name [276:34] here. And so I thought that's what it [276:36] was. So, we'll just go ask GBT um you [276:39] know what is the the repo image URL for [276:44] this for um ECS task definition because [276:47] I thought that's what it is. Sometimes [276:49] it will actually default over to Docker [276:50] Hub, but I'm not I'm just not confident. [276:52] This is something I always forget, so [276:53] it's not that big of a deal. [276:59] Oh, Docker.io. Okay, if you want to [277:01] explicitly do that or but here it says [277:03] the URL is just hello world. Sure. [277:14] If you want to be explicit. The only [277:16] thing that's confusing me is that see [277:17] how there's an underscore here and that [277:18] doesn't match. So I mean again we can go [277:22] ahead. We'll try hello world. [277:26] But this is something that um I don't [277:29] like about databases is that they never [277:31] make those UIs as easy as they can be. [277:34] Uh, and we'll go ahead and we'll try to [277:35] run this task again. And we will drop [277:38] this down here. We'll make sure we're [277:39] using number two. And we'll go ahead and [277:41] create this. [277:43] And so maybe we'll default over to [277:45] DockerHub this time. [277:48] So we will just wait a moment here and [277:50] see what happens. And I'm just going to [277:52] say like it's not airing out. The other [277:53] one aired out very quickly. So I do [277:55] believe that it is working. It does try [277:58] to check for those health statuses, but [277:59] again, this is a task that's going to [278:01] fire and then finish. So, I'm not [278:03] expecting it to do anything uh crazy [278:05] here. [278:07] And it stopped and exited. So, what I'm [278:09] trying to find here is its logs to see [278:11] that it actually ran. [278:14] And so, we'll give this nice refresh [278:16] here. And it stopped. [278:19] Failed to create. Failed to normalize [278:20] the image Docker Hub. Oh, no. That's the [278:22] other one. The one that's actually [278:23] running here is number two. And it's [278:25] deprovisioning. [278:28] And it looks like it worked. There are [278:30] no issues here. Let's go and see if we [278:32] can check out the logs. And here we have [278:35] hello from Docker. So, we successfully [278:37] used um ECS. Now, for the last one, I [278:41] just want to show you functions. [278:44] And I'm not sure if we shut down our EC2 [278:46] instance. If we didn't, let's go ahead [278:47] and do that. And our container before we [278:49] proceed. Oh, we did. Okay. I'm going to [278:52] go back over to ECS. [278:55] Now, to have that cluster up with [278:56] Fargate only is not going to cost us [278:59] anything, but it doesn't hurt to clean [279:00] up. So, we'll go ahead and do that. [279:05] Oh, we have to write delete this. And [279:07] notice you'll uh for deleting, they [279:10] always kind of vary this, which is kind [279:11] of frustrating. [279:16] And while that's thinking, I'm going to [279:17] go over here and we'll go to llama. This [279:19] one's going to be a lot easier to [279:21] utilize. [279:23] And we're going to go ahead and create a [279:24] new function. This will be my Ruby [279:26] function. I really like Ruby, so I'm [279:27] going to go ahead and drop this down to [279:29] Ruby. [279:30] got 3.4 here. Um, and I believe it will [279:33] come with some basic code. So, we'll go [279:35] ahead and hit create function [279:38] and we'll give it a moment here to [279:40] create. I'm going to go back over to [279:41] here and see that this cluster has been [279:43] deleted. And so, we have our Ruby [279:45] function. Oh, you're always changing [279:47] stuff. We don't need more information. [279:48] And so, here we have a built-in Visual [279:50] Studio Code editor. So, we can uh [279:53] implement whatever we want. And so I'm [279:55] going to go over to chatbt and I'm just [279:56] going to say uh can you make some kind [279:59] of [280:02] fun code to show us um lama. [280:09] Okay. I hope it doesn't ask me any [280:12] questions, but we're just trying to drop [280:13] something in here for fun. [280:18] Sure. So yeah, anything you want. It [280:20] doesn't really matter. But the idea here [280:22] is that we just drop in code and it [280:24] should just work. So I'm going to go say [280:26] allow. [280:28] Now normally after this gets over a [280:29] certain file size. I can't remember what [280:31] it is if it's um one megabyte or [280:34] whatever, but normally you have to [280:35] upload a zip or provide an S3 location. [280:37] The most common way is an S3 location. [280:39] Um but uh when we just have a few files, [280:41] it's not that big of a deal. So what [280:44] we'll do now is just save this file and [280:46] I'll hit deploy. [280:49] And so that is now deploying that [280:51] function. They used to have cloud9 [280:53] integrated into here, but then they got [280:55] rid of that service and so now it's uh [280:56] Visual Studio Code, which is fine. [281:00] And uh so that function is now deployed. [281:02] If we want to go ahead and test it, we [281:04] should have a test option somewhere [281:07] here. [281:08] So it used to be [281:11] uh along the top here. Oh, it's over [281:13] here now. Okay, great. So let's go ahead [281:15] and just say my test. Now, the only [281:17] trick here is that we need to know what [281:18] payload we need to provide. So, I'm [281:21] going to go back over and say don't show [281:23] this again. Back over to here, and I [281:25] just want to take a look at what it [281:26] expects. So, it's expecting a name and a [281:28] mood. So, um name [281:33] and then whatever mood you want. So, we [281:35] can say happy. So, I'm go over and try [281:38] this. So we have mood [281:41] um [281:47] happy. Of course your code's going to be [281:49] a little bit different than mine. So [281:52] make it work for you. Right. [281:55] Name [281:56] Andrew. [282:00] And we'll just delete that out. [282:02] I'm going to save this test just in case [282:04] I want to use it again. And let's see if [282:05] it actually works. Sometimes it expects [282:07] some other things in the payload, but [282:09] that seemed to work totally fine. Um, in [282:12] order to see the results, we're going to [282:14] check the logs. And so here, [282:17] salutations, Andrew, you seem happy. So, [282:19] we got back our logging. And so, there [282:21] you go. We just uh ended up doing all [282:23] three types of compute. Um, which is [282:26] good coverage. [282:28] But there you go. Our lambda is cleaned [282:30] up. And I will see you the next one. [282:31] Chowo chia. [282:37] Hey, this is Andrew Brown from Exam Pro [282:39] and we're taking a look at higher [282:40] performance computing services on AWS. [282:42] So before we do, we got to talk about [282:43] the Nitro system. So this is a [282:45] combination of dedicated hardware and [282:47] lightweight hypervisor enabling faster [282:49] innovation and enhanced security. All [282:51] new EC2 instance types use the Nitro [282:53] system and the Nitro system is designed [282:55] uh by AWS. Okay, so this is made up of a [282:58] few things. We have Nitro cards. These [283:01] are specialized cards for VPCs, EBS, [283:04] instance storage and uh controller [283:06] cards. You have Nitro security chips. [283:08] These are integrated into the [283:09] motherboard. Protects hardware [283:10] resources. And we have the Nitro [283:12] hypervisor. This is the lightweight [283:13] hypervisor memory and CPU allocation. [283:16] Bare metal like performance. There's [283:17] also uh Nitro Enclaves, but you know [283:20] that's a bit out of scope here, but [283:21] that's has to do with like EC2 [283:23] isolation. Okay. Uh then we have bare [283:25] metal instances. So you can launch EC2 [283:27] instances that have no hypervisor. So [283:29] you can run workloads directly on the [283:31] hardware for maximum performance and [283:33] control. We have the M5, the R5 um EC2 [283:36] instances that can run bare metal. [283:38] There's other ones I believe I've seen [283:40] as well, but um you know if you are [283:42] running bare metal, you can just go [283:43] investigate at the time of okay we have [283:46] bottle rocket. This is a Linux-based [283:47] open source operating system that is [283:49] purpose-built by Adabus for running [283:50] containers on VMs or bare metal hosts. [283:54] Then uh let's just define what HBC is. [283:56] So it's a cluster of a hundred of [283:59] thousands of servers with fast [284:00] connections between each of them with [284:02] the purpose of boosting computing [284:04] capacity. So when you need a [284:05] supercomputer to perform computational [284:07] problems too large to run on a standard [284:10] computer or computers or would take too [284:13] long, this is where you know HBC comes [284:15] into play. One solution here is Adabus [284:17] parallel cluster which is uh an adabus [284:20] supported open source cluster management [284:21] tool that makes it easy for you to [284:23] deploy and manage high performance [284:25] computing HPC clusters on AWS. So [284:28] hopefully that gives you uh an idea of [284:30] this stuff. Okay. [284:36] All right. So let's take a look at HPC [284:38] or high performance computing on AWS. So [284:41] HPC is for uh running large complex [284:43] simulations and deep learning workloads [284:44] in the cloud with a complete suite of [284:46] high performance computing product [284:47] services gains insight faster and [284:49] quickly move uh from idea to market blah [284:51] blah blah blah blah it's for ML or very [284:54] complex scientific computing stuff these [284:56] run at least on C5NS [284:59] okay and the way it works is that you [285:01] use this um CLI called pcluster for a [285:04] parallel compute or a parallel cluster [285:08] stuff and so let's see if we can get [285:09] this installed very easily. Um, so what [285:12] I'm going to do [285:14] is see how hard it is to install. Now, I [285:18] don't recommend you running this because [285:19] I don't know what it's going to cost me [285:21] and if I make a misisconfiguration, I [285:23] don't want you to have that spend here, [285:25] but I don't think it's that dangerous. [285:27] So, I'm going to go back over to US East [285:29] one here. I'm going to open up [285:30] CloudShell [285:33] and I'm going to give it a moment to [285:34] load. And so, as that is loading, let's [285:37] take a look at how we would go ahead and [285:39] install this. So install the current [285:40] parallel. Um it was parallel. I think we [285:43] can just copy that line. Okay. [285:46] And so we have to wait for environment [285:48] to spin up. All right. So once it has [285:50] spun up, we will install it and then we [285:54] will jump over to this tutorial here. [285:59] Okay. So we'll give this a moment. [286:03] And after waiting a little while here, [286:05] it looks like our shell is ready. It [286:06] looks like it's in bash. Um, I'm just [286:08] going to type in ads S3 LS as a sanity [286:11] check. [286:13] Okay, and it works. That's great. So, [286:16] we'll go back over here and I'm going to [286:18] go back up to install for Linux. [286:21] And what I need is that single command. [286:25] Where is it? [286:28] So, I'm certain that we already have [286:31] Linux or Python installed, but I just [286:34] want the command to install it. [286:38] You saw it a moment ago here. I'm just [286:39] going to back out till I can find it. [286:44] Uh, one more. There it is. So, it's [286:48] under Oh, it's this link here. And [286:49] that's what I talk about the [286:50] documentations being tricky. Sometimes [286:52] you have to click these uh headings here [286:54] to find stuff. So, this is the first [286:57] time installing it. So, we'll grab that. [286:59] Usually, you're supposed to create in [287:00] virtual environments with Python. I [287:01] don't care. This is my cloud shell. It [287:03] doesn't matter to me. So, we're going to [287:05] go ahead and download that. And [287:06] hopefully it is fast. And it was super [287:07] fast, which was really nice. And so, [287:10] what we'll do is go check out the [287:11] pcluster version. [287:15] Okay. And that looks fine to me. I'm [287:17] going to go down below here to run our [287:19] first job. Um, the returns the it gives [287:22] outputs. I don't think we need to [287:24] configure it because we already have our [287:26] CLI. So, what I'm going to do is go [287:28] ahead and create ourselves a new [287:29] cluster. Um beginning cluster creation [287:32] configuration file config not found. So [287:34] I guess we do have to configure this [287:39] configure. [287:42] And it's asking what region do we want [287:44] to be in? Um if I have US east one I [287:46] would choose it. For some reason it's [287:47] all the way for number 13. That is not a [287:49] lucky number but I'm going to choose it [287:51] anyway. Anyway, no key pair found in US [287:54] East1 region. Please create one of the [287:56] following. Um, so create an EC2 key [287:58] pairs. [288:00] Uh, no options found for EC2 key pairs. [288:03] That's fine. So what what I'll do is go [288:04] over here [288:07] and we'll go over to EC2 [288:12] and we will go over to key pairs. Key [288:15] pairs. Key pairs. Key pairs. We'll [288:16] create ourselves a new one here. So [288:18] we'll say um HPC key pair [288:22] or just my HPC [288:25] so we know what it is for. We have putty [288:28] or PM. We're going to do PM because [288:30] we're on Linux. We'll create that. And [288:32] notice that it downloaded the PM down [288:35] here and we're going to need that for [288:37] later. Um and so what I'll do is I'll [288:41] type in pcluster here again. Configure. [288:43] We'll choose 13. We'll choose number one [288:46] here. Uh allowed values for the [288:49] scheduler. I have no idea what these [288:52] are. Uh let's choose the number one. [288:55] Allowed values for the operating system [288:58] Amazon Linux 2. I know what that is. [289:00] Minimum cluster size one. Maximum [289:03] cluster size two. Head notice instance. [289:08] Oh, T2 micro. You can do that. Yeah, [289:10] let's do it. I didn't know we could do [289:12] that. Enter. Compute type. Uh T2 micro. [289:15] Sure. So, I thought that we'd have to [289:17] use a C5N, but I guess apparently not. [289:19] AutomateVPN uh VPC creation. Yes, of [289:22] course. Network configuration. So, [289:24] allowed values for the network [289:25] configuration. Uh head node in a public [289:28] subnet and and compute fleet in a [289:30] private subnet. Uh head node and [289:33] compute. We'll do it in the both just to [289:34] make our lives easier. I don't care. [289:36] First one sounds more secure, of course. [289:39] And so, oh, it's creating cloudformation [289:41] stack. Wow, this is easy. I thought this [289:43] was going to be super painful. Okay. So, [289:45] we'll go over here. We'll go take a look [289:47] at what Cloud Form's doing. All right. [289:51] Now, I don't care if we actually run a [289:53] task on here, but it was just [289:54] interesting to go through the process to [289:55] see how hard it was. And we will go look [289:58] at what resources are being created. So, [290:01] it's creating an internet gateway. So, [290:02] it's literally creating a isolate VPC [290:04] for it, which is totally fine, I guess. [290:07] Um, it's creating a subnet. It's [290:08] creating a route table. Refresh here. [290:12] Um, I'm not sure how much it wants to [290:14] create here. It just looks like VPC. [290:17] That's all it's creating. I thought [290:18] maybe the EC2 instances would show up [290:20] here, but maybe it's going to launch [290:21] that on a need basis. [290:27] Okay, so that's all created. Oh, now [290:29] it's doing a VPC gateway. [290:32] I think VPC gateways cost money. Let's [290:34] go take a look here. VPC pricing. [290:41] Yeah, there's a uh transfer fee. So, [290:44] just be careful about that. You know, [290:46] again, you just can just watch along [290:48] here. You don't have to do it. [290:51] Default route depends on public. So, now [290:53] it's creating EC2 route. [290:58] I don't know what an ads EC2 route is. [291:01] I've never seen that before. Sometimes [291:03] what we can do is go into EC2 and then [291:05] take a look on the lefth hand side. You [291:06] see anything in here? We don't know what [291:08] it is. is we just type in EC2 route [291:10] cloud form. Sometimes cloud form is [291:12] great for figuring out what a component [291:14] is. Not all components are represented [291:15] in the um [291:18] um management console. So specify a [291:20] route in the route table. Oh, it's just [291:21] a route. Okay, [291:25] we'll go back here. We'll refresh. [291:28] So that is done. Is the stack done? [291:31] Created complete. Good. We'll go back to [291:33] our cloud shell. It says you can edit [291:36] your configuration file or simply do [291:38] etc. So now let's see if we can create [291:39] the cluster. I assume this would create [291:42] EC2 instances. [291:44] So the job schedule you are using is [291:46] SGE. This is deprecated in future. Use [291:48] parallel cluster. Well should have told [291:50] me. Okay. There is a new version of 301 [291:54] parallel available. I don't understand [291:56] because I just installed it, right? [291:58] We'll go back to cloud for going to [292:00] probably create nested stacks which [292:02] that's what I thought it would do. NS [292:04] stacks means that it's reliant. So [292:05] there's one main one and then there's uh [292:07] children stack. So go here, see what [292:10] resources it's creating. Oh, whole bunch [292:13] of stuff. Wow, so many things. An SQSQ, [292:17] SNS, [292:19] uh network interface, a Dynamo DB table. [292:23] Yeah, you you probably don't want to run [292:24] this. You just want to watch me do it. [292:26] And then we go into here. It's creating [292:29] uh an EC2 volume. So that's going to be [292:31] EBS. [292:32] And then here we have [292:36] uh a log group. I don't know why they [292:38] separated those out. Doesn't seem very [292:40] necessary. [292:43] We are waiting on the elastic IP. That [292:46] always takes forever creating elastic [292:47] IP. Root instance profile. That is the [292:50] IM role for it. [292:53] That didn't take too long. These these [292:55] take a long time. I I never know why. [292:58] Create a role. It's really easy, but [292:59] attaching an IM policy, you're always [293:01] waiting for those. [293:04] Um, so I'm going to just stop it here. [293:08] I'll be back in a second because I don't [293:09] want to have to make you watch me stare [293:12] at the screen here. Okay. All right. So, [293:14] after a really, really long wait. Um, [293:17] and it always takes some time there, it [293:18] finally created. I'm not sure what it's [293:21] made. I mean, we generally saw over here [293:23] in the outputs, but usually the cost [293:25] that I'm worried about is whatever it's [293:27] launching under EC2. It might not even [293:29] have launched any servers here. We're [293:31] going to take a look here, see if [293:32] there's anything. So, we have a master [293:36] and a compute. And they're T2 Micros, so [293:39] seems pretty safe here. Um, this compute [293:42] is not running yet. So, I'm assuming [293:44] that this is like the machine that does [293:47] the computing. And maybe if you had [293:49] multiple machines here like that would [293:51] be the cluster like it would manage [293:52] multiple computes. U I'm not [293:54] particularly sure but let's just keep [293:56] going through the tutorial and see what [293:57] we can do. The next step is we need to [293:59] get this PEM key in our cloud shell [294:02] here. So this I don't know where this is [294:04] but what I'm going to do is I'm going to [294:06] move it to my desktop. I'm doing this [294:08] off screen by the way. So I'm moving it [294:10] to my desktop and then I'm just going to [294:11] go and upload the file. Okay. [294:14] And there it is. So, we'll say open and [294:17] we'll say upload [294:19] and it's going to upload it here onto [294:22] this machine. And I believe this is on [294:24] like I think this uses an EFS instance. [294:27] Like if you're wondering where the [294:28] storage for cloud shell is, if we go [294:30] over here, I think it's EFS. [294:33] Is it? [294:35] Uh I don't know where it is. Okay, maybe [294:36] it's just uh maybe it's somewhere else. [294:39] Okay, I can't remember where it is. But [294:40] anyway, um, so now [294:43] it's created the cluster. Can I hit [294:46] enter here? [294:49] Okay. [294:50] Can I create a tab? Like if I quit this, [294:54] is it going to kill it? It exited it, [294:57] which is I think it's fine. I don't [294:58] think it stopped running. And so now if [295:00] I do an ls, there's my key. And so we [295:03] can go back to our instructions. Just [295:06] have too many tabs open here. drag this [295:09] all the way to the left here. And so we [295:11] can try to use our key here to log in. [295:14] So what I'm going to do is [295:18] go here and we'll say my HPCPM and see [295:22] if that works. We'll say yes [295:25] and permission denied. It is required. [295:27] Your private key is not accessible. [295:29] That's because we have to chod it. [295:32] Um, [295:34] I never remember the command anymore [295:36] because I rarely SSH into machines. But [295:39] if we go to connect and we go to SSH [295:43] client, it'll tell us what we need to [295:44] run [295:46] Chamad 400. Okay, so that's what we need [295:48] to do is we need to do a Chimad 400. [295:50] Just wanted to grab that code there. [295:54] Okay, and now if we hit up, it should [295:56] SSH into the machine. There we are. [296:00] We are in the instance. We'll type it [296:03] exit. And so now we want to run our job [296:05] on this machine. [296:08] And if we go back over to here, I guess [296:12] we can go create our first job. So I'm [296:15] just doing this in vi [296:19] and I paste that in. Yep. [296:22] And I don't want the first line. Oh, [296:24] okay. That's perfect. Great. [296:27] Right. Quit. [296:29] Oh, there's no file name. Hold on here. [296:32] So, I need to name this file something. [296:34] So, I'm going to say job.sh. [296:37] And we're going to paste that again [296:38] here. We'll say paste. [296:42] And I don't know if that's cut off. [296:43] Yeah, it is. Okay, great. Is that one [296:46] okay? [296:49] I don't trust that the first line is [296:51] there. So, what I'm going to do [296:55] is go back to our tutorial here. [296:58] It's shebang for slashbin for slashbash. [297:03] Uh [297:05] this then that slashbin slashbash just [297:09] double check it. Looks good to me. We're [297:12] going to quit that. I'm just going to [297:14] make sure that it is what it we said it [297:15] is. So job.sh [297:17] looks correct to me. Good. And so we'll [297:20] try to run our job here. So I'm going to [297:21] say Q [297:24] um job.sh. sh [297:27] ls [297:29] and I guess it really depends on what we [297:31] decided to use when we set up that [297:33] thing. I can't remember what we choose [297:34] as our Q. We do Qstat. [297:38] Oh, okay. Okay. Okay. So, I think the [297:41] thing is like you see how we have SGE. I [297:43] think that that's what we use to queue [297:45] up jobs and so we have to have that [297:46] installed probably. So install [297:50] configure sun grid engine [297:56] sg install um Linux. [298:03] Oh boy, that looks like a lot of work. [298:06] So I don't think we need to do anything [298:08] further here, but as far as I [298:10] understand, the idea is that you're [298:12] choosing uh some kind of way to manage [298:14] these. And so I'm not sure what Q Q sub [298:17] is. Let's just go look up what that is. [298:18] What is Q sub? Oh, that is the sun grid [298:21] engine. Okay. So, how do we install [298:24] that? [298:30] Um, [298:32] I'm just going to see if we can install [298:33] it. So, I'm going to do I think this is [298:35] using yum. [298:37] So, if I do clear here, clear yum [298:41] install Q sub. Let's see if I can do it. [298:46] pseudoy yum install qub no package [298:48] available [298:50] Amazon Linux 2 q sub because that's [298:54] probably what we're running in cloud [298:55] shell [299:01] q sub [299:03] doesn't tell us how to install it [299:09] so that's probably what it is and so in [299:11] order to use this we would have to [299:13] install all that sun whatever whatever [299:16] and then we go through we do q sub it [299:18] would ceue it up um you could do qstat [299:20] cat hello destroy it that's pretty much [299:22] all we really need to know to understand [299:24] this would have been nice to queue up a [299:26] job and see it work but you know we're [299:28] getting kind of into a hairy territory [299:30] here and I think that we fundamentally [299:32] understand how this does work so what [299:33] I'm going to do is I'm going to go here [299:35] I'm going to remove the jobsh here and I [299:38] want to destroy this cluster [299:41] um so I'm going to do pcl cluster [299:43] commands [299:45] to figure out what all the commands are. [299:48] And there's probably a delete command. [299:50] So, we'll go back up here. [299:55] BC cluster. [299:58] Where is our crate? So, we'll say [299:59] delete. [300:03] Okay. And so, what that's going to do is [300:05] just tear down all the stuff now. [300:08] So if we go over to cloudformation. [300:17] Okay. And it looks like it's destroying. [300:20] So yeah, I'll see you here uh back in a [300:23] bit when it's all destroyed. Okay. All [300:25] right. So after a short little wait [300:26] there, it has destroyed. It has been so [300:28] long that I uh my connection vanished. [300:30] But just make sure if you did follow [300:31] along for whatever reason, uh you know, [300:33] make sure that the stuff is deleted. And [300:35] it looks like it did not destroy uh [300:37] this. So I'm going to go ahead and [300:38] delete that. That's just VPC stuff. So [300:40] I'm not too worried about it. I know [300:42] that's going to roll back no problem. [300:44] And so I'm going to consider this done. [300:45] So I'm going to make my way back to the [300:46] management console. Close this stuff up. [300:49] And we are good to go uh for our next [300:52] thing. [300:56] Hey, this is Andrew Brown from Exam Pro [300:58] and we're taking a look at edge and [301:00] hybrid computing services. So what is [301:02] edge computing? when you push your [301:04] computing workloads outside of your [301:06] network to run close to the destination [301:08] location. Uh so an example would be [301:10] pushing computing to run on phones, IoT [301:12] devices, external servers, not within [301:15] your cloud network. What is hybrid [301:17] computing? When you're able to run [301:18] workloads on both your on-remise data [301:21] center and the AWS uh VPC. Okay, so we [301:25] have a few services here starting with [301:26] ads outpost. This is a physical rack of [301:28] servers that you can put into your data [301:30] center. Adabus outputs allows you to use [301:33] adabus API and services uh such as EC2 [301:36] right in your data center. Then we have [301:38] ads wavelength. This allows you to build [301:40] and launch your applications in a [301:42] telecom data center. By doing this, your [301:44] applications will have ultra low latency [301:46] since they will be pushed over the 5G [301:48] network and be closest as possible to [301:50] the end user. Um so they've partnered [301:53] with things like Verizon, Vodafone, uh [301:55] Business and a few others, but those are [301:57] the two noticeable ones. Okay. We have [301:59] VMware cloud on AWS. So this allows you [302:02] to manage on-remise virtual machines [302:03] using VMware uh within EC2 instances. [302:06] The data center must be using uh VMware [302:10] for virtualization for this to work. [302:11] Okay. Then we have ads local zones which [302:14] are edge uh data centers located outside [302:16] of the ads region. So you can use ads [302:19] closer to the edge destination. When you [302:21] need faster computing storage databases [302:23] in populated areas that are outside of [302:25] AWS region, you can do this. There's [302:27] some other edge offerings on AWS that [302:29] aren't listed here. Like SageMaker has [302:30] what's called like Neo Sage Maker that [302:33] let you do edge computing with um ML, [302:36] but I mean this is good enough. Okay. [302:42] All right. So, I wanted just to show an [302:44] example of edge computing uh because we [302:46] didn't cover it in our generic uh [302:48] compute. And so, there's a variety of [302:50] services that allow you to do edge [302:51] computing like wavelength. And so, um, [302:54] I've never actually launched wavelength [302:56] before and I think that, uh, you have to [302:58] request it. So, if I go over to support [303:01] here, again, I've never done this [303:03] before, but I'm sure we can figure it [303:04] out pretty easily. I feel that if we [303:06] create a case, [303:10] um, maybe it's like service limit. [303:13] We type in wavelength here. Nope, not [303:16] there. [303:17] So, how do we get wavelength? wavelength [303:19] ads request. [303:27] So that's what I'm looking for here. [303:32] Okay. How do I use wavelength AWS? [303:38] Whoops. [303:44] And sometimes what I'll do is go to the [303:45] docs here. Opt into wavelength zones. [303:48] Before you specify wavelength zone for [303:50] resource or service, you must opt into [303:52] it. To opt in, go to the ads console. [303:55] Okay. So we'll go to EC2 [304:00] and then it's going to say use the [304:03] region selector in the navigation bar to [304:05] select the region which supports your [304:07] wavelength. [304:10] So, I know that there's stuff in [304:14] uh US West because of Las Vegas, right? [304:17] Or not Las Vegas, but Los Angeles, [304:19] right? So, if we go over here, there's [304:21] definitely that over there. On the [304:23] navigation pane of the EC2 dashboard, [304:25] under account attributes, select zones. [304:30] Okay. Do we see zones here? [304:34] Zones. [304:37] Oh, EC2 dashboard [304:40] zones. Let's go check here again. On the [304:43] navigation pane, choose EC2 dashboard. [304:45] We are there, right? [304:50] And under account attributes, uh [304:51] settings, account attributes. [304:55] Oh, over here. Okay. Oh, it's here. [304:58] Zones. [305:00] And so there we have two zones. And we [305:03] see switch regions to make uh zones a [305:06] different region. [305:08] Okay. So, under zone groups, turn on [305:11] wavelengths. [305:14] Zone groups. [305:16] Okay. Nothing there. So, I'm just going [305:18] to switch over to another one here. [305:21] Maybe Oregon. [305:24] Maybe CS West 2. Oh, look at all the [305:26] stuff we have here. I've never seen [305:28] these before. Okay. So, here is the [305:31] wavelength one. So, that is the Los [305:33] Angeles one. [305:36] We can go ahead and enable this before [305:37] disable the zone group. I'm not sure [305:39] what zone groups cost. So, wavelength [305:43] zone pricing. Again, you might just want [305:46] to watch me do this because it might [305:47] cost money. Um, and so you might not [305:50] want to have to spend for that [305:54] pricing. [305:58] uh provides mobile networks wavelengths [306:01] are available across whatever learn [306:03] about the data transfers in a price [306:05] about EC2 instances. [306:07] Okay. So what's the price [306:10] we go into here? [306:14] All right. So what I'm going to suggest [306:15] to you is don't do this but I'm going to [306:17] do it and we're just going to see what [306:19] the experience is like. Okay. So I'm [306:21] going to update my zone. So now I have [306:23] this one. So we'll say enable. I'm gonna [306:25] assume that it has to do with like data [306:27] transfer costs. [306:29] Okay. And uh we're going to go over to [306:32] EC2 [306:36] and we're going to go over to instances [306:37] here. [306:39] We're going to launch an instance and [306:41] we're going to see if we we have that [306:42] available. Now, I don't know if we're [306:44] restricted to particular uh instances. I [306:47] assume we can launch a Linux machine. [306:49] It'd be really weird if we couldn't, you [306:51] know. We'll go over to configuration and [306:53] what we want to do is choose [306:56] uh the zone. So how do we do it? So once [306:59] it's turned on confirmation to confirm [307:02] it, configure your network. So create a [307:03] VPC, create a carrier gateway so you can [307:06] connect your resources into the VPC to [307:08] the telecommunication network. Holy [307:10] smokes, this is complicated, [307:13] but it's just kind of interesting to see [307:14] like the process, right? You know, it's [307:17] not for our use case, but uh carrier [307:20] gateway, right? [307:22] And as I do this, I always check up all [307:23] the costs here. So I say carrier gateway [307:27] pricing AWS because maybe that's where [307:29] the price is. [307:32] Okay, if you don't get a pricing page, [307:34] then usually that's hard to say. [307:35] Logically isolated virtual networks. [307:39] And it's not telling me what [307:43] um to use carrier, you need to opt into [307:45] at least one wavelength zone. But I did, [307:47] right? [307:49] And sometimes what happens is that it [307:51] just takes time for the opt-in to to go. [307:56] So go here, manage the zone settings. [307:58] That was a lot easier way. So we have [308:00] one. It's we're opted in right here. [308:02] Okay. [308:05] And [308:07] okay, we'll we'll go here again. If that [308:09] one didn't work, um [308:13] we can try. So I guess these are all the [308:16] regions, Denver, things like that. [308:20] Can I opt in opt into this one? Opt in. [308:27] It's not super exciting. Like all we're [308:28] going to do is launch an EC2 instance. [308:30] But you know, we'll go through the [308:31] process here a bit. [308:34] And I don't know why I can't create one. [308:35] So we'll go back over to the [308:36] instructions here. [308:39] Create so you can connect. So create a [308:40] route table using the VPC to the route [308:42] table. So I think that's as far as we're [308:43] going to get here because I'm not seeing [308:45] any options here. But the idea was that [308:47] we would have to create a carrier [308:49] gateway. We'd update our route tables [308:51] and all we would be doing is launching [308:52] an EC2 instance. So, you know, it's no [308:55] different than launching it. You just [308:57] choose a different subnet. So, I think [308:58] you'd have to create a subnet for that [309:00] zone and launch it in there. And that [309:02] would be edge computing. Another example [309:04] of edge computing would be something [309:05] like via CloudFront, which we have uh [309:08] these um edge functions or not edge [309:12] functions. Yeah, functions here. And so [309:14] these are functions that are deployed to [309:16] CloudFront. So my CloudFront function [309:23] and these would be deployed to um edge [309:26] locations, right? And all you can use [309:28] here is JavaScript. So here's an example [309:30] of one and um I'm fine with this [309:35] development live. This function is not [309:36] published. We'll go to test. [309:39] Test the function. It's good. [309:43] publish publish that function. And so [309:46] the advantage of this is that you know [309:47] if you have functions that are in it was [309:50] Lambda there's a chance of cold start um [309:53] whereas if they're deployed on the edge [309:55] here there's still probably a cold start [309:57] but it's going to be a lot faster [309:58] because it's a lot closer to the edge [310:01] location. So um you know it's just a [310:04] different uh different cases but yeah [310:06] there was one where we're launching uh [310:07] EC2 workload into wavelengths which we [310:10] couldn't complete which is totally fine. [310:11] And then we have these functions on the [310:13] edge. There's other uh edge computing [310:15] services like within SageMaker you can [310:17] deploy I think it's called like neo [310:19] sagemaker and then for IoT devices those [310:21] are obviously on the edge so you can [310:23] deploy those as well. Uh but generally [310:25] that gives you an idea of edge [310:26] computing. Okay. [310:31] Hey Andrew Brown from Exam Pro and we're [310:33] looking at cost and capacity management [310:35] computing services. So before we talk [310:37] about them let's define what is cost [310:39] management. So this is how do we save [310:41] money and we have capacity management. [310:43] How do we meet the demand of traffic and [310:45] usages through adding or upgrading [310:47] servers. So let's get to it. The first [310:50] are the different types of ECG pricing [310:52] models. So you got spot instances, [310:54] reserved instances, saving plans. These [310:57] are ways to save on computing by paying [310:59] up in full or partially or by committing [311:01] to a yearly contract or multi-year [311:03] contract uh or by being flexible about [311:06] the availability interruption to [311:07] computing services. We have adabis [311:10] batch. So this plans, schedules and [311:11] executes your batch compute workloads [311:13] across the full range of adabus [311:15] computing services which can utilize [311:17] spot instances to save money. We have [311:19] adabis compute optimizer. So suggest how [311:22] to reduce cost and improve performance [311:24] by using machine learning to analyze uh [311:27] your uh your previous usage history. We [311:30] have EC2 autoscaling groups. So ASGs. [311:33] These automatically add or remove EC2 [311:35] servers to meet the current demand of [311:37] traffic. They will save you money and [311:40] meet capacity since you only run the [311:42] amount of servers you need. Then we have [311:44] ELB. So elastic load balancer. So this [311:46] distributes traffic to multiple [311:48] instances. We can reroute traffic from [311:50] unhealthy instances to healthy instances [311:52] and can route traffic to EC2 instances [311:54] running in different availability zones. [311:57] And then we have elastic beantock here [311:59] which is easy for deploying web [312:01] applications without developers having [312:03] to worry about setting up and [312:04] understanding the underlying ad services [312:07] similar to Heroku. It's a platform as a [312:09] service. So not all these are about [312:11] cost. Some them are about capacity [312:13] management like ELB. Um but yeah there [312:15] you go. [312:20] Hey, this is Andrew Brown from Exampro [312:22] and we are looking at the types of [312:24] storage services and no matter what [312:26] cloud service provider you're using, [312:27] they're usually broken down into these [312:28] three where we have blocks, file and um [312:32] uh object. Okay, so let's take a look at [312:34] the first. So this is going to be for [312:35] block storage. So for AWS, this is [312:38] called elastic block store. Data is [312:39] split into evenly split blocks directly [312:42] accessed by the operating system and [312:44] supports only a single write volume. So [312:46] imagine you have an application over [312:48] here and that application is using a [312:50] virtual machine that has a specific [312:52] operating system and then it has a drive [312:55] mounted to it. Uh could be using FC or [312:58] uh SCSI here. Um but the idea here is [313:00] when you need a virtual drive attached [313:02] to your VM is when you're going to be [313:04] using block. Okay. The next one here is [313:06] for um file or it's just basically a [313:09] file system. So this is AOS elastic file [313:12] storage. So the file is stored with data [313:14] and metadata multiple connections via a [313:17] network share supports multiple reads [313:19] writes locks the file. So over here uh [313:23] we could have an application but it [313:24] doesn't necessarily have to be an [313:25] application. And so it's using NAS [313:28] exports as the means to uh communicate. [313:30] And so the protocols here can be NFS or [313:32] SMB which are very common uh file system [313:36] protocols. And so the idea here is when [313:38] you need a file share where multiple [313:40] users or VMs need to access the same [313:42] drive. So this is pretty common where [313:44] you might have multiple virtual machines [313:45] and you just want to act as like one uh [313:48] drive. Uh one example that could be like [313:50] let's say you're running a Minecraft [313:51] server. you're only allowed to have one [313:52] world on a particular single drive, but [313:55] you want to be able to have multiple [313:56] virtual machines to maximize that [313:58] compute. That'd be a case for that. Um, [314:00] so there you go. Then the last one here [314:02] is like object storage. And so for as [314:05] this is called Amazon simple storage [314:06] service or also known as S3. So object [314:10] is stored with data, metadata, and a [314:11] unique ID scales with limited uh uh with [314:15] limited no file limit or storage limit. [314:18] So there's really very there's very [314:21] little limit to this. It just basically [314:22] scales up supports multiple reads and [314:24] rights. So there are no locks. And so [314:27] the protocol here we're going to be [314:28] using HTTPS and API. So when you just [314:31] want to upload files and not have to [314:33] worry about the underlying [314:34] infrastructure, not intended for high uh [314:36] IOPS, so input and outputs per seconds. [314:39] Okay. So depending on how fast you have [314:41] to do your read and writes are going to [314:42] determine uh you know whether you're [314:44] going uh this direction or the other way [314:47] um or you know how many need to actually [314:49] connect at at the same time and whether [314:51] it has to be connected as a mount drive [314:53] to the virtual machine. Okay. [314:58] Hey, it's Andrew Brown from Exam Pro and [315:00] we're going to do a short introduction [315:02] into S3 because on the certified cloud [315:04] practitioner, they ask you a little bit [315:06] more than they used to and so we need to [315:08] be a bit familiar with S3 because it is [315:11] um at least I think that Abus considers [315:13] its flagship uh storage uh service and [315:16] it really is one of the earliest [315:18] services is the second one ever [315:19] launched. Okay, so what is object [315:22] storage or object-based storage? So data [315:24] storage architecture that manages data [315:25] as objects as opposed to other storage [315:27] architectures. So file systems where uh [315:30] these are others right so which manages [315:32] data as files and a hierarchy and block [315:34] storage which manages data as blocks [315:36] with within sectors and tracks that get [315:38] stored on an actual uh drive. And so uh [315:41] the idea here is we have S3 which [315:43] provides basically unlimited storage. [315:45] You don't need to think about the [315:46] underlying infrastructure. The S3 [315:48] console provides interface for you to [315:49] upload and access your data. Okay. So we [315:51] have the concept of S3 objects. So [315:53] objects contain your data. They are like [315:56] files but objects may consist of a key. [315:59] This is the name of the object, a value, [316:01] the data itself made up of a sequence of [316:02] bytes. The version ID when versioning [316:05] enabled, the version of the object, [316:06] metadata, additional information [316:08] attached to the object, and then you [316:10] have your S3 buckets. So buckets hold [316:11] objects. Buckets can also have folders [316:13] which in turn hold objects. S3 is a [316:16] universal namespace. So bucket names [316:18] must be unique. It's like having a [316:19] domain name. Okay. And one other uh [316:22] interesting thing is an individual [316:23] object can be between zero bytes and up [316:26] to 5 terabytes. So you have unlimited [316:28] storage but you can't have uh files of [316:31] uh incredible size. Uh I mean 5 [316:33] terabytes is a lot but nothing beyond [316:34] that for a single file. But just [316:36] understand that you can actually have a [316:38] zero byte file. Uh and for like [316:41] associate certifications that can be a [316:43] an actual question. So that's why it's [316:45] there. [316:50] All right, let's take a look at S3 [316:52] storage classes. Um, and so for the [316:54] certified cloud practitioner, we need to [316:55] know generally what these are. For [316:57] social levels, we need more detail than [316:59] we have here, but let's get through it. [317:00] So, Adabus offers a range of S3 storage [317:02] classes that trade retrieval time, [317:04] accessibility, durability for cheaper [317:07] storage. And so, the farther down we go [317:09] here, the more cost effective uh it [317:11] should get uh pending uh you know, [317:13] certain conditions. Okay, so when you [317:15] put something into S3, it's going to go [317:17] into the standard uh tier, the default [317:19] tier here, and this is uh incredibly [317:22] fast. It has 99.99% availability, 11 9's [317:26] durability, and it's replicated across [317:28] three A's. And so uh you know, we have [317:31] this cheaper meter here on the left hand [317:34] side, and that would imply this is very [317:35] expensive, and it's not actually [317:37] expensive, but it is expensive at scale [317:39] when you can uh better optimize it with [317:41] these other tiers. So just understand [317:42] that. Um then you have the S3 [317:44] intelligent taring. So this uses ML to [317:46] analyze objects and usage and determine [317:48] the appropriate storage class. Data is [317:50] moved to the most cost-effective access [317:52] tier without any performance impact or [317:54] added overhead. Then you have S3 [317:56] standard IIA which stands for infrequent [317:59] access. This is just as fast as S3 [318:01] standard but it's cheaper if you access [318:03] the files less than once a month. [318:05] There's going to be an additional [318:06] retrieval fee applied. So if you do try [318:09] to retrieve data as frequently as S3 [318:11] standard, it's going to actually end up [318:12] costing you more. So you don't want to [318:14] do that. Okay. Then you have S3 one zone [318:17] IIA. So as it says, it's running in a [318:19] single zone. So it's as fast as S3 [318:21] standard, but it's going to have lowered [318:23] availability, but you're going to save [318:24] money. Okay. There is one caveat though. [318:27] Your data could get destroyed because [318:28] it's remaining in a single uh A. So if [318:31] that uh a or data centers um suffer a [318:34] catastrophe, you're not going to have uh [318:36] a duplicate of your data to retrieve it. [318:38] Okay. Um and then you have S3 Glacier. [318:40] So for long-term closed storage, [318:42] retrieval of data can take minutes to [318:44] hours, but it's very very very cheap. [318:47] And then you have S3 Glacier uh deep [318:49] archive, which is the lowest cost [318:51] storage class, but the data retrieval is [318:53] 12 hours. And so you know um all of [318:56] these here to here these are all going [318:58] to be in the same uh adabus S3 console [319:00] or Amazon S3 console. S3 Glacier is [319:03] basically like its own service but it's [319:05] part of S3. So kind of lives in this [319:07] weird state. There's one here that we [319:08] didn't have on the list here which is S3 [319:10] outputs because it has its own storage [319:12] class and doesn't exactly fit well into [319:15] um this kind of linear cheaper uh thing [319:18] here. Okay. [319:23] Hey, it's Andrew Brown from Exam Pro and [319:25] we are taking a look at the AdW family. [319:27] So, this is storage and compute devices [319:29] used to physically move data in or out [319:31] of the cloud when moving data over the [319:33] internet or provide private connection [319:35] that is too slow, difficult or costly. [319:38] So, we have snow cone, snowball edge and [319:41] snowmobile. And so, there originally was [319:43] just snowball and then they came out [319:45] with snowball edge. Uh, and edge [319:48] introduced edge computing. That's why [319:49] there's edge in the name. Uh but pretty [319:51] much all of these devices have edge [319:53] computing. Uh and they do individually [319:56] come with some variants. So with the [319:57] snowball snow cone, it comes in two [319:58] sizes where it has 8 terabytes of usable [320:01] storage and then there's one with 14 tab [320:03] of usable storage. For Snowball Edge, it [320:06] technically has like four versions, but [320:08] I'm going to break it down to two for [320:09] you. We have storage optimize where we [320:11] have 80 terabytes of use um uh of usable [320:15] storage there. And then compute [320:17] optimized 30.9.5 [320:19] terabytes. And even though it's not [320:21] here, you get a lot of vCPUs and [320:23] increased memory which could be very [320:25] important if you need to do edge [320:26] computing before you send that over to [320:28] AWS. And then last here we have [320:30] snowmobile which can uh store up to 100 [320:33] uh pabytes of storage. Um, in the, uh, [320:36] associates, I cover these in a lot more [320:38] detail because there's so much more [320:40] about these, like the security of them, [320:42] how they're tamperproof, something like [320:44] how they have networking built in, the [320:45] the connection to them. But, you know, [320:47] for this exam, that's just too much [320:48] information. Um, you just need to know [320:50] that there are three uh three ones in [320:52] the family, and generally what the sizes [320:54] are, and that they're going to be all [320:55] placed into Amazon S3. What's [320:58] interesting is that, you know, [320:59] snowmobile only does 100 pabytes, but [321:01] Adabus markets it as you can move [321:03] exabytes of of um content because you [321:06] can order more than one of these [321:08] devices. So, they'll market it saying [321:10] like Snowball Edge is when you want to [321:11] move pabytes of data and Snowball mobile [321:14] is when you want to move exabytes. But [321:16] you can see that a single thing isn't in [321:18] the exabytes, just in the pabyte. Okay. [321:24] Hey, this is Andrew Brown from Exam Pro [321:26] and we are taking a look at all the [321:28] Adabus storage services in brief here. [321:30] So, let's get to it. So, the first is [321:31] simple storage service S3. This is a [321:33] serverless object storage service. You [321:35] can upload very large files and an [321:37] unlimited amount of files. You pay for [321:38] what you store. You don't worry about [321:40] the underlying file system or upgrade [321:41] the disc size. You have S3 Glacier. This [321:43] is a cold storage service. It's designed [321:45] as a lowcost storage solution for [321:47] archiving and long-term backup. It uses [321:49] previous generation uh HDD drives to get [321:52] that low cost and it's highly secure and [321:54] durable. We have elastic block store [321:56] EBS. This is a persistent block storage [321:58] service. It is a virtual hard drive in [322:00] the cloud and you attach to EC2 [322:02] instances. You can choose different [322:03] kinds of hard drives. So SSD, IOPS, SSD, [322:07] throughput HDD and um cold HHD. Okay. We [322:11] have elastic file storage. So EFS. It is [322:14] a cloudnative NFS file system service. [322:17] So file storage uh you can mount to [322:19] multiple EC2 instances at the same time [322:21] when you need to share files between [322:23] multiple servers. We have storage [322:24] gateway. This is a hybrid cloud storage [322:26] service that extends your on-remise [322:28] storage to the cloud. We got three [322:29] offerings here. File gateway so extend [322:31] your local storage to Amazon S3. Volume [322:34] gateway caches your local drive to S3 so [322:36] you have a continuous backup of the [322:38] local files in the cloud. tape gateway. [322:40] So, stores files onto virtual tapes for [322:42] backing up your files on very [322:44] cost-effective long-term storage. We got [322:47] one more page here because there's a lot [322:48] of services here. We have Adabus Snow [322:51] family. So, these are storage devices [322:52] used to physically migrate large amounts [322:54] of data to the cloud. And so, we have [322:57] Snowball and Snowball Edge. These are [322:59] briefcase size data storage devices [323:01] between 50 to 80 terabytes. I don't [323:03] believe Snowball is available anymore. [323:05] It's just Snowball Edge. Uh, but it's [323:07] good to have all of them in here so we [323:08] can see what's going on. We have [323:10] snowmobile. This is a cargo container [323:12] filled with racks of storage and compute [323:13] that is transported via a semi trailer [323:16] tractor truck to transfer up to 100 [323:18] pabytes of data per trailer. I don't [323:20] think we're going to be ordering that [323:21] anytime soon because that's pretty darn [323:22] expensive, but that's cool. We have Snow [323:25] Cone. This is a very small version of [323:26] Snowball that can transfer 8 terabytes [323:28] of data. We have adabus backup a fully [323:30] managed backup service that makes it [323:32] easy to centralize and automate the [323:34] backup of data across multiple adabus [323:35] services. So EC2 EBS RDS Dynamob EFS [323:39] storage gateway you create the backup [323:41] plans. We have cloud endure disaster [323:44] recovery. So continuously replicates [323:45] your machine in a lowcost staging area [323:48] in your targets account and preferred [323:50] region enabling fast and reliable [323:51] recovery in case of IT data center [323:54] failures. We have Amazon FSX. This is a [323:56] feature-rich and highly performant file [323:58] system that can be used for uh Windows. [324:00] So that would be using SMB or Linux [324:02] which uses Luster. And so there we have [324:05] the Amazon FS FSX for Windows file [324:08] server. So use SMB protocol and allow [324:10] you to mount FSX to Windows servers. And [324:12] then the Luster one which uses uh Linux [324:15] Luster file system and allows you to [324:17] mount F FSX Linux servers. Are there any [324:20] storage services missing here? Not [324:21] really. I mean you could count elastic [324:23] container repository as one but um [324:26] that's kind of something else or you [324:28] could also count maybe um uh code commit [324:31] but you know I kind of put those in a [324:33] separate category where we where those [324:34] are in our developer tools or our [324:37] containers. Okay. [324:42] Hey, this is Andrew and in this video we [324:45] are going to go explore Amazon S3. This [324:47] is a service you will probably come [324:49] across a lot. So it's good to know this [324:52] one inside and out. Um but for the scope [324:54] of this we are just going to get a basic [324:56] introduction into it. Uh so let's make [324:58] our way over to S3. So S3 here is at the [325:01] top. Notice it said that I was in CA [325:03] Central. Um and so depending on where we [325:05] are is where the buckets are going to [325:07] initially create. I'm going to just [325:08] switch over to North Virginia US East [325:10] one. Uh and my recommendation again is [325:12] make buckets in your primary area. So um [325:16] I mean Canada that this would be totally [325:17] fine but um I know that in North America [325:20] I'll get 100% um or North Virginia I'll [325:23] get 100% of the features um for [325:25] learning. So that would be probably [325:26] optimal for learning here. Uh let's go [325:28] ahead and create ourselves a bucket. So [325:30] notice we have general purpose or [325:31] directory. Uh and so there is a clear [325:34] difference between these two. General [325:35] purpose is recommended for basically [325:37] everything and directory is for low [325:39] latency uses. Um, this works [325:42] specifically with S3 Express one zone [325:44] storage, but we are going to focus just [325:45] on general purpose. And we now also have [325:48] this newer feature where you can choose [325:50] either a global namespace or account [325:52] regional namespace. Um, historically the [325:55] challenge with uh S3 was always naming [325:58] your bucket because if someone had the [326:00] same name as you, um, then you wouldn't [326:02] be able to create your bucket. Um, and [326:03] what people would do is they would put [326:04] in things like their domain name and [326:06] you'd have to put your domain name when [326:07] you're doing website hosting. So here I [326:09] do like zampro.co. if somebody already [326:11] had that, you wouldn't be able to create [326:12] the bucket, which is very frustrating. [326:13] So, you'd be running to get your bucket [326:14] name, but now they have this account [326:16] regional namespace and it's going to put [326:19] this suffix here, but then allows you to [326:20] say like if I want examro.co, I'm not [326:22] going to have conflicts there. But we're [326:24] going to stay focused on the global [326:26] namespace for the time being. And I'm [326:28] just going to say my new bucket, which I [326:31] seem to name a lot of these this and [326:33] then I just put some random numbers. Um, [326:34] that way we will not have any conflicts [326:36] here in the global namespace. And so [326:39] that is good there. Then we have our [326:41] object ownership. So here we have ACL [326:44] disabled. So access control lists is one [326:47] of the oldest methods of providing [326:49] access um to buckets where um it's just [326:53] like broad controls and generally it's [326:55] not used anymore. There are some legacy [326:57] cases. So obviously legacy customers who [327:00] pay a really high bill and do not want [327:02] to change their workflows uh continue to [327:03] use these but really um ACL's are not [327:06] recommended and um you should be using [327:09] bucket policies. Then we have our block [327:12] public access settings. So at one point [327:14] um this did not exist and so people [327:16] would misconfigure very often um access [327:19] to their buckets and so AWS said we need [327:22] to have this explicit option where um [327:25] it's we block all public access by [327:27] default and if you really want to have [327:28] public access you'll have to um take off [327:31] this safeguard and then you know that [327:32] you're responsible for any data leaks. [327:35] All right we have bucket versioning. So [327:37] this will allow us to version files that [327:39] are in here. Um it's kind of a pain once [327:41] we turn it on to get things out of it. [327:43] Um but it's very very good feature if [327:45] you want to make sure your files stay [327:46] within your bucket especially if let's [327:48] say your account was compromised. If you [327:50] had uh versioning then they have to [327:52] remove all the versions and uh there's a [327:54] lot of work involved there. Um we can [327:57] have encryption and there's different [327:58] modes. We'll leave that alone for now. [327:59] Actually it looks like the bucket key is [328:01] enabled. Um and it's by default. I think [328:03] originally it wasn't turned on. So now [328:05] they have it on by default. But you can [328:07] see we have three types here. managed by [328:09] AWS which is um the easiest way then you [328:12] can generate out your own key but it's [328:14] still managed by AWS and then we have [328:16] this dual layer server sides where there [328:18] is multiple layers of encryption and [328:21] then for advanced settings we have [328:22] object lock and so this is really really [328:24] useful um uh like if you want to not [328:28] have data loss is to turn this on [328:31] because then you know you it's not going [328:34] to overwrite or delete files they'll [328:35] just they'll just stay there uh for [328:37] fixed time indefinitely. So definitely [328:39] object log is a very strong feature uh [328:42] when you need to make sure your data [328:43] stays around or if someone was to come [328:44] in and compromise your account that they [328:46] couldn't get just get rid of your data, [328:48] but you have to have that with [328:49] versioning. I'm not going to turn that [328:50] on because it's a big big pain in the [328:52] butt to uh uh delete the data. But we'll [328:55] go ahead and create this bucket. And so [328:57] now we have a bucket. So pretty [328:59] straightforward. Um I think we're going [329:01] to want to upload some files to this [329:03] bucket. So, normally I will go find some [329:05] graphics um on uh on the internet, but [329:08] I'm going to go ahead and just use [329:09] chatbt here today as they have a new [329:11] image model and this is the future might [329:13] not be so new anymore, but I'm going to [329:14] ask it to generate me some images. So, [329:16] I'm just going to give it a prompt. Uh [329:18] so, just a moment here. Okay, so we have [329:21] an image generated. And here it is. It's [329:23] kind of a mix of different levels of [329:24] Star Trek. It's uh unusual, but I [329:27] actually wanted four images, but I guess [329:28] it made a photo of four people, which is [329:30] fine. Uh, and so I'm going to go ahead [329:32] and download this image. So, just give [329:34] me just a moment here. And this will be [329:37] uh Star Trek like photo. I'm just naming [329:40] it here offscreen. And then, you know, [329:43] in your folder, you just drag it on in [329:45] here and it should just upload. Um, and [329:48] I think originally like when you used to [329:49] drag here, there used to not be this [329:50] confirmation screen, but I guess they I [329:53] mean this was here last time I I [329:54] recorded this video, but uh they've [329:56] definitely improved it. But I guess it's [329:57] just a good way to uh make sure you add [330:00] lots of files or folders. I think before [330:03] you couldn't add folders. So now being [330:04] able to drop an entire folder and [330:05] preserve that structure is very very [330:07] interesting. So that is good. Uh notice [330:09] here that bucking version is not on [330:11] here. It's showing the encryption type [330:12] and that object lock is disabled. Notice [330:14] that uh we do not have any permission [330:16] setup as um we we'll have to do that [330:19] separately. And then if you drop down [330:21] properties here, we can see the storage [330:22] class which will change the cost of uh [330:26] what we're utilizing based on the tier. [330:28] So standard is a good starting tier. Um [330:32] but until you have other use cases where [330:35] let's say you have data that's [330:36] infrequently accessed, then you'd move [330:38] it to that tier. Or if you want uh [330:40] long-term storage where you're barely [330:42] ever touching that data, um but there's [330:44] a cost of retrieving that data, then [330:46] there's those options. But we for now [330:48] we'll leave it under standard. Um here [330:52] the server side encryption key will just [330:53] use whatever Amazon S3 uses which is [330:55] good. The check sum just makes sure that [330:57] when a file is uploaded it's verifying [330:59] that the data actually matches what it [331:01] is. So here we have a bunch of other [331:03] methods for or types of methods for [331:06] doing a check sum. Um I mean I recognize [331:08] Shaw and I don't know these more [331:10] advanced ones but I'm sure they are [331:11] good. And we will continue. Oh just [331:14] before we do just notice that there's [331:15] metadata. You can attach metadata to [331:17] this. We'll just say user defined. We'll [331:19] just say um photo [331:22] group Star Trek. Okay. And we'll go [331:25] ahead and upload that there. Metadaya is [331:28] very very good at um helping you [331:31] determine what stuff is. But the [331:32] metadata is not attached to the image. [331:34] It's stored alongside the image because [331:36] if you actually have images on your [331:37] computer, you can store metadata [331:39] literally in the image. But that's not [331:41] what we're doing here. Okay. Um but [331:43] we'll go over to here. And now we have [331:45] our image. And if we want to download [331:47] it, we can go ahead and download it. So [331:49] there it is downloading. Pretty simple. [331:51] Um for in terms of actions, there are a [331:54] few things that we could set. Um I think [331:56] that would be useful is to show [331:58] pre-signed URL. So let's say you wanted [331:59] to share a link to someone that someone [332:01] could download and that link would [332:02] expire. That's a pre-signed URL. And we [332:04] could set the minutes an hour. So it [332:05] might say just five minutes here and [332:07] create a pre-signed URL. And so now I'm [332:09] going to copy that to my clipboard. I'm [332:11] going to open up an incognito tab just [332:13] so that it's not sharing the same [332:14] session. and we'll paste it in there and [332:15] we'll see if it downloads. And so [332:16] there's that image. And so that's the [332:18] way that you can share um files to other [332:21] people. But of course, you obviously [332:23] have to set an expiry on there. And so [332:25] that is a a very very good method uh for [332:28] doing that. Um generally like when files [332:31] are in here, they're not easy to move [332:32] around. And so um you know, again, this [332:34] is not a real file system. So except now [332:37] they do have file systems. So this is a [332:38] new feature where you can sync this to [332:39] your computer. But generally this is not [332:41] actually a file system. And so moving [332:43] things around here can be quite painful. [332:45] Um, and if we go over here, I mean, they [332:48] never used to have a dedicated metadata [332:50] tab, but that's kind of interesting. And [332:51] we did apply some kind of metadata here, [332:53] but notice that we don't see any of it [332:54] here. So create metadata configuration [332:57] for your bucket. So create a [332:58] configuration, generate and store [332:59] metadata in S3 metadata tables. So it [333:01] sounds like the automation of uh setting [333:04] up metadata, but we'll do that alone [333:05] because that's more of an advanced [333:06] feature. Uh we'll go under properties [333:08] here and see what other uh options we [333:13] have here. Um so what I'm looking for is [333:17] our bucket policies. They're probably [333:18] under permissions. Here we go. [333:20] Permissions. And so let's say we wanted [333:22] to create a bucket policy, but before we [333:24] can, we have to uh change the block [333:27] access information. So if we go ahead [333:28] here, I'm going to change this out. [333:30] Actually, before I do, I just want to [333:33] show you that if you go into an item, [333:36] notice that it has a URL, like a a [333:40] physical URL. And if I was to open this [333:42] in a new tab, I should not be able to [333:44] access it. See, I get an access denied. [333:47] So, let's say we wanted to make this [333:48] accessible. Uh, so we what we'll do, [333:51] notice we have permissions here, but we [333:53] have to do it at the bucket level. So, [333:54] what we'll do is go to our permissions, [333:56] and we cannot set a bucket policy [333:58] without turning this off. So, we're [333:59] going to say block all public access. I [334:01] actually won't use ACL, so I leave it [334:03] alone. But here we have two, which is a [334:05] new bucket policy or any uh uh objects [334:09] through a bucket policy or access [334:11] policy. So, I'm going to keep those two [334:12] unchecked. So, I can um set a bucket [334:15] policy here. [334:17] And so now with that turned off, if we [334:18] go over here, it should still be access [334:20] denied. And so now we can make our [334:22] policy which will allow us to access it. [334:25] So, I'm going to go ahead here and edit [334:26] it. Now, we do have policy examples. [334:29] And if we scroll on down here, we should [334:31] see one for accessing HTTP requests. [334:35] Here we go. [334:39] And that one's kind of okay. I think [334:42] we'll just write our own here. It's not [334:43] that hard to do. So, here we have our [334:45] statement. And I'm going to go over to [334:46] S3 and we'll choose S3. And we want to [334:49] grant objects. So, we'll say uh get [334:52] object. Here it is. So, get object. And [334:56] uh we can specify the exact resource. So [334:59] we can say all resources or a very [335:01] specific object here. Um so I'm going to [335:05] just say all for now. All resources. [335:10] And you can also identify like a [335:12] principal but like which accounts can [335:14] access it. But we're just going to go [335:15] ahead here and save this resource. [335:17] And here it says missing the Oh, we have [335:19] to have a principal field. Fair enough. [335:21] Okay. And so we'll go ahead here. I'm [335:23] not sure if it shows up under here. [335:24] Principal [335:27] No, I think it's part of the standard [335:29] one, right? Yeah, here. It's not a [335:31] condition. It's it's a literal [335:32] principle. I'm not sure why they don't [335:34] insert it in the editor automatically [335:36] for us, which is fine. Oh, it's right [335:38] here. Sorry. It is inserted here. So, [335:40] we're just saying from anywhere. So, [335:42] anybody from any account, from any user, [335:44] from anywhere is allowed to utilize it. [335:46] We'll go ahead and save it. Um, we do [335:49] have an invalid issue. It could be the [335:52] format of the resource as normally the [335:56] resource is formatted based on um the AR [335:59] of the bucket. So here it's saying [336:01] access to this bucket or file. So I'm [336:03] going to go grab the second one here. [336:06] Notice you can't exactly trust this [336:07] editor. You have to know what you're [336:08] doing. And so I'm going to go ahead and [336:10] grab the bucket name here. And I'm going [336:13] to paste it into place here. And we're [336:14] saying everything in this bucket, all [336:15] the files, um we should be able to read. [336:18] So we'll go ahead and we'll save [336:19] changes. And so now we have our bucket [336:21] policy. So in theory we should be able [336:23] to read the style. Now we h we have [336:25] that. The only problem with this bucket [336:26] policy is that it's very permissive [336:28] because it's saying anything in this [336:30] bucket. And this is where people run [336:31] into problems. So what we can do is just [336:33] lock this down either with conditions or [336:37] saying a very specific resource. So if [336:39] we only wanted to allow this file, what [336:40] we could do is go ahead here and do [336:43] this. And we could go ahead and save [336:45] that. [336:48] Right? And so now we can still access [336:49] it. So, if we had a second image, I'm [336:50] going to upload a second image. We'll [336:52] see um what will happen. So, just give [336:54] me a moment to generate another one. So, [336:56] I've generated a new file. I'm going to [336:57] go back over to um our bucket, which I [337:00] don't know where it is now. So, I'm [337:01] going to just sort based on date, and [337:03] we'll go into the bucket here, and I'm [337:06] going to go ahead and drag on in the [337:08] second one here. And we will upload [337:11] that. And so, now we have uh two two [337:15] images in our bucket. So, what I want to [337:17] do here is just see if I can access the [337:19] other one. So, we'll go ahead and give [337:20] it a hyphen 2, [337:23] right? And we can't. Okay. So, that is a [337:27] good way to implement our um [337:30] permissions. I think there's just one [337:31] other thing that I would like to show [337:33] you while we're in here. And look, look [337:34] at all the types. We have directory, [337:36] table, and vector buckets. They just [337:37] keep adding more and more types, which [337:38] is fine. But, um the thing that I want [337:40] to show you is um life cycle rules. So [337:43] life cycle rules is a means to move [337:46] files from one uh from one tier to [337:49] another. And so this is very useful if [337:50] you need something in long-term storage. [337:52] So something that you use right away, [337:53] but you know after a certain period of [337:55] time it should be infrequently access or [337:57] into glacier storage or deeper storage. [337:59] Uh you might not want to do this if um [338:02] you don't want to be able to delete the [338:04] files. Um sometimes when we move them [338:05] into those other ones, they have to stay [338:06] in other ones after a while. We'll say [338:08] standard uh to uh glacier. Okay. [338:15] Uh we could also just say to infrequent, [338:16] I guess, to if infrequent, but there's [338:19] different rules based on what we're [338:20] allowed to do. So here, limit the scope [338:22] of this rule to using one or more [338:24] filters. Apply. I'm going to say all to [338:26] objects here. So say acknowledge. And [338:28] here we have transition current versions [338:31] of objects between storage classes if we [338:33] have versioning turned on, which we [338:35] don't. Transition non-current versions [338:37] of objects. So, we'll do this one [338:38] because that's what we have is [338:39] non-current versions. [338:41] Here we also have permanent delete [338:43] non-current versions of objects. I kind [338:44] of like this uh delete after a while. [338:46] So, uh delete after a while. I think [338:49] that's a better use case then. That way [338:51] we don't have to worry about these [338:53] buckets sticking around. We can't get [338:54] rid of them. So, permanently delete [338:55] non-current versions. So, days after, so [338:58] there's probably a default number. I'm [338:59] going to give it one, but probably won't [339:00] let me do that. Maybe it will. So, days [339:03] after objects become non-current, number [339:05] of new versions to retain. zero. It says [339:08] one or zero. We'll say one. And [339:12] so here day zero object becomes down [339:15] current. Day one all are are retained. [339:18] And then it does that. So we'll go ahead [339:19] and create that rule. And so now we have [339:21] that rule there. And it's pretty [339:24] straightforward. So it's going to be [339:25] hard for us to observe this because we'd [339:27] have to wait a day. I'm not doing that. [339:30] But I think we basically covered the [339:32] basics, but obviously there's a lot [339:33] going on in S3. Tons and tons of stuff. [339:36] Um, so we're going to leave it there, [339:37] but we'll go ahead and clean up this [339:39] bucket. So, if we want to delete this [339:41] bucket, um, we first have to empty it. [339:43] So, we have to go to the top level here, [339:44] select it, and we'll go delete. But [339:46] it'll say, "Oh, it's not empty." We'll [339:47] go and empty it first. And then to empty [339:49] it, we're'll have to copy this and paste [339:52] it in here as such. And we'll go ahead [339:54] and empty that bucket. And then we'll [339:56] exit it. And we will go and now delete [339:58] this bucket. [340:02] There we go. And we'll delete it. And [340:03] we're all now cleaned up. So, there you [340:05] go. So that's the basics of S3. [340:12] Hey, this is Andrew. In this video, I [340:14] want to just point out some things about [340:15] Elastic Block Store. So Elastic Block [340:17] Store are the virtual drives that you [340:19] attach to your virtual machines. And so [340:21] this uh feature or service lives under [340:24] the EC2 console. So we'll make our way [340:25] over to EC2. You'll notice here we have [340:28] elastic block store where we have [340:30] volumes that we can create snapshots [340:32] which are um saved versions of our [340:36] volumes and we can manage the life cycle [340:38] of our volumes just like uh S3. And so [340:42] um you don't normally need to create [340:44] volumes separately here. I mean really [340:46] depends on what you're doing. But notice [340:47] that we can set the IOPS, the [340:48] throughput, the the size, where it is, [340:52] um if it's being loaded from a snapshot, [340:55] and then this could be attached to a [340:56] virtual machine, but generally you're [340:58] not creating them here first. You [341:00] usually create them on launch. So if we [341:02] go to launch instances here, and we [341:04] scroll on down, we have an option for [341:06] configure storage. And here we can [341:08] change the amount. I believe it goes up [341:10] to 30 gigabytes in the free storage for [341:12] GPT3, GP3. Um, and depending on what [341:16] region you're in, uh, some hardware is [341:18] just not available and specifically [341:19] region availability zone. So maybe in [341:21] Canada Central 1D, I don't have GP3 yet, [341:24] and so I or GP GP3 and I have to use [341:27] GP2, but they're generally [341:30] both really really good, but obviously [341:32] newer is better when it comes to drives [341:34] and features. Um, notice here that it's [341:36] showing that it's not encrypted. Um, and [341:38] so if we wanted more information here [341:40] that we could tweak now, we can uh tweak [341:43] more of that stuff. Not everything, I [341:45] don't think, appears here. Maybe some [341:46] stuff only appears when you're creating [341:47] new volumes, but mostly everything. Uh, [341:49] but here we can just drop this down and [341:51] encrypt it for whatever reason. Um, any [341:53] of us just never encrypted these by [341:55] default. Other providers do. Um, and you [341:58] can turn this on later on. But if you [342:01] can, uh, turn it on now because if you [342:03] don't, then you have to do this whole [342:04] thing where you snapshot it and launch a [342:06] new one. It's a big pain in the butt. [342:08] Um, also notice that like this is the [342:10] root volume. Uh, so, uh, there are some [342:13] limitations of what we can actually [342:15] utilize. So, if I could just give this a [342:17] nice refresh here for a second and we go [342:19] back down to our storage, wherever that [342:23] was. Here it is. Uh, and notice that [342:25] some of these things are grayed out. But [342:26] if I attach another volume, these ones [342:28] can be attached. Okay. So, there are [342:30] just certain things that cannot be a [342:32] root volume. Um, which is totally fine. [342:36] But I think that's about it. So there [342:37] you go. Cha chia. [342:44] Hey, it's Andrew. In this video, we're [342:46] going to explore f elastic file system. [342:48] So we'll go ahead and type in EFS at the [342:50] top here. So EFS is really really useful [342:53] if let's say you have multiple virtual [342:55] machines or even let's say your local [342:57] computer, you want to connect them all [342:59] to the same drive uh so that they are [343:01] sharing the same uh uh stuff. And so [343:04] that is basically what it is. So we're [343:05] basically creating a file system. Um and [343:08] there should be a serverless version [343:10] here. So notice it says throughput [343:11] elastic. So it's basically whatever we [343:13] use. Um you know you can just watch this [343:16] and see how I do it. It's up to you. Or [343:18] you can follow through here. But I [343:20] expect the class to be extremely [343:21] minimal. So say my EFS example as what [343:26] we're creating here. And every time I do [343:28] this they've changed it. So I'm going to [343:30] go ahead and go to customize and see all [343:31] the options. Uh so we have regional or [343:33] one zone. Obviously we want to be [343:35] regional. One zone is for um uh [343:38] low-level latency which we are not [343:39] utilizing. Here we have backups. I'm [343:41] going to turn that off because I really [343:42] do not need backups. Here we have the [343:44] life cycle management. So the idea here [343:46] is that after x amount of days it will [343:47] move stuff over. That is definitely new. [343:49] I'm going to set those to none. Um [343:52] encryption at rest is a great idea. And [343:55] here we have our different modes. We [343:56] have enhanced and bursting. So when I [343:59] used this last there wasn't this many [344:01] modes. So let's give it a review. So [344:02] enhanced provides more flexibility [344:03] through throughput levels and bursting [344:05] provides throughput that scales the [344:07] amount of storage for workloads basic [344:09] performance requirements. And so I don't [344:11] think there's going to be a huge [344:12] difference between these two. Um but [344:15] obviously what's going to be more cost [344:16] effective is choosing elastic over [344:17] provision. Provisioned is we are [344:20] choosing throughput. Um and I do not [344:22] want to figure that out. So we will [344:23] stick with elastic. And down below if we [344:27] wanted to choose more IO we possibly [344:30] could. But in whatever this setup is, [344:32] maybe it's our performance settings not [344:34] going to let us choose that. So we'll go [344:35] ahead and hit next. And so we have our [344:37] mount targets. They always give you a [344:39] bunch. Uh well each technically one for [344:41] every single availability zones. That [344:43] way when you mount it, you can mount it [344:45] to anywhere. Notice that we are [344:46] deploying this into a very specific VPC. [344:48] So our virtual machines and other stuff [344:51] will need to generally set in the same [344:52] VPC if we want it to work. We do have a [344:55] policy editor if we want to um set up [344:58] some file system access. I'm going to [345:00] leave it alone. And basically, we should [345:02] have no problems working with this. Go [345:04] ahead and create that. And we will wait [345:06] for it to create. I think it's instant. [345:07] Uh oh, it's not instant, but it's pretty [345:09] pretty fast normally. There we go. And [345:11] so now we'll go into here. Uh in order [345:13] to utilize it, we're going to need an [345:15] access point. So that is definitely [345:16] something we will need to create. So [345:18] we'll go ahead here and I'll just say my [345:20] access point and it's going to default [345:23] to the uh to the root. So I'll go ahead [345:25] and just put that in there. And there's [345:27] some optional post six information and [345:29] some other root information. I'm going [345:31] to leave all that alone. We'll go go [345:32] ahead and create that access point. And [345:34] so I believe if we click into here, it [345:36] should tell us um instructions on how to [345:39] utilize it. Normally it does. I think [345:42] we're viewing it right now, but in the [345:45] past it would just show us the [345:46] information like I'd have like a thing I [345:48] could click. Oh, view details. Is it [345:50] over here? No. Where's my instructions? [345:52] Oh, you know what? Maybe it's on this [345:54] attach button. Here we go. And so here [345:56] is a method of how we can mount. Now it [345:58] used to be really complicated back in [345:59] the day there used to be a ton of steps [346:01] but u since uh last time they've [346:04] implemented this EFS mount helper and so [346:06] it really does simplify um the process. [346:11] Okay. So if you are mounting uh on other [346:13] systems there's definitely more steps. [346:15] I'm not exactly sure where the docs are [346:16] anymore. They just keep changing it on [346:17] me here. Um but what we'll do is go [346:20] ahead and launch an EC2 instance and get [346:22] this mounted. Okay. So, we will go over [346:26] to here into EC2 and notice that we [346:30] didn't choose any volume size as is [346:32] basically serverless storage. It's going [346:33] to scale based on what we utilize and [346:35] that's what's going to cost. So, we'll [346:37] go ahead and say my new instance and [346:41] we'll just go ahead and launch this. [346:44] Um, if we wanted to attach that file [346:46] system, actually, we probably could go [346:47] here and just do that right here. [346:49] Currently have no file systems on this [346:50] instance. must select a subnet before [346:52] you can add an EFS system. Fair enough. [346:57] I mean, I guess we need an explicit one. [347:00] It should it should have a mount point [347:01] in all directory. So, that should be not [347:03] an issue. So, we could have created it [347:05] right here, but I'm going to go ahead [347:06] and add a file system. And we have this [347:10] one right here. Whoops. So, this [347:12] specified system does not have any mount [347:14] targets. Oops. Oh, that's the maybe the [347:17] old one that that I deleted. So, we'll [347:18] go back over to this one. We'll just [347:20] make sure that is the same one. So we [347:21] have FS0A [347:23] FF0A and so this is obviously an older [347:25] mount point that doesn't exist. It's [347:27] showing its uh location where it'll be [347:29] mounted. We'll go ahead and launch this [347:30] instance. I'm going to proceed without a [347:32] key pair. As I noticed with instance [347:33] connect, we could just get instantly in. [347:36] Um so I'll just do that to get into this [347:38] machine. And so we will wait for this to [347:40] launch. Takes a little bit of time. So [347:42] be back here in just a few minutes. [347:44] Okay. All right. So it's been a few [347:46] minutes. I'm going to give this a [347:47] refresh and see if it is ready. And I'm [347:49] looking for the instance state to be uh [347:51] running. And normally we have two [347:52] checks. We need it to pass. And it's [347:55] still initializing those checks. So I'm [347:57] going to wait for those to finish. And [347:59] then we will connect. All right. And so [348:01] our status checks have should have [348:02] passed by now. We'll go ahead and [348:04] connect to this instance. Um and so I'm [348:07] just going to use the EC2 instance [348:08] connect as that is a direct way to get [348:11] into this machine. And so the question [348:14] is is it already mounted which would [348:16] save us a lot of steps as normally you [348:18] would have to run stuff but I'm assuming [348:20] that it might have already done that. Um [348:22] so we are now in this machine and I want [348:25] to take a look at where that pathing [348:27] was. So normally like might have the [348:30] volume directory. Let me see here. So [348:32] we'll do ls- la at the root directory. [348:35] Um [348:37] and do we have a mount directory? M mnt. [348:40] That's usually what we want to go into. [348:41] CD mount. [348:44] Oh, sorry. For slashmount. There we go. [348:47] And we do have EFS. There it is. Oops. [348:49] Type in clear because I can't see what [348:50] I'm doing. And we'll do EFS. FS1. [348:55] And so we, I believe, are in that drive. [348:58] So, I'm going to go ahead and just touch [348:59] a new file here called hello.txt. [349:02] And we don't have permissions. So, I'll [349:04] just put pseudo in here. And so, now I [349:07] seem to have this file. So the idea here [349:08] is that this file now lives in EFS EFS. [349:13] Actually, I'm just going to edit this [349:14] file. You can do nano if you want. I [349:16] believe nano is I don't like nano, but [349:18] it's an easier way to work with it. Say [349:20] hello world in here. So I'm just typing [349:21] hello world. It's just a built-in [349:24] editor. [349:26] Hello. [349:28] I'm having such a hard time typing it. [349:30] And then uh we have here control X. So [349:32] I'll do control X to quit. And I'll say [349:36] Y for yes. And I'll hit enter. We get [349:40] permission denied. So I'll just hit X [349:41] and I'll just say no. And so we'll try [349:44] this again with pseudo on that. And so [349:46] I'll just type in hello world. And then [349:48] I will exit. And I'll say yes and enter. [349:53] And now I just want to make sure that [349:55] content is there. So I'll go ahead and [349:56] there it is. So the idea is that the [349:58] file system does not live with the EC2 [350:01] instance. And so if I was to tear this [350:03] down and launch a new one, I should be [350:05] able to get it. In fact, I could have [350:06] two connect at the same time and and [350:09] share the data. I'm not going to go that [350:10] complicated. I do show that in the more [350:12] advanced courses, but we're going to [350:13] keep it simple here. So, I'll say my web [350:15] server too. And we did well my my [350:19] storage server or just my my server 2. [350:21] My server 2, but we did tear down the [350:23] other one. So, we'll go all the way down [350:24] here. And it doesn't matter what um [350:27] subnet we put it in because there are [350:29] again mount zones everywhere. So, we'll [350:31] go over to here and I'm going to go over [350:33] to our file system. choose EFS and we [350:36] will add a shared file system. There it [350:38] is. [350:40] And so this one's over here. Now we'll [350:41] go ahead and launch this instance. We'll [350:43] launch without a key pair. Whoops. [350:46] And we be back in just a moment uh when [350:49] it passes both those checks and it is uh [350:52] online and available. Okay. [350:58] All right. It's been a while. Let's take [350:59] a look here and see if it's ready. So [351:00] the instance is uh ready. Did it pass it [351:02] checks? Um, no, no, not yet. Okay, I'll [351:07] just continue waiting. Usually, I [351:08] remember it being faster than this, but [351:10] that's fine. We'll wait. All right, so [351:12] our paths have uh checked our checks [351:14] have passed and we'll go ahead and give [351:16] this a connection over to here [351:21] and [351:23] we should be connected. Good. So, we'll [351:25] go over to that mount directory and all [351:26] we're observing here is is that file in [351:28] there. That's all we care about, right? [351:30] So, we go into here. There it is. I'm [351:33] going to just cat out the contents. So, [351:35] yeah, it's, you know, storage or a file [351:38] system that we can mount and utilize in [351:41] other places. So, it's quite nice there. [351:43] Uh, and that's all I really wanted to [351:45] show you. Of course, there's a lot more [351:46] that we can do with it, but um, again, [351:48] we're just keeping it nice and simple [351:49] here, so you just get some experience [351:51] with this tooling. I'm going to go over [351:53] here and see if I can tear down the EFS. [351:55] I wonder if there was a reason why my [351:57] old one wasn't torn down. It still isn't [351:59] torn down. So, I'm going to go ahead [352:01] here. probably have to delete the access [352:03] points first. Usually, this is how they [352:04] like you to do things is first you [352:06] delete the access point and then we'll [352:09] go ahead and try to delete this. [352:12] Mhm. [352:16] Okay. Does that work? [352:18] And [352:21] this one's deleting the mount. So, [352:22] that's good. Well, that one's going. I'm [352:24] going to go get rid of my other one. [352:25] It's the same procedure. Probably what I [352:27] didn't do was delete the access point in [352:29] my old one. Yeah. And that's probably [352:31] why it did not get rid of it. [352:37] Okay. And I'll just go back over to [352:39] here. Whoops. And so now they should be [352:42] gone. There we go. See you the next one. [352:44] Chow chow. [352:50] Hey, this is Andrew Brown from Exam Pro [352:52] and we are taking a look at what is a [352:54] database. So a database is a data store [352:57] that stores semistructured and [352:58] structured data. And just to emphasize a [353:01] bit more, a database stores more complex [353:04] data stores because it requires using [353:06] formal design and modeling techniques. [353:08] So databases can generally be [353:10] categorized as either being relational. [353:12] So structured data that strongly [353:13] represents tabular data. So we're [353:16] talking about tables, rows, and columns. [353:18] So there's a concept of row oriented or [353:20] colummer oriented. And then we have non [353:23] relational databases. So these are [353:25] semistructured that may or may not [353:27] distinctly resemble tabular data. So [353:30] here is a very uh simple example. The [353:32] idea is that you might some use some [353:33] kind of language like SQL put in your [353:35] database and you'll get back out tables [353:37] for relational databases. Let's just [353:39] talk about some of the functionality [353:40] that these databases have. So they could [353:42] be uh using a special specialized [353:44] language to uh query. So retrieve data. [353:46] So in this case SQL specialized modeling [353:49] strategies to optimize retrieval for [353:51] different use cases. uh more fine-tuned [353:54] control over the transformation of the [353:55] data into useful data structures or [353:57] reports and normally a database infers [354:00] uh someone is usually using using a a [354:02] relational row oriented data store. So [354:05] um you know just understand that when [354:07] people say database that's usually what [354:08] they're talking about like Postgress, [354:09] MySQL relational row store is usually [354:12] the default but obviously there there's [354:14] a lot more broader terms there. Okay. [354:20] Hey, this is Andrew Brown from Exam Pro [354:22] and we are taking a look at what is a [354:24] data warehouse. So it's a relational [354:26] data store designed for analytical [354:28] workloads which is generally column [354:30] oriented data store. Okay, so companies [354:33] will have terabytes and millions of rows [354:35] of data and they'll need a fast way to [354:37] be able to produce analytics reports. So [354:40] data warehouses generally perform [354:41] aggregation. So aggregation is the idea [354:43] of grouping data together. So find a [354:45] total or an average. Uh, and data [354:47] warehouses are optimized around columns [354:49] since they need to quickly aggregate [354:51] column data. And so here's kind of a a [354:54] diagram of um a data warehouse. And so [354:57] the idea is that it could be ingesting [354:59] data uh from a regular database. Here [355:02] I'm just getting out my pen tool. So it [355:03] could be a regular database or it could [355:04] be coming from a different data source [355:06] that isn't compatible in terms of a [355:07] schema and you use like ETL or ELT uh or [355:11] ETL to get that data into that data [355:14] warehouse. So data warehouses are [355:16] generally designed uh to be hot. So hot [355:19] means that they can return queries very [355:20] fast even though they have vast amounts [355:22] of data. Data warehouses are [355:24] infrequently accessed, meaning they [355:25] aren't intended for real-time reporting, [355:27] but maybe once or twice a day uh or once [355:30] a week to generate business and uh user [355:32] reports. Of course, it's going to vary [355:33] based on the um the service that is [355:36] offering the data warehouse. A data [355:38] warehouse needs to consume data from a [355:39] relational database on a regular basis. [355:41] And again, it can consume it from other [355:43] places, but you'll have to transform it [355:44] to get it in there. Okay. [355:50] Hey, this is Andy Brown from Exam Pro [355:52] and we're taking a look at a key value [355:53] store. So, a key value store or database [355:55] is a type of non-reational database or [355:57] NoSQL that uses a simple key value [356:00] method to store data. And so, key value [356:02] stores are dumb and fast. Uh, but they [356:04] generally lack features like [356:05] relationships, indexes, aggregation. Of [356:08] course, there are going to be providers [356:09] out there that have managed solutions [356:10] that might uh polyfill some of those uh [356:13] issues there. But I want to show you the [356:15] underlying way that key value stores [356:16] work to kind of distinguish them between [356:19] document stores. So a key value store is [356:22] literally a unique key alongside a [356:24] value. And the reason I'm representing [356:26] that as zeros and ones is because I want [356:28] you to understand that that's what it [356:30] is. It's basically just some kind of of [356:33] data there and how the key value uh [356:36] store interprets it is going to [356:38] determine what it is. So when you look [356:39] at a document database that is just a [356:42] key value store that uh uh interprets [356:45] the value as being documents, right? And [356:48] so key value stores can and do commonly [356:51] store um uh multiple uh like an [356:54] associative array. That's pretty common. [356:56] So even for Dynamo DB, that's how it [356:58] does it. And so that's why when you look [357:00] at a key value store, it looks like it a [357:03] a table, but it's not actually a table. [357:05] It's schema list because underneath it's [357:08] really just um you know that associative [357:10] array. And so that's why you can have uh [357:12] columns or sorry rows that have uh [357:16] different amounts of columns. Okay, so [357:19] due to the design, they are able to [357:21] scale very well beyond a relational [357:23] database and they can kind of work like [357:25] a relational database without all the [357:26] bells and whistles. So hopefully you [357:28] know that makes sense. Okay. [357:34] All right. Let's take a look at document [357:36] stores. So a document store is a NoSQL [357:38] database that stores documents as its [357:40] primary data structure. And a document [357:43] could be an XML uh type of uh structure. [357:46] But it also could be something like JSON [357:48] or JSON like document stores are [357:50] subclasses of key value stores. uh and [357:53] the components of a document store are [357:56] very uh comparable to relational [357:58] databases. So just kind of an example [358:00] here where in a relational database [358:03] they'd be called tables. Now you have [358:04] collections, they were called rows, now [358:06] they're called documents, you had [358:07] columns, they had fields, they may have [358:10] indexes, and then joins might be called [358:12] embedding and linking. So you can [358:13] translate that knowledge over. uh you [358:16] know they they're not as um they don't [358:18] have the same kind of feature set as a [358:20] relational database but you have better [358:21] scalability and honestly document stores [358:24] are just key value stores with some [358:25] additional features built on top of it. [358:27] Okay. [358:32] Hey Brown from Exam Pro and we're going [358:34] to take a look at the NoSQL database [358:36] services that are available on AWS. So [358:38] we have Dynamob which is a serverless [358:40] NoSQL key value and document database. [358:43] is designed to scale to billions of [358:44] records with guaranteed consistent data [358:46] returned in at least a second. You do [358:49] not have to worry about managing shards. [358:52] And DynamoB is Adabus' flagship database [358:55] service. Meaning whenever we think of a [358:57] database service that just scales, is [358:59] cost-effective and very fast. We should [359:01] think of DynamoB. And in 2019, Amazon, [359:04] the online shopping retail uh shut down [359:06] their last Oracle database and completed [359:08] their migration to DynamoB. So they had [359:11] 7,500 Oracle databases with 75 pabytes [359:14] of data and with Dynamob they reduced [359:17] that cost by 60% and reduced the latency [359:19] by 40%. So that's kind of to be like a [359:22] testimonial between relational and a [359:24] NoSQL database. So when we want a [359:26] massively scalable database that is what [359:29] we want Dynamob for and I really just [359:31] want to put that there because it if you [359:33] remember that you're going to always be [359:35] able to pass uh or get those questions [359:37] right on the exam. Okay. Then we have [359:39] document DB. So this is a NoSQL document [359:41] database that is MongoDB compatible. Uh [359:44] so MongoDB is very popular NoSQL among [359:47] developers. There were open source [359:49] licensing issues around using open [359:50] source MongoDB. So Adus got around it by [359:52] just building their own MongoDB database [359:54] basically. So when do you want a MongoDB [359:57] like database? You're going to be using [359:59] document DB. We have Amazon keyspaces. [360:02] This is a fully managed Apache Cassandra [360:04] database. So Cassandra is an open source [360:06] NoSQL key value database similar to [360:08] Dynamob that is colummer store database [360:11] but has some additional functionality. [360:12] So when you want to use Apachi Cassandra [360:14] you're using Amazon key spaces. [360:21] Hey this is Andrew Brown from Exam Pro [360:23] and we are taking a look at relational [360:24] database services starting with [360:26] relational database service RDS and this [360:28] is a relational database service that [360:30] supports multiple SQL engines. So [360:33] relational is synonyominous with SQL and [360:35] online transactional processing OLTP and [360:38] relational databases are the most [360:40] commonly used type of database among [360:42] tech companies and startups just because [360:44] they're so easy to use. I use them. I [360:46] love them. Um RDS supports the following [360:49] SQL engines. We first have MySQL. So [360:52] this is the most popular open source SQL [360:54] database. Uh and it was purchased and is [360:56] now owned by Oracle. Uh, and there's an [360:59] interesting story there because when [361:01] Oracle purchased it, they weren't [361:02] supposed to have it. Um, Mario DB was or [361:04] sorry, MySQL was sold to Oracle Sun [361:06] Systems and then within the year um, uh, [361:10] Oracle purchased it from them and the [361:13] original creators never wanted it to go [361:14] to Oracle um, just because of their uh, [361:17] the way they do licensing and things [361:18] like that. And so um the original [361:21] creators came back and they decided to [361:23] fork MySQL and then maintain it as [361:25] Mariab just so that uh you know Oracle [361:29] never kind of pushed away the most [361:30] popular um database so that everyone had [361:33] to go to a paid solution. Then you have [361:35] Postgress. So Psql as it's commonly [361:37] known is the most popular open source [361:39] SQL database among developers. This is [361:41] the one I like to use because it has so [361:43] many rich features over my school. Uh [361:45] but but it does come with added [361:46] complexity. Then Oracle has its own SQL [361:49] proprietary database which is well used [361:51] by enterprise companies but you have to [361:53] buy a license to use it. Then you have [361:56] Microsoft SQL. So Microsoft's [361:58] proprietary SQL database and with this [362:00] one you have to buy a license to use it. [362:02] Uh then you have Aurora. So this is a [362:04] fully managed database. Uh and there's a [362:07] lot more to go uh going on here with [362:09] Aurora. So we'll talk about it. It [362:10] almost acts as a separate service but it [362:12] is powered by RDS. So Aurora is a fully [362:15] managed database of either MySQL so five [362:18] times faster or Postgress SQL three [362:20] times faster database. So when you want [362:23] a highly available, durable and scalable [362:26] and secure relational database for [362:28] Postgress MySQL, you want to use Aurora. [362:30] Uh then you have Aurora serverless. So [362:32] this is a serverless ondemand version of [362:34] Aurora. So when you want the most of the [362:36] benefits of Aurora but you can trade uh [362:39] off to have cold starts or you don't [362:41] have lots of traffic or demand uh this [362:43] is a way you can use Aurora in a [362:44] serverless way. Then you have RDS on [362:47] VMware. So this allows you to deploy RDS [362:49] supported engines to onremise data [362:51] centers. Uh the data center must be [362:53] using VMware for server virtualization. [362:56] So when you want databases managed by [362:58] RDS on your own database center. Uh and [363:01] yeah I realize that this is a small [363:02] spelling mistake. should say just on [363:04] here, but yeah, there you go. [363:10] Hey, this is Andrew Brown from Exam Pro [363:12] and we're looking at the other database [363:13] services that AOS has because there's [363:15] just a few loose ones here. So, let's [363:16] talk about Redshift. So, it is a pabyte [363:19] size data warehouse and data warehouses [363:21] uh are for online analytical processing, [363:24] OLAP. And data warehouses can be [363:26] expensive because they are keeping data [363:28] hot, meaning that they can run a very [363:30] complex query and a large amount of data [363:32] and get that data back very fast. So [363:34] when you need to quickly generate [363:36] analytics or reports from a large amount [363:38] of data, you're going to be using [363:39] Redshift. Then you have elastic. So this [363:42] is a managed database of an in-memory [363:44] and caching open source databases such [363:46] as Reddus or memcache. So when you need [363:48] to improve the performance of an [363:50] application by adding a caching layer in [363:51] front of your web servers or database, [363:53] you're going to be using elastic. Then [363:55] you have Neptune. This is a managed [363:58] graph database. The data is represented [364:00] as interconnected nodes. I believe that [364:02] it uses Gremlin as the way to interface [364:04] with it, which is no surprise because [364:06] that's what it looks like most cluster [364:08] providers are using. So when you need to [364:10] understand the connections between data, [364:12] so mapping fraud rings or social media [364:14] relationships, uh very relational [364:16] database heavy information, you're going [364:18] to want to use Neptune. We have Amazon [364:20] time streams. It's a fully managed time [364:22] series database. So think of devices [364:24] that send lots of data that are [364:25] time-sensitive such as IoT devices. So [364:28] when you need to measure how things [364:29] change over time, we have Amazon quantum [364:32] ledger database. This is a fully managed [364:35] uh ledger database that provides [364:36] transparent immutable cryptographically [364:39] variable transaction logs. So when you [364:41] need to record a history of financial [364:43] activities that can be trusted. And the [364:45] last one here is database migration [364:47] service DMS. It's not a database per se [364:50] but it's a migration service. So you can [364:53] migrate from on premise database to AWS [364:56] from two databases in different or same [364:58] ad accounts using different SQL engines [365:00] and from an SQL to a NoSQL database. And [365:02] I'm pretty sure we cover this in a bit [365:04] uh greater detail in this course. Okay. [365:11] Hey, this is Andrew. In this video, [365:13] we're going to go ahead and explore [365:14] Dynamob. So, let's make our way over to [365:17] the NoSQL database that is cheap, fast, [365:21] and cool. Um, so what we'll need to do [365:23] is create a new table. So, we'll just [365:24] say my new table. Doesn't really matter [365:26] what it is. And generally, you'll always [365:28] have to set a partition key. uh you [365:30] don't need the sort key, but if we just [365:32] had to do two, we'll do email as a [365:34] string. And then here we'd have created [365:36] at date. Um there is a bit of a [365:38] sensitivity when treating uh created at [365:40] dates as or dates because you don't [365:42] necessarily have a date format, but you [365:45] can interpret date formats particular [365:46] way. So you there is a bit of a strategy [365:48] around choosing the correct date and [365:50] whether that's compatible with TTL, but [365:52] we're not going to worry about that [365:53] right now. You can see that we have a [365:55] bunch of default settings. Let's go to [365:58] customize. So we can exp explicitly see [366:00] what they they are. So we have standard [366:02] and in infrequent access. So we're going [366:04] to leave it on standard. We have on [366:06] demand and provisioned. So on demand in [366:08] this case is um basically whatever you [366:11] use. It's like the most serverless. This [366:12] is a serverless service, but this one is [366:14] uh truly serverless in the sense that um [366:17] it's exactly what you use and nothing [366:18] else. For provision, you're saying, [366:20] "Hey, I need a guaranteed throughput um [366:22] of a particular min and max for reads [366:25] and writes." Um, but for this we're just [366:27] going to stick with on demand. Uh, we'll [366:29] scroll on down here. And so we can set [366:30] up secondary indexes, which we do not [366:32] need. Um, we have our encryption, which [366:34] is turned on by default. Uh, we can turn [366:36] on deletion protection, which I'm not [366:38] going to do. And then we can manage our [366:39] policies. And we'll go ahead and create [366:41] this table. And this creates extremely [366:44] quickly. [366:45] Usually does because there's not much [366:48] going on here. But we will just pause [366:49] here and wait. Okay. And there was [366:51] really no reason to pause because it's [366:52] already created. We'll go ahead here and [366:54] let's go and insert some data. So, we'll [366:56] explore the table items and somewhere [366:59] here we should be able to create a new [367:00] item. But notice that we can add [367:02] whatever kind of attributes we want. So, [367:05] um I can go here and just say Andrew at [367:07] exampro.co. [367:08] We'll say the date, whatever it is. I [367:10] don't know what the date is. So, I'm [367:11] going say 2050 [367:13] for fun. And then we have this and we [367:15] say uh the real Andrew. [367:18] Okay. And we can go ahead and create [367:19] that item. But each item because it's a [367:22] nosql database does not have to follow [367:24] the same schema. So we'll go here say [367:26] bico examro.co and this will be 2025 or [367:30] 2050 it's not 2025 but 20 2050 uh056 [367:36] and we will add another attribute which [367:38] is um we'll say number and we'll just [367:42] say how many tires tire count [367:46] and we'll put six. Again this I'm not [367:48] trying to make any kind of logical data. [367:49] I'm just showing that you can make [367:50] records here and that they um do not [367:53] have to be the same. So, we would [367:55] normally use code like an API to extract [367:58] data, but they do have the uh particle [368:01] editor. I always called this party uh uh [368:04] party QL, but then someone's like, "Oh, [368:06] it's called particle." I'm like, "Oh, [368:08] okay." But this allows us, I believe, to [368:10] utilize um SQL uh in a natural way if [368:14] you do not want to uh work with another [368:16] way. So, I'm just going to go ahead and [368:18] see if we could find some documentation [368:20] on the party Q or particle [368:24] particle SQL. Actually, it might automp [368:26] complete if we just go start typing. We [368:28] select from or what do we do if we click [368:31] this over here? [368:34] No, that's not very helpful. But we'll [368:35] go over to here and find out via the [368:37] user guide. So, somewhere here we should [368:40] see particle [368:42] particle. [368:43] Nope. [368:45] And so we'll just search for that [368:48] uh for examples here. Here we go. Okay. [368:51] So we have select expression from table [368:53] condition. And I'm just trying to look [368:55] for a full example. So here is kind of [368:58] one. So we'll go ahead and just paste [369:00] this in. We'll have to go grab our table [369:02] name. [369:04] So it's my new table. [369:07] And we'll go here with email. [369:11] I'm not sure if we title case that or [369:12] not. [369:15] If we go to explore our items here, it's [369:18] capitalize [369:21] and we'll say email [369:25] with andrewexampro.co. [369:28] Notice that it says it will incur [369:29] charges. If you do not want to incur [369:31] charges, you don't have to run this, but [369:33] I know it's going to cost me pennies, so [369:34] I'm not going to be worried about it. [369:36] Um, and so there's something that is not [369:37] fully formed in the statement. Maybe we [369:39] need double quotations around uh that [369:41] string there. There we go. And we do not [369:44] get any results back. So there's [369:45] something wrong [369:48] with my query. So I'm going to just take [369:50] a moment here to use chatbt and maybe it [369:52] will help us through our query. So I'm [369:55] going to go ahead and say I'm using [369:56] parti particle. [369:59] I get no results back [370:02] even though email is my primary [370:06] primary key. [370:09] Okay. Okay. And we'll just wait a moment [370:10] here and see if I can get a better [370:12] query. I'm doing this offscreen here. [370:14] It's going uh it's your quotas. It's not [370:16] your primary key. Oh, it's your quotes. [370:18] Okay. So, we'll go ahead and we'll try [370:22] um singles. [370:24] But what's strange here is they're [370:25] showing doubles and then singles. That [370:26] would have took forever to figure out. [370:28] So, I'm glad if that's the case that [370:29] it's helping us out here. And look at [370:31] that. Isn't that bizarre? [370:33] But there are there are reasons for that [370:35] probably. But anyway, we were able to [370:36] query our data. But that is DynamoB in a [370:39] nutshell. There's just way too much [370:40] about the service. Um, and this is [370:42] something that we would cover [370:45] in uh in a more advanced course, but [370:48] this is enough for now. But there you [370:50] go. That is Dynamo DB. [370:57] Hey, this is Andrew. In this video, [370:58] we're going to launch our own database [371:00] using RDS. So, let's go to the RDS [371:03] console and launch something new. [371:05] So here we will go to databases and [371:09] create ourselves a new database. [371:12] Um, and notice we have like express [371:14] configuration, full configuration. You [371:15] just have to click into that. I don't [371:16] like that they're doing that. We'll [371:17] click here. Oh my goodness, they really [371:21] are making things confusing. I do not [371:23] like this. But you can obviously change [371:24] your options and launch it. I'm not [371:27] going to do it that way. I'm going to go [371:28] the full configuration mode so we can [371:31] see all of our options. So here we have [371:32] a lot of different types of databases. [371:34] Postgress, [371:36] Maria, which is just a uh a flavor or a [371:39] fork of MySQL, but I'm going to go with [371:42] Postgress. Now, Aurora is great, except [371:44] it gets very expensive very quickly, and [371:46] we want something to be very cost- [371:47] effective and something practical. So, [371:49] we'll start with Postgress, which is um [371:51] very popular amongst developers um just [371:53] because it can do basically everything [371:55] and it's easy to use. Here we have full [371:58] configuration or easy create. We're [371:59] going to continue continue on with full [372:00] creation. We have production, dev, test [372:02] or free. We're going to go free tier. [372:04] And so that's going to make sure that it [372:05] launches in a single availability zone. [372:08] Um we have our engine. So you want to [372:10] try to use the latest engine as that'll [372:12] make things a lot easier. Uh there is [372:14] the database identifier um which you [372:16] cannot change later. So I would probably [372:19] suggest making this something very very [372:21] clear. Um but I'm going to leave it [372:23] alone. We have the master username which [372:25] is Postgress. [372:27] And then we can set our password. I'm [372:28] going to just make the password capital [372:30] T. testing one two three four five six [372:33] um and capital T testing one two three [372:36] four five six so definitely not [372:38] something super secure but it will work [372:41] I'll give it an exclamation mark at the [372:42] end here that might just help boost the [372:44] strength there we go we're going to [372:46] stick with password authentication so [372:47] there's definitely multiple ways that we [372:49] can authenticate again all these [372:50] settings we would cover in greater [372:52] detail in advanced courses um and then [372:55] we can choose our instance type so [372:57] apparently there's now a T4G micro Um, [373:00] I'm still old. I remember like when [373:02] there was a T1, you know, but now we're [373:03] on to T4, which is totally fine. Uh, the [373:06] availability of instance types is going [373:08] to vary based on your region. So, some [373:10] might not have this and then you might [373:11] have to use a um a T3. Um, and so it's [373:14] going to depending on where you are. We [373:16] can obviously choose our uh disc. I [373:18] would prefer GP GP3. I don't see why we [373:21] would ever not use GP3 if it's a if it's [373:24] available. Um, and then we'll go down [373:26] below here. uh don't connect EC2 compute [373:30] resources or be able to connect to it. I [373:32] think I would like to be able to do that [373:33] because I'm going to want to use an EC2 [373:35] instance to connect to this and that [373:36] will set us a b a bunch of stuff up [373:38] here. But we will have to launch an EC2 [373:40] instance beforehand so that we can [373:42] actually uh do that. I'm going to just [373:44] do that right now. Normally I would use [373:46] some kind of thirdparty thing to connect [373:48] to the database, but um I think this [373:50] will be the easiest way to do it. So [373:51] I'll just say my web server. We'll [373:52] pretend that this is the thing that [373:53] we'll be connecting um to it. And in [373:57] here, we'll stick with Amazon Linux, [373:59] which should be fine, a T3 micro. And [374:02] we'll go ahead and launch this instance. [374:04] I'm going to go proceed without key pair [374:06] as we can just um use EC2 um connect [374:11] serial connector or whatever it's called [374:12] to get into this uh instance. So, we [374:15] will just wait for that to launch. Um or [374:19] I don't think we have to wait, but we [374:20] can go over [374:22] uh to our RDS. I already closed it out. [374:27] We'll have to go back over to RDS and [374:28] start that process all over again, which [374:30] we might have had to do anyway to be [374:31] honest. So, we'll go here and I do not [374:34] like that. So, we'll go over to [374:35] database, go to full configuration, [374:38] choose Postgress, and just continue down [374:41] here. Again, this is how you learn [374:43] folks. You do it once, you do it twice, [374:45] you do it three times. It's okay if we [374:47] are backing out here. Okay, so we choose [374:49] single availability zone. This is going [374:51] to stay the same. This is going to stay [374:53] the same. Um, [374:56] they do have credential manage here. [374:57] Actually, I'm going to say self-manage [374:58] because if you have this, this is going [375:00] to cost you $1 and I do not want to pay [375:02] that. And so, we now have our password [375:04] here. So, capital T testing 1 2 3 4 5 6. [375:06] One thing I noticed was [375:09] um Oh, free tier. That's why this looked [375:11] a little bit different because before we [375:13] it didn't show us that option, right? It [375:14] was already um showing us to ask for us [375:17] our password. So go ahead and try this [375:19] again. Capital T testing 1 2 3 4 5 6 [375:22] exclamation mark. Um this is fine. We'll [375:25] switch this over to GP3 if it's [375:27] available. If it's not for you, that's [375:28] totally fine. We do want to connect to [375:30] an EC2 compute resource and we will [375:32] choose this one here. [375:34] So it says adding EC2 compute resource [375:36] automatically selects the BP subnets and [375:38] public access settings. So this will [375:40] make things super super easy for us. Um, [375:43] after the database is created, you [375:44] cannot change the VBC. That's totally [375:45] fine. [375:47] And we do want automatic setup. And here [375:50] it's not letting us set public access, [375:52] which is totally fine. So, normally, you [375:55] know, what I would do is I wouldn't use [375:56] an EC2 instance, and I would just set [375:58] this to be um public access, and then we [376:01] would just connect with it. But we're [376:02] going to just try a different way today. [376:04] Okay. [376:06] Um, and just looking for any other [376:08] settings. We don't need RDS proxy. [376:09] That's useful if you are you use a llama [376:11] and you need some kind of um uh pooling [376:15] of pull requests. We're not doing that. [376:18] We have the certificate there which is [376:19] fine. The port is 5432 which is what it [376:21] should be. Um we'll stick with standard. [376:24] We don't need anything else uh for that. [376:25] In fact, we can just disable performance [376:27] insights as I do not need that [376:28] information. [376:33] And [376:35] I think that might be everything. Oh, [376:37] initial database name. We'll just say um [376:42] we'll just say [376:44] to-do prod as our application here. I do [376:48] not want uh backups on as this is just [376:50] for fun. Encryption can stay on. That's [376:53] totally fine. Um no maintenance window [376:56] period. So that is fine. So there should [376:58] be no real cost with using this. So [377:00] we'll go ahead and create this database. [377:01] And this does take some time. If we had [377:05] backups turned on, the first thing it [377:07] would do is create a snapshot. We'd be [377:08] waiting here forever. So that's why we [377:10] skip that. And so we will just uh wait [377:13] until this is ready. Okay. [377:16] All right. So our database is up and [377:19] ready. What we're going to do is go over [377:20] to our EC2 instance here and see if we [377:23] can establish a connection. So um to our [377:26] actual database, but first we'll get in [377:27] here. In order to do that, we're going [377:29] to need the Postgress client. Now I [377:31] don't remember what it is. uh to install [377:33] here but we will just go over to chatbt [377:35] and say how do I install the Postgress [377:38] PS client on Amazon Linux 2 or 2003 or [377:44] whatever. Yeah, it says 2023 2023 here. [377:47] They keep changing it on us could be [377:50] even a newer one here. And so here [377:52] suggesting that we [377:55] grab it like this [377:57] and we will Oops, it didn't copy copy [378:00] paste. So I'll just write it in here. No [378:01] big deal. [378:03] PostgrassQL. [378:06] If that gets us installed, we will be in [378:08] good shape here in just a moment. [378:11] I mean, it seems like it's thinking. [378:17] There we go. Okay, now it's waking up. [378:20] Says there's not a match here. So, now [378:21] it's saying to go ahead and do this. Uh, [378:24] which kind of makes sense. We'll go [378:25] ahead and choose 15. though um I think [378:28] it matters which version of Postgress [378:31] that we launch but generally there is a [378:33] certain level of backwards compatibility [378:34] so this might be fine so we'll go ahead [378:36] and do this and so it's absolutely [378:38] grabbing it now great so now we have the [378:40] Postgress client so to connect to it [378:42] we're going to need a URL string which [378:44] we'll need to assemble so we'll go over [378:46] to here and we need the endpoint URL [378:50] um so what I'm looking for it's actually [378:52] kind of interesting that we have oh did [378:54] they did they uh make it so we easily [378:57] connect to it because this is not [378:58] something that they used to do before. [379:01] Code snippet cloud shell. Wow, this is [379:02] really really nice. I like the fact that [379:04] they do this. So here it says connection [379:05] steps. Follow the steps below. [379:08] Um so here we have the global PM. [379:13] Okay. Yeah, let's give this a try. I was [379:15] not expecting this. Okay, so we'll go [379:18] ahead and paste this in. [379:21] I'm telling you folks, I've been using [379:22] Adabus for a long time and teaching it [379:24] for a long time, but every time I go on [379:26] this console, you never know what you [379:28] are going to find. [379:31] Um, so you just got to keep up with the [379:33] changes. So go ahead and we will copy [379:37] this [379:40] and rightclick paste. I'm uh doing [379:42] rightclick copy paste just because it [379:43] gets a little bit finicky here. And so [379:45] we should be able to connect to our [379:47] database now. Well, it' be nice if we [379:49] can. [379:51] And what's the password? Capital T. [379:52] Testing 1 2 3 4 5 6 exclamation mark. [379:56] And we are in. So, I'm going to go over [379:58] here and just uh you know, give me a [380:01] table with some data for Psql for um a [380:06] to-do app. Okay. And we'll just wait a [380:09] moment here. [380:12] There we go. So, we'll go ahead and [380:13] create a table. [380:15] Paste. Hit enter. We just created our [380:18] table. And there's some C data. [380:22] Paste. We'll hit enter. And so now I can [380:25] just say select all from to-dos. There's [380:28] our data. Turn X on. We'll say select [380:32] all limit one. [380:34] There we go. So that worked. It's quite [380:36] nice. Um, now of course having another [380:40] instance just to connect to it is kind [380:43] of expensive, but like if this is your [380:44] web server, then that's a non-issue, [380:46] right? Um and really like your database [380:48] you don't really want it to be public [380:49] facing. So connecting through an [380:51] instance should be always the case uh [380:52] that you are utilizing here. But we are [380:54] done now. Let's go ahead and delete this [380:56] database. Um cannot create the snapshot [380:59] because uh it will identify as already [381:02] exists. Okay. So it wants to create a [381:04] snapshot. I actually don't want a [381:05] snapshot. I just want it to delete. So [381:06] we'll try this again. So I'm going to [381:08] turn off the snapshot here because [381:10] that's going to slow things down. I mean [381:12] you might be making a snapshot and [381:13] that's totally fine. it just takes [381:15] forever. So I acknowledge I'm not using [381:17] snapshot. So that is now spinning down. [381:20] We'll go over to our EC2 instance and we [381:23] will go ahead and terminate this. [381:26] There we go. And I will just wait here [381:29] and confirm everything is done just [381:30] because you know if we forget about [381:32] these they can get expensive. So I do [381:34] not want to forget them. Okay. All [381:35] right. Looks like everything is cleaned [381:37] up and we'll just give this a refresh. [381:39] Yes, we are good. I'll see you in the [381:41] next one. Cha. [381:46] All right, let's take a look at [381:47] Redshift. So, Redshift is a data [381:49] warehouse and it's generally really [381:51] expensive. So, it's not something that [381:52] you're going to want to launch uh [381:54] dayto-day here, but let's see how far we [381:56] can get with it um just by running [381:58] through it. So, what we'll do is go [382:00] ahead and create a cluster. And again, [382:01] you can just watch me do this. You don't [382:02] have to create uh you don't have to [382:03] create one yourself. Uh so, free trial [382:05] configure for learning. That sounds good [382:07] to me. Uh is free for a limited time if [382:09] your organization has never created a [382:11] cluster. Well, I rarely ever create [382:12] these. So when the trial ends, delete [382:14] your cluster to void the charges of on [382:16] demand. Okay, that sounds fair. Um, so [382:19] here we're going to have two V3 CUS. [382:21] It's going to launch a D a DC2 [382:25] large. [382:27] So let's look that up for pricing. [382:33] Show me prices, please, please, please. [382:38] Um, [382:41] I think it's loading right here. Okay, [382:44] so I don't know how much it is, but I [382:46] know it is not cheap. And down below we [382:49] have sample data is loaded into your [382:50] Redshift cluster. That sounds good to [382:52] me. Ticket is the sample data. Okay, [382:56] ticket sample data. [382:59] Redshift. I just imagine they probably [383:01] have like a tutorial for it here. They [383:04] do. right here. [383:06] And so because I want to know what we [383:08] need to do to query it, right? If we can [383:10] even query it via the interface here. So [383:12] the admin user is ads user. Um and the [383:15] password is going to be capital T [383:16] testing 1 2 3 4 5 6 exclamation. And [383:19] we'll hit create cluster. [383:23] Oh, cool. We can query the data right in [383:24] here. So that's what I wasn't sure about [383:26] whether we would be able to just query [383:28] it in line because before you'd have to [383:30] use Java with JDBC or an OBC driver and [383:35] download the jar and it's not as fun as [383:38] it sounds of course but it looks like we [383:40] can query data once the data is loaded. [383:44] So that looks really good. I guess we [383:46] can pull data in from um the [383:48] marketplace. So that's looks pretty nice [383:50] too. [383:52] And I guess we could probably integrate [383:53] it into other things like Quicksite [383:54] because you probably want to adjust your [383:56] data over there. [383:58] Again, I usually don't spend a lot of [383:59] time in Redshift. Um, but looks like [384:01] it's a lot easier to use. I'm very [384:03] impressed with this. So, I don't know [384:05] how long it takes to uh launch a [384:07] Redshift cluster. I mean, it is 160 GB [384:10] uh of of of storage there. It's uh even [384:14] at the smallest, it's pretty large. So, [384:15] what I'm going to do is to stop the [384:16] video and I'll be back when uh this is [384:18] done. Okay. Okay. Okay, so after a short [384:21] little wait here, um it was a lot faster [384:23] than I was expecting, but uh it's [384:25] available. And so looks like here it [384:26] says to query the sample data, use [384:28] Redshift version two. So I'm going to [384:30] click that. And I'm sure there's tons of [384:32] buttons to get here. And it'd be great [384:33] if it just populated the query for me. [384:36] Um it doesn't, but this looks really [384:38] nice. Really nice UI. I wonder if it has [384:40] like some existing queries. No, that's [384:44] okay. So, what I'm going to do here is [384:47] I'm going to go ahead and pull out this [384:49] query and see if we can get this to work [384:51] here. Never found out what those prices [384:54] were, though. [384:56] Okay. And what we'll do is hit run. I [384:59] like how there's like a limit of 100, [385:00] but here it has that. So, we'll go ahead [385:02] and hit run and see what data we get. [385:04] So, relation sales does not exist. Okay. [385:09] So, [385:11] what's going on here? [385:15] Um we'll go up here. So most of the [385:17] examples in the Redshift documentation [385:19] uses uh a sample database called ticket. [385:21] This sample this small database consists [385:23] of seven tables. You can load the ticket [385:25] data set by following the this here. [385:30] Okay. So to load the sample data from [385:32] Amazon S3. [385:38] Okay. So, [385:40] I would have thought it already had the [385:42] data in there. I could have swore it [385:44] would have [385:47] dev [385:48] public [385:53] tables [385:56] zero tables. Okay. So, I don't think [385:59] there's any data in here and so we're [386:01] going to have to load it ourselves. [386:04] I really thought it would have added it [386:05] for us. Uh but let's go ahead and create [386:07] these tables and see if this is as easy [386:09] as we think. So run that create that [386:12] table. [386:15] Cool. Okay, we got it down here. [386:19] We'll run that. We'll just run each at a [386:21] time. [386:23] I think there's seven of them. So [386:34] date already exists. Okay, that's fine. [386:37] Event already exists. It's saying all [386:38] these tables exist. [386:41] Maybe I just wasn't patient. [386:48] H Okay. [386:51] Um, [386:54] interesting. All right. So, maybe we'll [386:56] go back and uh run that query. Maybe we [386:58] just had to wait a little while for that [386:59] data to load. [387:02] Run. [387:04] Okay. So, you know what? I think it was [387:06] doing this for us. Like, if if the if it [387:09] did not create it for us, we would have [387:11] to go through all these steps, which is [387:13] fine because we're learning a little bit [387:14] about um uh uh Redshift, but um uh it [387:18] looks like we just had to wait there. [387:19] So, it looks like you would run those, [387:21] you download that, you use the copy [387:23] command to bring it over there. Um it [387:25] looks like you can do all of this via [387:27] the uh this interface here. And we've [387:29] done a query, so that's kind of cool. [387:32] Um, I imagine you probably could like [387:34] save it or export it. What if we chart [387:35] it? What happens? Okay, you can chart [387:38] it. That's kind of fun. [387:42] Can we export it out to just We can save [387:44] it. I thought maybe it could export out [387:45] to Quicksite, but I I suppose you'd [387:47] rebuild it in Quicksite, eh? But yeah, I [387:50] guess that's it right there. So, that's [387:51] pretty darn simple. So, what I'm going [387:53] to do is make my way back over to [387:55] Redshift because we are done for this [387:57] example. [388:01] And we will go over to clusters here. [388:04] And I'm going to go ahead and [388:06] delete my cluster. [388:12] Delete. [388:14] Create file snapshot. Nope. [388:17] Delete. [388:19] Delete the cluster. There we go. So, I'm [388:22] pretty sure that will succeed. No [388:23] problem there. And we are done with [388:25] Redshift. And Redshift is super [388:26] expensive. Just make sure that thing [388:28] deletes. Okay. [388:34] Hey, this is Andrew Brown from Exam Pro [388:36] and we are taking a look here at [388:37] cloudnative networking services. Um, and [388:40] so I have this architectural diagram I [388:42] created which has a lot of networking [388:43] components. Uh, when people create [388:45] networking diagrams for AWS, they don't [388:47] always include all these things here [388:49] even though they're there. So, we're [388:50] just being a little bit ver verbose so [388:52] you can see. Okay. The first thing is [388:53] our VPC, our virtual private cloud. This [388:55] is a logically isolated section of the [388:57] adabus cloud where you can launch ads [388:59] resources. That's where your uh [389:01] resources are going to reside. Not all [389:03] services uh require you to select a VPC [389:06] um because they're managed by AWS, but I [389:08] wouldn't be surprised if under the hood [389:10] they are in their own VPC. Okay. Then if [389:13] you want uh the internet to reach your [389:14] services, you're going to need an [389:15] internet gateway. Um then you need to [389:18] figure out a way to route things to your [389:21] uh various subnets, and that's where [389:23] route tables uh come in. Then we need to [389:26] def define a region that it's going to [389:28] be which is a geographical location on [389:30] your network. Then you have your [389:32] availability zones which are basically [389:34] your data centers where your ads [389:35] resources are going to reside. Then you [389:37] have subnets which is a logical [389:39] partition of an IP network into multiple [389:41] smaller network segments. Um and these [389:44] pretty much map to your uh availability [389:46] zones if you're making one per a. And [389:49] then we have knackles. These act as a [389:51] firewall at the subnet level. Then we [389:53] have security groups that act as a [389:54] firewall at the instance level. So [389:56] hopefully that gives you a good [389:57] overview. Okay. [390:02] All right. So now let's take a look at [390:04] enterprise or hybrid networking. So we [390:06] have our onremise uh environments or [390:08] your private cloud and then we have our [390:10] adabus account or our public cloud. So [390:12] there's a couple services here that we [390:13] can bridge them together. The first is [390:15] adabus virtual private network VPN. It's [390:18] a secure connection between on premise [390:20] remote offices and mobile employees. [390:22] Then you have direct connect. This is a [390:24] dedicated gigabit connection from [390:26] on-remise data center to ad. So it's a [390:28] very fast connection. A lot of times [390:30] with direct connect we say it's a a [390:31] private connection but that doesn't [390:33] necessarily mean secure. It's not [390:34] encrypting uh the data in transit. So [390:37] very commonly these services are used [390:38] together not just singular. Okay. Um and [390:42] then uh we have private links. And so [390:44] this is where you already uh are using [390:46] AWS but you want to keep it all within [390:48] as never going out to the internet. [390:50] Okay. So these are generally called VPC [390:52] interface endpoints and then the [390:54] marketing pages called them private [390:56] links which is a bit confusing but you [390:58] know it just keeps traffic within the [390:59] ads network so it does not transverse [391:01] out to the internet. Okay. [391:07] Hey this is Andy Brown from Exam Pro and [391:09] we are taking a look at VPCs and [391:11] subnets. So a VPC is a logically [391:13] isolated section of the adabus network [391:15] where you launch your adabus resources [391:17] and you choose a range of IPs using a [391:19] cider range. So a cider range is an IP [391:21] address followed by uh this uh net mask [391:24] or subna submask and that's going to [391:25] determine how many IP addresses there [391:27] are. Um and there's a bunch of math [391:30] behind that which we're not going to get [391:31] into. Um but anyway, so here is an [391:34] architectural diagram just showing a VPC [391:36] with a couple subnets. So subnets is a [391:38] logical partition of an IP network into [391:41] multiple uh smaller network segments. [391:44] And so you're essentially breaking up [391:45] your IP ranges for VPCs into smaller [391:47] networks. So just thinking about cutting [391:49] up a pie. Okay. So subnets need to have [391:51] a smaller cider range uh to uh the VPC [391:56] represent for their portion. So uh [391:58] for/24 is actually smaller which is [392:01] interesting. The the higher the number [392:03] gets the smaller it gets. And so this [392:04] would allocate 256 IP addresses. And so [392:07] that's well smaller than 16. Okay, we [392:10] have the concept of a public subnet. So [392:13] this is one that can reach the internet [392:14] and a private subnet. The one that [392:16] cannot reach the internet. And um these [392:19] are not uh strictly enforced by AWS. So [392:21] the idea is that when you have a subnet, [392:23] you can just say don't by default assign [392:26] publicly assignable IP addresses. But [392:29] it's totally possible to launch an EC2 [392:31] instance into your private subnet and [392:34] then turn on um uh the IP address. So [392:37] you got to do other things to ensure [392:38] that they stay private or public. Okay. [392:45] Hey, it's Andrew Brown from Exam Pro and [392:47] we are comparing security groups versus [392:49] knackles. So I have this nice [392:50] architectural diagram that has both [392:52] knackles and security groups in them and [392:54] we'll just kind of talk about these two. [392:56] So, knackles stand for network access [392:58] control list and they act as a virtual [392:59] firewall at the subnet level. And so, [393:02] here you can create an allow uh and deny [393:05] rules. And this is really useful if you [393:07] want to block a specific IP address [393:09] known for abuse. And I'm and I'm going [393:11] to just kind of um compare that against [393:13] uh security groups because that's going [393:14] to be a very important difference. Okay. [393:16] So, sec security groups act as a [393:18] firewall at the instance level and they [393:20] implicitly deny all traffic. So, you [393:22] create only allow rules. So you can [393:25] allow an EC2 instance to access port on [393:28] uh port 22 for SSH, but you cannot block [393:31] a single IP address. And the reason I [393:33] say that is because in order for you to [393:35] block a single IP address in secure [393:37] group, you would literally have to block [393:38] or you would literally have to allow [393:40] everything but that IP address. And [393:42] that's just not feasible. Okay? And so [393:43] if you can remember that one particular [393:45] example, you'll always be able to [393:47] remember the difference between these [393:48] two. One other thing that um Adabus [393:51] likes to do is is ask which ones are [393:53] stateless, which ones are stateful. But [393:55] at the uh cloud particular level, [393:56] they're not going to be asking you that. [393:58] Okay. [394:02] All right. Let's learn a bit about u [394:04] networking with AWS. So what I want you [394:06] to do is go to the top and type in VPC, [394:08] which stands for virtual private cloud. [394:10] And what we'll do is set up our own VPC. [394:12] It's not so important that you remember [394:13] all the little bit of details, but you [394:15] get through this so that you can [394:17] remember the major components. So, what [394:18] I'll do is create a new VPC. I'm going [394:20] to call this my VBC uh tutorial. And [394:24] here I'm going to say 10.0.0.016. [394:28] The reason you're wondering why I'm [394:29] doing that, if we go to XYXY [394:33] Z here, um this tells you the size of [394:35] it. So, I go here and I put 16. So, you [394:38] can see we have a lot of room. If we do [394:40] 24, it takes up it. It It's smaller. [394:43] See? So, this is basically the size of [394:44] it, right? The empty blocks over here. [394:46] So, we're going to have a lot of room. [394:48] So we do 10 000016. We don't need IPv6. [394:52] We're going to go ahead and create that. [394:54] And once we have that, we can go ahead [394:55] and create a subnet, which we will need. [394:58] So we're going to choose our VPC. We'll [395:00] go down here and say my subnet tutorial. [395:04] And we'll choose the first a. You can [395:06] leave it blank. It'll choose it random. [395:07] And then we need to choose a block that [395:09] is smaller than the current one. So 16 [395:11] would be definitely um uh well 16 is the [395:16] size that we have now. So we can match [395:17] that size but 10.0.0.0/24 [395:21] would be absolutely smaller. Okay. So we [395:24] go ahead and create that subnet. [395:27] And so that is all set up now. Um [395:32] let's see if our route table is hooked [395:33] up. So our route table says where it [395:35] links to and it says to local. So it's [395:38] not going anywhere. And that's because [395:39] we need to attach a uh internet gateway [395:43] that allows us to reach the internet. [395:45] So, if we go over here and create a new [395:47] internet gateway, we'll say my IGW [395:50] and we'll go ahead and create that. [395:53] And what we'll do is associate that with [395:56] our VPC we created here. Okay. And so [396:00] now that we have the internet gateway [396:02] attached, we want that subnet to make [396:04] its way out to the internet. So, if we [396:06] go to the route table, we can edit the [396:09] uh route table association here. I like [396:12] how it keeps on showing me this as if I [396:14] don't know what I'm doing. Um, but I do. [396:16] And so [396:19] this would change that particular [396:20] association, but I want to add to that [396:22] route table. So I thought when I clicked [396:25] that it would allow me to add more, but [396:27] apparently I got to go to route tables [396:28] over here. And I'm looking for the one [396:31] that is ours. We can see that it's over [396:33] here. Could even name it if we wanted [396:35] to, like my route table. [396:38] Notice when we apply uh uh uh names, [396:41] it's actually just applying a tag. See [396:43] over here, it's always what that is. [396:46] So, we'll go over to routes and we want [396:48] to edit the routes and we want to add a [396:50] route. And we want this to go to 0000. [396:52] And we're going to choose the internet [396:54] gateway. Okay. [396:57] We're going to say save changes. [397:00] And what that's going to allow us to do [397:01] is to reach the internet. [397:05] Um and so what I want to do is go back [397:07] to subnet. I was just curious about [397:09] this. I've never used this before. [397:12] Um, so looks like we could just choose [397:14] some options here. I'm not too concerned [397:16] about that, but I assume like that's [397:18] used for debugging. Azure's had those [397:20] kind of services for a long time and so [397:22] adus has been starting to add those so [397:23] you can easily debug your network, which [397:25] is nice. So we have a subnet. The subnet [397:30] uh can reach the internet because [397:31] there's a there's um [397:34] uh internet gateway and it's hooked up [397:36] via the route table. One thing that [397:38] matters is will it assign a public IP [397:40] address. Um, so that is something that [397:43] we might want to look into. It's not the [397:45] default subnet, which is totally fine. [397:48] So it says auto assign is no. So that [397:50] might be something that you might want [397:51] to change. So here we go to edit the [397:55] table association. No, it's not there. [397:57] They changed it on me. Used to be part [398:00] of the uh setup instruction. Used to [398:01] just checkbox it now and they moved it. [398:03] Modify the auto assign. So we'll say [398:05] enable. So that means it's always going [398:07] to give it a public IP address on [398:08] launch. [398:11] And while we're here, I'm just going to [398:12] double check if I have any elastic IPs I [398:14] did not release. Okay, just double [398:15] checking here. And so [398:18] this is all set up and we should be able [398:20] to launch a um EC2 now within our our [398:23] new VPC. So I'll go over here to EC2. [398:27] Okay. [398:30] And I'm going to launch a new instance. [398:33] say Amazon Elix 2. [398:36] We're gonna choose this tier here. [398:39] And now what we should be able to do is [398:41] select that. [398:43] And that is our subnet there. Okay. [398:46] Go ahead and launch that. I don't care [398:48] if we use a key whatsoever. So I'm going [398:50] to go ahead and launch that there. [398:54] Okay. We'll go back. [398:58] And so there you go. It is launching. [399:00] So, we created our VPC and we launched [399:02] uh in it no problem whatsoever. [399:05] So, hopefully that is pretty darn clear. [399:08] Um, so yeah, uh, what I'm going to do is [399:10] I'm going to let that launch because I [399:12] want to show you security groups. So, [399:15] within AWS, you can set security groups [399:17] and knackles and that's going to allow [399:19] or deny access based on stuff. And when [399:22] we launch this EC2 instance, it has a [399:23] default security group that was [399:25] assigned. We could have created a new [399:26] one, but what I might want to do is [399:28] create myself a new security group here. [399:31] Okay. And you can end up with a lot [399:33] really fast. Like here is a bunch. And I [399:36] can't even tell what's what. So like [399:38] there's a bunch for load balancers and [399:40] things like that. And so I might just go [399:42] ahead and delete a bunch of these [399:43] because I cannot tell what is going on [399:46] here. And um we'll delete these security [399:50] groups. [399:51] And sometimes they won't let you delete [399:53] them because they're associated with [399:54] something like a network interface or [399:55] something. [400:00] All right. But um we need to find out [400:03] which one we're using right now. So the [400:05] one that we are using is the launch [400:08] wizard 4. So we'll go into here. [400:11] And I don't know if you can rename them [400:13] after they've been created. I don't [400:14] think so, which is kind of frustrating [400:15] because if you want to rename it, it's [400:17] like I don't want that to be the name. [400:19] So, what's interesting is you can go [400:21] here and you can edit the routes, [400:24] uh, the rules, sorry, the inbound rules [400:26] and the outbound rules. And so, here [400:27] it's open on port 22. So, that allows us [400:30] to SSH in. We could drop this down and [400:32] choose different things. So, if we want [400:33] people to access a website, we go port [400:35] 80 and we say from anywhere, ipv46. So, [400:38] now anyone can access it. um you might [400:42] want to do something like give it access [400:44] to Postgress that runs on port 5432 [400:48] things like that um could be something [400:50] else like maybe you need to connect to [400:52] Redshift that's on that port you can go [400:54] ahead and save those rules we're just [400:56] going to say uh from anywhere you can [400:57] even say my IP so maybe only I'm allowed [401:00] to connect to it right so you added [401:02] inbound rules you don't really ever have [401:04] to touch outbound rules it's set for all [401:06] traffic so it's stuff that's leaving [401:09] uh the that there one interesting thing [401:13] to note about uh security groups is that [401:17] you don't have a deny option right so [401:20] let's say you only wanted a particular [401:22] IP address you only wanted um let's say [401:24] what's my IP my IP address [401:28] so that is my IP address and let's say [401:31] I wanted to block it right so I go here [401:34] and I say okay I want to block [401:38] on all TCP I want to block this number, [401:40] right? But I can't do that. All I can [401:43] say is I allow this number. So, in order [401:45] to do it, I would have to enter [401:46] everything but this number in here. And [401:48] you can enter ranges in with like these [401:51] forward slashes and stuff like that. But [401:52] you would imagine that'd be really hard [401:53] because you have to start and go like [401:55] you'd have to start and go through every [401:56] single IP address in the world to get it [401:58] out of here. And that's almost [401:59] impossible. And that's the key thing I [402:01] want you to remember about security [402:02] groups. [402:04] Um, so that's security groups. And [402:05] there's also knackles. [402:09] Knackles, um, they're associated with [402:11] subnets, so they probably show up under [402:12] VPC. I rarely touch knackles. Rarely [402:15] ever have to. Um, I mean, they're great [402:19] tools, but, you know, for me, I I just [402:20] don't ever need them. So, knackles are [402:23] associated with subnets. [402:26] So, we can go here and try to see my [402:28] subnet tutorial. So, we created our [402:29] subnet. We got a knackle for free. And [402:32] we can set inbound and outbound rules. [402:34] And so here [402:36] here is where we could say okay I want [402:38] to add a new rule and I want to and I [402:41] want to make the rule number 150. You [402:44] always do these in the hundreds okay or [402:46] the power of tens so that you can move [402:47] them around easily and I can say all [402:50] traffic that comes from this IP address. [402:55] I'm going to put the forward slashzero [402:56] that just means a single IP address. I [402:59] say deny, right? And so now [403:02] uh this at my address, I can't access [403:04] that EC2 instance. Okay? If I try to go, [403:07] there's nothing running on the server, [403:08] but if I was to try to use it, I [403:09] wouldn't be able to do it. And and this [403:11] applies to anything for that subnet. [403:13] It's not for a particular instance. It's [403:14] for anything in that subnet. So [403:16] hopefully that is is pretty clear there. [403:19] Um but that's pretty much all you really [403:20] need to know. I mean, there's lots of [403:22] other stuff like network firewalls, all [403:24] these other things. It gets pretty [403:25] complicated. Um it's well beyond what we [403:28] need to learn here. But uh what we'll do [403:30] is tear down that EC2 instance. [403:34] Okay, we'll terminate that. [403:37] And once that instance is destroyed, we [403:39] can get rid of our security group and a [403:40] bunch of other stuff. [403:44] And there's always a bunch of these darn [403:46] things. [403:49] So we'll say delete [403:54] one security group associated. [403:59] So we go here. This is the one we are [404:00] using but I want to get rid of all these [404:01] other ones. [404:08] Okay. If I go here it could be because [404:09] like of inbound rules. [404:12] So see this one because you can [404:13] reference another security group within [404:16] a security group. So I'm just going to [404:17] go save that there. see any my IP there. [404:19] Whoops. [404:22] It's set to NS NFS. So, that might have [404:25] been set up for our access point. [404:31] Or I could just delete it. That' [404:32] probably be easier. [404:34] Okay. So, that's one that's kind of of a [404:37] pain. [404:39] So, I'm just looking for rules that [404:41] might be referencing other security [404:42] groups [404:46] to get rid of them. [404:49] Okay, let's try this again. [404:57] We'll go ahead and delete. I'm leaving [405:00] the um [405:03] I'm leaving the uh the defaults alone [405:05] because those come with your VPCs and [405:06] you don't want to get rid of those. [405:11] So, it won't let me delete this one. So, [405:14] I'm going to go edit that rule. [405:16] Delete it. Save it. You might not have [405:19] this kind of cleanup to do. It just [405:21] might be me here, you know. [405:24] Um, outbound, inbound. [405:28] Let's try this again here. [405:36] Delete. [405:39] And I'll open this one up. [405:45] Must be this one that is referencing the [405:47] other one. [405:53] I'm just going to delete the rule. [405:59] And this is something that's just kind [406:00] of frustrating with AWS, but it's just [406:02] how it is where sometimes it's hard to [406:04] get rid of uh resources because you have [406:06] to click through stuff. So, it's not [406:07] always a clean you might have like [406:08] lingering resources. And this isn't [406:10] going to cost us anything, but it's just [406:12] the fact that um [406:15] that it just makes things harder to see [406:18] what you're doing, you know? [406:22] This last one really doesn't want to go [406:24] away. [406:28] So, I'm just trying to delete all the [406:29] rules out of here. Get rid of it. Can I [406:32] delete this one now? [406:36] One group associated. It will not show [406:38] me what it's talking about. Okay, here [406:39] it is. Um, [406:44] okay. This is referencing it. [406:47] I think it was the one. It was an old [406:49] one. I don't know what this is. [406:58] We'll go down here [407:02] and we'll go here and delete that. And [407:04] while I've been cleaning all these up, [407:06] now we can go over to our inst instance. [407:08] make sure that it's terminated. It is [407:09] good because if our instance is not [407:11] terminated, we cannot destroy the VPC. [407:13] Uh prior the VPC could not be destroyed [407:15] unless you detach the internet gateway. [407:17] I wonder if it's going to still complain [407:18] about that. [407:21] We'll say yes. It actually looks like it [407:23] includes it in the cleanup. [407:26] Type delete here. [407:32] There we go. So, we're all good. We're [407:34] all cleaned up. There you are. [407:40] Hey, this is Andy Brown from Exam Pro [407:41] and in this video I just want to show [407:43] you CloudFront. So, let's make our way [407:44] over to CloudFront. And CloudFront is a [407:47] content delivery network and it's used [407:49] to cache your data all over the place. [407:51] As you can see, I have some older ones [407:53] here. If you have a splash screen, what [407:55] you can do is just look for the lefth [407:56] hand side. There might be a hamburger [407:57] menu. Open that up and then click on [407:59] distributions. And what we're going to [408:01] do is create a new distribution. If you [408:03] don't want to create one, because these [408:04] do take forever to create, um you can [408:06] just kind of watch along. I don't even [408:08] feel like I'm going to hit the um the [408:10] create distribution button because I [408:11] just hate waiting for so long. But the [408:13] idea is that you have to choose an [408:14] origin. And so the origin could be [408:15] something like an S3 bucket, a load [408:17] balancer, media store. This is where um [408:20] the the content distribution network is [408:22] going to source its content, right? So [408:25] if I say this bucket here um and I just [408:28] it'll probably default to the root path. [408:30] The idea is that it's going to be able [408:32] to pull content from there and then [408:33] cache it everywhere. And then down below [408:36] you can say, okay, set the type of [408:38] protocol, redirect to here. You can set [408:41] up uh caching rules or like how often do [408:44] you want it to cache, like cache a lot, [408:46] don't cache a lot. But the great thing [408:48] is like you have these edge or these um [408:50] lambda edge functions. So you can uh [408:53] read and modify the request and response [408:56] to the CDN which is very powerful. But [408:58] what I'm going to do is I'm just going [408:59] to go look at what we already have [409:01] because again I said they take forever [409:03] to spin up and we're not going to see [409:05] too much if we do. So once it's spun up, [409:07] um this is what it looks like. So you'll [409:10] have an origin. It says where it's [409:11] pointing to. You can create multiple [409:12] origins, group them. Uh you can modify [409:15] your behavior. So that was basically [409:17] what we were looking at before. As you [409:18] can see, we have our behavior there. [409:20] Nothing super exciting. We can set up [409:22] error pages. You can restrict based on [409:24] geographical location. So if you're for [409:26] whatever reason if you if you're not [409:28] allowed to serve content in UK, you [409:30] could say exclude this geographical [409:32] region, right? So you have an allow list [409:35] or a block list saying like okay, we [409:37] can't do UK because like let's say you [409:38] just don't want to do um say England. [409:41] You don't want to do um uh GDPR for [409:44] whatever reason. You could block out I [409:46] don't know why I'm having a hard time [409:47] here. Britain, England. It's England, [409:50] right? United Kingdom. There we go. So [409:53] you just say, okay, forget United [409:54] Kingdom. I don't have to do GDPR now for [409:56] invalidations. The idea is that you know [409:58] it is a cache. So things can get stale [410:01] or just persist. And so here you can [410:03] just type in say I want to get rid of [410:06] image.jpg and then you create that [410:08] invalidation and then it will go delete [410:10] it out of the cache. And so the next [410:12] time someone requests it'll get the the [410:13] fresh content. This usually doesn't take [410:15] that long. But that's pretty much [410:16] CloudFront in a nutshell. Okay. [410:23] Hey, this is Andrew Brown from Exam Pro [410:24] and we are taking a look at EC2, also [410:26] known as Elastic Compute Cloud. And so [410:28] this is a highly uh configurable virtual [410:30] server or it's also known as a virtual [410:33] machine and that's what we're going to [410:34] generally refer to it. Uh EC2 is [410:37] resizable compute capacity. It takes [410:39] minutes to launch new instances and [410:41] anything and everything on Adabus uses [410:42] EC2 instances underneath. That's why we [410:45] generally call it the backbone to all [410:46] the Adabus services. And uh you're going [410:49] to just have to choose a few options [410:50] here. So the first thing you'll need to [410:52] do is choose your OS via your Amazon [410:54] machine image. So that's where you get [410:56] Red Hat, Ubuntu, Windows, Amazon Linux, [410:59] Seuss. It might also come with [411:00] pre-installed libraries and things like [411:02] that. Then you choose your instance [411:04] type. That's going to determine things [411:05] like your vCPUs, your memory. So here [411:08] you can see how many there are and [411:10] you'll have like a monthly cost and [411:12] that's the name of the instance type. [411:14] Then you have to add storage. So very [411:16] commonly you're attaching elastic block [411:18] storage or elastic files system or [411:21] service. Uh and so you know if you do [411:24] choose your EBS uh you are going to have [411:26] to determine what type it is. So whether [411:28] it's a solid state drive, a hard disk [411:31] drive, a virtual magnetic tape or even [411:33] attaching multiple volumes not just a [411:35] single one. And the last thing is [411:36] configuring your instance. So this is [411:38] configuring the security groups, the key [411:40] pairs, user data, IM roles, placement [411:42] groups, all sorts of things. So we will [411:44] experience in that because we will show [411:45] you how to launch an EC2 instance and [411:48] it'll make a lot of sense if it does not [411:49] make sense right now. Okay. [411:55] All right. Let's take a look here at EC2 [411:57] instance families. So what are instance [411:59] families? Well, instance families are [412:00] different combinations of CPU, memory, [412:03] storage, and networking capacity. And [412:05] instance families allow you to choose [412:07] the appropriate combination of capacity [412:09] to meet your application's unique [412:11] requirements. Different instance [412:13] families are different because of the [412:14] varying hardware used to give them their [412:16] unique properties. And we do talk about [412:19] this thing about uh capacity reservation [412:22] where adabus can actually run out of a [412:23] particular type of instance family [412:25] because they just don't have enough [412:26] hardware in that data center and so you [412:28] have to reserve it. But let's go through [412:29] the different types of instance [412:30] families. The first is general purpose [412:32] and these are the names of the different [412:34] families. uh very popular ones is the T2 [412:38] um the T2 and one that's really [412:40] interesting is the Mac which actually [412:42] allows you to run um a a Mac server. So [412:46] these are great balance of compute, [412:47] memory and network resources. So you're [412:49] going to be using these most of the [412:50] time. The use cases here would be web [412:52] servers, code repositories, things like [412:54] that. Then you have compute optimize. So [412:57] um they all start with C. Uh no surprise [412:59] there. They're ideal for computebound [413:01] applications that benefit from high [413:03] performance processor. The edge cases [413:04] here are scientific modeling, dedicated [413:06] gaming servers, ad server engines, [413:08] things like that. Then you have memory [413:10] optimized. Um, and so there's a variety [413:12] here. These are fast performance for [413:14] workloads that process large data sets [413:16] in memory. Um, they're great for [413:18] in-memory caches, in-memory databases, [413:20] real-time big data analytics. Then you [413:22] have accelerated optimize. So this is [413:24] your P2, P3, P4, things like that. These [413:27] are hardware accelerators or [413:29] co-processors. These are great for [413:31] machine learning, computational finance, [413:33] seismic analysis, speech recognition. If [413:36] you're doing um uh ML on AWS, you you'll [413:39] start coming across these types. AWS [413:41] technically has a separate page on [413:43] SageMaker ML machines, but they're all [413:44] pulling from these instance families. [413:46] Okay. Then you have storage optimize. So [413:48] I3, i3n things like that. These are [413:51] highly high sequential read and write [413:53] access to very large data sets on local [413:55] storage. The use cases here would be [413:57] NoSQL in memory or transactional [413:59] databases. data warehousing for the [414:01] certified cloud practitioner, you just [414:03] need to generally know these five [414:04] categories, not the names of the [414:06] instance families. If you're doing um [414:09] associates or above, you definitely want [414:10] to know these things in a bit more [414:12] detail. And I want to say that commonly [414:14] instance families are called instance [414:15] types. But an instance type is a [414:17] combination of size and family. But even [414:19] AWS's documentation doesn't make this [414:22] family distinction clear. But I know [414:24] this because, you know, in Azure, they [414:25] make that very clear and and GCP. And so [414:28] I'm bring that language over here to [414:29] just kind of normalize it for you. Okay, [414:36] let's take a look at what EC2 instance [414:38] types are. So an instance type is a [414:40] particular instance size and instance [414:42] family. And a common pattern for [414:44] instance sizes you'll see is things like [414:46] nano, micro, small, uh, medium, large, x [414:50] large, 2x large, 4x large, 8x large. And [414:54] you know, generally they're you to the [414:56] power of twos, but sometimes it'll be [414:57] like 12, 14, 16, or it's even. Uh, and [415:00] so when you go to launch your EC2 [415:02] instance, you're going to have to choose [415:04] that instance type. And so here you can [415:06] see, you know, here is our T2 micro, and [415:09] then we have um the small, the medium, [415:11] the large, the Xarge. [415:14] Okay, but there are exceptions to this [415:15] pattern for sizes. So, you know, there [415:18] is one particular one called metal. And [415:21] so that's going to indicate that this is [415:22] a bare metal machine. And then sometimes [415:24] you get these oddball ones like 9x [415:26] large. So you know the rule of power of [415:28] two or even numbers is not always the [415:30] case. Uh but generally it'll be pretty [415:32] even for you know the start here. Okay. [415:35] Uh just talking about instance sizes. So [415:37] the EC2 instance sizes generally double [415:39] in price and attribute. So uh just [415:42] bringing up these numbers a little bit [415:43] closer. Starting at the small here [415:44] you're going to notice one two doesn't [415:48] maybe double there but four and here we [415:49] see 12 24 uh almost doubles there. [415:53] almost doubles there. But I want to show [415:55] you that the price is generally almost [415:56] double. So 16, 33, 67, 135. And so a lot [416:01] of times like you always have the option [416:03] to say, okay, do I want to go to the [416:05] next instance size up or have uh an [416:08] additional instance of the same size. [416:09] And sometimes it's a better approach to [416:11] get an additional instance because then [416:13] you can distribute it across another A [416:15] uh but then you also meet additional [416:17] capacity. So there you go. [416:23] So we talked about dedicated instances [416:26] and hosts a little bit but let's just [416:27] make that distinction very clear. So [416:29] dedicated hosts are single tenant EC2 [416:31] instances designed to let you bring your [416:33] own license. So B YOL based on machine [416:35] characteristics and so we'll compare the [416:38] dedicated instance to the dedicated host [416:40] across isolation billing uh physical [416:42] characteristics visibility affinity [416:44] between a host and instance targeted [416:47] instance placement automatic instance [416:49] placement and add capacity using [416:51] allocation request. So for isolation for [416:54] dedicated instance you're going to get [416:55] instance isolation. So you can have the [416:58] same customer on the same physical [416:59] machine but there is virtualization [417:01] there for them and there's a guarantee [417:02] of that. Um for a dedicated host you [417:05] have physical server isolation so you [417:07] get the whole server. For billing uh on [417:10] a dedicated instance it's per instance [417:12] billing and it's going to have an [417:13] additional fee of $2 per region. And for [417:15] dedicated host it's per host billing. So [417:18] it's a lot more expensive but you get [417:19] the whole machine. Uh for visibility of [417:21] physical characteristics you're not [417:23] going to get any of that information for [417:24] a dedicated instance. for a dedicated [417:26] host you are such as sockets core host [417:28] host ID and this is really important [417:31] when you have a bring your own license [417:32] and they're saying this license is for x [417:35] amount of cores or x amount of sockets [417:38] uh then we have affinity so there's no [417:40] affinity for dedicated instance for [417:42] dedicated hosts you'll have consistency [417:44] with deploys to the same instance to the [417:45] same physical server uh there's no [417:48] control of target in instance placement [417:49] for dedicated instance you do have [417:51] control on a dedicated host for auto [417:54] automatic instance placements you have [417:55] it for both and to add capacity using [417:58] allocation requests it's a no for [418:00] dedicated instance and it's a yes for [418:02] dedicated host so I want to come back to [418:05] the main point that's what's highlighted [418:06] here is that on a dedicated host you [418:08] have visibility of sockets core host ID [418:11] and this is really really important when [418:13] you're bringing your own licensed BYOL [418:16] such as um you know Microsoft SQL [418:19] servers where you have to specify the [418:22] amount of cores and things like that [418:23] Okay, [418:28] so we've been talking about uh tenency [418:30] and I just wanted to make it very clear [418:32] uh the difference between the different [418:34] levels of tenency on AWS. So we have [418:36] three. Okay. So we got dedicated host. [418:39] So your server lives here and you have [418:41] control of the physical attribute. So [418:43] basically the whole server. Okay. Uh [418:46] then we have dedicated instances. So [418:48] your server is on the same uh physical [418:50] machine as other customers but the [418:53] actual slot that you have the dedicated [418:55] instance will always be the same. Uh and [418:58] then we have uh the default. So your [418:59] instance will live somewhere on the [419:02] server. Uh and when you reboot it's [419:04] going to be somewhere else. So there's [419:05] no guarantee that it's going to be in [419:06] the same place every single time. Okay. [419:13] Hey, this is Andrew Brown from Exam Pro [419:15] and this follow along we're going to be [419:16] looking at EC2 and also um services that [419:19] are adjacent to it. So like autoscaling [419:21] groups, load balancers, elastic IPs, [419:23] things like that. So we fully understand [419:25] EC2. Um, you don't have to know tons for [419:28] the exam, but you should be able to go [419:30] through the motions of this with me so [419:31] that you can cement that knowledge um, [419:33] for some of those deeper concepts like [419:35] working with key pairs and things like [419:36] that. So, let's make our way over to the [419:39] EC2 console and learn what we can learn. [419:42] Um, and generally when you go over to [419:44] the EC2 console, it'll bring you to the [419:46] dashboard. For whatever reason, it [419:47] didn't bring me there. And then the idea [419:49] here is that on the lefth hand side, we [419:51] can make our way over to instances. [419:53] Okay. And this is where we can launch [419:55] our first instance. So if we go here and [419:58] launch our instance, the first thing [419:59] we're going to be presented with is to [420:01] choose our MI or Amazon machine image. [420:05] And so that is a template that contains [420:06] the software configuration. So the [420:08] operating system, applications, and [420:10] other binaries that would be installed [420:12] on that OS by default. All right. And so [420:15] we have a variety that we can choose [420:16] from in the quick starts. And generally [420:18] the ones that you're going to see first [420:19] are the ones that support. So there [420:22] are uh um AMIs or operating systems that [420:24] a will support when you contact them and [420:27] then there's ones that are outside that [420:28] where uh they'll still help you with but [420:30] they might not have the knowledge on. So [420:32] just understand that if you pick from [420:33] these core ones you're going to be in [420:35] good shape. Uh the most popular is the [420:37] Amazon Linux 2 because it's part of the [420:39] free tier and it is is very minimal and [420:42] well hardened by AWS. So it's a very [420:44] good choice there. But you can see you [420:45] can install a bunch of things. So like [420:47] if you want to launch a Mac OS server [420:49] you can absolutely do that. a Red Hat, [420:52] uh, Suzie, Ubuntu, a Windows server, you [420:55] name it, they have it. Um, if you wanted [420:57] something more farther out there, you [421:00] could go to the marketplace and, uh, [421:02] subscribe to one that is managed by [421:04] company. Basically, everything exists [421:06] under the sun here. Or you could get a [421:08] community AMI. So, these are ones that [421:09] are contributed by the community for [421:11] free. But, we're going to go back to [421:13] quick start here. And what I want you to [421:14] notice is that there is this AMI ID. [421:17] That's how we can uniquely identify what [421:19] we're using. If we were to change [421:20] region, even with the same Amazon Linux [421:23] 2 instance, this thing will change. So [421:25] just understand that it is regional [421:26] based and it comes in a 64-bit variant [421:29] and a ARM variant. And so we're going to [421:31] be using the x86 here. You can notice [421:34] here you can change it on the right hand [421:35] side. We're going to stick with x86. I'm [421:37] going to go ahead and hit next. So now [421:40] we're going to choose our instance type. [421:42] And so this is going to decide um uh [421:44] greatly how much we're going to be [421:46] spending because the larger it is, the [421:48] more we're going to spend. So see this [421:49] T2 micro. If we wanted to know the [421:51] pricing for that, we go to EC2 [421:53] pricing AWS. [421:56] And once we get to EC2 pricing, we want [422:00] to go to on demand. [422:02] And from here, this will load. And so [422:06] down below, we can kind of go find our [422:08] price. So it should show us [422:10] should show us the list. Ah, here it is. [422:12] Okay. So I can say AT2 micro. [422:15] And we can see the on demand is this. [422:17] So, it seems really cheap. What you got [422:19] to do is do the math. So, if you do time [422:21] 7:30, that's how many hours there are in [422:23] a month. If we launch a TT Micro and [422:26] let's say we didn't have the free tier, [422:27] we you do if you first made your [422:29] account, you're going to have 7 750 [422:32] hours for free with the free tier. But [422:34] if you didn't, it would only cost you $8 [422:36] and 46 USD. Okay? So, just be aware of [422:40] that. And if you ever need to figure [422:42] something out, go there, copy it, do the [422:43] math, 7:30. It's pretty easy. So here we [422:46] have a T2 micro in the T2 family. It's [422:48] going to have one V vCPU. Notice it has [422:51] a V for virtual. So there could be more [422:53] than a single CPU on the underlying [422:57] hardware, but we're only going to have [422:58] access to one virtual CPU. We have one [423:01] gigabyte of memory. It's for low to [423:04] moderate network performance. So that's [423:05] a factor that can change if you need [423:07] like uh uh gigabit stuff like really [423:09] fast connections for onrem hybrid [423:11] connections and you have specialized [423:13] servers for that. But for this, this is [423:15] fine. The TT Micro is great. Uh if you [423:17] want, you can also search uh this way to [423:19] see all the instance families and things [423:21] like that. You can filter for current [423:22] generations, all generations. So this is [423:24] fine. Okay. So from there, we're going [423:27] to go to configure our instance type. [423:28] You can say let's launch multiples of [423:31] these instances. Let's turn on spot to [423:33] uh save money and try to bid for a [423:35] particular price. We can change our VPC. [423:38] It's going to default to the default [423:40] VPC. Um if you have no subnets just [423:42] going to pick one at random here which [423:44] is fine. Um whether to auto assign a [423:47] public IP address. If you do not have an [423:49] IP address you cannot reach the [423:50] internet. So generally you want this to [423:52] be enabled. This is dependent on the [423:54] subnet whether it will default to [423:56] enabled. But doesn't matter if you have [423:58] an EC2 instance in a private or public [424:00] subnet. You can always override this and [424:02] give it a public IP address. You have [424:04] placement groups which allows you to [424:06] place servers together closely. Not [424:07] something for the certified cloud [424:08] practitioner. There's capacity [424:10] reservations. So if you're worried about [424:12] adabus running out of this, you can [424:14] reserve capacity. So that's kind of [424:16] interesting. Domain join directory. This [424:18] isn't something that I've done much [424:19] with, but I imagine that has something [424:21] to do with um direct active directory or [424:23] something like that to join information. [424:26] Then you need to uh have an IM role. And [424:29] we absolutely do need an IM role here. [424:30] So what I want you to do is create a new [424:32] RO. Just going to close off these other [424:34] tabs here. And we will go Wait a moment. [424:37] create a new role here. And we want to [424:40] do this for EC2. So, we say EC2 is what [424:42] we're creating the rule for. We'll hit [424:44] next. And um I don't know if I have a [424:47] policy, but I'm going to go ahead and um [424:49] well, I don't need to make a new policy, [424:51] but I just want SSM. And the reason I [424:53] want SSM is so that I can um uh use [424:58] sessions manager to login. So, we don't [424:59] have to use key pairs. We will use key [425:01] pairs, but if we didn't want to use it, [425:03] that's what we could do. And this used [425:04] to be the old role. It'll tell you, hey, [425:06] go use this new one here. So, I just [425:08] want to make sure I know which one it [425:10] is. And so, we'll just check box that [425:12] on. We'll hit next. We can add tags [425:14] right here. It' be uh well, actually, we [425:16] don't need to add any tags here. So, [425:17] that's fine. We'll just hit next. And [425:18] then I'll just say uh my SSM EC2 RO. [425:23] Okay. And we'll create that RO. And now [425:27] that we have created that RO, we can go [425:29] back to our first tab here and give this [425:31] a refresh and then drop down and it [425:32] should show up here. [425:35] If we go down here a little bit, we [425:36] could turn on extra monitoring. There is [425:38] monitoring built in, but if you wanted [425:40] to uh monitor it to a lower uh like it [425:44] more frequently, you could do that as [425:45] well. We want share tenency, right? This [425:48] is where you change to dedicated [425:49] instance or dedicated host. Obviously, [425:51] these cost more, but we're going to [425:52] stick with shared. Elastic inference. [425:54] So, this is for um uh attaching a a [425:58] fractional GPU. Great for ML. Not [426:00] something that we want. There's credit [426:02] specification. I don't remember seeing [426:03] this before. Selecting unlimited for [426:05] credit specification allows for to burst [426:07] beyond the baseline. So this for [426:09] bursting here you can attach an EFS. So [426:12] if you need a file system that you want [426:14] to mount or attach. Um then there's the [426:17] enclave option. So Nitro Enclave enables [426:19] you to create isolated compute [426:20] environments to further protect your uh [426:22] and securely process highly sensitive [426:24] data. So it might be something you might [426:25] want to check box on um based on your [426:27] use case. And then down below are we [426:30] have the ability to enter our user data. [426:31] And this is something we want to do [426:33] because we want to install [426:36] Apache so that we have something to work [426:38] with here. So what I'm going to do is [426:39] make a shebang. So that is a pound and [426:42] an exclamation mark. I know that's [426:43] really small. So I'll try to bump up my [426:45] font here so you can see what I'm doing. [426:47] And we're going to do a forward slashbin [426:49] and a forward slashbash. On the next [426:50] line here, we're going to do yum [426:51] install- y httpd. Um that's going to [426:55] install apachi. And why it's not called [426:58] apachi, I don't know why, but they call [426:59] it httpd. [427:02] There's no Apache in the name there. And [427:03] so we'll say systemctl start httpd [427:07] systemct ctl enable httpd. So we're [427:10] saying start up apachi and then make [427:12] sure that it stays running if we restart [427:14] our machine. Very simple. So from there [427:18] we will go to our storage. We'll say add [427:20] our storage. And this is at 8 gigabytes [427:23] by default. We could uh uh turn that up [427:25] to 30 if we like. So you can go all the [427:27] way up to 30 if you like. Um, and you [427:29] might want to do that, but I'm going to [427:30] leave it at eight. We could change our [427:32] volume type. I'm fine with GP2 because [427:34] it's very cost effective. And if we want [427:36] to turn on encryption, and you should [427:37] always turn on encryption. There's no [427:39] reason not to. So, we'll turn that on. [427:41] It's not like it's going to cost you [427:42] more. It's going to be the same cost. [427:44] It's just your choice there. If do we [427:46] want to add a tag? Yes, we're going to [427:47] add a name. And we're going to say my [427:48] EC2 instance. [427:51] Okay. [427:53] And so, that's going to give us a name, [427:54] which is something we would really like [427:56] to have. Then, we have our security [427:57] group. I'm going to just create a new [427:59] security group called my EC2SG here and [428:03] just say my EC2 SG. Something you cannot [428:06] do is rename a security group once [428:08] you've made it. So make sure you don't [428:09] make a spelling mistake up here. And we [428:12] want to be uh accessing that HTT htt. [428:19] So in order to do that we need to make [428:20] sure we have HTTP as a type with the [428:22] port 80 open. And we want it from [428:25] anywhere. So we'll say anywhere and that [428:27] will be 0.0.0.0/z [428:30] and that's for the IPv4. This is for the [428:32] IPv6. Okay. So we'll just say internet [428:36] and this is for SSH, right? And for this [428:40] um I would probably suggest to say my [428:42] IP, but since we might be using a cloud [428:44] shell to do that, we're going to leave [428:45] it as anywhere so that we don't have any [428:47] issues connecting. So from here we'll [428:49] review and launch and you can review [428:52] what it is that's going on here. It's [428:55] going to say here, hey, you have an open [428:57] port. That's okay. We we want the [428:59] internet to see our website because [429:01] that's the whole point there. And we'll [429:02] go ahead and launch it. It's going to [429:04] ask for a key pair. We can go down and [429:05] say proceed without key pair. But what [429:07] I'm going to do is I'm going to create a [429:08] new key pair because I want to show you [429:10] how those work. And I'm sure we've [429:11] already done in this course once, but [429:12] we'll do it again. And so I'm going to [429:15] just name this as my EC2 instance here. [429:18] And then we're going to go download that [429:19] key pair. It's going to download a PM [429:22] file there. And so now we can go ahead [429:25] and launch that instance. [429:28] And while that is launching, so I'm [429:29] going to just close this other tab here. [429:31] We're going to click on the view [429:32] instances. And so here is that instance. [429:34] That's why we put the tag so we could [429:36] have a name there. We're going to wait [429:37] for that to start. But as that's going, [429:39] I'm going to make a new tab by just [429:40] right clicking here on the logo. Click [429:42] anywhere pretty much to do that. And uh [429:45] once we do that, we'll click on cloud [429:46] shell. [429:50] And as that is going, what I want to do [429:52] is take this PM down below. I'm going to [429:54] move it to my desktop to make it easier [429:56] for me to upload. I'm doing this [429:57] offscreen. Okay. [430:02] And uh once this environment is running, [430:05] I'm going to go ahead and upload that. [430:06] Okay. So, we'll just give it a moment to [430:09] do that. We're also waiting for the [430:12] server to spin up. As you'll notice, [430:14] there is a public IP address here. It [430:17] says it's running. So, if we want, we [430:18] can copy it. We're looking for those two [430:20] checks to pass. So the server could be [430:23] available, but generally you want to [430:24] wait for those two system checks because [430:26] one says, "Hey, the hardware is fine, [430:28] the network's fine, things like that." [430:29] Okay, but if I take that IP address, [430:31] paste it on up here, we have the web [430:33] page, so that is working. Uh, no problem [430:36] there. So that's great. And we'll go [430:38] over to CloudShell, and that is still [430:40] starting. Uh, it's not the fastest, but [430:42] that's just how it is. and um you know [430:45] we'll get going here in a second as soon [430:49] as this decides to load. [430:53] There we go. So it's loaded. I can type [430:55] clear here just to clear that screen [430:57] out. And so what I want to do is upload [430:59] that PM file. So I'm going to go and [431:00] upload that file. We're going to go [431:02] ahead and select it. I'm going to go to [431:03] my desktop here. Whoops, my desktop. And [431:06] we are going to choose my EC2 instance [431:08] PM. All right. And from there we'll hit [431:10] upload. That's going to upload that PM [431:12] file. [431:15] Once that is uploaded, we're going to do [431:16] ls. [431:18] Okay. And so, uh, this is from a [431:20] previous tutorial, so I'm going to go [431:21] ahead and just delete that other one [431:22] there. We'll say remove EFS example PM. [431:26] Yes. [431:28] Okay. We'll type clear. [431:30] And then what we can do here is type in [431:32] chimod. And um, I believe it's 400. And [431:36] what did we call this? My EC2 instance [431:39] pam. If you hit tab, it will [431:40] autocomplete, which is nice. And if you [431:42] do ls-la, we can take a look at that [431:44] file and see it should look like this. [431:47] It should have only one R here. So the [431:49] idea is you're locking it down. So it's [431:51] not writable or executable. It's just [431:53] readable because that's what you have to [431:55] have it if you want to SSH. And so if we [431:57] want to SSH, what we'll do is hit the [431:59] connect button here. [432:01] And we have four options. They just give [432:03] you too many options. There's going to [432:04] be a fifth one for sure soon. But right [432:06] now we're talking about SSH. So for SSH [432:09] um we had to chim our file which we did [432:11] and then we need to use this DNS to [432:13] connect to it. And so this is the full [432:14] line here. If you click on this, copy [432:17] that over and paste it in. [432:19] That should be everything. And notice [432:20] we're doing EC2 user followed by this. [432:23] You could put the IP address in here [432:25] instead if you preferred. So if you were [432:28] over here, [432:30] you could go and take that IP address, [432:32] which is I think shorter, nicer, but um [432:34] you know, if you just click that one [432:36] button, it works. That's fine. You [432:38] always have to accept the uh the [432:40] fingerprint. Then you'll be inside the [432:42] instance. You can type who am I to see [432:43] which user you are. You're the EC2 user [432:46] and that's the user that AWS creates for [432:48] their Amazon Linux instances. Um it's [432:50] going to vary per um AMI. So not all [432:54] AMIs have an EC2 user. It might be [432:56] something else, but that's generally the [432:58] ones that ads uses for their supported [432:59] ones. And so if we do um an LS, again, [433:03] we're in the server right now. We can [433:04] tell because it says right here. where [433:05] if we do a pwd we can kind of just kind [433:08] of look around. So I think it's going to [433:09] be at var www. That's where httpd [433:13] or apachi always uh puts their files [433:15] here. So if I go in here whoops I'm just [433:19] looking for um the index file. So I [433:22] thought the index file was in [433:26] cdvar www [433:30] h [433:31] h h h h h h h h h h h h h h h h h h h h [433:31] h h h h h h h h h h h h h h h h h h h h. [433:33] Well, where the heck is it? So, I'm [433:34] going to just touch a file here and see [433:36] if it overrides it. [433:39] Oh, I don't care. I'll just type pseudo. [433:42] And what we can do is just try to [433:43] restart this system ctl. Um, [433:47] there's a very similar command that's [433:49] like uh service. And so, I always forget [433:51] the order of it. So, I think it'd be I'm [433:53] just checking um probably uh restart [433:57] httpd. [434:00] And so, failed to restart. The policy [434:03] was not provided as the name service. Um [434:05] service [434:12] uh maybe pseudo. [434:15] There we go. And so if we go back here, [434:17] I'm going to see if it changed because [434:19] it will take whatever is in the index [434:21] html file. So if there's no file there, [434:23] it's going to uh show that there. And so [434:24] what I can do is I can edit this file. [434:27] going to type vi index html and um I'm [434:30] going to hit I for insert mode. Oh, it [434:33] says it's read only. So what we have to [434:35] do q colon q quit [434:39] oops uh clear ls and so what we need to [434:43] do is do pseudo vi index html and so vim [434:48] every single key is a hotkey. Okay. Um [434:51] and I'm not teaching vim here but I'm [434:52] going to teach you the basics. The idea [434:53] is that when you're here, notice that [434:55] the cursor is blinking. When I hit I, it [434:58] enters insert mode. Now I can type [435:00] normally. So I'd say hello uh hello [435:04] cloud. Okay. And I'm going to hit escape [435:06] to go back to um navigation mode, [435:09] whatever you want to call it. I'm going [435:10] to hit colon so it brings up the [435:12] command. I'm going to type in uh write [435:15] and quit. Okay. And hit enter. And so [435:18] I'll type clear. And so whoops, clear. [435:21] And so we'll hit up till we get that [435:24] command. Pseudo systemctl restart HBD. [435:27] We'll hit that. Hit enter. [435:31] Okay. And it should restart pretty fast. [435:35] There it is. It says hello cloud. I [435:37] probably didn't even have to restart it [435:38] to do that. But anyway, so now that [435:40] instance, uh, you can see how we're [435:42] updating that. So, what I want to do is [435:44] just do a sanity check and make sure [435:46] that if we restart this instance that [435:48] we're going to be able to um have Apachi [435:51] running. That's something you should [435:52] always do if you have an app and you or [435:54] anything and you install it, restart [435:55] your server, make sure that everything [435:56] works. So, what I'm going to do is uh [435:59] just hit exit here. So, we go back to [436:02] the top level cloud shell, type clear. [436:04] I'm going to go back over to my EC2 [436:06] instance. You might have to click around [436:08] to find it here. And what I want to do [436:10] is reboot it. Okay. And if I reboot the [436:13] machine, the IP address is going to stay [436:15] the same. Okay, so if I reboot it, the [436:18] IP address is going to stay the same. [436:19] And the reboot's going to happen really [436:21] fast. If we want to observe that reboot, [436:24] we could go over to um here on the right [436:27] hand side, go to the system log, and it [436:29] would show us that it it had rebooted, [436:32] I think. So, yeah, it does cloud in it [436:33] there. I think it rebooted. [436:36] Not sure. Um but anyway, if it's [436:38] rebooted, then we can go ahead and [436:40] connect and make sure everything's fine. [436:41] So, let's just go here and hit enter. [436:43] And let's see if the what the web page [436:45] is here. [436:49] Notice that it's hanging, right? So, [436:51] it's probably because it's still [436:52] restarting [436:54] even though it doesn't look like it is. [436:55] And that's something that you have to [436:56] understand about the cloud is that you [436:59] have to think about what you're doing [437:01] and have confidence that it is happening [437:02] and also just double check it. But, uh [437:05] that's something that can be kind of [437:06] frustrating because these are globally [437:08] available services. uh uh they're [437:10] massively scalable and so one of the [437:12] trade-offs is that you don't always have [437:13] the most uh responsive uh UIs. Adabus [437:17] has one of the most responsive UIs out [437:18] of all the major providers, but even [437:20] still like sometimes I have to second [437:21] guess myself. But the page uh right now [437:24] is not working. Now it is. So it's fine. [437:26] So it just took time for that to reboot. [437:28] And so um what I want to do is connect a [437:30] different way. So we're going to go here [437:32] and we're going to hit um we're going to [437:34] checkbox that on. We're going to hit [437:35] connect. And instead of using SSH [437:37] client, we're just going to go to [437:37] sessions manager and hit connect. And [437:40] this is the preferred way of connecting [437:42] because you don't have to have this this [437:45] SSH key. And that's a lot more secure [437:47] because if someone has that key and you [437:49] you know you hand it to someone, they [437:51] could hand it to somebody else and then [437:52] you have a big problem on your hands. So [437:54] here, this looks very similar, but if [437:56] you type who am I, it actually logs in [437:57] as the SSM user, which is kind of [437:59] annoying. So I type in a pseudo su. I [438:02] have to do this hyphen here. And then [438:03] I'm going to say the user I want to be, [438:04] which is EC2 user. And then if I type [438:07] who am I, we are the correct user. You [438:08] can't do anything in that SSM hyphen [438:10] user or or SSM user. So you got to [438:12] switch that over. And I can bump this up [438:14] to make it a bit larger. So this is [438:16] obviously not as nice as working over [438:18] here or even in your own terminal, but [438:20] it's a lot more secure and it's tracked [438:23] and all these other things. So we really [438:24] should be using it. Okay. [438:27] And um I really don't like having to [438:29] bump this up with my HTML. I'm going [438:31] just go back to zero there. There's [438:32] probably like a way to configure that. [438:34] But anyway, uh let's just go and take a [438:37] look at our file. I'm gonna type vi [438:40] again and we're gonna do var www html [438:43] index html. I'm going to put pseudo in [438:46] front of there. And again, remember you [438:48] have to hit I to go into insert mode. [438:52] And uh what I'm going to do is just take [438:54] capitalize that hello cloud. Give that [438:56] exclamation mark. Colon WQ to quit. [438:59] Right quit. Going to go back here. [439:01] Refresh. Okay. Okay, so we don't have to [439:02] restart our server, which is nice. All [439:04] right, so um that's that that's pretty [439:08] clear. So I'll hit terminate here. And I [439:11] don't think we need cloud shell for [439:12] anything. So I'm just going to close [439:13] that. And so that's pretty much it when [439:16] it when it comes to working with an an [439:19] EC2 instance. And so the next thing I [439:20] want to show you is elastic IP. Okay. [439:27] Okay. Okay. So now I want to show you [439:28] elastic IP uh commonly abbreviated to [439:31] EIP. And so all that is it's just a um a [439:35] static IP and IP that does not change [439:36] because this EC2 instance here notice [439:39] that it's 54 1634104. [439:42] And what would happen if we were to stop [439:44] this instance not reboot it but stop it [439:46] because for whatever reason we had to or [439:48] or um for whatever reason. And if we [439:52] were to stop this instance and we were [439:54] to restart it. [439:57] Okay. Uh and we have to wait for it to [440:00] stop. But that IP address is going to [440:02] change. Okay. [440:05] So 54 1634104. Hopefully we can observe [440:08] that. I'm just going to write that down [440:10] so we do not forget so I can prove to [440:14] you that it does change. [440:18] And now that it it's still stopping [440:20] here. So, as that's stopping, we're just [440:23] going to go ahead and get our elastic [440:25] IP. And we'll prove that as we go here. [440:27] So, I'm going to go over to here. And [440:29] so, what I want to do is reserve or [440:31] allocate an elastic IP address. And so, [440:33] I'm going to say US East1. And it's [440:36] going to say from the Amazon pool of [440:37] IPv4 addresses. So, Adabus has a bunch [440:40] of IP addresses they're holding on to. [440:42] And so, you can just allocate one. And [440:45] once you've allocated, that's your IP [440:47] address. So coming back to here. Okay, [440:50] this is stopped. Notice there is no [440:53] public IP address. We're going to start [440:55] it again. [440:59] Okay. And then we'll just checkbox it [441:00] on. And we just have to wait a little [441:02] while to see what the IP address is [441:04] going to be. I'm going to tell you it's [441:06] going to be something else. [441:09] So if I go back here, this is 542351210. [441:14] And our original one was 541634104. [441:17] So the reason why it's important to have [441:19] the same address is that if uh you have [441:22] a load balancer, well not a load [441:23] balancer, but if you have a domain [441:25] pointing to your I uh your server and [441:28] you reboot, then the route you have a [441:30] dang a dangling um path or route where [441:34] uh Revity 3 was just going to be [441:35] pointing to nothing. And so it does have [441:37] things to mitigate that like aliases and [441:39] things like that. But um in general, you [441:41] know, there's cases where you just have [441:43] to have a static IP address. And so we [441:46] had allocated one over here. And if we [441:48] want to assign it, we're going to [441:49] associate that elastic IP address. We're [441:52] going to drop it down. Choose a CC2 [441:54] instance. Um I suppose the private IP as [441:57] well. And then we're going to go ahead [441:58] and hit allocate or associate. [442:02] And once it's associated, it should now [442:04] have 341 1991 12116. [442:07] So, we go over here [442:11] and we're going to take a look here. And [442:13] that's its IP address. We can pull it [442:14] up. Okay. And that's that. So, yeah, [442:18] that's elastic IP. [442:24] Okay. So, now that we um have our [442:26] elastic IP, we have our EC2 instance [442:28] running. Let's say um you know, we lose [442:30] the server, we terminate it. So, we [442:32] would lose all of our configuration. And [442:33] so if we wanted to bake this AMI to save [442:35] it for later, what we'd have to do is go [442:37] and create an image. So to do that, we [442:39] go to the top here and we go to images [442:41] and templates and we can create an image [442:42] or we can create a a a template, which [442:44] is a lot better. But for the time being, [442:46] we're just go ahead and create an image. [442:47] And when you create an image, you're [442:48] basically creating an AMI. And so here [442:50] I'm just going to say my EC2 [442:54] and I'm going to go 00 to just kind of [442:56] like number it. So that's a very common [442:57] numbering. Just do three zeros and then [442:59] increment by one. And so here I can just [443:01] say my Apache server. And so it's going [443:04] to save some settings like the fact that [443:06] there is a a volume. You could uh save [443:09] some tags there. And so I might go ahead [443:11] and add a tag and just say name. And [443:12] we'll just say my EC2 server or so that [443:16] it remembers that. [443:18] Okay. And then what we'll do is go ahead [443:21] and create our image. And so this can [443:23] take a little bit of time. If we go over [443:25] to uh images here, [443:29] it's going to be spinning for a while [443:30] and uh we'll just wait until it's done. [443:32] Okay. All right. So, after waiting a [443:34] little while here, our AMI is ready. So, [443:36] we're just waiting for it to go [443:37] available. If you do not see it, just [443:38] make sure you hit the refresh. Um [443:40] because sometimes ADS will just spin [443:42] forever. Um and so that's just something [443:44] you'll have to do. So, you know, [443:46] hopefully that makes sense. What we'll [443:47] do is go make our way back over to [443:50] instances here and we can launch one [443:52] this way. Well, actually, we can do it [443:54] over from um the AMI page. So, what I'm [443:57] going to do is just terminate this [443:58] instance. We're all done with it. Okay. [444:01] And we'll hit terminate. It's totally [444:03] fine. And it had a message about elastic [444:05] IPs about releasing them. So, when it [444:07] does that, the elastic IP is still over [444:09] here. So, it did not release it. So, [444:12] what we're going to do is go ahead and [444:14] disassociate the elastic IP. [444:16] Okay. And then we're also going to [444:19] release the IP address because if we [444:21] don't, we're going to have this IP [444:22] address that's sticking around that [444:23] we're not using. It is going to charge [444:25] us a dollar month over month. So just be [444:26] aware of those because that's just kind [444:28] of like a hidden cost there. But what [444:30] we're going to do is go over to AMI [444:32] and we're going to select it here. We're [444:34] going to go to actions. We're going to [444:35] go ahead and launch. [444:37] And what it's going to do is make us [444:38] fill out all this other stuff again. So [444:40] if you had made a launch template, uh we [444:42] wouldn't have to fill out all this [444:43] stuff. It'd be part of it. But that's [444:45] what I'm trying to show you with this [444:46] AMI stuff. So, um, instead of filling [444:49] out all this, what I'm going to do is [444:50] now go create a launch template just to [444:52] kind of show you that that would be a [444:55] much easier way to work. [444:57] So, we go over to EC2 instances and then [445:00] on the left hand side, we're looking for [445:02] a launch template. Launch launch [445:04] configurations is the old thing. Um, [445:07] launch templates. Here we go. So, what [445:10] we'll do is create ourselves a launch [445:11] template. We'll just say my Apache [445:13] server. [445:15] And then down below, we need to choose [445:18] our AMI. So, we're going to go here and [445:20] we need to type it in. So, what did we [445:22] call it? My EC2. [445:26] I really don't like this uh search here. [445:28] It's very slow and frustrating. But once [445:30] we find it, Whoops. That's why I don't [445:32] like it because a lot of times it'll be [445:34] loading and you'll end up clicking the [445:35] wrong thing. [445:37] Okay. So, [445:40] I don't like this. Okay. We'll type in [445:42] my [445:45] Give it a second. [445:48] There it is. Just wait because it will [445:50] keep loading. And then once it's loaded, [445:52] hit enter. [445:55] And so it has that instance selected. [445:56] And then from there, uh, don't include [445:59] it in the launch template. So here we [446:01] could be explicit. I would say I want [446:03] this to be T2 T2 micro, but we could [446:05] exclude it if we wanted to. We could [446:07] specify the key pair here. Um, not that [446:09] we really want to use key pairs. We'll [446:11] say my EC2 instance. Then down down down [446:13] here for the networking we can specify [446:15] uh that security group we created. So we [446:17] created one here called my EC2SG. [446:20] Um storage is fine. It's going to be [446:23] encrypted. Network interface is fine. [446:25] Advanced details. What I want to do is [446:27] set the IM instance profile. That's [446:28] really important because we don't want [446:30] to have to figure out that role every [446:32] single time. So we'll put that there. [446:35] And that should be everything. And we [446:38] could put user data in there but it's [446:39] already baked into our AMI. So we don't [446:41] have to worry about anything. So, what [446:42] I'm going to do here is go ahead and [446:44] create this launch template. And then [446:46] we're going to view this launch [446:47] template. And so, now what we can do is [446:49] then use it to launch an instance. Okay. [446:54] And so, we're going to look here, and [446:56] it's very similar to DC2, but except [446:58] it's vertical. So, we're going to have [446:59] one instance. It's going to use that [447:01] AMI, that instance type. So, you can see [447:02] how you can override them, which is [447:04] nice. We're going to check the advanced [447:05] details. Make sure that IM profile is [447:07] set. And we'll go ahead and launch this [447:10] from a template. [447:11] So from there, we can go ahead and click [447:14] the instance value there. And just be [447:16] aware that when you do click through [447:18] links like that, you'll end up with a [447:19] search. So I was just checkbox that off [447:20] so I can see what I'm doing. And so [447:22] we're just waiting for this instance to [447:24] show up. And the only thing I notic is [447:25] it didn't set our darn tags. So I wanted [447:28] the name in there, and I think it's [447:30] because we set it in the AMI, but it [447:31] didn't carry over to the launch [447:32] template. So I'd have to go back to the [447:34] launch template and update it probably. [447:36] Okay. So, if I go into here into the [447:37] launch template, [447:40] um, we can probably modify create a new [447:43] version [447:45] and then add tags there. So, we say name [447:50] uh my uh Apache server. [447:54] I realize I'm changing it between them. [447:56] And so, that should allow us to have a [447:58] version two. So, we'll create that. And [448:01] but anyway, that will be for the next [448:03] time we launch it. Okay. [448:05] And so this instance is running. I'm [448:06] going to go grab the IP address. The [448:09] server may or may not be ready. We'll [448:11] take a look here. And so it's just [448:13] spinning. If it's spinning, it's either [448:15] the server is not ready or um our port's [448:18] not open. So it was just getting ready [448:20] to work there. So it is working now. So [448:23] that is our launch template. So now you [448:25] know we don't have to worry about losing [448:26] our stuff. And if we need to make new [448:28] versions, we can just bake new AMIs and [448:31] increment them as uh inc and attach them [448:34] as new versions in the launch template. [448:35] Okay. [448:41] All right. So what I want to show you in [448:42] this follow along is to set up an [448:44] autoscaling group for our EC2 instance. [448:47] And the idea behind this is that um [448:49] we'll be able to always ensure that a [448:51] single server is running or uh increase [448:54] the capacity if the demand requires it. [448:56] So, in order to create an autoscaling [448:58] group, we can go all the way down below [449:00] to here. Um, and so, you know, I really [449:03] don't like the autoscaling group form, [449:05] but it's okay. We'll work our way [449:06] through it. So, the first thing is we'll [449:07] have to create our or name our [449:09] autoscaling group. So, we'll just say my [449:11] ASG. And then we'll have to select a [449:13] launch template, which is great because [449:14] we already have one. And then we'll have [449:16] to select the version. I'm going to [449:17] select version two so that it applies [449:19] that tag name. And we'll go to next. And [449:22] so here um it's going to need to select [449:25] a VPC and then we need some subnets. So [449:28] we're going to choose three just because [449:30] to have high availability you have to be [449:32] running in at least three different [449:33] availability zones. So that's why we [449:35] have three different subnets. And then [449:37] down below we have the instance type [449:38] requirements. So uh T2 micro launch [449:42] template looks good to me. So we'll go [449:43] ahead and hit next. [449:47] And then from here we can choose to do a [449:48] load balancer. And so I want to do the [449:50] load balancer separate. So we won't do [449:53] it as of yet, but very often if you're [449:54] going to have an autoscaling group, [449:55] you're going to usually have a load [449:57] balancer, but we'll talk about that when [449:59] we get to that point there. So we'll [450:01] just go to the bottom here and hit next. [450:03] And so this is what's important. So how [450:05] many do you want to be always running? [450:07] And so we always want to have one. And [450:09] maybe the maximum capacity is two. And [450:11] you want the desired cast capacity be to [450:13] be around a particular number. So if you [450:15] had three and you said the desired is [450:16] two, there are things that could try to [450:18] work to always make sure there's two, [450:20] but we just want to have one for this [450:21] example. We can set up a scaling policy. [450:24] So I do target tracking scaling policy. [450:26] And so here we could do it based on a [450:28] bunch of different things. So if the CPU [450:29] utilization went over 50%, it would [450:32] launch another server. So that might be [450:34] something we might want to set. So I'll [450:35] we're not going to uh try to trigger the [450:37] scaling policy, but we might as well [450:39] just apply because it's not too hard. [450:40] And then you can also do a scaling uh [450:42] scalein protection policy. So, if you [450:44] want to make sure it does not um uh [450:47] reduce the amount of servers, that's [450:49] something you could do. We could add a [450:51] notification to say, hey, there's a [450:52] scaling policy happening here, which is [450:54] fine. We don't have to worry about that. [450:56] Um, and there's tags. So, add tags to [450:58] help you search, filter, etc. Um, so I'm [451:00] going to put a tag here. I'm going to [451:02] say name. I'm just wondering if this is [451:04] going to attach to the EC2 instance or [451:05] this is for the autoscaling group. You [451:07] can optionally choose to add tags to [451:09] instances by specifying tags in your [451:11] launch template. So, we already did [451:12] that. So, I don't need to put a tag [451:14] here. And so, we can review our um [451:18] autoscaling group and go ahead and [451:19] create that autoscaling group. [451:22] Okay. And so, that autoscaling group [451:25] expects there to be a single instance. [451:27] So, what's going to do is it's going to [451:28] start launching an instance. And so, [451:30] what I'm going to do is just get rid of [451:32] this old server because we don't need it [451:34] anymore. This old one here. Okay. [451:38] And you can already see, okay, that the [451:40] load balancer is launching this new one [451:43] here. And remember, we updated our [451:45] version two to have that name. So that's [451:46] how we know that it is. So if we go back [451:48] over to our autoscaling group, [451:53] okay, it's now saying there is an [451:55] instance. We don't have a status as of [451:57] yet. [451:59] And so there are ways of doing uh status [452:02] checks to for it to determine whether or [452:04] not the server is working. Um because if [452:07] the server is unhealthy, what it would [452:08] do is it would actually kill it and then [452:10] start up a new one, right? So if I go [452:12] down below, it's right now doing an EC2 [452:13] health check. And the EC2 health check [452:15] just means that is the server working [452:17] right. Um is it running? It doesn't [452:19] necessarily mean like, hey, can I load [452:20] this web app? Um but you know, it's very [452:23] simple. So we'll give it a moment here [452:26] to start up and just make sure that it's [452:27] working. [452:33] Okay. And I think it's ready. Okay. So, [452:34] if I take that public IP address here [452:36] and paste it in, there it is. Okay. So, [452:39] if we were to tell it to increase the [452:42] capacity to three, then what it would do [452:43] is it would launch three and then it [452:45] should probably launch it all evenly to [452:48] those other it should evenly launch it [452:51] to all those other uh availability zones [452:53] and then we'll have something that is [452:54] highly available. Okay, so that's pretty [452:57] much it for this and then we'll move on [452:58] to autoscaling groups. [453:03] All right. So we have our uh EC2 [453:06] instance now managed by an autoscaling [453:08] group. And the great thing is that if we [453:09] terminate this instance, this [453:11] autoscaling group will launch another uh [453:14] instance to meet our particular [453:15] capacity. Um the only thing though is [453:17] that if we were to have multiple EC2 [453:19] instances running like three of them um [453:22] how would you distribute traffic to them [453:25] all right? So you know you have an IP [453:27] address coming in from the internet. Uh [453:29] but let's say you want to evenly [453:30] distribute it and that's where a load [453:32] balancer comes into play and even if you [453:34] have a single server you should always [453:36] have a load balancer because it just [453:37] makes it a lot easier for you to scale [453:39] when you need to and you it acts as an [453:42] intermediate layer where you can attach [453:43] a web application firewall you can [453:45] attach an SSL certificate for free. So [453:48] there's a lot of reasons to have a load [453:51] balancer. So, what we'll do is go down [453:53] below on the lefth hand side and we're [453:54] going to make our way over to load [453:55] balancers and we're going to create [453:57] ourselves a new load balancer. So, I'm [453:59] going to hit create load balancer here [454:02] and you're going to see we have a lot of [454:03] options. Application load balancer, [454:04] network load balancer, gateway load [454:06] balancer, and then the classic load [454:08] balancer. And so, we are uh running an [454:11] application. So, I'm going to create an [454:12] application load balancer. And here I'm [454:14] going to say my ALB um for an [454:17] application load balancer. This is going [454:18] to be internetf facing. It's going to be [454:20] IPv4. [454:21] um we're going to let it launch in the [454:23] default um subnet and we're going to [454:25] choose the same the same uh uh a right [454:31] so that we get the same subnets as our [454:33] that are in our autoscaling group and [454:35] that's really important. Okay. And then [454:37] here um you know we need to have a [454:41] security group and I just feel like [454:42] selecting the same one here because that [454:44] should work no problem there. And we [454:47] want to make sure that we can listen on [454:49] port 80. And then it's going to forward [454:51] it to a a um a target group. And it [454:54] looks like I might have a target group [454:56] there from before. So just to reduce [454:58] that confusion, you won't have this [455:00] problem. I'm just going to double check [455:01] if that's true. So do I have a target [455:03] group from there from before? Yes, I do. [455:06] That came from [455:09] I'm not sure. It might have been created [455:10] by um Elastic Beantock and wasn't [455:13] deleted. Okay. So I'll go back over to [455:16] here just so there's less confusion and [455:20] we were selecting our target group. So [455:22] we're going to have to create a new [455:23] target group. So we'll go over here and [455:26] here you can choose whether it's [455:27] instance IP lambda application load [455:30] balancer. So you could point it [455:32] specifically to an IP address. And so if [455:34] it was a static IP address that would [455:35] make sense. Uh apparently you can port [455:38] uh point it directly to instances. I [455:40] don't remember seeing that option [455:41] before. I guess that makes sense. Yeah. [455:44] No, sorry. That makes sense because that [455:45] would go to uh VPCs, okay? Or sorry, [455:48] ASGS, autoscaling groups. It's just that [455:51] you are pointing them to autoscaling [455:52] groups. You're not pointing them to [455:53] instances. So that's why that's [455:54] confusing. So I'm going to say my um [455:57] target group. It'll be for port 80 here. [456:00] Um protocol HTTP1 is fine. We want to be [456:03] in the same u VPC. So that's fine as [456:06] well. And down below we have our health [456:08] check. And so the for slash means that [456:10] it's going to hit the index html page. [456:12] And so if it gets back um something [456:15] healthy and that that something healthy [456:16] is going to be um port 80 then it's [456:20] going to be considered good. And then we [456:22] can say the threshold of check. So I'm [456:24] just going to reduce this so it's not so [456:25] crazy. So we'll say three uh two and [456:28] then 10. Okay. And then it expects back [456:32] a 200 which I think that's what we'll [456:35] get back. So we'll go ahead and hit [456:36] next. And so now we have our target [456:39] group and it should register instances. [456:42] So it's saying hey we detected this and [456:44] this fits the requirements for this. So [456:46] this is now uh this C2 instance is now [456:48] in this target group. Okay. So we can go [456:50] back over here and we can now drop down [456:53] and choose Whoops. Hit the refresh [456:55] button [456:57] and choose our target group. [457:00] So I'm not seeing it here. So I'm going [457:02] to go back over here. Oh, we didn't [457:04] create it. Okay. [457:07] And now we can go back, hit refresh, and [457:09] there it is. [457:12] And yeah, that looks all good. So we'll [457:14] go ahead and hit create load balancer. [457:17] We can view the load balancers. And [457:19] these create really fast. If we scroll [457:21] on up, what we can do is now access our [457:24] server through this DNS name. Okay, so [457:26] we copy that, paste that on in there. [457:30] Does it work? [457:36] not as of yet. So if it's not working [457:38] there because we did say look at these [457:40] instances another way is to directly [457:42] associate your autoscaling group with [457:44] the load balancer. So if I go into here [457:46] and we hit uh edit [457:51] there is a way aha load balancer. So [457:56] we want to associate this way and we [457:57] want to say this target group here. [458:01] And also while we're here, we might as [458:02] well set it to ELB. So it's going to use [458:04] the ELB check. So that makes it so the [458:06] autoscaling group, if it wants to uh [458:08] restart server, it's going to use the [458:09] ELB's check, which is a lot more [458:11] sophisticated. And then what we'll do is [458:13] go hit update. [458:15] Okay. [458:18] And now if we go back over to our load [458:21] balancer, I'm just going to close some [458:22] of these tabs so it's a little less [458:23] confusing. [458:26] Load balancer here. [458:30] I think we should be able to see through [458:31] here whether it is seeing it. Let's go [458:35] down below. Listeners, monitoring, [458:38] integrated services. No, it's going to [458:40] be through the target group. [458:44] Okay. [458:48] I mean, it already had it there. So [458:50] maybe it's just that it hasn't finished [458:51] the check. So over here it has a health [458:53] status check. Oh, now it's healthy. [458:55] Okay. So, if it's healthy in the target [458:57] group and the load balancer is pointing [458:58] to it, then it should technically work. [459:00] So, we're going to go ahead and [459:04] uh copy the DNS again here, make a new [459:07] tab, paste it in, [459:11] and there it is. Okay, so that's how [459:14] you're going to access um all your all [459:16] your instances that are within your [459:17] autoscaling groups. You're going to [459:18] always go through the DNS. And so if you [459:20] had a row 53 uh domain, like you had [459:23] your domain managed by AWS, you just [459:25] point to the load balancer and that's [459:27] how you'd hook it up. So that's pretty [459:29] much it. So yeah, there you go. [459:35] All right. So there you go. We learned [459:36] everything we wanted to know about EC2. [459:38] So the the last thing to do is to tear [459:40] everything down. So we have a load [459:41] balancer. We have an autoscaling group. [459:43] Um and those are the two things we'll [459:45] have to pull on down. So the first thing [459:47] would be to take down the autoscaling [459:49] group. And when you delete an [459:50] autoscaling group, it's going to delete [459:52] all the EC2 instances. So we'll do it [459:54] that way. If you tried to delete the [459:56] EC2, it would just keep on spinning out. [459:58] So you have to delete that first. And so [460:00] as that's deleting, then we'll be able [460:02] to delete our load balancer. I'm going [460:03] to try anyway to see if I can delete it [460:05] at the same time. [460:08] And so I'll go up here. I'm going to go [460:09] ahead and delete that uh load balancer. [460:12] Actually, it did work. No problem. [460:15] Going to make sure I don't have any [460:16] elastic IPs. [460:18] I'm going to also make sure I don't have [460:20] any key pairs. You can keep your key [460:22] pairs around, but like I just want to [460:24] kind of clean this up. So, [460:28] okay. [460:39] Okay. And that instance should be [460:40] terminating. [460:43] Got to go back to the autoscan group [460:44] here. [460:49] If we click into it, we can check um [460:51] it's activity here. [460:55] So, it's just saying successful. So, it [460:57] is waiting on ELB connection draining, [461:00] which is kind of annoying because we [461:02] deleted our ELB, so there's nothing to [461:03] drain. [461:05] Um draining is just to make sure that uh [461:08] you know there's no interruptions when [461:10] terminating services. So, just trying to [461:11] be smart about it. [461:23] And all I want to see is that it's just [461:24] saying terminating over here and then I [461:26] think we're done. [461:28] Okay. So, we'll just have to wait a [461:29] little while here. Okay. And I'll see [461:32] you back in a moment. Okay. All right. [461:34] So, after waiting a very long time, it [461:36] did destroy. Okay. So, if I go down over [461:39] to uh my load balancer here, we're going [461:41] to see that it does not exist. So, there [461:43] was that connection draining thing, [461:44] which was kind of annoying. It's [461:45] probably because I deleted the load [461:47] balancer first and then the um the uh [461:51] the autoscaling group second and [461:52] probably connection draining was turned [461:54] on, but it's not a big deal. We just [461:55] waited it and it did eventually delete. [461:57] So, we're pretty much all done here. So, [461:59] there you go. [462:04] Hey, this is Andrew Brown from Exam Pro [462:06] and we are taking a look at EC2 pricing [462:07] models and there are five different ways [462:09] to pay with EC2. Remember EC2 are [462:11] virtual machines. So we have on demand, [462:13] spot, uh reserved, dedicated and adus [462:16] savings plans. So what we'll do is look [462:18] at these in summary here and then we'll [462:20] dive deep onto each of these different [462:22] pricing models. So for on demand you are [462:24] paying the uh a low cost and also you [462:26] have a lot of flexibility with this [462:28] plan. Uh you are paying per hour. So [462:30] this is a pay as you go model. Uh or you [462:32] could be paying down to the second which [462:34] we'll talk about uh the caveats there [462:36] when we get to the on demand section. [462:38] This is suitable for workloads that are [462:40] going to be short-term spiky [462:41] unpredictable workloads uh that cannot [462:44] be interrupted and it's great for [462:45] first-time applications. And the on [462:47] demand uh pricing model is great when [462:49] you need the least amount of commitment. [462:51] For spot pricing you can see we can save [462:53] up to 90% which is the greatest savings [462:54] of out of all these models here. Uh the [462:57] idea here is you're requesting spare [462:58] computing capacity that Adabus is not [463:00] using and that's where you're going to [463:01] get that savings. You have flexible [463:02] start and end times. Uh but your [463:04] workloads have to be able to handle [463:06] interruptions because these servers can [463:08] be stopped at any time to be given to [463:10] more priority customers. Uh and this is [463:12] great for non-critical background jobs. [463:14] Very common for like scientific [463:16] computing uh where jobs can be started [463:18] and stopped at any given time. This has [463:20] the greatest amount of savings. Then you [463:21] have reserve or reserved instances. This [463:24] allows you to save up to 75%. This is [463:26] great for steady state or predictable [463:28] usage. You're committing uh with AWS uh [463:31] for EC2 usage over a period of one or [463:33] threeyear terms. You can resell un uh [463:37] unused reserved instances. So you're not [463:39] totally stuck with this if you buy them. [463:41] This is great for the best long-term [463:43] savings. Then you have dedicated. So [463:45] these are just dedicated servers and [463:47] technically not a pricing model, but [463:49] more so that the fact that it can be [463:51] utilized with pricing models. Um but the [463:53] idea here is it can be was used with on [463:55] demand reserved or even spot. This is [463:57] great when you need to uh have a [463:59] guarantee of isolate hardware for [464:01] enterprise requirements and this is [464:02] going to be the most expensive. Uh so [464:04] yeah there you go and we'll dive deep [464:06] here. Okay. [464:12] So the ondemand pricing model is a pay [464:15] as you go model where you consume [464:17] compute and then you pay later. So when [464:20] you launch an EC2 instance by default [464:22] you are using that ondemand pricing and [464:25] on demand has no upfront payment and no [464:28] long-term commitment. You are charged by [464:30] the second up to a minimum of 60 [464:32] seconds. So technically a minute or the [464:34] hour. So let's just talk about the [464:36] difference between those uh per second [464:39] billing and those per hour billing. So [464:41] per second are for Linux, Windows, [464:43] Windows with SQL Enterprise, Windows [464:45] with SQL Standard, Windows with SQL web [464:48] instances that do not have a separate [464:50] hourly charge. And then everything else [464:53] is going to be um per hour. And so, you [464:56] know, when I'm launching EC2 instance, I [464:58] can't even tell when something's per [464:59] second or per hour. You just have to [465:01] know that it has a separate hourly [465:02] charge. But generally, you know, if [465:04] you're just launching things, it's going [465:05] to probably be the per second billing. [465:07] when you look up the hourly or the uh [465:09] the pricing, it's always shown in the [465:11] hourly rate. So, even if it is using uh [465:14] per second billing, when you uh look up [465:16] that pricing, it's always going to show [465:18] it to you like that. But on your bill, [465:19] you'll see it down to the second, okay? [465:21] Up to the first 60 seconds. Uh and on [465:24] demand is great for workloads that are [465:26] short-term, spiky, or unpredictable. Uh [465:28] but when you have a new app development, [465:30] this is where you want to experiment. [465:32] And then when you're ready to uh start [465:34] saving because you know exactly what [465:36] that workload's going to be over the [465:37] span of a year or three, that's where [465:39] we're going to get into reserved [465:40] instances, which we'll cover next. [465:46] Hey, this is Andrew Brown from Exam Pro [465:48] and we are taking a look at reserved [465:50] instances, also known as RARI. And this [465:52] is um a bit of a complex topic but uh [465:55] you know if we do get through it it's [465:56] going to serve you well through uh [465:59] multiple adabus certifications. So let's [466:01] give it a bit of attention here. So RAR [466:03] is designed for applications that have a [466:05] steadystate predictable usage or [466:07] required reserve capacity. So the idea [466:09] is that you are saying to AWS I'm going [466:11] to make a guaranteed commitment uh [466:13] saying this is what I'm going to use and [466:14] I'm going to get savings because ads [466:16] knows that you're going to be spending [466:18] that money. Okay. So the idea here is [466:21] that the reduced pricing is based on [466:22] this kind of formula where we have term [466:24] class offering the RA attributes and [466:26] payment options. Technically the RA [466:28] attributes don't exactly factor into it [466:30] other fact that they an R attribute [466:32] could be like the instance type size but [466:34] I'm going to put that in the formula [466:35] there just because it is an important [466:37] component. So let's take a look at each [466:39] of these components of the formula to [466:41] understand how we're going to save. So [466:43] the first is the term. So the term uh [466:45] the idea here is the longer the term the [466:47] greater the savings. So, you're [466:48] committing to a one-year or three-year [466:50] contract uh with AWS. Um, and one thing [466:54] you need to know is that these do not [466:56] renew. So, at the end of the year, the [466:59] idea is that you have to purchase again. [467:01] And when they do expire, your instances [467:03] are just going to flip back over to on [467:05] demand with no interruptions to service. [467:07] Then you have class offerings. And so, [467:09] the idea here is the less flexible the [467:11] offering, the greater the savings. So, [467:12] the first is standard. And this is up to [467:15] a 75 reduction in the price compared to [467:18] on demand. And the idea here is you can [467:20] modify some RA attributes which we'll [467:22] we'll talk about when we get to the um [467:25] RA tribute section there. Then you have [467:27] convertible so you save up to 54% [467:29] reduced pricing compared to on demand. [467:31] And you can exchange uh rais based on [467:34] the RA tributes if the value is greater [467:36] or equal in value. And there used to be [467:38] a third class called schedule but this [467:40] no longer exists. So if you do come [467:42] across it, just know that is not [467:44] planning on offering this uh again for [467:46] whatever reason. I'm not sure why. Uh [467:48] then there are the payment options. So [467:49] the greater upfront, the greater the [467:51] savings. So here we have all upfront. So [467:53] full payment is made at the start of the [467:55] term. Partial upfront. So a portion of [467:57] the cost must be paid upfront and the [468:00] remaining hours in the terms are build [468:01] at a discounted rate. And then there's [468:03] no upfront. So you are build at a [468:05] discounted hourly rate for every hour [468:07] within the term regardless of whether [468:09] the reservance is being used. And this [468:11] is really great this last option here [468:13] because basically you're saying to AWS [468:14] you're saying like I'm just going to pay [468:16] my bill as usual but I'm going to just [468:18] tell you what it's going to be and I'm [468:19] going to save money. So if you know uh [468:21] that you're going to be using a T2 [468:23] medium for the next year. Uh you can do [468:26] that and you're just going to save [468:27] money. Okay. So rais can be shared [468:29] between multiple accounts within an [468:31] organization and unused rais can be sold [468:33] in the reserved instance marketplace but [468:35] we'll talk about the limitations around [468:37] that when we get a bit deeper in here [468:39] just to kind of show you what it would [468:40] look like in adabus console and they [468:41] updated it. I love this new uh UI here. [468:44] The idea here is you're going to filter [468:45] based on your requirements and that's [468:47] going to show you rais that are [468:48] available and then you'll just choose [468:50] the desired quantity. You can see the [468:51] pricing stuff there. You're going to add [468:53] it to cart. You're going to check out [468:54] and that's how you're going to purchase [468:55] it. Okay. [469:01] So another factor to that formula were [469:03] RARI attributes and sometimes the [469:05] documentation calls them RA attributes [469:06] sometimes they call them instance [469:07] attributes but these are limited based [469:09] on class offering and can be uh can [469:13] affect the final price of the RA [469:14] instance and there are four RA [469:16] attributes. So the first is the instance [469:18] type. So this could be like an M4 large [469:21] and this is composed of an instance [469:23] family. So the M4 and the instance size [469:25] so large. Okay. Then you have the [469:27] region. So this is where the reserved [469:29] instance is purchased. Then you have the [469:31] tenency whether your instance runs on [469:33] shared. So the default which uh would be [469:36] multi-tenant or a single tenant which [469:37] would be dedicated hardware. And then [469:39] you have the platform whether you're [469:41] using Windows or Linux. Even if you're [469:43] using on demand of course this would [469:44] just affect your pricing but there are [469:46] some limitations around here which we'll [469:48] get into as we dive a bit deeper here [469:49] with RARI. Okay. [469:55] All right, let's compare regional and [469:57] zonal RARI. So when you purchase an [469:59] RARI, you have to determine the scope uh [470:02] for it. Okay, so this is not going to [470:04] affect your price, but it's going to [470:05] affect the flexibility of the instance. [470:07] Uh so this is something you have to [470:08] decide. So we're going to talk about [470:10] regional RARI, which is when you [470:11] purchase it for a regional and zonal [470:13] RAI, when you purchase it for an [470:14] availability zone. So when you purchase [470:17] it for a regional RAI, it does not [470:19] reserve capacity, meaning that there's [470:21] no guarantee that those servers will be [470:23] available. So if ads runs out of those [470:25] servers, uh you're just not going to [470:26] have them. But when it's zonal, uh you [470:29] are reserving capacity. So there's a [470:30] guarantee that those will be there when [470:32] you need them. Um in terms of uh a [470:35] flexibility, uh you can use the regional [470:38] RARI for any A within that region. But [470:41] for the zonal RAI, you can only use it [470:43] for that particular region. We're [470:45] talking about instance flexibility. um [470:48] you can apply the discount to uh any [470:51] instance in the family regardless of the [470:52] size. Uh but then when we're looking at [470:55] a there is no instance flexibility. [470:57] Okay? So you're just going to use it for [470:58] exactly what you defined. You can cue [471:00] purchases for regional RAI. You cannot [471:03] cue purchases for zonal RAI. So there [471:05] you go. [471:11] Let's talk about some RAI limits here. [471:12] So there's a limit to the number of [471:14] reserved instances that you can purchase [471:15] per month. And so uh the idea here is [471:18] that you can purchase 20 regional [471:20] reserved instances per region and then [471:22] 20 zonal reserved instances per A. So if [471:26] you have a region that has three A's, [471:28] you can have uh 60 um zonal reserved [471:31] instances in that region. Okay, there [471:34] are some other limitations here. So for [471:36] regional limits, you cannot exceed the [471:38] running on demand instance limit by [471:40] purchasing regional reserved instances. [471:42] The default for on demand limit is 20. [471:45] So before purchasing your RARI, ensure [471:47] on demand limit is equal to or greater [471:49] than your RARI you intend to purchase. [471:51] You might even want to open up a service [471:53] uh limit increase just to make sure you [471:55] don't hit that wall. For zonal limits, [471:58] you can exceed your running on demand uh [472:00] instance limit by purchasing zonal [472:02] reserved instances. If you're already uh [472:04] have 20 on demand instances and you [472:06] purchase 20 zonal reserved instances, [472:08] you can launch a further 20 on demand [472:10] instances that match the specification [472:12] of your zonal reserved instances. So [472:14] there you go. [472:20] Let's talk about capacity reservation. [472:22] So EC2 instances are backed by different [472:24] kinds of hardware and so there is a [472:26] finite amount of servers available [472:27] within an availability zone per instance [472:30] type of family. Remember an availability [472:31] zone is just a data center or a [472:33] collection of data centers and they only [472:35] have so many servers in there. So if [472:37] they run out because the demand is too [472:38] great, you just cannot spin anything up. [472:40] And so that's what's happening. and you [472:41] go to launch specific EC2 instance type [472:43] but AOS is like sorry we don't have any [472:45] right now and so the solution to that is [472:48] capacity reservation so it is a service [472:50] of EC2 that allows you to request uh a [472:53] reserve of EC2 instance type for a [472:55] specific region and a so here you would [472:58] see that you just select the instance [472:59] type platform a tenency the quantity and [473:03] then here you might manually do it [473:04] specify time or you might say okay I [473:07] can't get exactly what I want but can [473:09] give me something generally around uh [473:11] that kind of stuff or that type that I [473:13] want. So the reserve capacity is charged [473:15] at the selected instance type on demand [473:17] rate whether an instance is running in [473:19] it or not. And you can also use regional [473:21] reserve instances with your capacity [473:23] reservations to benefit from billing [473:26] discounts. So there you go. [473:32] So there are some key differences [473:33] between standard and convertible RARI. [473:36] So let's take a look at it here. So the [473:38] first is that with standard RAI you can [473:39] modify your attributes. So you can [473:41] change the A within the same region. You [473:44] can change the scope from a zonal RARI [473:46] to original RARI or vice versa. You can [473:49] change the instance size uh as long as [473:51] it's a Linux and it has the default [473:53] tendency. You can change the network [473:55] from EC2 classic to VPC and vice versa. [473:58] But when you're looking convertible, you [474:00] you don't modify RA attributes. You [474:02] perform an exchange. Okay? Okay. And so [474:04] standard RAIS cannot do exchanges where [474:07] convertible RAI you can uh exchange [474:10] during the term for another convertible [474:11] RAI with new RA attributes. And this [474:13] includes the instance family, instant [474:15] type, platform, scope and tenency. Um in [474:20] terms of the marketplace, you c uh they [474:22] can be bought in standard RAI uh in the [474:24] marketplace or you can sell your RARI if [474:26] you uh don't need them anymore. Uh but [474:28] for convertible RAI, they cannot be sold [474:31] or bought in the marketplace. you're [474:32] just dealing with AWS directly. Okay. [474:39] Hey, this is Andrew Brown from Exam Pro [474:41] and we are taking a look at the reserved [474:43] instance marketplace. We had mentioned [474:45] it prior, so let's give it a little more [474:46] attention here. So, it allows you to [474:47] sell your unused standard RARI to recoup [474:50] your spend for RARI you do not intend or [474:52] cannot use. So, reserved instances can [474:55] be sold after they have been active for [474:57] at least 30 days. And once Adabus has [474:59] received the upfront payment, you must [475:01] have a US bank account to sell RARI on [475:03] the RAR marketplace. There must be at [475:05] least one month remaining in the term [475:06] for the RARI you are listing. You will [475:09] retain the pricing and capacity benefit [475:11] of your reservation until sold and the [475:13] transaction is complete. Your company [475:15] name and address upon request will be [475:17] shared with the buyer for tax purposes. [475:20] A seller can set only the upfront price [475:22] of an RARI. The usage price and other [475:24] configurations such as instance type, [475:26] availability zone, platform will remain [475:28] the same as when the RARI was initially [475:30] purchased. The term length will be [475:31] rounded down to the nearest month. For [475:33] example, a reservation with 9 months and [475:35] 15 days remaining will appear as 9 [475:37] months on the RARI market. You can sell [475:40] up to 20,000 USD in reserved instances [475:42] per year if you need to sell more RARI. [475:45] Reserved instances in the GovCloud uh [475:47] region cannot be sold on the RAR [475:49] marketplace. So, there you go. [475:55] Hey, it's Andrew Brown from Exam Pro and [475:57] we are taking a look at spot instances. [475:59] So, Adabus has unused compute capacity [476:02] that they want to maximize the utility [476:04] of their idle servers. All right, so the [476:06] idea is just like when a hotel offers [476:09] booking discounts to fill vacant suites [476:11] or planes offer discounts to fill vacant [476:13] seats. All right, so spot instances [476:16] provide a discount of 90% compared to [476:18] ondemand pricing. Spot instances can be [476:21] terminated if the computing capacity is [476:23] needed by other ondemand customers, but [476:25] from what I hear, rarely rarely does [476:27] spot instances ever get terminated. Um, [476:30] it's designed for applications that have [476:31] flexible start and end times or [476:33] applications that are only feasible at [476:35] very low compute costs. So, you see some [476:37] options here like load balancing [476:38] workloads, flexible workloads, big data [476:40] workloads, things like that. Um there is [476:42] another service called batch which [476:44] is for doing batch processing and this [476:46] is very common what you use um spot with [476:49] and so you know if you find the spot [476:50] interface too complicated you're doing [476:52] batch processing you want to use this [476:53] service instead um there are some [476:55] termination conditions so instances can [476:58] be terminated by adabus at any time if [477:00] your instance is terminated by ads you [477:02] don't get charged for a partial uh hour [477:04] of usage if you terminate an instance [477:06] you will be still charged for an hour uh [477:08] that it ran so there you [477:15] Hey, this is Andrew Brown from Exam Pro [477:17] and we are taking a look here at [477:18] dedicated instances. So, dedicated [477:21] instances is designed to help meet [477:23] regulatory requirements. Itus also has [477:25] this concept called dedicated hosts and [477:27] this is more for when you have strict [477:28] serverbound licensing that won't support [477:30] multi-tenency or cloud deployments and [477:32] we'll definitely distinguish that in [477:34] this course but just not in this slide [477:35] in particular. Um and so to understand [477:38] uh dedicated instances or hosts we need [477:40] to understand the difference between [477:41] multi-tenency and single tenency. So [477:43] multi-tenency you can think of it like [477:45] everyone living in the same apartment [477:47] and single tenency you can think of it [477:49] everyone having their own house. So the [477:50] idea here is that you have a server I'm [477:53] just going to get my uh cursor or my pen [477:55] out here to say server and you have [477:57] multiple customers running workloads on [477:59] the same hardware and the idea is that [478:01] they are separated via virtual [478:03] isolization. So they're using the same [478:04] server but it's just software that might [478:06] be separating them. Okay. And then we [478:09] have the idea of single tenency. So we [478:11] have a single customer that has [478:13] dedicated hardware. So the physical [478:15] location is what separates customers. Um [478:18] and the idea here is that dedicated can [478:20] be offered via ondemand, reserved and [478:23] spot. So that's why we're talking about [478:25] dedicated here in the pricing model. [478:26] Just so you know that, you know, even [478:28] though these are a lot more expensive [478:29] than on demand, uh you can still save by [478:32] using reserve and also spot, which I was [478:34] very surprised about. Um and when you [478:37] want to choose dedicated, you're just [478:38] going to launch your EC2 and you'll have [478:40] a drop down where you have that shared. [478:42] So that's the default dedicated. So you [478:44] have dedicated instance and dedicated [478:45] host. And again, we'll talk about [478:46] dedicated host uh later when we need to [478:49] here. Um and so again the reason why um [478:52] you know enterprises or large [478:54] organizations may want to use dedicated [478:56] instances is because they have a sec uh [478:58] a security concern or obligation about [479:00] uh against sharing the same hardware [479:02] with other adabus customers. Okay. [479:09] Hey, this is Andrew Brown from Exam Pro [479:11] and we are taking a look at Adabus [479:13] savings plans and this is similar to [479:15] reserved instances but simplifies the [479:17] purchasing process. So, it's going to [479:18] look a lot like RARI at the start here, [479:20] but I'll tell you how it's a bit [479:21] different. Okay. So, there are three [479:23] types of saving plans. You have compute [479:24] savings plan, EC2 instance saving plans, [479:27] and SageMaker saving plans. Uh, and so [479:30] you just go ahead and choose that. You [479:31] can choose two different terms. So, one [479:33] year, threeear. So, it' be simple as [479:35] that. And then you choose the following [479:37] payment options. So, you have all [479:38] upfront, partial payment, and no [479:40] upfront. And then you're going to choose [479:41] that hourly commitment. You're not [479:43] having to think about standard versus [479:45] convertible. uh uh regional versus [479:47] zonal, ribbutes. It's a lot simpler. Uh [479:51] and let's just talk about the three [479:53] different saving plans or types in a bit [479:55] more detail. So you have compute. So [479:57] compute savings plans provides the most [479:59] flexibility and helps to reduce your [480:00] cost by 66%. These plans automatically [480:03] apply to EC2 instances usage. [480:06] Fargate, AIS Lambda service usage [480:08] regardless of the instance family, size, [480:10] a region, OS or tenency. Then you have [480:12] EC2 instances. So this provides the [480:15] lowest prices offering saving up to 72% [480:18] in exchange for commitment to usage of [480:20] instance uh individual instance families [480:22] in a region. So automatically reduce uh [480:24] your cost on the selected instance [480:26] family in the region regardless of a [480:28] size OS tenency. Gives you the [480:30] flexibility to change your usage between [480:32] instances with a within a family in that [480:34] region. And the last is SageMaker. So [480:37] helps you reduce SageMaker cost by uh up [480:39] to 64% automatically apply to SageMaker [480:42] usage regardless of instance family size [480:45] component ads region. If you don't know [480:47] what SageMaker is, that's AWS's ML [480:49] service and it uses EC2 instances or [480:52] specifically ML EC2 instances. So [480:54] everything's basically using EC2 here. [480:56] Um but there you go. [481:02] All right, let's take a look at the zero [481:04] trust model. And the zero trust model is [481:06] a security uh model which operates on [481:08] the principle of trust no one and verify [481:10] everything. So what I mean by that is [481:12] malicious actors being able to bypass [481:14] conventional access controls [481:16] demonstrates traditional security [481:17] measures are no longer sufficient and [481:19] that's where the zero trust model comes [481:21] into play. So with the zero trust model [481:24] identity becomes the primary security [481:26] perimeter. Uh and so you might be asking [481:29] what do we mean by primary security [481:30] perimeter? The primary or new security [481:32] perimeter defines the first line of [481:33] defense and its security controls that [481:36] protect a company's cloud resources and [481:38] assets. Um, if this still doesn't make [481:41] sense, we do cover a part of the defense [481:43] in depth where you see the layers of [481:46] defense from data all the way to [481:48] physical. And so you can kind of see, [481:50] you know, what we're talking about in [481:51] that model there. But the old way that [481:54] we used to do things is network [481:55] ccentric. So we had traditional security [481:57] focused on firewalls and VPNs since [481:59] there were few employees or workstations [482:01] outside the office or they were in a [482:02] specific remote office. So we treated [482:05] the network uh the network as kind of [482:07] like the the boundary. So if you're in [482:09] in office there's nothing to worry [482:10] about. But we don't think like that [482:12] anymore because everything is [482:13] identitycentric. So this is where we [482:16] have bring your own device remote [482:18] workstations which are becoming more [482:19] common. Uh we can't always trust that [482:21] the employee is in a secure location. We [482:23] have uh identity based security controls [482:25] like MFA providing provisional access [482:27] based on the level of risk from where [482:29] when and what a user wants to access and [482:32] identitycentric does not replace uh but [482:34] it augments networkcentric security. So [482:36] it's just an additional layer of [482:38] consideration for uh security when we're [482:41] thinking about our adless cloud [482:42] workloads. Okay. [482:48] All right. So we just loosely defined [482:49] what the zero trust model is. So let's [482:51] talk about how we would do zero trust on [482:53] AWS. And so zero trust has to do a lot [482:56] with identity security controls and so [482:58] let's talk about what is at our disposal [483:00] on AWS. So on as we have identity and [483:03] access management IM this is where we [483:04] create our users or groups or policies. [483:06] So an IM policy is a set of permissions [483:09] that allow you to say okay this user is [483:11] allowed to use uh these services with [483:13] these particular actions. Uh then you [483:15] have the concept of permission [483:17] boundaries. And so these are saying okay [483:20] um these aren't the permissions the user [483:21] has currently but these are the [483:22] boundaries to which we want them to [483:24] have. So they should never have access [483:25] to um uh ML services and if someone's to [483:29] uh apply them uh uh permissions it'll [483:33] always be within these boundaries. Then [483:35] you have service control policies and [483:36] these are organizationwide policies. So [483:38] if you have a policy where you don't [483:40] want anyone to run anything in the [483:41] Canada region, you can apply that policy [483:43] at the organizational level and it will [483:45] be enforced. Then within an IM policy [483:48] there are the concept of conditions and [483:50] so these are all the kind of like uh [483:52] little knobs you can uh tweak to say how [483:54] do I uh control based on a bunch of [483:56] different factors. So there's source IP [483:58] so restrict where the IP address is [484:00] coming from a requested region so [484:03] restrict based on the region as we just [484:05] mentioned as an example. uh multiffactor [484:07] off presence. So restrict if MFA is [484:10] turned off. Uh current time, so restrict [484:12] access based on time of day. Maybe you [484:15] your employee should never be really [484:16] using things at night. And so that could [484:18] be an indicator that someone is doing [484:19] something malicious. So you know, only [484:21] give them access during a certain time [484:23] of day. And so that's where we're going [484:25] to figure out, you know, based on all [484:27] these type of controls, security [484:28] controls, uh to our ads resources, we [484:30] can kind of enforce the zero trust model [484:33] on AWS. OS does not have a readytouse [484:35] identity controls that are intelligent [484:37] which is why I ad is considered not to [484:39] have a zero trust offering for customers [484:41] and thirdparty services need to be used. [484:43] So what I'm saying is that technically [484:46] you know this checkbox is this thing [484:48] saying okay we can kind of do zero trust [484:50] on AWS but there's a lot of manual work [484:53] and you know if I was to say okay um I [484:58] don't want anyone using this at [485:00] nighttime it doesn't really detect you [485:02] know what I'm saying it's not going to [485:03] say oh I think this time is suspicious [485:06] or malicious so then restrict access [485:08] only to these core services and anything [485:09] outside of the services can't be used it [485:12] can't exactly do that without a lot of u [485:14] work yourself and that's what I'm [485:15] talking about here where we have a [485:17] collection of ad services that can be [485:18] set up in an intelligence intelligentish [485:21] detection way for identity concerns but [485:23] requires expert knowledge so the way you [485:25] might do that on AWS is that everything [485:27] all the API calls go through ads cloud [485:29] trail and so what you could do is feed [485:32] those into Amazon guard duty and guard [485:33] duty is an intrusion uh uh intrusion [485:37] detection and protection system so it [485:39] could detect suspicious or malicious [485:40] activity on those cloud trail logs and [485:42] You could follow that up with [485:44] remediation or you could pass that on to [485:46] Amazon detective that could analyze, [485:48] investigate and quickly identify [485:49] security issues uh that it could ingest [485:52] from Guard Duty. But I'm telling you [485:54] that this stuff here is not as easy um [485:57] for the consumer. And so you of course [486:00] you can do zero trust model but it's [486:01] going to take a lot of work here and [486:03] there are some limitations which we'll [486:04] talk about next here. [486:09] So now let's see how we would do zero [486:11] trust on Adabus with third parties. So [486:13] Adus does technically implement a zero [486:15] trust model but does not allow for [486:17] intelligent identity security controls [486:19] which you know you can do it but it's a [486:22] lot of work. So uh let's kind of compare [486:24] it against kind of a third party where [486:26] we would get the controls that we would [486:27] not necessarily get with AWS. So for [486:29] example, Azure Active Directory has a [486:31] real-time and calculated risk detection [486:33] based on data points than AWS and this [486:36] is based on device and application, time [486:38] of day, location, whether MFA is turned [486:40] on, what is being accessed and the [486:43] security controls verification or logic [486:45] restriction is much more robust. So you [486:48] know just as one particular example like [486:50] device and application is not something [486:52] that ads factors in uh with the existing [486:55] controls or at least not in a way that [486:57] is consumer friendly and you know I [486:59] can't say on adabus okay when you think [487:02] that this is the type of threat only [487:04] allow them access to these things or if [487:06] you think they're in a risky area or [487:07] risky uh location only give them access [487:10] to you know these things or where [487:12] there's not sensitive data you can't [487:13] exactly do that on adabus very easily [487:15] and so this is where third party [487:16] solutions are going to come into play. [487:18] So you have Azure Active Directory, [487:20] Google Beyond Corp, JumpCloud, and all [487:22] these have more intelligent security [487:23] controls for real-time detection. Um, [487:25] and so the way you would use these is [487:27] these would be your primary directories. [487:29] Uh, for Google Beyond Corp is just a [487:32] zero trust framework. So I guess you'd [487:34] use uh Google's uh cloud directory, but [487:37] the idea anyway here is that you'd use [487:39] single sign on to connect those [487:41] directories to your ads account. And [487:43] that's how you'd access access those uh [487:45] ads resources and you get this more [487:47] robust functionality. Okay. [487:53] Hey, it's Andrew Brown from Exam Pro and [487:55] we're looking at identity. Now, we need [487:57] to know a bunch of concepts before we [487:58] talk about identity on AWS. So, let's [488:00] jump into it. The first is a directory [488:02] service. So, what is directory service? [488:04] Well, it's a service that maps the names [488:07] of network resources to network [488:08] addresses. and a directory services [488:10] shared uh infrastructure or information [488:13] in infrastructure for locating, [488:14] managing, administrating and organizing [488:16] resources such as volumes, folders, [488:18] files, printers, users, groups, devices, [488:22] telephone numbers and other objects. A [488:24] directory service is a critical [488:25] component of a network operating system [488:28] and a directory server or a name server [488:31] is a server which provides a directory [488:33] service. So each resource on the network [488:35] is considered an object by the directory [488:38] server. information about a particular [488:39] resource is stored as a collection of [488:41] attributes associated with that resource [488:43] or object. Uh well-known directory [488:46] services would be a domain name service. [488:49] Um so the directory service for the [488:51] internet, Microsoft active directory and [488:54] uh they have a cloud hosted one called [488:57] Azure Active Directory. We have Apachi [488:59] directory service, Oracle inter internet [489:02] directory. So, oid uh open ldap uh cloud [489:07] identity and jump cloud. Okay. [489:14] Hey, this is Andy Brown from Examp Pro [489:15] and we are taking a look at Active [489:17] Directory. Now, you might say, well, [489:18] we're doing AWS. Why are we looking at [489:20] this? Well, no matter what cloud service [489:22] provider you're using, you should know [489:23] what Active Directory is. Uh especially [489:25] when it comes to identity because you [489:26] can use it with AWS. Um so, let's talk [489:29] about it. So, Microsoft introduced [489:31] active directory domain services in [489:33] Windows 2000 to give organizations the [489:35] ability to manage multiple on-remise [489:36] infrastructure components and systems [489:38] using a single identity per user. And [489:40] since then, it's uh involved uh evolved [489:43] obviously it's uh running beyond Windows [489:45] 2000 as of today. And uh they even have [489:48] a managed one called Azure AD which is [489:51] on Microsoft Azure. But just to kind of [489:53] give you an architectural diagram here. [489:54] The idea is that you would have your [489:56] domain servers here. Uh and they might [489:58] have child domains. And the idea is that [490:00] you have these running on multiple [490:02] machines so that you have redundant [490:04] ability to log in from various places. [490:06] When you have a bunch of domains, it's [490:07] called a forest. And then within a [490:09] domain, you actually have organizational [490:11] units. And within within organizational [490:12] units, you have all your objects like [490:14] your users, your printers, your [490:15] computers, your servers, uh all things [490:17] like that. Okay. [490:22] Hey, this is Andrew Brown from Exam Pro [490:24] and we are talking about identity [490:25] providers, also known as IDPs. [490:29] So, an identity provider is a system [490:31] entity that creates, maintains, and [490:32] manages identity information for [490:34] principles and also provides [490:35] authentication services to applications [490:37] with a federation or distributor [490:39] network. A trusted provider of your user [490:41] identity that lets you use authent uh [490:43] lets you authenticate to access other [490:45] service identity providers. So this [490:47] could be like Facebook, Amazon, Google, [490:49] Twitter, GitHub, LinkedIn. Uh federated [490:52] identity is a method of linking a user's [490:54] identity across multiple separate [490:56] identity management systems. And so some [490:58] things that uh we can use for that is [491:00] like open ID. So this is an open [491:02] standard and decentralized [491:03] authentication protocol. Allows you to [491:05] be able to log in to different social [491:07] media platforms using Google or Facebook [491:09] account. Open ID is about providing who [491:11] you are. Then we have OOTH 2.0. This is [491:14] an industry standard protocol for [491:15] authorization. OOTH doesn't share [491:17] password data but instead uses [491:20] authorization tokens to prove an [491:22] identity between consumers and service [491:24] providers. OOTH is about granting access [491:26] to functionality. And then we have SAML [491:29] security assertion markup language which [491:32] is an open standard for exchanging [491:34] authentication and authorization between [491:35] an identity provider and a service [491:38] provider. And this is important use for [491:40] SAML which we use for single sign on via [491:43] the web browser. Okay. [491:50] Hey, this is Andrew Brown from Exam Pro [491:52] and we're looking at the concept of [491:53] single sign on. So SSO is an [491:55] authentication scheme that allows a user [491:57] to log in with a single ID and password [491:58] to different systems and software. SSO [492:01] allows IT departments to administer a [492:02] single identity that can access many [492:04] machines and cloud services. So the idea [492:06] is you have Azure Active Directory. This [492:08] is just an example of a very popular [492:09] one. You'd use SAML to do SSO and you [492:12] can connect to all things Slack, Adabus, [492:14] Google Workspaces, Salesforce or your [492:16] computer. Uh the idea here is uh once [492:18] you uh log in um you don't have to log [492:22] in multiple times. So you log into your [492:23] primary directory and then after that [492:25] you're not going to be presented with a [492:26] login screen. Some services might show [492:28] an intermediate screen, but the idea is [492:30] you're not entering your credentials in [492:32] multiple times. So it's seamless. [492:37] All right, let's talk about LDAP. So, [492:40] lightweight directory access protocol is [492:42] an open vendor neutral industry standard [492:44] application protocol for accessing and [492:46] maintaining distributed directory [492:47] information services over uh IP network. [492:50] So, a common use of LDAP is to provide a [492:54] central place to store usernames and [492:56] passwords. LDAP enables for same sign [492:59] on. So same sign on allows users to uh [493:01] use a single ID and password but they [493:03] have to enter it every single time they [493:05] want to log in. So maybe you have your [493:07] on premise active directory and then [493:09] it's going to store it in that LDAP [493:11] directory and so the idea is that um you [493:14] know all these services like Google [493:16] Kubernetes [493:17] um Jenkins is going to uh deal with that [493:20] LDAP server. So why would you use LDAP [493:23] over SSO which is more convenient or [493:25] seamless? So most SSO systems are using [493:28] LDAP under the hood, but LDAP was not [493:31] designed natively to work with web [493:32] applications. So some systems only [493:34] support integration with LDAP and not [493:36] SSO. So you got to take what you can [493:38] get. Okay, [493:43] let's take a look here at multiffactor [493:44] authentication, also known as MFA. And [493:47] this is a security control where after [493:48] you fill in your user's name and email [493:51] password, you have to use a second [493:53] device such as a phone to confirm that [493:55] it's you that is logging in. So MFA [493:57] protects against people who have stolen [493:59] your password. MFA is an option in most [494:01] cloud providers and even social media [494:03] websites such as Facebook. So the idea [494:05] is I have my uh username or email and [494:08] password. I'm going to try to log in. [494:10] This is the first factor. And the second [494:12] factor or multiffactor is I'm going to [494:14] use a secondary device. So maybe my [494:16] phone where I'm going to enter in [494:17] different codes or maybe it's [494:19] passwordless. So I just have to press a [494:20] button to confirm that it's me and then [494:22] I'll get access. So in the context of [494:24] AWS it's strongly recommended that you [494:27] turn on MFA for all your accounts [494:29] especially the adabus root account. Uh [494:31] we'll see that when we do the follow [494:33] alongs. [494:38] Let's take a look at security keys. So a [494:40] security key is a second device used as [494:42] a second step in authentication process [494:44] to gain access to a device, workstation [494:46] or application. A security key can [494:48] resemble a memory stick and when your [494:50] finger makes contact with a button of [494:51] exposed metal on the device, it will [494:53] generate and autofill a security token. [494:55] A popular brand of security keys is the [494:57] Ubi key and this is the one I use and is [494:59] looks exactly like the one that's right [495:01] beside my desk. It works out of the box [495:03] with Gmail, Facebook, and hundreds more. [495:05] supports 502 web off uh U2F. It's [495:10] waterproof and crush resistance. It uh [495:12] has variations like USBA us NFC dual [495:16] connectors on a single key. Can do a [495:18] variety of things. So when you turn on [495:20] MFA on your Adabus account, you'll have [495:22] virtual MFA device. So that's when [495:24] you're using something like a phone or [495:26] using software on your phone to do that. [495:28] Then there's the U2F security key. So [495:30] this is what we're talking about right [495:31] now. And there's even other kinds of [495:33] hardware MFA devices um which we're not [495:36] really going to talk about, but um you [495:38] know just security keys tie into MFA. [495:41] And this is a lot better way than using [495:43] a phone because you know you can have on [495:45] your desk and press it um and you know [495:47] you don't have to worry about your phone [495:48] being not charged. Okay. [495:54] Hey, this is Andrew Brown from Exam Pro [495:56] and we are taking a look at Adabus [495:57] identity and access management also [495:59] known as IM and you can use this service [496:02] to create and manage adabus users groups [496:04] uh use permissions to allow and deny [496:06] their access to adabus resources. So [496:09] there's quite a few components here. [496:10] Let's get to it. So the first is IM [496:12] policies. So these are JSON documents [496:14] which grant permissions for specific [496:16] users, groups or a role to access [496:18] services and policies are attached to IM [496:21] identities. Then you have IM permissions [496:23] or a permission and this is an API [496:25] action that can or cannot be performed [496:27] and they're represented in the IM policy [496:30] document. Then there's the IM identity. [496:32] So we have IM users. These are end users [496:35] who log into the console or interact [496:36] with AWS resources programmatically or [496:38] via clicking UI interfaces. You have IM [496:41] groups. So these these uh group up your [496:44] users. So they all share the same [496:45] permission levels. So maybe it's admins, [496:48] developers or auditors. Then you have IM [496:50] roles. So these roles grant adabus [496:51] resources permissions to specific adabus [496:54] API actions and associate policies to a [496:56] role and then assign it to an adus [496:58] resource. So just understand that roles [497:01] are when you're attaching these to [497:03] resources. So like if you have an EC2 [497:05] instance and you say it has to access [497:06] S3, you're going to be attaching a a [497:08] role not a policy directly. Okay. [497:16] Hey, this is Andrew Brown from Exam Pro [497:18] and we are looking at IM policies a [497:20] little bit closer here and they are [497:22] written in JSON and contain the [497:23] permissions which determine the API [497:25] actions that are allowed or denied. Um, [497:27] and rarely do I write these out by hand [497:30] uh because they have a a little wizard [497:32] that you can use to uh write out the [497:34] code for you. But if you want to, you [497:36] absolutely can write it out by hand. But [497:38] we should know the contents of it and [497:39] how these JSON files work. So the first [497:41] thing is the version uh which is the [497:43] policy language version and it's been [497:45] 2012 for a very long time. I don't see [497:47] that changing anytime soon if they [497:49] happen to change uh what or what the [497:52] structure of the JSON is. Then you have [497:54] the statements and these are for policy [497:56] elements uh and you're allowed to have [497:58] multiples of them. So the idea is that [498:00] this is the the policies or permissions [498:02] we should say uh that you uh plan on [498:05] applying. Then you have the SID. This is [498:08] a way of labeling your statements. Um, [498:10] this is useful for like visualization or [498:12] for referencing it for later on, but a [498:14] lot of times you don't have to have a [498:15] SID. Um, then there's the effect. It's [498:17] either allow or deny. Then you have the [498:20] action. So here we're saying give access [498:22] to S3 for all actions under it. There's [498:26] another action down below where it's [498:28] saying give access. I'm get my pen tool [498:30] out here just to create a service link [498:32] role. So that's a cross account role [498:34] there. Then there's the principal. So [498:36] this is the account user role or [498:38] federated user to which you would like [498:39] to allow access or deny. So we're [498:42] specifically saying uh this IM user [498:44] named Barkley um in our adabus account [498:47] there. Uh then there are the resources. [498:49] So the resources to which the action [498:51] applies. Um so in this one up here we [498:54] are specifying a specific adabus bucket. [498:55] Here we're saying all possible resources [498:57] in it in an adabus account. And then the [498:59] condition. So there's all sorts of [499:01] different kinds of conditions. So this [499:02] is a string-like one. saying look at the [499:04] service name and if it starts with this [499:06] or that then they'll have access to [499:08] that. So this person even though it says [499:09] all resources they're really only going [499:11] to have access to RDS. Okay. [499:17] So in this follow along we're going to [499:18] take a closer look at IM policies. So go [499:21] to the top and type in AM. And what [499:23] we'll do is make our way over here uh [499:26] all the way over to policies. And what I [499:28] want to do is create a new policy that [499:30] only has access to uh um limited [499:33] resources. So um let's say we want to [499:36] create an Amazon EC2 instance and that [499:38] EC2 instance has access to a very [499:41] particular S3 bucket. So what I want you [499:44] to do is make your way over to S3. And [499:46] we're going to create ourselves a new [499:47] bucket. [499:50] And I'm going to go ahead and create a [499:51] bucket here. We're going to call this um [499:55] policy tutorial [499:58] and I'm going to just put a bunch of [499:59] numbers here. You'll have to randomize [500:02] it for your use case. [500:04] And so now that we have our bucket, what [500:06] we're going to do is go ahead and create [500:07] a policy. [500:11] And the policy is going to choose a [500:13] service. We're going to say S3. And what [500:15] I want to do is only be able to list out [500:17] actions. I'm going to expand this. So I [500:19] don't want everything. So we're just [500:20] going to say list buckets. [500:22] Okay. And then what we'll do is uh [500:26] expand this here. And I want to say for [500:27] a particular bucket. So we'll go back [500:30] over here, click into our bucket, [500:33] and uh we're going to go ahead and set [500:36] those permissions [500:38] by finding that uh AR. [500:41] We're going to paste that. [500:43] We're going to paste that AR up there. [500:44] Sometimes it's a bit tricky. It vanishes [500:46] on you. And we could set other [500:49] conditions if we wanted to, but this is [500:51] pretty simple. as it is. And so that's [500:54] our rule here, right? So we're saying [500:56] this policy allows us to list this [500:57] bucket for that. Okay. [501:00] So what we'll do is go ahead and hit [501:01] next. We'll hit review and we'll just [501:04] say my bucket policy [501:09] and we'll create that policy. [501:14] Okay. So there's a few other things I [501:16] think that I'd like to do with this [501:18] policy. I'm going to pull it back up [501:19] here. So if we want to find it, uh you [501:22] used to be able to filter these based on [501:23] the ones that you created, but um [501:28] yeah, these are like the little icon. So [501:30] these are ones that I've created up [501:31] here. And so there's my bucket policy. [501:36] And I feel like I want to update this [501:38] policy to have a bit of extra [501:41] information here. So I'm going to go [501:43] edit this policy. [501:45] No, you know what? I think this is fine. [501:47] So, what I want to do is now create a [501:48] role. [501:52] And we're going to create a new role. [501:53] And I'm going to call this um well, [501:56] before I do, I need to choose what it's [501:57] for. So, it's going to be for EC2. So, [501:59] we're going to go ahead and hit next. [502:01] We're going to choose our policy. So, my [502:02] bucket policy. There it is. And I want [502:05] to add another one here because I want [502:07] to be able to use sessions manager [502:08] because I really don't want to use an [502:09] SSH key to check that this works. And so [502:15] um for this I I need to use SSM. So I'm [502:19] gonna type in SSM here [502:22] and I'm going just make sure this is the [502:23] new one. So this policy will soon be [502:25] deprecated. Use Amazon SSM manage for [502:28] instance should always open these up and [502:29] read them and see what they do. And so [502:32] that's the one that's going to allow us [502:33] to access uh Simpsons manager. So we can [502:35] use sessions manager. Okay. And so we're [502:38] going to say my EC2 roll for S3. [502:43] I'm go ahead and create ourselves a RO. [502:48] And so now that we have our RO, I'm [502:50] going to go over to EC2 [502:53] and I'm going to go ahead and launch [502:54] myself a new instance. [502:57] We're going to choose Amazon Linux 2. [503:00] We're going to stick with T2 Micro. I'm [503:02] going to go over to configuration here. [503:04] Everything is fine here. Um, I'm fine [503:07] with all that. Storage is fine. We'll go [503:09] to security group. And I don't want any [503:11] ports open because I'm not going to be [503:14] using SSH. [503:16] We're going to launch this instance. I [503:18] don't even want to keep pair. [503:20] Okay. [503:23] And then we're going to go over here. [503:24] And so what we're waiting for is this [503:26] instance to launch. As that is going, [503:28] what I want to do is go over to my S3 [503:31] bucket. And I want to place something in [503:32] this bucket. So I do have some files [503:34] here. Um, so what I'm going to do [503:38] is create a new folder here. Whoops. Uh, [503:42] I'm going to go back and I'm just going [503:43] to create a folder first. Create a [503:45] folder. Enterprised. [503:52] And I'm going to click into this. And [503:53] then I'm going to upload all of my [503:55] images here. So you'll have to find your [503:57] own images off the internet. These are [503:59] just the ones I have. And we'll go ahead [504:02] and upload those. [504:04] Give that a moment. [504:10] Okay. And so we don't have access to [504:12] read those files. We'll adjust our [504:14] policy as we go so that we can do that. [504:16] Okay. [504:18] So this instance should be running. Um [504:20] it has doesn't have the two status [504:22] checks passed. We should be able to uh [504:24] connect to it. So click on connect here. [504:26] And so we have options like EC2 instance [504:28] connect, sessions manager, SSH client. I [504:30] want you to go to sessions manager. [504:32] says, "We weren't able to connect to [504:33] your instance. Common reasons. SSM agent [504:35] wasn't installed." We absolutely have [504:36] that installed. The required IM profile. [504:39] Oh, right. So, we were supposed to [504:40] attach I forgot to do. We were supposed [504:43] to attach an IM profile, right? So, an [504:45] IM profile is the RO uh it or the it [504:49] holds the RO uh that's going to give the [504:52] permissions to that instance. And since [504:54] we didn't add it, we got to go [504:55] retroactively add it after the fact. [504:59] And so I'm going to have to modify the [505:01] IM RO and we're going to choose my EC2 [505:05] RO for S3. And we're going to save that. [505:08] And actually when that happens, you have [505:09] to reboot the machine. You only have to [505:12] do that if you have no RO attached like [505:14] prior, no profile attached, and you're [505:16] attaching it for the first time. But [505:18] after that, you never have to reboot the [505:19] machine. This is the only case where [505:20] you'd have to do that. [505:23] That's why when I launch an EC2 [505:24] instance, I always at least have the SSM [505:26] role attached, the managed one to get [505:28] sessions manager so that I don't ever [505:30] have to do a reboot in case I have to [505:31] update the policy. [505:34] And so we will give that a moment. There [505:38] it says initializing. So I'm going to [505:40] try again to connect to it. Okay. [505:46] And we still don't have that option [505:47] there. Um so I'm going to go back to my [505:49] instances. I'm going to check to see if [505:52] the role the role or policy is attached [505:55] or profile I should say. [506:00] So I'm just looking for it here. [506:05] There it is. [506:07] And so if I click into this into the RO, [506:10] we can see that we have the Amazon SSM [506:13] manage instance core there. So that's [506:15] set up and the my uh bucket policy. So, [506:19] this has everything that it should be [506:22] able to do it. No problem. [506:27] Okay. So, I'm going to try that again. [506:30] Okay. So, now the connect shows up. AWS [506:32] is finicky like that. You just have to [506:34] have confidence in knowing what you're [506:36] doing is correct. Okay. We'll go ahead [506:38] and hit connect. [506:40] And I didn't have to use SSH keys or [506:42] anything. And this is a lot more secure [506:44] way to connect your instances. when it [506:46] logs us in, it's going to set us as the [506:48] SSM user, but we want to be the [506:52] um the EC2 user. Okay, [506:55] that's uh AdWM [506:58] like their Linux versions as the EC2 [507:00] user and that's what you're supposed to [507:01] use. But it's just you just that's how [507:04] you have to get to that. You just have [507:05] to type that pseudo su-en EC2 user. [507:08] Okay, just once. And if you type who am [507:11] I, that's who you are. If you type exit, [507:12] you'll go back to that user. So if I [507:14] type exit and I type who am I? I'm now [507:16] this person. So I'm going to go back hit [507:18] up. Go back in there. Type clear. So now [507:20] I want to see if I have access to S3. So [507:23] I have to do AO as S3 LS. Let's see if I [507:26] can list buckets. It says access denied. [507:30] So [507:32] I mean that kind of makes sense because [507:34] if you have list buckets and we're just [507:35] saying only that bucket, that might not [507:37] make a whole lot of sense. [507:39] So I'm going to go back to my policy. I [507:42] might have just written a a crummy [507:43] policy, but we'll say I am here. If we [507:46] have that one open, we should just go [507:47] here and click on this policy here. [507:54] I'm going to edit that policy. [507:56] So, what I'm going to do is I'm just [507:58] going to change it. I'm going say all [507:59] resources, review the policy, save [508:01] changes, and we'll see how fast that [508:03] propagates. [508:06] Okay. [508:15] because I'm pretty sure I don't have to [508:16] do anything here. It should just now [508:18] give me full access to S3. [508:21] Just going to keep on hitting up here. [508:24] So, what I'm going to do is I'm just [508:25] going to take like a three four minute [508:27] break. Going to get a drink. I'm going [508:28] to come back here and see if this [508:29] propagates. I'm pretty sure I don't have [508:31] to do anything for that to propagate. [508:33] And I think that I've attached [508:35] everything correctly here. Okay. [508:39] Okay. So, I haven't had much luck here. [508:41] It's still having the same issue. So, if [508:43] that is happening, what I'm going to do [508:45] um is I'm just going to reboot it [508:47] because maybe I didn't give it a good [508:49] opportunity to reboot there. Again, I [508:51] don't think we should have to reboot it [508:52] every time when we're we're changing um [508:55] uh things there. But, we will give it [508:56] another go here and see if that fixes [509:00] that problem there. So, no sessions man [509:02] is going to time out here, which is [509:03] totally fine. [509:06] It's going to kill that session there. [509:08] Um, and so what we'll have to do is [509:10] close this out because there's not much [509:12] we can do with that. [509:14] And we're going to go ahead and go back [509:15] to connect. And so we're waiting for [509:17] this button to appear because it is [509:19] rebooting. So if we want to monitor that [509:22] stuff, usually there is an option here [509:25] to monitor where it'll show us the [509:28] system logs of what it's doing. So here [509:30] it's just like restarting the machine. [509:41] I'm not sure if we expect to see [509:43] something after this. [509:45] So, I can click that there. [509:51] And uh yeah, it's easy to get turned [509:53] around this. So, I can connect to it [509:54] again. Now [509:59] we'll type in pseudo su- ect2 user ads [510:03] s3 ls [510:06] and we still have [510:09] access deny for list buckets. So if [510:11] that's the case it could be that um [510:14] sometimes you need other permissions [510:16] when doing list policy like list [510:18] buckets. So if that's the case we're [510:20] going to do a sanity check. I'm just [510:22] going to say all permissions here. Okay. [510:24] And this way there's no way that I've [510:26] set this incorrectly. Um it just has to [510:28] work now. So type this in. [510:32] There we go. Okay. So there has to be [510:34] something more to it. So just because [510:35] you say list buckets, you know, like [510:38] means there must be more to it, right? [510:39] So if I go here to this, right, and I [510:42] say whoops, [510:44] and I say uh list buckets here, we'll [510:47] say copy [510:49] paste. Okay. [510:52] Here [510:58] it's saying maybe I need get object as [511:00] well. So I just know from using adabus a [511:04] long time that that's the case that it [511:06] could be more than one thing. So you [511:08] know that was in the back of my mind [511:09] that that could be happening and I guess [511:11] that is but notice I didn't have to [511:12] restart my uh my server boot my server [511:15] to get those to work. Um but anyway [511:18] let's go lock that down and see if we [511:19] can just kind of make this uh more [511:21] focused. So let's say um all resources [511:25] I'm going to specify [511:27] the condition. [511:30] So I might want to just say for [511:31] particular buckets [511:34] we'll say specific when we do checkbox [511:36] everything then you have to do this. So [511:38] for storage accounts these are fine any [511:41] for objects [511:45] that could be something we'll say [511:48] multi-reion access bucket any bucket but [511:51] what I'm going to say is I want to only [511:53] allow them to access things in a [511:54] particular bucket and so if I go to AR [511:57] here [511:59] um what is our bucket Our [512:08] bucket name is policy tutorial 3414 [512:12] whatever, right? And so we can actually [512:16] give it a wild card or we can say [512:18] enterprise [512:21] d [512:23] and we learned this in the course that [512:24] uh you can provide orange with [512:26] randomized [512:28] things there. I don't know if I spelled [512:29] it wrong over here. So, I should really [512:30] double check. I should probably just [512:32] copy it. [512:39] Oops. [512:41] I just don't want to type it wrong. And [512:43] so this [512:45] okay [512:47] means that we should only be able to get [512:49] stuff from there. I'm going to review [512:50] the policy. See if it takes. Save the [512:52] changes. [512:54] And if I just view the JSON here, [512:59] notice it says anything from here, [513:01] right? So allow S3 anything as long as [513:05] it's within here. And then it also broke [513:06] it up into sub ones for here. Okay. Um, [513:10] so anyway, what I want to see is what [513:12] happens [513:13] if I upload something into the loose [513:15] area here. So I'm going to say upload [513:18] and I'm going to just say add a file. [513:22] We're just going to grab data here. and [513:24] upload it. [513:26] Go back to our bucket. There's our file. [513:29] We have that stuff in there. And so if I [513:31] go back over to my EC2 instance, which [513:32] I'm still connected to. Uh, who am I? [513:36] Okay, great. Clear. Um, so I'm going to [513:39] say S3 LS. See if that works still. It [513:42] does. Good. And so what I want to do is [513:44] see if I can copy a file locally. So I'm [513:47] going to do ads S3 copy. [513:51] I think it was S3. No, it's just S3. [513:53] Copy policy uh S3 [513:58] policy [514:00] tutorial [514:02] 341. [514:06] Whoops. 34 [514:08] tutorial [514:12] 34141 [514:14] slash [514:16] enterprised [514:19] data.jpg. [514:21] I think it's a jpg. Let's go double [514:23] check. Yeah, it is. Okay. And then I [514:26] just want to say data.jpg. [514:29] And it downloaded it, right? So, I'm [514:32] going to remove that one. And so, now [514:33] what I'm going to do is I'm just going [514:34] to see if my policy is working or maybe [514:37] my permissions aren't exactly what I [514:38] think they are. And I was able to [514:40] download it. So, [514:42] it's these policies can get kind of [514:44] tricky because like this one says allow [514:46] all actions for these, but then these [514:48] say all actions. And so, [514:52] That makes it hard because I want get [514:54] object. [515:00] So, another thing we can do, [515:02] and if that one doesn't work really [515:03] well, I'm just going to write one by [515:05] hand. It's not that scary to write these [515:07] by hand. You just get used to it. So, [515:09] I'm going to say effect. [515:12] Um, is it disallow or maybe it's deny? [515:19] deny [515:21] action [515:27] s3 get object. I believe that's what it [515:30] is. [515:33] Resource [515:35] and then I'm going to specify exactly [515:36] the resource I don't want it to allow. [515:38] So, we're going to say AR [515:40] AWS S3 3 colons [515:44] policy tutorial [515:50] 34141. [515:53] Uh, I just say data.jpg. [515:57] Now, if this is not valid, it's going to [515:58] complain and say, "Hey, you didn't write [515:59] this right." And it and it's fine. Okay. [516:03] So, [516:04] we'll save those changes. [516:08] And so that should deny access to that, [516:10] right? [516:12] Hopefully I got the policy right. [516:16] Okay, so that one doesn't work, which is [516:18] fine. [516:20] And that one's fine. So that worked. We [516:22] were able to deny that. But you can see [516:24] there's a little bit of an art to [516:25] creating these policies. Uh as you make [516:28] more of them, it becomes a lot easier. [516:30] So hopefully it's not too scary. But uh [516:32] that's all there really is uh to it that [516:34] I want to show you today. So, what we're [516:35] going to do is clear out this bucket. [516:37] We're done with this bucket here. So, [516:38] we'll say delete. Whoops. We got to [516:40] empty it first. [516:44] And we'll just say permanently delete [516:45] here. [516:47] Okay. And we will exit that out. We're [516:51] going to go ahead and delete that [516:52] bucket. [516:55] Grab its name here. [516:59] And uh we'll go back over here. [517:02] I think I forgot to delete this bucket [517:04] from earlier. I'm just going to delete [517:05] that because I don't need that bucket if [517:07] that's okay with you. Just going to go [517:09] ahead and delete that. [517:12] And we have that EC2 instance running. [517:14] So, we want to stop that. [517:19] Go ahead and we're going to terminate [517:21] that. Yes, please. [517:24] And then we'll go to IM and do some [517:25] cleanup. [517:29] I have some custom roles I've been [517:30] creating um you know, from prior things. [517:33] A lot of those usually there's a way to [517:36] uh we've redesigned it. Okay. Where's [517:38] the redesign? This is the redesign. That [517:40] can't be it because there'll be like [517:42] roles that ads makes. I think these are [517:43] all roles that I've made. [517:47] Um I don't want to delete service roles, [517:52] but I want to get rid of some of these [517:53] because I just have too many. You know, [517:55] it's getting out of hand for me. And I'm [517:58] gonna just see if it will let me [518:02] delete [518:06] all of these. Let's delete those. [518:16] There we go. Just clean up a bit. I [518:18] still have a lot here, but there's like [518:19] service roles that Adabus creates once, [518:21] and you really don't want to delete [518:22] those because [518:25] you don't. Um, and then I have a bunch [518:28] of these. Like I'm never going to use [518:29] these, so I might as well detach them. [518:31] Delete. Detach. [518:36] Really don't want to keep like rolls [518:38] that you're never going to use around [518:41] things like that, like gauze. We're [518:43] going to be using that again. [518:45] Delete. [518:53] There's that bucket we just created. [519:00] Anyway, you get the idea. So, uh yeah, [519:02] that's uh that's I am okay. [519:09] Principle of lease privilege PP is the [519:11] computer security concept of providing a [519:13] user role or application the least [519:15] amount of permissions to perform an [519:16] operation or an action. And the way we [519:19] can look at it is that we have just [519:21] enough access. So ja permitting only the [519:24] exact actions for the identity perform a [519:26] task and then we have just in time jit [519:28] permitting the smallest length of [519:30] duration an identity can use permission [519:32] so usually when we're talking about pp [519:34] it's usually a focus on here u but now [519:37] these days uh there's a larger focus on [519:39] jit as well and so jit is the difference [519:42] between having long lived um uh [519:44] permissions or access keys versus [519:46] short-lived ones and the most [519:48] progressive thing in pp is now riskbased [519:51] adapt adaptive policy. So each attempt [519:53] to access a resource generates a risk [519:55] score of how likely the request is to be [519:56] from a compromised source. So the risk [519:59] score could be based on many factors [520:00] such as device, user location, IP [520:02] address, what services being accessed [520:04] and when. Did they use MFA? Did they use [520:06] biometrics things like that and right [520:09] now at as of this time does not [520:11] have a riskbased adaptive policies built [520:13] into AM. You can roll your own. Um [520:16] what's interesting is Cognto has [520:19] riskbased adaptive policies. they call [520:20] it like um adaptive authentication but [520:22] that's for user pools and not identity [520:24] pools. User pools is for getting access [520:27] to an app uh that you have built through [520:29] an IPD where identity pools incognito is [520:34] about getting access to adabus [520:35] resources. So uh you know I'm sure ads [520:38] will get it eventually but they just [520:39] don't have it right now and you have to [520:40] rely on third-party um identity [520:42] solutions uh to get riskbased adaptive [520:45] policies. Now talking about just enough [520:47] access and just in time. Just in time is [520:49] like you think how would you do that [520:50] with AWS? You just add and remove [520:52] permissions manually. Well, one thing [520:54] you could do is use something like [520:55] console mi. So this is an open-source [520:56] Netflix project to self-s serve [520:58] short-lived IM policies. So an end user [521:01] can access adabus resources while [521:03] enforcing JA and JIT. And so there's a [521:05] repo there as well. Um but the idea is [521:08] they have like this self-s serve wizard. [521:09] So you say I want these things and then [521:11] the machine decides okay you can have [521:13] them or you you don't need them. and it [521:15] just frees you up asking people and [521:18] worrying about the length and stuff like [521:19] that. Okay. [521:24] Hey, this is Andrew Brown from Exam Pro [521:26] and we are taking a look at the adabus [521:28] root user. Uh, and this gets confusing [521:30] because there's an adabus account, root [521:32] user, and regular user. So, let's [521:34] distinguish what those three things are. [521:36] So, here we have an adus account and the [521:38] account which holds all the ads [521:39] resources including the different types [521:41] of users. Then you have the root user. [521:43] This is a special account with full [521:44] access that cannot be deleted. And then [521:47] you have just a user and this is a user [521:49] for common tasks that is assigned [521:51] permissions. So just understand that [521:54] sometimes people say adas account [521:55] they're actually referring to the user [521:56] and sometimes when they're saying [521:58] account they're actually referring to [521:59] the ads account that holds the users. I [522:01] know it's confusing. It just it's based [522:02] on what people decide the context is [522:04] when they're speaking. So the ads [522:06] account user is a special user who's [522:08] created at the time of the ads account [522:10] creation and they can do uh they have a [522:13] lot of conditions around them. So the [522:15] reuser account uses an email and [522:16] password to log in as opposed to the [522:19] regular user who's going to provide [522:21] their account ID alias username and [522:23] password. The root user account cannot [522:25] be deleted. The root user account has [522:27] full permissions to the account and its [522:28] permissions and cannot be limited. And [522:30] when we say it cannot be limited, we're [522:32] saying that if you take an IM policy to [522:34] explicitly deny the user access to [522:36] resources, it's not something you can [522:37] do. However, you can do it in the case [522:39] of adabus organizations with service [522:41] control policies because a service [522:43] control policy applies to a bunch of [522:46] accounts. So it just it's one level [522:47] above and so that is a way of limiting [522:49] root users, but generally you can't [522:51] limit them within their own account. Uh [522:53] there can only be one root user uh per [522:55] adus account. The root user is instead [522:58] for very spe spe spe spe spe spe spe spe [522:59] spe spe spe spe spe spe spe spe spe spe [522:59] spe spe spe spe spe spe spe spe spe spe [522:59] spe spe spe spe spe spe spe spe spe spe [522:59] spe spe specific and specialized tasks [523:00] that are infrequently or rarely [523:02] performed. And there's a big list and [523:04] we'll get into that here in a moment. [523:05] And the root uh account should uh not be [523:08] used for daily or common tasks. It's [523:10] strongly recommended to never use the [523:12] root users access keys because you can [523:14] generate those and use them. It's [523:15] strongly recommended to turn on MFA for [523:18] the root user and any of us will bug you [523:20] to no ends to tell you to turn it on. So [523:22] let's talk about the uh tasks that you [523:25] should be performing with a root user [523:26] and only the root user can perform. So [523:29] changing your account settings. This [523:31] includes account name, email address, [523:32] root user password, root user access [523:34] keys, other account settings such as [523:36] contact information, payment currency [523:38] preference, regions do not require the [523:40] root user credentials. So not [523:42] everything. Um restore IM user [523:44] permissions. So if there's an I IM [523:48] admin, so it's just a user that has [523:49] admin access who actually revokes their [523:51] own permissions, you can sign into the [523:52] root user to edit policies and restore [523:54] those permissions. Um, so you can also [523:57] activate IM access to the billing and [523:59] cost management console. You can view [524:01] certain tax invoices. You can close your [524:04] Adabus account. You can change or cancel [524:06] your Adabus support plan. Register as a [524:08] seller in the reserved instance [524:09] marketplace. Enable MFA uh delete on S3 [524:12] buckets. edit or delete an Amazon S3 [524:15] bucket policy that includes an invalid [524:18] VPC ID or VPC endpoint ID, sign up for [524:22] GVCloud, and something that's not in [524:24] here, which this I took this from the [524:25] documentation, but uh you can use the [524:27] ads uh account user to create the [524:29] organization. You can't create that with [524:31] any other user. So, um you know, the [524:33] ones I highlighted in red are very [524:35] likely to show up in your exam, and [524:36] that's uh why I highlighted them there [524:38] for you. But there you go. [524:44] Hey, this is Andrew Brown from Exam Pro [524:46] and we are taking a look at Adabus [524:47] single sign on also known as Adabus SSO. [524:50] And so this is where you create or [524:52] connect your workforce identities in ads [524:54] once and manage access centrally across [524:56] your ads organization. So the idea here [524:59] is you're going to choose your identity [525:00] source whether it's SSO itself, [525:02] active directory, SAML 2.0 IDP. You're [525:06] going to man manage user permissions [525:07] centrally to adops accounts applications [525:10] sample applications and it uses it can [525:13] you get singleclick access to all these [525:15] things. So you know just to kind of zoom [525:16] in on this graphic here uh you know you [525:19] have your on premise active directory [525:22] it's establishing a ad trust connection [525:25] over to a single sign on you're going to [525:28] be able to apply permissions to access [525:30] resources within your ads account so via [525:32] adabus organizations in your [525:34] organizational units down to your [525:36] resources you can also use ads sso to [525:39] access custom samplebased applications [525:42] so you know if I build a web app and I [525:44] uh like the exam pro platform and I [525:46] wanted to use sample based uh [525:50] connections for single sign on there I [525:51] could do that as well and you can [525:53] connect out SSO access to your business [525:55] cloud applications so office 365 Dropbox [525:58] Slack things like that so there you go [526:05] let's take a look here at application [526:06] integration so this is the process of [526:09] letting two independent applications to [526:11] communicate and work with each other [526:13] commonly facilitated by an intermediate [526:15] system. So cloud workloads uh strongly [526:18] encourage systems and services to be [526:19] loosely coupled and soabus has many [526:22] services for the specific purpose of [526:24] application integration and these are [526:26] based around common systems or design [526:28] patterns that utilize application [526:30] integration and this would be things [526:32] like queuing streaming pub API gateways [526:36] state machines event buses and I'm sure [526:39] there are more but that's what I could [526:41] uh think about that are the most common [526:43] ones. Okay. [526:48] So to understand queuing we need to know [526:50] what is a messaging system. So this is [526:53] used to provide asynchronous [526:54] communication and decouple processes via [526:56] messages and events from a sender [526:58] receiver or a producer and a consumer. [527:01] So a queueing system is a messaging [527:04] system that generally will delete [527:05] messages once they are consumed. It's [527:07] for simple communication. It's not real [527:09] time. You have to pull the data. It's [527:11] not reactive. And uh a good analogy [527:13] would be imagine people that are queuing [527:15] in a line to go do something. So for AWS [527:19] it's called simple queueing service SQS. [527:22] It's a fully managed queuing service [527:23] that enables you to decouple and scale [527:26] microservices, distributed systems and [527:28] serverless applications. So a very [527:30] common use case in a web application [527:32] would be to queue up transactional [527:33] emails uh to be sent like sign up, reset [527:36] password. And the reason why we have [527:38] queuing to decouple uh those kind of [527:40] actions is that if you had a long [527:42] running task um and you had too many of [527:45] them, it could hang your application. So [527:46] by decoupling them and letting a [527:49] separate compute uh service take care of [527:51] that um that would be something that [527:53] would be very useful. Okay, [527:58] let's take a look here at streaming. And [528:00] so this is a different kind of messaging [528:02] system. Um but the idea here is you have [528:05] multiple consu consumers that can react [528:07] to events and so in streaming we call [528:10] messages events and then in a queuing [528:12] system we just call them messages but [528:13] events live in the stream for long [528:15] periods of time so complex operations [528:17] can be applied and generally streaming [528:19] is used for real time stuff whereas [528:22] queuing is not necessarily uh real time [528:25] and so adus's solution here is Amazon [528:27] Kinesis you could also use Kafka but [528:29] we'll focus on Kinesis here so Amazon [528:31] Kinesis is the adabus fully managed [528:33] solution for collecting, processing and [528:34] analyzing streaming data in the cloud. [528:37] So the idea is that you have these [528:38] producers so that are producing events [528:41] could be EC2 instances, mobile devices, [528:44] could be a computer or traditional [528:45] server. They're going to go into the [528:48] data stream. There's a bunch of shards [528:50] that scale and there's consumers on the [528:51] other side. So maybe Redshift wants that [528:53] data, Dynamo DB, S3 or EMR. Okay, but [528:56] the thing you have to remember is that [528:58] streaming is for real time data. And as [529:01] you can imagine, because it's real time [529:02] and it's doing a lot more work than um a [529:05] queuing system, it's going to cost more. [529:07] Okay. [529:12] So, we have another type of messaging [529:14] system known as pub sub. So, this stands [529:17] for publish subscribe pattern commonly [529:20] implemented in messaging systems. In a [529:22] pub sub system, the sender of messages, [529:24] the publishers do not send their [529:25] messages directly to receivers. They [529:28] instead send their messages to an event [529:30] bus. The event bus categorizes their [529:32] messages into groups. Then receivers of [529:34] messages, subscribers subscribe to these [529:36] groups. Whenever new messages appear [529:38] within their subscriptions, the messages [529:40] are immediately delivered to them. So [529:43] the idea is you have publishers, event [529:44] bus subscribers. And event buses appear [529:47] more than once. So it actually appears [529:48] in streaming, appears in this pub sub [529:50] model, and then it can appear in other [529:53] variations. So you're going to hear it [529:54] more than once, the word event bus. Um, [529:56] so the idea here is the publisher has no [529:58] knowledge of who the subscribers are. [530:00] The subscribers do not pull for [530:01] messages. Messages are instead [530:02] automatically immediately pushed to the [530:04] subscribers. And messages and events are [530:06] interchangeable terms in pub sub. All [530:09] right. And so you know the idea here [530:12] with publisher subscribers just imagine [530:14] getting like a um a magazine [530:16] subscription, right? If you think of [530:17] that, you kind of think of the [530:18] mechanisms that are going here. In terms [530:20] of practicality, it's very common to use [530:22] these as a real-time chat system or a [530:25] web hook system. So, you know, hopefully [530:27] that gives you an idea there. In terms [530:29] of AWS's solution, we're using simple [530:31] notification service SNS. This is a [530:33] highly available, durable, secure, fully [530:35] managed pub sub messaging service that [530:39] enables you to decouple microservices, [530:41] distributed systems, and serverless [530:42] applications. So, here we have a variety [530:46] of publishers like the SDK, the CLI, [530:48] cloudatch, aid with services. [530:50] You'll have your SNS topic. You can uh [530:52] filter things, fan them out, and then [530:54] you have your subscribers through [530:55] Lambda, SQS, emails, HPS looks very [530:58] similar to streaming, but again, you [531:01] know, um you know, there's not a lot of [531:02] communication going back between it. [531:04] It's just publishers and subscribers and [531:06] it's limited to, you know, these things [531:09] here. So, it's a very managed service, [531:12] right? Whereas, uh Kinesis, you can do a [531:14] lot more with it. Okay. [531:21] So what is API gateway? Well, it is a [531:24] program that sits between a single entry [531:26] point and a and multiple backends. API [531:28] gateway allows for throttling, logging, [531:30] routing, logic or formatting of the [531:32] request and response. When we say [531:34] request and response, we're talking [531:35] about HTTPS uh requests and responses. [531:39] And so the service for AWS is called [531:41] Amazon API gateway. So API gateway is [531:44] just a type of pattern and this is the [531:47] few cases where ads has named the thing [531:50] after what it is and so we have Amazon [531:52] API gateway which is a solution for [531:54] creating secure APIs in your cloud [531:56] environment at any scale create APIs [531:58] that act as a front door for [532:00] applications to access data business [532:02] logic or functionality from back-end [532:04] services. So the idea is that you have [532:06] data coming in from uh mobile apps, web [532:08] apps, IoT devices and you actually [532:10] define the API calls and then you say [532:13] where do you want them to go. So maybe [532:15] tasks are going to go to your lambdas um [532:17] and then other routes are going to go to [532:19] RDS, Kinesis, EC2 uh or your web [532:22] application. And so these are really [532:25] great for having um this uh being able [532:28] to define your API routes and change [532:30] them on the fly and then and always [532:32] route them to the same place. Okay. [532:39] So what is a state machine? It is an [532:41] abstract model which decides how one [532:43] state moves to another based on a series [532:45] of conditions. Think of a state machine [532:47] like a flowchart. And for AWS, the [532:49] solution here is Adabus step functions. [532:51] So coordinate multiple ad services into [532:53] a serverless workflow, a graphical [532:55] console to visualize the components of [532:57] your application as a series of steps. [532:59] automatically trigger and track each [533:01] step and retries when there are errors. [533:04] So your application executes in order as [533:06] expected every time, logs the state of [533:09] each step. So when things go wrong, you [533:11] can diagnose and debug problems quickly. [533:14] And so here's example of using a bunch [533:17] of um uh steps together on the uh the [533:21] adabus step functions service. And so [533:24] you know this is generally applied for [533:25] serless workflows but it is something [533:27] that is very useful in application [533:29] integration. Okay. [533:35] So what is an event bus? An event bus [533:37] receives events from a source and routes [533:39] events to a target based on rules. So [533:41] I'll get my pen tool out here. So we [533:43] have an event. It enters the event bus. [533:44] We have a rules. Tell it to go to the [533:46] target. It's that simple. And we have [533:49] been seeing event buses in other things [533:51] like uh streaming and uh pub sub but [533:55] adabus has this kind of event bus [533:57] offering uh that is kind of uh high [533:59] level it's called event bridge and it's [534:01] a service event bus service that is used [534:03] for application integration by streaming [534:04] real-time data to your applications. The [534:07] service was formerly known as event [534:08] Amazon cloudatch events. They gave it a [534:10] renaming to give it a better um [534:13] opportunity for users to know that it's [534:16] there to use. uh and they also extended [534:18] its capabilities. And so the thing is is [534:21] that a lot of ads services are always [534:22] emitting events and they're already [534:24] going into this bus. And so if you [534:25] utilize this service um it's a lot [534:27] easier than having to roll your own [534:29] thing uh with other services. So Amazon [534:32] event bridge will just define an event [534:33] bus. So there is an event bus holds [534:35] event data defines the rules on an event [534:37] bus to react to events. You always get a [534:39] default event for every single AIS [534:41] account. You can create custom event [534:42] buses scope to multiple accounts or [534:44] other ABS accounts. You have a SAS event [534:46] bus scope to thirdparty SAS providers. [534:49] You have producers. These are ADA [534:50] services that emit events. You have [534:52] events. These are data emitted by [534:53] services. There's JSON objects that uh [534:56] travel the stream within the event bus. [534:57] You have partnered sources. These are [534:59] thirdparty apps that can emit events to [535:01] event buses. You have rules. These [535:03] determine what events to capture and [535:05] pass to targets. And then targets, which [535:07] are ADA services that consume events. [535:09] So, yeah, it's all just this great [535:11] built-in um uh uh uh stuff that's going [535:14] on here. And so you know there there [535:16] might be a case where you can use event [535:17] bridge and save your time uh a lot of [535:20] time and effort uh doing application [535:22] integration. Okay. [535:27] Hey this is Andrew Brown from Exam Pro [535:29] and we are taking a look at application [535:31] integration services at a glance here. [535:33] So let's get through them. So the first [535:34] is simple notification service. This is [535:37] a pub sub messaging system. Sends [535:40] notifications via various formats such [535:42] as plain text, email, HTTPS, web hooks, [535:45] SMS, text messages, SQS and Lambda. [535:48] Pushes messages which are then sent to [535:50] subscribers. You have SQS. This is a [535:53] queueing messaging system or service [535:56] that sends events to a queue. Other [535:58] applications pull the queue for messages [535:59] commonly used for background jobs. We [536:01] have step functions. This is a state [536:03] machine service. It is. It coordinates [536:05] multiple AA services into a serverless [536:07] workflow. Easily share data among [536:09] lambdas. Have a group of lambdas wait [536:11] for each other. Create logical steps. [536:14] Also works with Fargate tasks. We have [536:16] event bridge formerly known as cloudatch [536:18] events. It is a service event bus that [536:20] makes it easy to connect applications [536:21] together from your own application, [536:23] thirdparty services, and adabus [536:24] services. Then there's Kinesis, a [536:26] real-time streaming data service. [536:28] Creates producers which send data to a [536:30] stream. Multiple consumers can consume [536:32] data within a stream used for real-time [536:34] analytics. Click streams ingesting data [536:36] from a fleet of IoT devices. You have [536:39] Amazon MQ. This is a managed message [536:41] broker service that uses Apache [536:43] ActiveMQ. So if you want to use Apache [536:46] Active MQ, there it is. Manage Kafka [536:48] service. And this gets me every time [536:51] because it says MSK. And that is the [536:54] proper initialization, but you think [536:55] it'd be MKS. It is a fully managed [536:58] Apache Kafka service. Kafka is an open [537:01] source platform for building real-time [537:02] streaming data pipelines and [537:04] applications. Similar to Kinesis but [537:05] more robust, very popular by the way. We [537:08] have API gateway, a fully managed [537:10] service for developers to create, [537:11] publish, maintain, monitor, and secure [537:13] APIs. You can create API endpoints and [537:15] route them to Adabus services. We have [537:17] AppSync. This is a fully managed GraphQL [537:19] service. GraphQL is an open-source [537:21] agnostic query adapter that allows you [537:23] to query data from many different data [537:25] sources. So there you go. [537:32] Hey, this is Andrew Brown. Let's talk [537:33] about Adabus Amplify, which is an [537:35] opinionated framework and a fully [537:36] managed infrastructure to allow [537:38] developers to focus on building web apps [537:40] and mobile applications. This is a very [537:43] confusing service because there is an an [537:45] umbrella of things that are under Adus [537:47] Amplify. So we have the CLI which is [537:49] used uh to interact with amplify [537:53] resources. We have the SDK which you use [537:55] client side. We have amplify UI which [537:57] are UI components to quickly build up [538:00] themes connected to AWS. We have Amplify [538:02] hosting which is for static website [538:04] hosting. I also think it does like web [538:05] application hosting. We have Amplify [538:08] Studio which is a visual development [538:10] environment for building full stack web [538:12] and mobile apps. Um and then there's Gen [538:14] Two. And I just hate Amplify so much [538:18] because they keep saying that they're [538:20] focusing on developer experience. Yet, [538:23] no matter how many times I pick up the [538:25] service, and it's been like what, six [538:27] years or five years since I've I've been [538:28] using this, a year after year, hoping [538:31] that this thing will be better and I can [538:33] never get through a single tutorial from [538:36] their getting started stuff. And you [538:38] really have to piece things together and [538:39] it's just a mess. So, um, let's just [538:42] talk about what it wants you to know. [538:45] And I don't want you to waste your time [538:47] learning this service. It amplify has [538:49] direct integrations with Cognto, API [538:51] gateway, AppSync, S3, DynamoB, AOS, [538:55] Lambda, and I'm sure a whole host of [538:57] other things. The the big idea with [538:59] Amplify is that they try to be [539:01] JavaScript framework first to get people [539:03] in. They tell you all the frameworks it [539:05] works with. It works with regular [539:06] JavaScript. Um, but they seem to spend a [539:10] lot of time around these components to [539:11] make your life easier. don't think it [539:13] really worked out that well Amplify has [539:15] Gen two which is currently in preview [539:17] but it's all over their marketing stuff [539:18] and they're telling you to use that [539:20] right now and the idea is that this is [539:22] supposed to improve the developer [539:23] experience but supposed to be code first [539:26] um which it should have always been code [539:28] first but uh they got really confused [539:30] along the way um so you know amplifies [539:33] just never never seems to get it there [539:35] uh despite how nice the people are in [539:38] the team and the developer advocates and [539:39] stuff like that it just does not cross [539:42] the line. It's really sad. One other [539:44] thing that you need to know about able [539:46] is that if you want to use Amazon [539:48] Cognto, [539:49] they used to have like an isolate [539:51] library for it for um a client side [539:54] library when you wanted to integrate [539:55] your own custom one, but you have to use [539:57] the amplify um amplify client side SDK [540:01] in order to interact uh with Cognto. [540:05] Okay, so there used to be one that was [540:06] separate. So unfortunately, you have to [540:07] bring that over. The nice thing is that [540:09] amplify is modular. So that is great. [540:12] But yeah, I will attempt a lab and it's [540:15] going to be a messy one and I don't [540:16] expect to finish it, but I just want to [540:17] give you kind of an idea of what it [540:19] looks like when you're utilizing it and [540:22] where I'm going to stop and say, "Hey, I [540:23] don't like the service." Okay. [540:30] Hey, this is Andrew Brown. Let's talk [540:31] about AppSync, which is a fully managed [540:33] GraphQL service. Uh so the idea is that [540:36] you have uh apps sync which is uh going [540:38] to be your entry point uh to your API. [540:41] You will define a schema which will [540:44] represent your data model. Within the [540:46] data model you have models. So um those [540:48] are going to need to pull data from data [540:51] sources. And the way they're going to do [540:53] that is through resolvers. And so [540:54] resolvers um implement state changing [540:58] operations for the queries, mutations or [540:59] subscriptions. So they basically map uh [541:03] basically to those things. Uh and then [541:05] the idea is you'll have an SDK. So [541:08] specifically use the amplify SDK um to [541:11] uh pull data from AppSync and it will [541:13] actually generate out um uh scaffolding [541:16] uh for your models to be able to send [541:19] those queries over which is really nice. [541:20] One thing I want to point out is that [541:22] AppSync can support real-time APIs via [541:24] the GraphQL subscription feature um [541:26] which is cool. Let's just talk about [541:28] other features about AppSync. So you [541:30] have two API types. We have GraphQL APIs [541:32] and merge APIs. The key difference here [541:34] is merge APIs is just merging a bunch of [541:36] GraphQL APIs into one. The reason you [541:39] might want to do this, you have multiple [541:40] teams. Each team manages their own API, [541:43] but for the end user, you want a single [541:45] API for them to access. Uh for data [541:48] sources, we have Dynamob table, uh [541:50] Amazon Open Search, uh Adus Lambda [541:53] Functions, HTTP endpoints, Amazon Event [541:56] Bridge, uh relational databases. In [541:58] particular, this is just for RDS HTB [542:00] endpoints which could also go to Aurora [542:02] because Aurora is on RDS. We have a few [542:05] caching options. We have no caching for [542:08] request caching or per resolver caching. [542:10] What's interesting about the caching [542:12] solution here is you actually provision [542:14] an instance. So you pick an instance [542:16] type. Uh so it's not serless. It's an [542:18] ongoing cost. For authorization types, [542:21] we have API key, AWS AM and cognto user [542:26] pools. Uh the reason you want [542:27] authorization is to say who's allowed to [542:29] access your API. So those are your [542:31] options there. AppSync supports custom [542:34] domains which is nice. AppSync has a [542:36] query editor built into the UI so it's [542:38] very easy to work on your queries and it [542:41] has two different runtime resolvers. We [542:43] have the appsyncjs JavaScript and uh [542:46] VTL. So I mean I could have gone a lot [542:49] deeper here with appsync but the thing [542:51] is that you just need to understand that [542:53] it is for graph uh graphql APIs and we [542:55] just need to do a basic lab but it's a [542:57] great service but again this is all we [543:00] need to know. So there we go. [543:06] Hey this is Andrew Brown from Exam Pro [543:08] and we are comparing virtual machines to [543:10] containers. So I know we covered this [543:12] prior but I just want to do it one more [543:14] time just to make sure that we [543:15] fundamentally understand the difference [543:16] before we jump into containers. So the [543:19] idea is that if you were to request an [543:20] EC2 instance it has a host operating [543:23] system that we don't really know much [543:25] about but we don't really need to know. [543:27] Uh and then the idea is you have a [543:28] hypervisor which allows you to deploy [543:31] virtual machines. And so when you launch [543:33] an EC2 instance, you're actually [543:34] launching a VM on top of a hypervisor on [543:37] a server uh with on uh within the AWS uh [543:40] data centers servers there. And you're [543:42] going to choose an operating system. So [543:43] like Ubuntu and it might come with some [543:45] pre-installed packages or you're going [543:47] to install your own libraries, packages, [543:48] and binaries. And then you're going to [543:50] decide what kind of workloads you want [543:51] to run on there. So it could be Django, [543:53] uh MongoDB, so your database, and some [543:56] kind of queuing system like Rabbit MQ. [543:58] the uh difficulties with virtual [544:00] machines, you're always going to end up [544:01] with some unused space because you're [544:03] going to want to have some headroom uh [544:05] to make sure that uh you know if you [544:07] know Django needs more memory or or [544:10] MongoDB needs more storage that you have [544:12] that room that you can grow into. But [544:14] the idea is that you're always paying [544:16] for that even when you're not utilizing [544:18] it. And so you know that can be uh not [544:21] as cost effective as you'd like it to [544:23] be. So when we're looking at um doing [544:25] this again and we are using containers [544:29] um instead of the hypervisor we have [544:31] container virtualization a very common [544:33] one would be called docker damon for [544:34] docker of course and so now you're [544:36] launching containers and so maybe you [544:38] have alpine and this is for your web app [544:40] and then you install exactly the [544:42] libraries packages and binaries you need [544:43] for that and then for uh MongoDB you [544:46] want to have a different OS different [544:48] packages and same thing with rabbit MQ [544:51] maybe you want to run it on FreeBSD and [544:52] the idea is that uh you know you're not [544:55] going to have this waste because it it's [544:57] kind of changed the sense that these [544:59] containers are flexible so they can [545:01] expand or decrease based on the the use [545:04] case of what they need uh and you know [545:06] if you use particular services like ads [545:08] fargate you know you're paying like for [545:11] running the containers not necessarily [545:13] uh for uh overprovisioning okay so VMs [545:16] do not make best use of space apps are [545:18] not isolated which could cause uh config [545:20] conflict security problems or resource [545:22] Hogging containers allow you to run [545:25] multiple apps which are virtually [545:26] isolated from each other. Launch new [545:28] containers. Configure OS dependencies [545:30] per container. Okay. [545:36] Hey, this is Andrew Brown from Exam Pro [545:37] and we are taking a look at the concept [545:39] of microservices. And to understand [545:41] microservices, we first need to [545:43] understand monoliths or monolithic [545:45] architecture. And the idea here is that [545:47] we have one app which is responsible for [545:49] everything and the functionality is [545:50] tightly coupled. So I'm going to get my [545:52] pen tool out here and just to highlight [545:54] notice that there is a server and [545:56] everything is running on a single server [545:58] whether it's load balancing caching the [546:00] database um maybe the marketing website [546:03] the front-end JavaScript framework the [546:05] backend with its API uh the uh OM [546:09] connected to background tasks things [546:11] like that and that's the idea of a [546:12] monolith and that's what um a lot of [546:14] people are used to doing but the idea [546:16] with micros service architecture is that [546:18] you have multiple apps which are [546:19] responsible for one uh one thing and the [546:21] functionality is isolate and stateless [546:24] and so just by uh leveraging um various [546:27] cloud services or bolting it onto your [546:29] service um you know you are technically [546:31] using microser architecture so maybe [546:34] your web app is all hosted um in [546:37] containers so you have your APIs your or [546:39] your reports maybe you've abstracted out [546:42] some particular functions into lambda [546:44] functions you have your um marketing [546:47] website hosted on S3 you have your [546:49] front-end JavaScript hosted on S3 three, [546:51] you're now using elastic load balancer, [546:54] uh, elastic cache, RDS, [546:57] SQS, and that's the idea between [546:59] monoliths and microservices. Okay, [547:06] let's take a look here at Kubernetes, [547:08] which is an open-source container [547:09] orchestration system for automating, [547:11] deployment, scaling, and management of [547:13] containers. It was originally created by [547:15] Google and now maintained by the [547:17] cloudnative computing foundation. So the [547:19] C and CF Kubernetes is commonly called [547:22] K8. The eight represents the remaining [547:24] letters for Kubernetes, which is odd [547:26] because everyone calls it Kubernetes [547:28] with the S on there, but that's just [547:30] what it is. The advantage of Kubernetes [547:32] over Docker is the ability to run [547:34] containers distributed across multiple [547:36] VMs. A unique component of Kubernetes [547:38] are pods. A pod is a group of one or [547:40] more containers with with shared [547:42] storage, network resources, and other [547:44] shared settings. So here is kind of an [547:46] example where you have your Kubernetes [547:48] master. It has aulular controller etc. [547:51] you might be using. It uses an API [547:53] server to run nodes. Within the nodes we [547:56] have pods and within the pods we have [547:58] containers. Kubernetes is ideally for [548:00] micros service architectures where [548:02] company has tens to hundreds of services [548:05] they need to manage. I need to really [548:07] emphasize that tens to hundreds of [548:10] services. All right. So, you know, [548:12] Kubernetes is great, but just understand [548:13] that it is really designed uh to be used [548:15] for massive amounts of microservices. If [548:18] you don't have that need, you might want [548:21] to look at something just easier to use. [548:23] Okay. [548:28] All right. Let's take a look here at [548:29] Docker, which is a set of platform as a [548:31] service products that use OS level [548:33] virtualization to deliver software in [548:35] packages called containers. So Docker [548:38] was the earliest popularized open source [548:41] container platform, meaning there's lots [548:42] of tutorials. There's a lot of services [548:44] that uh integrate with Docker or make it [548:47] really easy to use. And so when people [548:49] think of containers, they generally [548:50] think of Docker. There's of course a lot [548:52] more options out there than Docker to [548:54] run containers, but this is what people [548:55] think of. And so we said it's a suite of [548:57] tools. So the idea is you have this [548:59] Docker CLI. So these are CLI commands to [549:01] download, upload, build, run, and debug [549:03] containers. A Docker file, a [549:05] configuration file on how to provision a [549:07] container. Docker compose uh which is a [549:10] tool and configuration file when working [549:11] with multiple containers. Docker Swarm, [549:14] an orchestration tool for managing [549:16] deployed multicontainer architectures. [549:18] Docker Hub, a public online repository [549:21] for containers published by the [549:22] community for download. And one really [549:24] interesting thing uh that came out of [549:25] Docker was the open container initiative [549:27] OCI which is an open governance [549:30] structure for creating open industry [549:31] standards around container formats and [549:33] runtimes. So Docker established the OC [549:36] OCI and it is now maintained by the [549:38] Linux Foundation. And so the idea is [549:41] that you can write a docker file or or [549:44] do things very similarly and use [549:45] different types of um uh technologies [549:48] that can use containers as long as [549:50] they're OCI compatible you can use them. [549:52] So Docker has been losing favor with [549:54] developers due to their handling of [549:55] introducing a paid open source model and [549:58] alternatives like Podman are growing and [550:00] that's why we're going to talk about [550:00] Podman next. Okay. [550:06] So let's take a quick look here at [550:08] Podman which is a container engine that [550:10] is OCI compliant and is a dropin [550:12] replacement for Docker. I just want to [550:14] get you exposure here because I want you [550:15] to know about this um and that you can [550:18] uh use it as opposed to using Docker. Um [550:20] there are a few differences or [550:22] advantages that podman has. So podman is [550:24] damonless where docker uses a containerd [550:26] damon. Podman allows you to create pods [550:28] like kubernetes where docker does not [550:30] have pods. Podman only replaces one part [550:33] of docker. Podman is is to be used [550:35] alongside builda and uh scopio. So you [550:38] know docker is an all-in-one kind of [550:40] tool. Uh everything is done via a single [550:42] cli and everything is there. But you [550:44] know they just wanted to make it more [550:45] module. And so uh these other tools [550:48] anytime you say podman it usually means [550:49] we're talking about podman builda and [550:51] scopio. So builda is a tool used to [550:54] build the OCI images and scopio is a [550:56] tool for moving container images between [550:58] different types of container stoages. [551:00] Podman is not going to show up in your [551:01] exam but you should practically know it [551:03] um just for your own benefit. Okay [551:10] let's take a look here at the container [551:12] services offered on AWS. So we have [551:14] primary services that actually run [551:16] containers, provisioning and deployment [551:17] on you know tooling around provisioning [551:19] and deployment and supporting services. [551:22] So the first here is elastic container [551:24] service ECS. Um and the advantage of [551:26] this service is that it has no cold [551:28] starts but it is a self-managed EC2. So [551:31] that means that you're going to be [551:32] always paying for the resource as it is [551:34] running. All right. Then you has ads [551:36] Fargate. So this is more robust than [551:39] using Adabus Lambda. It can scale to [551:41] zero costs. um and it's uh being managed [551:44] by Adabus manage EC2. However, it does [551:47] have cold start. So, you know, if you [551:48] need containers launching really fast, [551:50] you might be wanting to use ECS. Then [551:53] you have Elastic Kubernetes Service EKS. [551:55] This is uh open source. It runs [551:57] Kubernetes. Um and this is really useful [552:00] if you want to avoid vendor lock in um [552:03] which is not really a problem but uh [552:05] that or it's just you want to run [552:07] Kubernetes. Then you have Adabus Lambda. [552:09] So, you only think about the code. Uh [552:11] it's designed for short running tasks. [552:13] Uh if you need something that runs [552:14] longer, you'd want to use uh that is [552:16] serverless, you'd use ads Fargate, which [552:18] is serverless containers. You can deploy [552:20] custom containers. So prior ads lambda [552:23] just had um pre-built runtimes which [552:25] were containers, but now you can create [552:27] any kind of container and uh use that uh [552:29] on ads lambda for provisioning [552:32] deployment. You can use elastic bean [552:33] sock. So um it can uh deploy elastic [552:37] container service for you um which is [552:39] very useful there. Now now there's [552:41] appunner which kind of overlaps on what [552:43] elastic beantock does but it specializes [552:46] it specializes for containers um and I [552:49] believe that it can actually I don't [552:51] know what it uses underneath because it [552:52] is a managed service. So elastic [552:54] beantock is um open you can see what is [552:56] running underneath and appunner I don't [552:58] believe you can see what is running [552:59] underneath it's just taken care of by [553:01] AWS. Then there's ads uh copilot CLI. So [553:04] this allows you to build, release, [553:06] operate productionready containerized [553:08] applications on apprunner, ECS and ASUS [553:10] Fargate for supporting services. You [553:12] have elastic container registry. This is [553:14] a rep for your containers. Not [553:15] necessarily just Docker containers, but [553:17] containers in general, probably OCI [553:19] compliant containers. X-ray, so analyze [553:21] and debug between microservices. So you [553:24] know it's distributed tracing. Then you [553:26] have step functions. So, stitch together [553:28] lambdas and ECS tasks to uh create um um [553:32] a state machine. And the only thing I [553:34] don't have on here would be, you know, [553:36] being able to launch an EC2 instance [553:37] from the marketplace that has um a uh a [553:42] container runtime installed like Docker. [553:44] I just don't feel that that's very [553:45] relevant for for the exam, but it is [553:47] another option for containers. Not [553:49] something that people do very often, but [553:50] there you go. [553:55] Hey, this is Angie Brown from Exam Pro [553:57] and we are taking a look here at [553:58] organizations and accounts. So, Adabus [554:00] organizations allow the creation of new [554:02] Adabus accounts. It allows you to [554:04] centrally manage billing, control [554:06] access, compliance, security, and share [554:08] resources across your Adabus accounts. [554:10] So, here's kind of a bit of a structure [554:12] of um the architecture of Adabus [554:15] organizations. And we'll just kind of [554:17] walk through the components. So, the [554:18] first thing you have is a root account [554:20] user. This is a single sign-in identity [554:22] that has complete access to all adabus [554:24] services and resources in an account and [554:27] each account has a root account user. So [554:30] generally you will have a master or root [554:32] account and even within that you'll have [554:33] a root account user and for every [554:36] additional account that you have you'll [554:37] notice over here we have a root account [554:40] user. [554:41] Then there's the concept of [554:42] organizational units. Uh these are [554:44] commonly abbreviated to OUS. So they are [554:47] a group of adabus accounts within an [554:48] organization which can contain other [554:50] organizational units creating a [554:52] hierarchy. So here is one where we have [554:55] called starfleet and here's one called [554:57] federation planets and underneath we [554:59] have multiple uh accounts. It was [555:01] accounts within that organizational unit [555:03] and even though it does not show it here [555:05] you can create an organizational unit [555:07] within an organizational unit. Then we [555:09] have service control policies SCPs and [555:12] these give uh central control over the [555:14] allowed permissions for all adabus [555:15] accounts in your organization helping to [555:18] ensure your accounts stay within your [555:20] organization's guidelines. What they're [555:22] trying to say here is that um there's [555:24] this concept of adabus IM policies and [555:27] all you're doing is you're creating a [555:28] policy that's going to be uh [555:30] organizational unitwide or [555:33] organizationalwide or for select [555:35] accounts. So it's just a way of applying [555:37] IM policies across multiple accounts. [555:39] organizations must be turned on and [555:41] once it's turned on it cannot be turned [555:43] off. It's generally recommended that you [555:45] do turn it on um because basically when [555:48] if you're going to run any kind of [555:49] serious workload you're going to be [555:50] using adabus organizations to uh isolate [555:53] your ads accounts based on workloads. [555:55] You can create as many ads accounts as [555:56] you like. One account will be the master [555:59] or root account. Um, and I say root [556:01] account here because this is the new [556:03] language here and some of the [556:04] documentation still calls it master [556:05] account. So just understand this is the [556:07] root account not to be confused with the [556:10] root account user. So another [556:13] clarification I want to make is an adus [556:15] account is not the same as a user [556:17] account which is another thing that is [556:19] confusing. So when you sign up for AWS [556:22] you get um an adabus account and then it [556:24] creates you a user account which happens [556:26] to be a root user account. So hopefully [556:28] that is clear. [556:34] So adabus control tower helps [556:35] enterprises quickly set up a secure [556:37] adabus multi account. It provides you [556:39] with a baseline environment to get [556:41] started with a multi-count architecture. [556:43] So it does this a few uh a few different [556:45] ways. The first thing is it provides you [556:47] a landing zone. This is a baseline [556:49] environment following well architected [556:51] and best practices to start launching [556:53] production ready workloads. So imagine [556:55] you wanted to go have um you know the [556:57] perfect environment that you know is [556:59] secure um is correctly configured and [557:02] has good logging in place. That's what a [557:04] landing zone is. And so Adabus's landing [557:07] zone for control tower is going to have [557:08] SSO enabled by default. So it's very [557:10] easy to move between IPS accounts. It'll [557:12] have centralized logging for Adabus [557:14] cloud trail so that you know they're [557:16] going to be tamper evident or [557:17] tamperproof away from your workloads [557:19] where they can't be affected. It'll have [557:21] cross account security auditing. Um so [557:23] yeah, landing zones are really great to [557:25] have. Then there's the account factory. [557:26] They used to call this um uh a vending [557:30] machine, but uh they changed it to [557:32] account factory. The idea is that it [557:33] automates provisioning of new accounts [557:34] in your organization. It standardizes [557:37] the provisioning of new accounts with [557:38] pre-approved uh account configuration. [557:41] You can configure account factory with [557:42] pre-approved network configuration and [557:44] region selections. Uh enable [557:46] self-service for your builders to [557:48] configure and provision new accounts [557:49] using ABA service catalog. ADA service [557:51] catalog is just pre-approved uh [557:53] workloads uh via cloudformation [557:55] templates that you created to say okay [557:56] you're allowed to launch this server or [557:58] these resources. Um and the third and [558:01] most important thing that as control [558:02] tower comes with is guard rails. So [558:04] these are prepackaged governance rules [558:06] for security operations compliance that [558:08] customers can select and apply [558:10] enterprisewide or to specific groups of [558:12] accounts. So adabis control tower is the [558:15] replacement of the retired adabus [558:17] landing zones. So, if you remember AA's [558:19] landing zones, which was never a self-s [558:22] serve, easy thing to sign up for. It [558:24] required a lot of money and uh stuff to [558:26] go in there. They just don't really have [558:28] it anymore. And it was control tower is [558:30] the new offering um there. Okay. [558:36] Hey, this is Andrew Brown from Exam Pro [558:38] and we are taking a look at Adis Config. [558:40] And to understand config, we need to [558:42] know what compliance as code is. And to [558:45] understand compliance as code we need to [558:46] understand what change management is. So [558:49] change management in the context of [558:50] cloud infrastructure is when we have a [558:52] formal process to monitor changes [558:55] enforce changes and remediate changes. [558:58] And compliance is code also known as CAC [559:01] is when we utilize programming to [559:03] automate the monitoring enforcing and [559:05] remediating changes to stay compliant [559:07] with the compliance program or expected [559:10] configuration. So what is adabus config? [559:13] Well, it's a compliances code framework [559:15] that allows us to manage change in your [559:17] ID as accounts on a per region basis. [559:20] Meaning that you have to turn this on [559:22] for every region that you need it for. [559:24] And so here is a very simple example [559:26] where let's say we create a config rule [559:29] and we have an EC2 instance and we [559:31] expect it to be in a particular state. [559:33] And then in the other case, we have a an [559:36] RDS instance and it's in a state that we [559:38] do not like. So the idea is that we try [559:40] to remediate it to put it in a state [559:42] that we want it to be and those config [559:43] rules are just powered by lambdas as you [559:46] can see based on the lambda icon there. [559:48] So when should you use ads config? Well, [559:51] this is when I want this resource to [559:52] stay configured a specific way for [559:54] compliance. I want to keep track of [559:56] configuration changes to resources. I [559:59] want a list of all resources within a [560:01] region and I want to use uh analyze [560:04] potential security weaknesses. And you [560:06] need detailed historical information. So [560:09] there you go. [560:14] Hey, this is Andrew Brown from Exam Pro [560:16] and in this follow along we're going to [560:17] take a look at Adabus Config. So Adabus [560:19] config is a tool that allows you to [560:21] ensure that your services are configured [560:23] as expected. So I've already activated [560:25] it in my North Virginia region. So what [560:27] I'm going to do is just go over to Ohio [560:29] here uh because it is per region [560:31] activated. And I'll go over to config [560:34] and then what we'll have to do is set it [560:35] up. So there is this one-click setup and [560:38] it did skip me to the review step [560:40] because it's kind of piggybacking on the [560:42] configuration of my original one here. [560:44] But the idea is that you'll just say uh [560:46] record all resources in this region or [560:48] things like that. You'll have to create [560:50] a service ro link if you have not done [560:53] so. So this will look a little bit [560:54] different but here it's using existing [560:56] one. You'll have to choose a bucket so [560:58] or create a bucket. Uh it's not super [561:01] complicated. So you get through there [561:02] you hit confirm and basically you're [561:04] going to end up with this. So the [561:06] inventory um lets you see all the the [561:09] resources that or not all of them but [561:11] most resources that are in your adabus [561:13] account in this particular region. It [561:15] this will not populate uh right away. So [561:17] you will have to wait a little bit of [561:19] time for that to appear. One really nice [561:22] thing are conformance packs. I really [561:23] love these things. When first brought [561:26] these out, there was only like a couple, [561:27] but now they have tons and tons and tons [561:29] of conformance packs. So you can go [561:31] deploy a conformance pack and you can [561:33] open up the templates. I just want to [561:35] show you, look at how many they have. [561:38] So, there's some you might recognize [561:39] like NIST, [561:41] uh, CIS, things like that, well [561:42] architected, uh, stuff. And all these [561:45] are, um, and I'm not sure if it's easy [561:47] to open these up, but all these are, if [561:49] we open them up, they're on GitHub, is [561:51] these are just cloudformation templates [561:52] to set up configuration rules. So, [561:55] there's a variety of suggested rules, [561:57] uh, like around IM best practices and [562:00] things like that that we can load in. [562:01] Um, but the idea is that you're just [562:03] going to create rules. So, you go here [562:04] and you add a rule. And they have a [562:06] bunch of manage rules here um that we [562:08] can look at, but I think it might be fun [562:10] to actually run a um a conformance pack. [562:13] I'll just show you what it looks like to [562:14] add a rule first. So, let's say we [562:16] wanted to do something for S3. Um and it [562:20] was making sure that we are blocking [562:22] public access. So, we go next here. [562:24] Generally, you'll have a trigger type [562:25] you can choose whether it's uh [562:26] configured when it happens or it's [562:29] periodic. This is disabled in this case [562:31] here. And you just scroll on down. Um [562:33] and then once you've added the rule, [562:37] what you can do [562:39] is also manage remediation. So if this [562:43] rule said, hey, this thing is [562:45] non-compliant. We want you to take a [562:47] particular action, you have all these [562:49] ads actions that you can perform and you [562:51] can notify the right people to correct [562:53] it or have it autocorrect if you choose [562:56] to do so. Um for rules, you can also [562:58] make your own custom ones. So that's [563:00] just you providing your own lambda [563:02] function. So you're providing that [563:03] lambda ar and so basically you can have [563:05] it do anything that you want. Whatever [563:07] you want to put in a lambda you can make [563:09] ad as config check for. Okay. So it's [563:12] not super complicated here but um this [563:15] one here is just going to go ahead and [563:16] check. And so if we go and reevaluate [563:20] it might just take some time to show up. [563:21] It's either going to say that it's [563:22] compliant or non-compliant. Okay. And I [563:25] it should be compliant. But while we're [563:27] waiting for that to happen, let's just [563:28] see how hard it is to deploy a [563:29] conformance pack because I feel like [563:30] that's something that's really [563:31] important. Oh, you can just drop them [563:33] down and choose them. That's great. So, [563:34] we might want to go to AM here. Oops. [563:37] Identity and access management. [563:40] And hit next. And say uh my um [563:45] uh IM best practices. And you might not [563:48] want to do this because it does have [563:50] spend. And I want to say spend. It's not [563:51] going to happen instantly, but the idea [563:53] is that if you turn this on and forget [563:54] to remove it. Uh you will see some kind [563:57] of charges over time because it does [563:58] check based on the rules. It's not super [564:00] expensive, but it is something to [564:02] consider about. Um but anyway, so looks [564:04] like we created that conformance pack. [564:05] So if I refresh, it looks like it's in [564:08] progress. I wonder if that's going to [564:09] set up a cloud for template. I'm kind of [564:11] curious about that. So we'll make our [564:13] way over to cloud for [564:18] it is. So that's really nice because [564:19] once that is done, what we can do is [564:21] just tear it down by deleting the stack. [564:23] So I'm going to go back over to our [564:25] conformance pack here. [564:28] Let's take a look here. And so it still [564:30] says it's in progress, but it is [564:32] completed. And we can click into it. [564:35] And we can see all the things that it's [564:38] doing. So it says IM groups have user [564:39] check performance pack. Um, and so it [564:42] looks like there's a bunch of uh cool [564:43] rules uh here. So, what we'll do is [564:48] we'll just wait a little while and we'll [564:49] come back here and then just see if um [564:52] this updates and see how compliant we [564:54] are from a uh a basic account. Okay. All [564:57] right. So, after waiting a little while [564:58] there, it looks like some of them are [565:00] being set. So, I just gave it a hard [565:01] refresh here. Uh and here you can see [565:03] that it's saying is root account um [565:05] whoops. We'll give it a moment here to [565:07] refresh. But, uh is the root account MFA [565:09] applied? Yes. Have we done a password [565:12] policy? No. Oh, and actually I never did [565:13] a password policy, which is something I [565:15] forgot to do. But here, they're just [565:17] talking about the minimums and maximums [565:18] of things that you can do. Okay, so [565:21] that's a conformance pack. Um, but if we [565:24] go to rules, actually, I guess it's all [565:25] the rules here. I can't really tell the [565:28] difference between the conformance pack [565:29] rules and our plane rules. It's kind [565:30] it's kind of all mixed together here, I [565:33] think. [565:36] Yeah. So, it's a bit hard to see what's [565:37] going on there. If we go to the core [565:39] performance pack and click in again, it [565:41] might show the rules. Yeah, there we go. [565:43] So, here's the rules there. We're seeing [565:44] a little bit more information. So, use a [565:46] hardware MFA. So, you know how they're [565:48] talking about using a security key like [565:50] what I showed you that I had earlier in [565:52] the course, things like that. Um, IM [565:55] password policy, things like that. So, [565:57] you know, not too complicated, but um I [566:00] think I'm all done here. So, what I'm [566:01] going to do is I'm going to go over to [566:03] Cloudformation and tear that on down. [566:05] But, you get the idea. [566:07] Well, I might want to show you a drift. [566:09] So, there used to be a way It's because [566:12] I keep changing things on me here, but [566:14] there's a way to see uh history over [566:17] time. And so that was something [566:21] that they used to show. And I'm just [566:24] trying to like find where they put it [566:25] because it is like somewhere else. [566:29] Resources maybe. [566:32] Ah, resource timeline. Okay, so they [566:34] moved it over into the resource [566:36] inventory. And so if we were to take a [566:38] look at something anything maybe this [566:40] here resource timeline um and there [566:43] might not be much here but the idea is [566:45] it will show you over time how things [566:46] have changed. So the idea is that not [566:48] only can you say with it was config is [566:50] something compliant but when was it [566:52] compliant and that is something that is [566:53] really important to know. Okay so very [566:55] simple example maybe not the best but [566:57] the idea is that we can see when it was [566:59] and was not compliant based on uh [567:01] changes to our stuff. But uh anyway that [567:04] looks all good to me here. So, I'm going [567:06] to make my way over to Cloudformation. [567:07] Actually, I already already have it open [567:09] over here. We're going to go ahead and [567:10] delete that stack. Um, termination [567:14] protection is enabled. You must first [567:16] disable it. So, we'll edit it, disable [567:18] it, whatever. Okay, we'll hit delete [567:21] there. And as that's deleting, I'm going [567:23] to go look for and config my original [567:28] rule there. Again, I'm not really [567:30] worried about it. I don't think it's [567:31] going to really cost me anything, but uh [567:32] I might as well just kind of clear the [567:34] house here just so you're you're okay as [567:36] well. And so if we go over to our rules, [567:40] um the one that I spun up that was [567:42] custom I think was this one here because [567:44] these are all grayed out, right? So I [567:45] can go ahead there, delete that rule, [567:47] type in delete, [567:50] and we are good. So there you go. [567:53] That is [567:55] it. All right. [568:01] Let's take a look at the concept of [568:03] tagging within AWS. So a tag is a key [568:06] and value pair that you can assign to an [568:08] ads resource. So as you are creating a [568:10] resource, it's going to prompt you to [568:12] say, "Hey, what tags do you want to [568:13] add?" You're going to give a key, you're [568:15] going to give a value. And so some [568:17] examples could be something like based [568:19] on department, the status, the team, the [568:22] environment, uh the project as we have [568:24] the example here, the location. Um and [568:27] so tags allow you to organize your [568:28] resources in the following way. For [568:30] resource management, so specific [568:31] workloads, so you can say you know [568:33] developer environments, cost management [568:35] and optimization, so cost tracking, [568:37] budgets and alerts, operations [568:39] management, so business commitments, SLA [568:41] operations, mission critical services, [568:43] security, so classification of data, [568:45] security impact, governance and [568:47] regulatory compliance, automation, [568:49] workload automation. And so it's [568:52] important to understand that tagging can [568:53] be used in junction with um IM policy so [568:56] that you can restrict access or things [568:59] like that based on those tags. Okay. [569:05] All right. I just want to show you one [569:06] interesting thing about tags. Um and [569:09] it's just the fact that it's used as the [569:12] name for some services. So when you go [569:14] to EC2 and you launch an instance, uh [569:17] the way you set the name is by giving it [569:18] a tag called name. And I just want to [569:20] prove that to you. Just like one of [569:23] those little exceptions here. So we [569:24] choose an instance here. [569:27] We go to configure storage and then what [569:29] we do is we add a tag and we say name. [569:32] Um and my server name. Okay. And then we [569:35] go ahead and review and launch. We're [569:37] going to launch this. I don't need a key [569:39] pair. So we'll just say proceed without [569:41] key pair. I acknowledge. [569:44] Okay. [569:47] and we will go view the instances and [569:49] you'll see that is the name. So, um [569:51] that's just like one of those exceptions [569:53] or things that you can do with tags. If [569:56] there's other things with tags, I have [569:57] no idea. That's just like a a basic one [570:00] that everybody should know. And that's [570:02] why I'm showing to you with the tags. [570:04] But there you go. [570:09] So, we just looked at tags. Now, let's [570:11] see what we can do with resource groups, [570:12] which are a collection of resources that [570:14] share one or more tags. Or another way [570:16] to look at it, it's a way for you to [570:19] take multiple tags and organize them uh [570:22] into resource groups. So, it helps you [570:24] organize and consolidate information [570:26] based on your project and the resources [570:27] that you use. Resource groups can [570:30] display details about a group of [570:31] resources based on metrics, alarms, [570:34] configuration settings, and at any time [570:36] you can modify the settings of your [570:38] resource groups to change what resources [570:40] appear. Resource groups appear in the [570:43] global console header uh which is over [570:45] here and under the systems manager. So [570:48] technically it's part of ads simple [570:50] systems manager or systems manager [570:52] interface but it's also part of the [570:54] global interface. So sometimes that's a [570:56] bit confusing but uh that's where you [570:57] can find it. Okay. [571:03] All right. So, what I want to do is [571:04] explore resource groups and also um [571:07] tagging. So, what I want you to do is [571:09] type in resource groups at the top here. [571:12] And it used to be accessible, [571:14] not sure where they put it, but it used [571:16] to be accessible here at the top, but [571:17] they might have moved it over to systems [571:19] manager. So, I'm going to go to SSM [571:20] here. Not sure why I can't seem to find [571:23] it today. And on the lefth hand side, [571:26] we're going to look for Resource [571:29] groups. [573:00] All [573:16] right. So, what I want to do is take a [573:18] look at resource groups. And I'm really [573:20] surprised because it used to be [573:22] somewhere in the global now, but I think [573:24] they might have changed it. Um, and [573:27] what's also frustrating is if I go over [573:29] to systems manager, it was over here as [573:32] well. And so on the lefth hand side, I'm [573:34] looking for resource groups, it's not [573:36] showing up. So, I don't know the best. [573:39] You keep moving things around on me. And [573:40] I'm I can only update things so quickly [573:42] in my courses. But if you type in [573:44] resource groups and tag editor, it's [573:46] actually over here. Um, I guess it's its [573:49] own standalone service now. Why they [573:51] keep changing things, I don't know. But [573:53] uh the idea is we want to create a [573:55] resource group. So you can create [573:57] unlimited single region groups in your [573:59] AIS account. Use the group to view [574:01] related insights, things like that. So [574:03] I'm going to go ahead and create a [574:04] resource group. You can see it can be [574:05] tag based or cloud forbased. But I don't [574:08] have any tags. I don't really have [574:10] anything tagged. So what I'm going to do [574:12] is make my way over to S3. We're just [574:13] going to create some resources or a [574:15] couple resources here with some tags so [574:17] that we can do some filtration. So I can [574:19] go ahead and create a bucket. going to [574:20] say my bucket uh this like that. Whoops. [574:26] And then down below I'm going to go down [574:27] to tags and we're going to say project [574:30] and we're going to say um RG for [574:33] resource group. [574:37] Okay. And then I can go back over here [574:38] and then I'm going to just say I can say [574:41] exactly what type I want. I'm going to [574:42] support all resource types [574:45] and I'm going to say project [574:49] RG. You see how it autocompletes? [574:51] And we'll go down below. We'll just say [574:56] my RG [574:58] a test RG. [575:00] We'll create that. [575:03] And so now we have a resource group and [575:05] we can see them all in one place. Uh [575:07] resource groups are probably useful for [575:10] using in policies. So I can say say like [575:13] resource group IM policies. [575:17] That's probably what they're used for. [575:21] Okay. So before you use IM managed to [575:22] access users groups, you should [575:24] understand IM features, things like [575:25] that. [575:28] And so administrators can use JSON [575:30] policies to specify who has access to [575:32] what. And so a policy action or resource [575:35] group is used following the prefix [575:37] resource groups. So my thought process [575:40] there is that if you want to say okay [575:43] you have access to a resource you can [575:45] just specify a resource group and it [575:48] will include all the resources within [575:49] there and so that might be um a better [575:52] way to apply permissions at a per [575:54] project basis um and that could save you [575:57] a lot of time writing out IM policies. [575:59] So that's basically all there really is [576:02] to it. Also, you kind of get a an [576:03] overview of of the um resources that are [576:06] there. So, that can be kind of useful as [576:09] well. There's the tag editor here. I [576:11] can't remember what you use this for. [576:13] You can set up tag policies. [576:16] Tag policies help you standardize tags [576:18] on resource groups in your accounts. Use [576:20] uh to define tag policies and ads or to [576:22] attach them to the entire organization. [576:24] Um we're not in the or accounts, so I'm [576:26] not going to show you this and it's not [576:28] that important. Um but just understand [576:29] that resource groups can be created and [576:31] they are used within IM policies in [576:34] order to um uh grant or deny access to [576:37] stuff. And go ahead and delete that [576:39] resource group. And really ads, stop [576:41] moving that on me. If you move it one [576:42] more time, I'm just never going to talk [576:43] about resource groups again. Okay. [576:49] Hey, this is Andrew Brown from Exam Pro [576:51] and we are taking a look at the cloud [576:53] adoption framework. So this is a white [576:55] paper to help you plan your migration [576:56] from on-remise to AWS. At the highest [576:59] level, the AWS CAF organizes guidance [577:01] into six focus areas. We got business [577:04] people, governance, platform, security [577:06] and operations. And this white paper is [577:08] pretty high level. uh so you know it [577:11] doesn't get into uh granular details on [577:13] how that migration should work uh but [577:15] gives you kind of a holistic approach [577:17] and I believe that probably through the [577:18] ads uh Amazon partner network there's [577:21] people that specialize in using this [577:23] particular framework to help [577:24] organizations move over and I believe [577:26] that adus has professional services [577:28] through the APN but let's just kind of [577:30] break down what these six categories are [577:32] not going to go too deep into this um [577:33] but let's do it so the first is the [577:35] business perspective so these are [577:37] business managers finance managers [577:39] budget owners strategy stakeholders. So [577:41] it's how to update the staff skills and [577:44] organizational processes to optimize [577:45] business value as they move ops to the [577:47] cloud. You have people perspective. So [577:49] human resources, staffing, people, [577:51] managers. So how to update the staff [577:53] skills and organizational processes to [577:55] optimize and maintain the workforce and [577:57] ensure competencies are in place at the [577:59] appropriate time. You have governance [578:01] perspective. So CIOS, program managers, [578:04] project managers, enterprise architects, [578:05] business analysts. So how to update the [578:08] staff skills and organizational [578:09] processes that are necessary to ensure [578:11] business governance in the cloud and [578:13] manage uh and measure cloud investments [578:15] to evaluate the business outcomes. We [578:17] have platform perspectives. So CTO's, IT [578:19] managers, solution architects. So how to [578:21] update the staff skills and [578:23] organizational processes that are [578:24] necessary to deliver and optimize cloud [578:26] solutions and services security [578:28] perspectives. So CISO, IT security [578:30] managers, IT security analysts. So how [578:33] to update the staff skills and [578:34] organizational processes that are [578:36] necessary to ensure that the [578:37] architecture deployed in in the cloud [578:40] aligns to the organization security [578:41] control requirements resilience and [578:43] compliance requirements. We have [578:45] operational or operations perspective. [578:47] So IT operations managers, IT support [578:49] managers. So how to update the staff [578:52] skills and organizational processes that [578:53] are necessary to ensure system health [578:55] and reliability during the move of [578:57] operations to the cloud and then to [578:59] operate operate using agile ongoing [579:01] cloud computing best practices. So this [579:04] just taps the surface of what the CAF [579:06] is. Uh and I think for each of these [579:08] they actually have a more detailed [579:10] breakdown. So you know business is going [579:12] to break down to even more uh uh finite [579:14] things there. Okay. [579:21] All right. So, we looked at the digital [579:22] transformation checklist. Now, let's [579:24] look at the Adabus cloud adoption [579:25] framework. Notice that there's also the [579:27] Adabus cloud adoption readiness tool uh [579:29] which goes along with the framework. In [579:32] fact, this button here is going to take [579:34] you to that readiness tool, but we want [579:35] to look at where the actual um uh white [579:40] paper is. I mean, there is this nice [579:42] infographic which is more of a summary [579:44] um information. You could also uh get [579:48] the same information from an audio book, [579:51] but um the real one is the ebook. This [579:53] is the thing that actually has all the [579:54] information in great depth. And if we [579:57] scroll on down, you will see those [579:59] categories. Uh they should be right [580:02] here. So these are the ones that we were [580:04] covering. Um but you just need to have a [580:06] very high level of it. If you really [580:08] want to know more, you can read this in [580:10] great depth, but you really really don't [580:12] need to. Um and the infographic [580:14] basically has a very similar summary. So [580:17] again, it's enough for us to understand. [580:20] Uh what's interesting is more so the [580:22] cloud adoption readiness tool. So if we [580:24] go here and click here, this is going to [580:26] give you a survey to produce an [580:28] assessment report. And so this is what [580:31] the report will look like in the end. Um [580:33] and with a heat map so you have an idea [580:35] of what you can do and our radar chart. [580:37] So a lot of fun stuff. And so if we [580:40] start our assessment, you can just go [580:42] through here and checkbox stuff and we [580:44] get to the end you will be able to for [580:45] free generate out that assessment report [580:48] uh up here that button and convince your [580:50] team or your stakeholders you know why [580:53] you need to adopt uh cloud. But there [580:55] you go. [581:01] Hey, this is Andy Brown from Exam Pro [581:03] and we're taking a look at [581:04] businesscentric services. And you might [581:06] say well why? because in the exam guide [581:08] it explicitly says that these are not [581:10] covered. But the thing is is that when [581:12] you're taking the exam, some of the uh [581:14] choices might be some of these services [581:16] as distractors. And if you know what [581:18] they are, it's going to help make sure [581:20] that you um uh guess correctly. And the [581:23] thing is that some of these services are [581:25] useful and you should know about them. [581:27] So that's another reason why I'm talking [581:29] about them here. So the first one is [581:30] Amazon Connect. This is a virtual call [581:32] center. You can create workflows to [581:34] route callers. You can record phone [581:35] calls, manage a queue of callers based [581:37] on the same proven system used by Amazon [581:40] customer service teams. We have [581:41] workspaces. This is a virtual remote [581:43] desktop service. Secure managed service [581:45] for provisioning either Windows or Linux [581:47] desktops in just a few minutes, which [581:49] quickly scales up to thousands of [581:50] desktops. We have workdocs, which is a [581:52] shared collaboration service, a [581:54] centralized storage to share content and [581:56] files. It is similar to Microsoft [581:57] SharePoint. Think of it as a shared [581:59] folder where the company has ownership. [582:01] We have Chime, which is a video [582:02] conference service. It is similar to [582:04] Zoom or Skype. You can screen share, [582:06] have multiple people on the on the same [582:08] call. It is secure by default and can [582:10] show you a calendar of upcoming calls. [582:13] We have workmail. This is a managed [582:14] business uh email contacts calendar [582:17] service with support of existing desktop [582:18] and mobile email client applications [582:21] that can handle things like IMAP similar [582:23] to Gmail or Exchange. We have Pinpoint. [582:25] This is a marketing campaign management [582:27] service. Pinpoint is for sending [582:29] targeted emails via SMS, push [582:31] notifications, voice messages. So you [582:34] can perform um A2B testing or create [582:36] journey. So complex email response [582:39] workflows. We have SCES. This is a [582:41] transactional email service. You can [582:43] integrate SCES into your application to [582:45] send emails. You can create common [582:47] templates, track open rates, keep track [582:49] of your reputation. We have Quicksite. [582:51] This is a business intelligence uh [582:52] service. connect multiple data sources [582:54] and quickly visualize data in the form [582:56] of graphs with little to no knowledge. [582:58] Definitely you want to remember [582:59] quicksite, SCES, Pinpoint uh because [583:02] those definitely will show up in exam. [583:04] The rest probably not, but they could [583:05] show up as distractors. Okay. [583:12] Hey, this is Andrew Brown from Exam Pro [583:13] and we are taking a look at provisioning [583:15] services. So let's first define what is [583:17] provisioning. So provisioning is the [583:18] allocation or creation of resources and [583:20] services to a customer and provisioning [583:23] services are responsible for setting up [583:24] and managing those ads services. We have [583:27] a lot of services that do provisioning. [583:29] Most of them are just using cloud for [583:30] underneath which we'll mention here. But [583:32] let's get to it. The first is elastic [583:33] beantock. This is a platform as a [583:35] service to easily deploy web apps. EB [583:38] will provision various services [583:39] like EC2, S3, SNS, cloudatch, EC2 [583:42] autoscaling groups, load balancers. uh [583:44] and you can think of it as the Heroku [583:46] equivalent to AWS. Then you have ops [583:49] works. This is a configuration [583:50] management service that also provides [583:52] managed instances of open source [583:54] configuration managed software such as [583:55] chef and public puppet. So you'll say I [583:58] want to have a load balancer or I want [584:00] to have servers and it will provision [584:02] those for you uh indirectly. Then you [584:04] have cloudformation itself. This is an [584:06] infrastructure modeling and provisioning [584:08] service. It automates the provisioning [584:09] of adab services by writing [584:10] cloudformation templates in either JSON [584:12] or YAML. And this is known as IA or [584:14] infrastructures of code. You have quick [584:17] starts. These are pre-made packages that [584:18] can uh be launched and configure your [584:20] AOS compute, network storage and other [584:22] services required to deploy a workload [584:24] on your device. We do cover this in this [584:26] course, but quick starts is basically [584:28] just cloudformation templates that are [584:29] authored by the community or um by um [584:33] Amazon partner network. Okay. Then we [584:35] have AIS marketplace. This is a digital [584:37] catalog for thousands of software [584:38] listings of independent software vendors [584:40] that you can use to find, buy and test [584:41] and deploy software. So the idea is that [584:44] um you know you can go there and [584:45] provision whatever kind of resource you [584:47] want. We have AIS amplify. This is a [584:49] mobile web app framework that will [584:51] provision multiple AOS services as your [584:52] backend. It's specifically for [584:54] serverless services. I don't know why I [584:56] didn't write that in there. Um but you [584:58] know like Dynamob um things like uh [585:01] whatever the GraphQL service is called, [585:03] API gateway, things like that. Uh then [585:06] we have ads apprunner. This is a fully [585:08] managed service that makes it easy for [585:09] developers to quickly deploy [585:11] containerized web apps and APIs at scale [585:13] with no prior information experience [585:15] required. It's basically a platform as a [585:17] service but for containers. We have a [585:20] copilot. This is a command line [585:21] interface that enables customers to [585:23] quickly launch and manage containerized [585:25] applications as it basically is a a CLI [585:29] tool that sets up a bunch of scripts to [585:30] set up pipelines for you. Makes things [585:32] super easy. We have adabus code start. [585:34] This provides a unified user interface [585:36] enabling you to manage your software [585:38] development activities in one place. [585:39] Usually launch common types of stacks [585:41] like LAMP. Then we have CDK and so this [585:44] is infrastructure as a code tool. Allows [585:46] you to use your favorite programming [585:47] language generates out cloudformation [585:48] templates as a means of IA. So there you [585:51] go. [585:56] Hey, this is Andrew Brown from Exam Pro [585:58] and we are taking a look at Adus Elastic [585:59] Beantock. Before we do, let's just [586:01] define what passes. So platform as a [586:03] service allows customers to develop, run [586:05] and manage applications without uh the [586:07] complexity of building and maintaining [586:09] the infrastructure typically associated [586:11] with developing and launching an app. [586:13] And so Elastic Beantock is a pass for [586:16] deploying web apps with little to no uh [586:18] knowledge of the underlying [586:19] infrastructure so you can focus on [586:20] writing application code instead of [586:22] setting up an automated deployment [586:24] pipeline or DevOps tasks. The idea here [586:27] is you choose a platform, upload your [586:29] code and it runs with little uh [586:30] knowledge of the infrastructure and ads [586:33] will say that it's generally not [586:34] recommended for production apps but just [586:35] understand that they are saying this for [586:37] enterprises and large companies. If [586:39] you're a small to medium company, you [586:41] can run elastic beantock for quite a [586:42] long time. It'll work out great. Elastic [586:44] beantock is powered by cloud formation [586:46] templates and it sets up for you elastic [586:49] load balancer ASGs RDS EC2 instances [586:52] preconfigured for particular platforms [586:55] uh monitoring integration with cloudatch [586:57] SNS uh deployment strategies like in [587:00] place blue green uh deployment has [587:02] security built in so it could rotate out [587:04] your passwords for your databases and it [587:06] could run dockerized environments and so [587:08] when we talk about platforms you can see [587:10] we have docker multicontainer docker uh [587:13] Go. Net, Java, Node.js, Ruby, PHP, [587:16] Python, Tomcat, Go, a bunch of stuff. [587:19] And just to kind of give you that [587:20] architectural diagram to show you that [587:22] it it can launch of multiple things. [587:24] Okay. [587:29] Hey, it's Andy Brown from Exam Pro and [587:30] in this follow along, we're going to [587:32] learn all about Elastic Beantock. Maybe [587:34] not everything, but we're going to [587:36] definitely know how to at least um use [587:38] the service. So elastic beantock is a [587:41] platform as a service and what it does [587:42] is it allows you to uh deploy web [587:45] applications very easily. So here I've [587:47] made my way over to elastic beanto an [587:50] environment and app and then we set up [587:51] our application. We have two tiers a web [587:54] server environment a worker environment. [587:56] Worker environment is great for [587:57] longunning workloads performing uh [588:00] background jobs and things like that. [588:01] And then you have your web server which [588:03] is your web server and you can have both [588:05] and it's generally recommended to do so. [588:07] Um but anyway, what we'll do is create a [588:09] new application. So I'll say my app here [588:12] and uh there's some tags we can do and [588:14] then it will name based on the [588:16] environment. Then we need to choose an [588:18] environment name. So I'll say my [588:19] environment and just put a bunch of [588:21] numbers in there. Hit the check [588:22] availability. Scroll on down and we have [588:24] two options. Manage platform, custom [588:26] platform, and I'm not sure why custom is [588:29] blanked out, but it would allow you to [588:32] um it would allow you to I I think use [588:34] your own containers. So I'm a big fan of [588:36] Ruby. So I'm going to drop down to Ruby. [588:38] And here we have a bunch of different [588:40] versions. And so 2.7 is pretty pretty [588:43] new, which is pretty good. And then [588:44] there's the platform version, which is [588:46] fine. And the great thing is it comes [588:47] with a sample application. Now you could [588:49] hit create environment, but you'd be [588:51] missing out on a lot if you don't hit [588:52] this configure more options. I don't [588:54] know why they put it there. It's not a [588:56] very good UI, but um if you click here, [588:58] you actually get to see everything [589:00] possible. And so up here, we have some [589:02] presets where we can have a single [589:03] instance. So this is where it's [589:06] literally running a single EC2 instance. [589:07] So it's very cost effective. You can [589:09] have it with spot uh spot pricing so you [589:11] save money. Um there's high [589:13] availability. So you know if you want it [589:15] set up with a load balancer and [589:16] autoscaling group it will scale very [589:18] well or you can do custom configuration. [589:20] We scroll on down here. [589:23] You can enable Amazon X-ray. You can [589:25] rotate out logs. You can do log [589:27] streaming. Um there's a lot of stuff [589:30] here. And basically it's just like it [589:33] sets up most for you, but you can pretty [589:35] much configure what you want as well. If [589:37] we had the load balancer set, if I go [589:38] here, go to high availability now, we'll [589:41] be able to change our load balancer [589:42] options. You have different ways of [589:44] deploying. So you can go here and then [589:46] change it from all at once, rolling, [589:48] immutable, traffic splitting, depends on [589:50] what your use case is. Um, we can set up [589:54] a key pair to be able to log into the [589:56] machine. [589:58] There's a whole variety of things. You [590:00] can connect your database as well. So it [590:01] can create the database alongside with [590:03] it and then it can actually rotate out [590:05] the key so you don't have to worry about [590:07] it which is really nice. What I'm going [590:08] to do is go to the top here and just [590:10] choose a single instance because I want [590:11] this to be very cost effective. We're [590:13] going to go ahead and hit create [590:14] environment. [590:16] And so we are just going to wait for [590:19] that to start up and I'll see you back [590:20] when it's done. Okay. [590:23] Okay. So it's been uh quite a while here [590:26] and it says a few minutes. So if it does [590:28] do this, what you can do is just give it [590:30] a hard refresh. I have a feeling that [590:31] it's already done. Is it done? Yeah, [590:34] it's already done. So here it says on [590:36] September 2020, Elastic Beat, etc. [590:39] Default default, I don't care. Um, but [590:41] anyway, so this application, I guess [590:43] it's in a pending state. Um, I'm not [590:45] sure why. Let's go take a look here. [590:47] Causes instance has not sent any data [590:50] since launch. Uh, none of the instances [590:52] are sending data. So that's kind of [590:54] interesting because um I shouldn't have [590:57] any problems. You know what I mean? So [590:59] what I'm going to do is just reboot this [591:00] machine and see if that fixes the issue [591:02] there. But usually it's not that [591:04] difficult because it's the sample [591:05] application. It's not up to me um as to [591:08] how to fix this. You know what I mean? [591:10] So I'm not sure. But um what we'll do is [591:15] we will let the machine reboot and see [591:17] if that makes any difference. Okay. All [591:19] right. So after rebooting that machine [591:21] now it looks like the server is healthy. [591:22] So, it's not all that bad, right? If you [591:24] do run into issues, that is something [591:26] that you can do. And so, uh, let's go [591:30] see if this is actually working. So, at [591:31] the top here, we have a link. And so, I [591:33] can just rightclick here. It says, [591:35] "Congratulations. Your first adus [591:36] elastic, uh, Beantock Rubin application [591:38] is now running." So, it's all in good [591:41] shape. Um, there's a lot of stuff that's [591:43] going on here in Elastic Beantock that [591:45] we can do. Uh, we can go back to our [591:46] configuration and change any of our [591:48] options here. So there's a lot of stuff [591:51] as you can see. Uh we get logging. Uh so [591:53] click the request log. So if we click on [591:55] this and say last 100 lines [591:59] we should be able to get uh logging [592:01] data. We have to download it. I wish it [592:03] was kind of in line but here you can [592:04] kind of see what's going on. So we have [592:06] SD access logs error logs puma logs. [592:09] Elastic beantock engine. So you could [592:11] use that to debug. Very common to take [592:14] that over to uh support if you do have [592:16] issues. uh for health, it monitors the [592:18] health of the instances, which is great. [592:21] Then we have some uh monitoring uh data [592:24] here. So it gives you uh like a built [592:26] dashboard. So that's kind of nice. You [592:28] can set up alarms. Um you have not [592:30] defined any alarms. You can add them via [592:32] the monitoring dashboard. So I guess [592:34] you'd have to [592:36] you'd have to somehow add them. Um I [592:38] don't think I've ever added alarms for [592:40] um Elastic Beantock, but it's nice to [592:42] know that they have them. You can set up [592:44] schedules for managed events. Then this [592:46] is event data. So it's just kind of [592:48] telling you, it's kind of like logs and [592:50] it just tells you of things that have [592:51] changed. So there's stuff like that. [592:54] What I'm looking for is to see how I can [592:56] download the existing application [593:00] because there's a version uploaded here. [593:02] Oh, the source is over here. Okay. So [593:06] I think it's probably over here, the one [593:08] that's running. Is that it? [593:13] If it was easy to find, what I probably [593:14] would do is just modify it and Oh, yeah. [593:16] It's over here. So, if we go here and [593:18] download the zip, [593:22] I wonder if it'd be even worth um [593:24] playing with this. So, let's I'm just [593:26] going to see if we can go over to Cloud9 [593:29] and give this a go quickly. [593:32] So, if we go over and launch a Cloud9 [593:34] environment, maybe we can tweak it and [593:35] upload a revised version. So, we'll go [593:38] say create new. We'll say EB um [593:43] uh environment for elastic beantock. [593:46] We'll set it all the defaults. That's [593:47] all fine. It's all within the free tier. [593:49] We'll create that environment. What I'm [593:51] going to do is just take this uh Ruby [593:53] zip file and move it to my desktop. And [593:56] as that is loading, we'll give it a [593:57] moment here. I'm just going to go back [593:59] and I was just curious, does it let you [594:01] download it directly from here? No. So [594:04] the only thing is that you know if you [594:05] download that application Alaskan [594:08] Beantock usually has a configuration [594:09] file with it and so I don't know if they [594:11] would have given that to us but if they [594:14] did that would be really great but we [594:17] just have to wait for that to uh launch [594:19] there as well. I guess you can save [594:21] configurations and roll back on those as [594:23] well. [594:27] Um but we will just wait a moment here [594:30] while it's going. I might just peek [594:32] inside of this file to see what it is [594:34] this zip contains. [594:37] Just going to go to my desktop here. [594:38] Open up that zip. [594:41] So, it looks pretty simple. It doesn't [594:43] even look like a Rails app. It looks [594:44] like maybe it's a Sinatra app. I thought [594:46] before that it would it would have [594:47] deployed a Ruby on Rails application, [594:49] but maybe they keep it really simple. [594:51] Um, [594:53] I don't see usually it's like YAML files [594:56] they use for configuration. I don't see [594:58] that there. [595:00] So it might be that the default settings [595:03] will work fine. Uh there's a config.ru [595:06] and stuff like that. But once Cloud9 is [595:08] up here, we will upload this and see [595:10] what we can do with it. Okay, so there [595:12] we go. Uh Cloud9 is ready to go. And so [595:14] if we right click here, whoops. Right [595:16] click here, we should be up be able to [595:18] upload a file. If not, we can go up here [595:20] to the top [595:22] or it's here or there. [595:25] Where is the upload? I' I've uploaded [595:27] things in here, so I absolutely know we [595:28] can. I just got to find it. [595:34] Is that the upload? [595:39] Upload files. Cloud9. [595:49] Oh boy, that's not helpful. That's not [595:51] helpful at all. So, let me just click [595:54] around a little bit here. I mean, worst [595:55] case, I can always just bring it in via [595:57] a curl. Oh, upload local files. There it [595:59] is. I was just not um being patient. [596:02] Okay, so we'll drag that on in there and [596:05] we will [596:07] Did it upload? Yep, it's right there. [596:08] Okay, great. And so we need to unzip it. [596:10] So what I'll do is just drag this on up [596:12] here. I'll do an ls and we'll say unzip [596:16] ruby.zip. [596:17] And so that unzipped the contents there. [596:20] I think the readme was part of cloud9. [596:23] So I'm going to go ahead and delete that [596:24] out. Not that it's going to hurt [596:26] anything. And so now what we can do, [596:29] we'll delete the original [596:31] original zip there. [596:34] Um, and let's see if we can make a [596:36] change here. So I'm just going to open [596:38] up, see what it is. So it's yeah, it's [596:39] running Sinatra. So that's pretty clear [596:41] there. We have a proc file to say how it [596:43] runs. We have a worker sample, so that [596:46] just tells how the requests go. You [596:48] don't need to know any of this. I'm just [596:49] kind of clicking through it because I [596:50] know Ruby very well. We have a cron YAML [596:53] file, so that could be something that [596:54] gets loaded in here. So I think [596:56] basically a Sinatra app probably just [596:58] works off the bat here. But if we want [597:01] to make a change, we probably just make [597:02] a change over to here. So I'll go down [597:05] here and this is your [597:07] second AWS elastic bean sock [597:10] application. So the next thing we need [597:11] to do is actually zip the contents here. [597:14] I don't know if it would let us zip it [597:16] within here, but I'll have to look like [597:18] zip the contents of a directory [597:22] Linux. just goes to show [597:26] Google is everything. [597:28] So, the easiest way to zip a folder [597:33] um [597:39] zip everything in the current directory [597:45] Linux. [597:51] Okay, that's easy. So we'll go back over [597:53] here and we will type in zip [597:58] and it wants hyphen r for recursive [598:00] which makes sense and then the name of [598:03] the zip. So um [598:06] uh ruby2.zip [598:09] and we'll do period [598:14] zip warning found is who is zip? [598:21] Oh. Uh, yum install zip. Maybe we have [598:26] to install uh zip, but maybe it's not [598:27] installed. [598:29] Pseudo yum install zip [598:32] since it's Amazon too. It uses yum. [598:36] And so package already installed. So I'm [598:38] going to type zip again. So zip is there [598:39] now. Great. Oops. Don't need to install [598:41] twice. [598:46] Zip warning. Ruby 2zip not found or [598:49] empty. [598:57] Okay. So, install zip and use zip hyphen [599:00] R. You can use the flag to best [599:04] compensate. [599:07] So, if that's not working, what I'm [599:08] going to do is just go up a directory. [599:15] Why is it saying not found or empty? [599:33] Maybe I need to use [599:39] Okay, so I think the problem was is I [599:41] was using the wrong flag. So I put F [599:43] instead of R. I don't know why I did [599:45] that. So I probably should have done [599:46] this. Okay. And so that should have [599:48] copied all the contents of that file. So [599:50] what I'm going to do is go ahead. [599:51] Whoops. Make sure I have that selected [599:53] and download that file. And once I have [599:56] downloaded that file, I'm going to just [599:58] open the contents to make sure it is [600:00] what I expect it to be. So we're going [600:02] to open that up. And whoops, get out of [600:05] here. Winar. And it looks like [600:07] everything I want. So what I'm going to [600:09] do is go back over to here. I'm going to [600:12] make sure I have my Ruby 2 on my [600:14] desktop. and we're going to see if we [600:16] can upload another version here. So, [600:18] upload and deploy. Choose the file. [600:20] We're going to go all the way to my [600:21] desktop here and we're going to choose [600:23] Ruby 2 and um like Ruby 2 will be the [600:28] version name or we'll just say two and [600:30] we'll deploy and we'll see if that [600:31] works. Okay, but there are like elastic [600:35] beans configuration files like YAML [600:36] files that can sit in the root directory [600:38] and so generally you're used to seeing [600:40] them there. But you know, I imagine that [600:42] Adus probably engineered these examples [600:43] so that it uses all the default [600:45] settings. But uh once this is deployed, [600:47] I'll see you back here in a moment. [600:49] Okay, after a short little wait, it [600:51] looks like it has deployed. So what I'm [600:52] going to do is just close my other tabs [600:54] here and open this up and see if it's [600:56] worked. It says your second ads elastic [600:59] being stock ruby application. So uh we [601:01] were successful, uh deploying that out, [601:04] which is really great. So what we can do [601:05] now is just close that tab there. And uh [601:08] since we have that cloud9 environment, [601:09] it will shut down on its own. But you [601:12] know, just for your benefit, I think [601:14] that we should shut it off right now. So [601:16] go ahead and delete that. I'm going to [601:18] go back over to Elastic Beantock here. [601:20] And I just want to destroy all of it. So [601:23] we'll see if we can just do that from [601:24] here. Terminate the application. [601:28] Enter the name. So I think we probably [601:30] have to enter that in there. [601:33] And so I think that Oh, a problem [601:36] occurred. Rate [601:37] exceeded [601:40] what? [601:41] That's AWS for you. So, it's not a big [601:43] deal. I would just go and check it [601:45] again. [601:46] And maybe what we'll do is just delete [601:48] the application first. [601:54] Okay. So, that one is possibly deleting. [602:01] Let's go in here. Is anything changing? [602:06] Can't even tell. We'll go ahead. Oh, [602:09] can't take that one out. [602:22] Delete application. Again, [602:25] if it takes you a couple times, it's not [602:27] a big deal. [602:29] It's AWS for you, so there's a lot of [602:32] moving parts. So it looks like it is [602:34] terminating the instance and so we just [602:36] have to wait for that to complete. Uh [602:38] once that is done, we might have to just [602:40] tear down the environment. So I'll see [602:41] you back here when it has finished [602:43] tearing this down. Okay. All right. And [602:44] so after a short little wait here, I [602:46] think it's been destroyed. We'll just [602:47] double check by going to the [602:48] applications, going to the environments. [602:50] Yeah, and it's all gone. Probably [602:52] because I initially deleted that [602:53] environment and then took the [602:54] application with it. So I probably [602:55] didn't have to delete the app [602:56] separately. Um but uh yeah, so there you [602:59] go. Just make sure your Cloud 9 [603:01] environment is gone and you are a-ok. [603:02] Okay. There'll probably be some like [603:04] lingering S3 buckets. So, if you do want [603:06] to get rid of those, you can. It's not [603:07] going to hurt anything having those [603:08] around. Uh, but they do tend to stack up [603:11] after a while, which is kind of [603:13] annoying. So, if you don't like them, [603:14] you can just empty them out as I am [603:17] doing here. Whoops. Oh, just permanently [603:20] delete. [603:23] Copy that text there. [603:26] We can go back. [603:30] to here and then just go take out that [603:32] bucket. Let's delete that there. [603:39] Oh, and if you get this, this is kind of [603:41] annoying, but uh Elastic Beantock likes [603:43] to put in an IM permission or policy in [603:45] here. So, if you go down here, there's a [603:47] bucket policy. You just have to delete [603:48] it out. It prevents it from being [603:50] deleted. [603:52] And we'll go back over here and then we [603:55] will delete it. [603:58] Okay. And yeah, there we go. That's it. [604:06] So, let's take a look at serverless [604:08] services on AWS. And this is not [604:10] including all of them because we're [604:12] looking at the most purely serverless [604:14] services. Uh if we tried to include all [604:16] the serverless services, it would just [604:18] be too long of a list. Uh but let's take [604:20] a look here. So, um before we do, let's [604:22] just redefine what is serverless. So [604:24] when the underlying servers, [604:25] infrastructure and operating system is [604:26] taken care of by the CSP, serverless is [604:29] generally by default highly available, [604:31] scalable, cost-ffective. You pay for [604:32] what you use. The first one is Dynamob, [604:35] which is a serverless NoSQL key value [604:37] and document database. It's designed to [604:39] scale to billions of records. We [604:41] guarantee consistent data returned in at [604:43] least a second. You do not have to worry [604:45] about managing shards. You have simple [604:47] storage service S3, which is a [604:49] serverless object storage service. You [604:51] can upload very large and unlimited [604:53] amounts of files. You can pay for what [604:55] you store. You don't worry about the [604:56] underlying file system or upgrading the [604:58] disk size. We have ECS Fargate which is [605:00] a serverless orchestration container [605:02] service. Is the same as ECS except you [605:05] pay on demand per running container. [605:07] With ECS you have to keep a EC2 server [605:10] running even if you have no containers [605:12] running where Adabus manages the [605:14] underlying server. So you don't have to [605:16] scale or upgrade the EC2 server. We have [605:19] Adabus Lambda which is a serverless [605:21] function service. You can run code [605:23] without provisioning or managing [605:24] servers. You upload a small piece of [605:26] code. Choose uh how much memory you [605:28] want, how long you want the function is [605:30] allowed to run before timing out. You're [605:32] charged based on the runtime of the [605:34] service function rounded to the nearest [605:36] 100 milliseconds. We have step [605:38] functions. This is the state machine [605:40] service. It coordinates multiple [605:42] services into serverless workflows. [605:45] Easily share data among lambdas. have a [605:48] group of lambdas wait for each other [605:50] create logical steps also work with [605:52] Fargate tasks we have Aurora serverless [605:54] this is a serverless on demand version [605:56] of Aurora so when you want most of the [605:58] benefits of Aurora but uh trade you have [606:00] to trade off those cold starts or you [606:02] don't have lots of traffic or demand so [606:04] things serless services that we could [606:06] have put in here as well is like API [606:08] gateway apps sync ads amplify um and [606:12] those are like the the first two were [606:14] application integrations you could say [606:16] SQS [606:17] SNS those are all serverless services [606:19] but you know again we'd be here all day [606:21] if I I n I listed them all right [606:28] let's take a look at what is serverless [606:30] and we did look at it from a server [606:32] perspective earlier in the course but [606:34] let's just try to abstractly define it [606:36] and talk about the architecture so [606:38] serverless architecture generally [606:39] describes fully managed cloud services [606:42] and the classification of a cloud [606:44] service being serverless is not a [606:46] boolean main answer. It's it's not a yes [606:48] or a no, but an answer on a scale where [606:50] a cloud service has a degree of [606:52] serverless. And I do have to point out [606:54] that this definition might not be [606:56] accepted by um everybody because [606:59] serverless is one of those uh terms [607:02] where um we've had a bunch of different [607:04] cloud service providers define it [607:06] differently. And then we have thought [607:07] leaders that have a particular concept [607:10] of what it is. So, you know, I just do [607:12] my best to try to make this practical [607:13] here for you. But a serverless service [607:16] could have all or most of the following [607:18] characteristics. And so it could be [607:20] highly elastic and scalable, highly [607:22] available, highly durable, secure by [607:25] default. It abstracts away the [607:26] underlying infrastructure and our build [607:28] based on the execution of your business [607:31] tasks. A lot of times that uh that cost [607:34] is not uh is not always represented as [607:37] something that is like I'm paying X for [607:39] compute. it could be abstracted out into [607:42] some kind of um credit that uh doesn't [607:45] necessarily map to something physical. [607:47] Then we have serverless can scale to [607:49] zero, meaning when it's not in use, the [607:51] serverless resources cost nothing. Uh [607:54] and these two last topics basically pull [607:56] into pay for value. So you don't pay for [607:59] idle servers. You're paying for the [608:01] value uh that your service provides. [608:05] And uh my friend Daniel who runs the [608:07] serless Toronto group, he likes to [608:09] describe serless as being similar to [608:11] like energy efficient rating. So an [608:13] analogy of serless could be similar to [608:15] energy rating labels which allows [608:16] consumers to compare the energy [608:18] efficiency of a product. So some [608:20] services are more serless than others. [608:23] And again, you know, some people might [608:24] not agree with that where there's a a [608:26] definitive yes or no answer, but I think [608:29] that's the best way to look at it. Okay. [608:35] Hey, it's Andy Brown from Exam Pro and [608:37] we're taking a look at Windows on [608:38] Adabus. So, Adabus has multiple cloud [608:40] services and tools to make it easy for [608:42] you to run Window workloads on Adabus. [608:44] So, let's get to it. So, the first is [608:46] Windows Servers on EC2. So, you can [608:48] select from a number of Windows Server [608:50] versions including the latest version uh [608:52] like Windows Server 2019. Uh for uh [608:55] databases, we have SQL Server on RDS. [608:57] You can select from a number of SQL [608:59] Server database versions. Then we have [609:01] adabus directory service which lets you [609:03] run Microsoft active directory ad as a [609:06] managed service. We have adabus license [609:08] manager which makes it easier to manage [609:10] your software licenses from software [609:12] vendors such as Microsoft. We have [609:14] Amazon FSX for Windows file server which [609:17] is a fully managed scalable storage [609:19] built for Windows. We have the Adabus [609:22] SDK which allows you to write code in [609:23] your favorite language to interact with [609:25] Adabus API but it specifically has [609:27] support fornet a language favorite for [609:29] Windows developers. We have Amazon [609:32] Workspaces. So this allows you to run a [609:34] virtual desktop. You can launch a [609:35] Windows 10 desktop to provide secure and [609:38] durable workstations that is accessible [609:40] from wherever you have an internet [609:42] connection. Lambda supports [609:44] PowerShell as a programming language to [609:45] write your serverless functions. And we [609:48] have ads migration acceleration program. [609:50] MAP for Windows is a migration [609:53] methodology for moving large [609:55] enterprises. ADS has Amazon partners [609:57] that specialize in providing [609:59] professional services for map. This is [610:01] not just everything for Windows on AWS. [610:04] Like if you want to move your SQL server [610:06] over to RDS Postgress, I believe they've [610:10] like they created an adapter to do that. [610:13] Um but yeah, hopefully that gives you an [610:14] idea what you can do with Windows on [610:16] AWS. Okay. [610:21] Hey, this is Andrew Brown from Exam Pro [610:23] and I want to show you how you can [610:24] launch a Windows uh server on AWS. So, [610:27] what you're going to do is go to the top [610:28] here and we are going to type in EC2. [610:31] And from here, uh what we'll do is we'll [610:34] go ahead and launch ourselves a new EC2 [610:37] instance. [610:38] And we are going to have um a selection [610:41] of instances that we can launch. And so [610:43] we're looking for the Microsoft Windows [610:46] uh server. And this is interesting. [610:48] There's actually a free tier eligible. [610:51] That is crazy because if you go over to [610:53] Azure, they don't have a free tier [610:55] Windows server in AWS does. So that's [610:58] pretty crazy. Um and it runs on a T2 [611:01] Micro. No, that can't be right. There's [611:04] no way it could run in T2 Micro. That [611:06] seems like that's too small. Let's try [611:08] it. Okay. Okay. I just don't believe it [611:10] because when you use Azure, you have to [611:12] choose a particular size of instance by [611:14] default and it's a lot more expensive [611:16] and there is no free tier. So, we'll go [611:18] here. There are free tiers just not [611:21] really for Windows in particular. So, [611:23] we'll go here. This looks good. Security [611:25] groups. This opens up RDP. So, we can [611:27] get into that machine. We're going to go [611:28] next here and launch this machine. [611:33] Says if you plan to use AMI, the [611:35] benefits the Microsoft license mobility, [611:37] check out this form. That's not [611:39] something we're worried about today. And [611:42] I mean, I guess we can create a key [611:44] pair. I'm not sure what we would use a [611:46] key pair for here. Um, for Windows AMIs, [611:49] the private key file is required to [611:51] obtain the password used to log into the [611:53] instance. Okay, so I guess we're going [611:54] to need it. So, [611:56] Windows key. [612:00] Great. We'll launch that instance [612:02] and uh I'll see you back here when it [612:05] launches. But I just don't believe that [612:06] it would launch that fast, you know. All [612:08] right. So, after a short little wait [612:10] here, the server is ready. And so, let's [612:13] see if we can actually go ahead and [612:14] connect to this. So, I'm going to hit [612:15] connect here and we're going to go over [612:17] to RDB client. So, you connect to your [612:19] Windows instance using a remote desktop [612:21] client of your choice and downloading [612:22] and running the RDB shortcut below. So, [612:25] I'm going to go ahead and download this. [612:27] And you're going to have to be on a um [612:31] Windows machine to be able to do this or [612:33] have an RDB client installed. I think [612:34] there's one for Mac that you can get [612:36] from the Apple Store. Um, but all I'm [612:38] going to do is just double click the [612:40] file. So, [612:42] you probably can't see it here. I'm just [612:44] going to expand this. Try to Oh, my [612:48] computer is being silly, but anyway, [612:49] there we go. We moved it over there. And [612:50] I'm just going to drag over here and [612:52] just double click this image so you can [612:54] see that I'm doing it. I'm saying [612:56] connect. [612:57] Okay. [612:59] And then it's going to ask for a [613:00] password. So, I'm going to hope that I [613:02] can just click that and get the [613:03] password. So to decrypt the password, [613:06] you will need your key pair instance. [613:08] You'll have to upload that. And I don't [613:10] know if I remember having to do that [613:11] before, but it's a great security [613:13] measure. So I'm fine with it. I'm going [613:15] to drag my key to my desktop so I can [613:17] see what's going on there as well. [613:20] And we're going to go grab that and [613:21] decrypt the password. And so now, [613:26] um, where's our password? Oh, it's right [613:29] here. Okay. So we're going to grab that [613:30] password. there. [613:33] We will paste that in. Said okay. [613:37] Say yes and see if we can connect to [613:40] this instance. And if this is running on [613:41] a T2 micro, I'm going to lose it because [613:44] that is just cheap. [613:50] It just just doesn't seem possible to me [613:52] because again on Azure you have to [613:54] launch an instance with a lot of stuff [613:56] and it just uh seems uh crazy. What's [613:59] also interesting is that Adabus uh on [614:01] Windows like launches so fast. It's [614:04] unbelievable how fast these servers uh [614:06] spin up and it's just very unusual. But [614:08] yeah, so we are in here. Um [614:13] it's not asking me to activate or [614:15] anything. So I guess there's already a [614:17] Windows license here. [614:20] And um I'm not sure if there's any kind [614:22] of like games installed. Like do we have [614:25] Mind Sweeper? Can I play Mind Sweeper on [614:27] here? [614:30] It's a data center server, so I'm [614:31] assuming not. Um, but yeah, so this is a [614:34] Windows server and it's pretty [614:35] impressive that this works. I'm not sure [614:37] if this is going to have an outbound [614:38] connection here. Um, just because we [614:40] probably would have to configure it. [614:41] Just say okay. I just I really don't [614:44] think it's going to go out to the [614:45] internet by default. [614:50] Yeah. ly you'd probably have to [614:53] do some stuff, you know. [614:58] Oh, no. There we go. So, yeah, we got to [615:00] the internet. So, it's totally possible. [615:02] But, uh, yeah, that's about it. That's [615:04] all I really wanted to show you. So, [615:05] what I'm going to do is just go back to [615:07] EC2 and we're going to shut down the [615:09] server here. Just expand that there. [615:14] And we will go here and we will [615:17] terminate that instance. [615:21] Good. We'll give that a refresh. That's [615:22] shutting down and we are done. [615:29] Hey, this is Andrew Brown from Exam Pro [615:31] and we are taking a look at AIS license [615:33] manager. And before we do, let's talk [615:35] about what by YOL or bring your own [615:38] license means. So, this is the process [615:39] of reusing an existing software license [615:42] to run vendor software on a cloud [615:43] vendor's computing service. B YOL allows [615:46] companies to save money since they may [615:48] have purchased the license in bulk or [615:50] the time that provided a greater [615:51] discount than if purchased again. And so [615:54] an example of this could be the license [615:55] mobility provided by Microsoft's volume [615:57] licensing to customers with eligible [616:00] server applications covered by the [616:01] Microsoft software assurance program. Uh [616:04] and I don't know what I was trying to do [616:05] there. I guess maybe it's just SA and I [616:06] missed the parenthesis there on the end. [616:08] No big big deal. Um but license [616:11] manager is a service that makes it [616:12] easier for you to manage your software [616:14] licenses from software vendors centrally [616:16] across ads in your on- premise [616:18] environments. license manager [616:20] software uh that is licensed based on [616:22] virtual cores uh physical cores sockets [616:25] or a number of machines. This includes a [616:27] variety of software products for [616:29] Microsoft, IBM, SAP, Oracle and other [616:31] vendors. So that's the idea. You say [616:33] what is my license type? It's it's bound [616:35] to this amount of CPUs. Database license [616:38] manager works with EC2 with dedicated [616:40] instances, dedicated host, and even spot [616:43] instances. And for RDS, there's only for [616:45] Oracle databases. So, you can import [616:47] that license for your Oracle server. Um, [616:50] just understand that um if you're doing [616:53] Microsoft Windows Servers or Microsoft [616:54] SQL Server license, you're generally [616:56] going to need a dedicated host because [616:58] of the assurance program. Uh, and this [617:01] can really show up on your exam. So even [617:03] though a license manager works on [617:04] dedicated instances and spot instances [617:07] just try to gravitate towards dedicated [617:10] hosts on the server or on the exam. [617:12] Okay. [617:17] All right. Let's take a look at the [617:18] logging services that we have available [617:20] in AWS. So the first one here is cloud [617:22] trail and this logs all API calls [617:25] whether it's SDK or the CLI. So if it's [617:27] making a call to the API, it's going to [617:29] get tracked between adabus services. And [617:31] this is really useful to say who can we [617:33] blame? Who was the person that did this? [617:35] So who created this bucket? Who spun up [617:37] that expensive EC2 instance? Who [617:39] launched the SageMaker notebook? Um and [617:41] the idea here is you can detect [617:42] developer misconfigurations, detect [617:44] malicious actors or automate responses [617:47] through the system. Then you have [617:48] cloudatch which is a collection of [617:50] multiple services. I commonly say this [617:51] is like an umbrella service because it [617:53] has so many things underneath it. So we [617:55] have cloudatch logs which is a [617:56] centralized place to store your cloud [617:58] services log data and application logs. [618:00] Metrics which represents a timeordered [618:02] set of data points a variable uh to [618:05] monitor. Uh event bridge or previously [618:07] known as cloudatch events triggers an [618:09] event based on a condition. So every [618:11] hour take a snapshot of the server [618:13] alarms triggers notifications based on [618:15] metrics. Dashboards creates [618:17] visualizations based on metrics. And [618:18] that's not all of the things that are [618:20] under cloudatch but those are the core [618:22] five ones you should always know. Um, [618:24] absolutely there. Then we have Adabus [618:26] X-ray. This is for distributed tracing [618:28] system. So you can use it to pinpoint [618:30] issues within your microservices. So you [618:32] see how data moves from one app to [618:34] another, how long it took to move and if [618:36] it failed uh to move forward. Okay, [618:42] let's take a closer look here at Abis [618:44] Cloud Trail because it's a very [618:45] important service. So it's a service [618:47] that enables governance, compliance, [618:49] operational auditing, and risk auditing [618:51] of your ABS account. And the idea is [618:52] that every time you make an API call, [618:54] it's going to show up as some kind of [618:55] structured data that you can uh interact [618:58] with or read through. So cloud trail is [619:00] used to monitor API calls and actions [619:02] made on the account. Easily identify [619:04] which users and accounts made the call [619:06] to AWS. So you might have the where, so [619:08] the source IP address, the when, the [619:10] event time, the who, the user agent, uh, [619:13] and the what, the region, resource, and [619:15] action. So I'm just going to get my pen [619:16] tool out here for a moment and just [619:18] notice you have the event time. So when [619:20] it happened, the source, the name, the [619:22] region, the source IP address, the user [619:24] agent, uh who was doing it. So here was [619:26] Leforge, the response element. So you [619:28] know it's very clear what is going on [619:30] here. Um and then you know cloud trail [619:33] is already logging by default and will [619:34] collect logs for the uh for the last 90 [619:36] days via event history. If you need more [619:38] than 90 days, you need to create a trail [619:40] which is very common. You'll go into AWS [619:42] and make one right away. Trails are [619:44] outputed to S3 and do not have guey like [619:46] event history. To analyze a trail, you [619:48] have to use Amazon Athena. And I'm sure [619:50] there are other ways to analyze it [619:52] within AWS, but here's just what the [619:54] event history looks like. So, right off [619:56] the bat, you can already see that there [619:58] are information there. I'm not sure if [619:59] they've updated the UI there. They might [620:01] have uh as even when I'm recording this, [620:03] I kind of feel like if we go into the [620:05] follow along, which we will, um I bet [620:07] they might have updated that. But the [620:08] idea here is that, you know, you can [620:10] browse the last 90 days, but anything [620:12] outside of that, you're going to have to [620:13] do a little bit of work yourself. Okay. [620:19] So, we're not going to cover all the [620:20] Cloudatch services. There's just too [620:22] many. But let's look at the most [620:23] important ones. And one of that those [620:25] important ones is Cloudatch alarms. So, [620:27] Cloudatch alarms monitors a Cloudatch [620:29] metric based on a defined threshold. Uh [620:31] so, here you can see there's kind of a [620:32] condition being set there. So, if the [620:34] networking is greater than 300 for one [620:36] data point within 5 minutes, it's going [620:38] to breach an alarm. So, uh that's when [620:40] it goes outside its defined threshold. [620:42] And so the state's going to either be [620:43] something like okay so the metric or [620:45] expression is within the defined [620:46] threshold so do nothing alarm the metric [620:49] or expression is outside of the defined [620:50] threshold so do something or [620:52] insufficient data the alarm has just [620:54] started the metric is not available not [620:56] enough data is available and so when the [620:58] state has changed you can define actions [621:00] that it should take and so that could be [621:02] doing a notification autoscaling group [621:04] or any C2 action um so cloudwatch alarms [621:07] are really useful for a variety of [621:09] reasons the one that we will come across [621:10] right away will be setting up building [621:12] alarm. [621:17] So let's take a look here at the [621:18] autonomy of an alarm. And so I have this [621:20] nice graphic here to kind of explain [621:22] that there. And so the first thing is we [621:24] have our threshold condition. Uh and so [621:26] here you can just set a value and say [621:28] okay the value is a thousand or 100 [621:30] whatever you want it to be. And this is [621:32] going to be for a particular metric the [621:34] actual data we are measuring. So maybe [621:36] in this case we're measuring network in [621:38] so the volume of incoming network [621:39] traffic measured in bytes. So when using [621:41] five minute monitoring divide by 300 we [621:43] get bytes per second if you're trying to [621:45] figure out that calculation there. You [621:46] have data points. So these represent the [621:48] metrics measurement at a given point. [621:50] Then you have the period how often it [621:52] checks to evaluate the alarm. So we [621:54] could say every five minutes. Uh you [621:56] have the evaluation period. So the [621:57] number of previous periods and the data [622:00] points to alarm. So you can say one data [622:02] point is breached in evaluation period [622:04] going back four periods. So this is what [622:06] triggers the alarm. Uh the thing I just [622:09] want you to know is that you can set a [622:10] value right and that it's based on a [622:12] particular metric and there is a bit of [622:13] logic here in terms of uh the alarm. So [622:16] it's not as simple as just it's breached [622:18] but there's this period thing happening. [622:20] Okay [622:25] let's take a look at cloudatch logs. So [622:27] to understand that we have log streams [622:29] and log groups. So a log stream is uh a [622:32] stream that represents a sequence of [622:33] events from an application or instance [622:35] being monitored. So imagine you have an [622:37] EC2 instance running a web application [622:39] and you want those logs to be streamed [622:41] to cloudatch logs. That's what we're [622:43] talking about here. So you can create [622:44] log streams manually. Uh but generally [622:46] this is automatically done by the [622:47] service you are using. Uh unless you [622:49] were collecting application logs on an [622:51] EC2 instance as I just described here is [622:53] a log group of a lambda function. You [622:55] can see the log streams are named after [622:57] the running instance. Lambda's uh [622:58] frequency run on new instances. So the [623:00] stream contains timestamps. So what I'm [623:03] trying to say here is that there's a [623:04] variety of different services. Lambda, [623:06] RDS, what have you. And they already [623:09] send their logs to Cloudatch logs and [623:11] they're and they're going to vary. Okay, [623:12] so here's a log group of an application [623:14] log running on EC2. You can see here the [623:16] log streams are named after the running [623:18] instance ID. Here is the log group for [623:20] Adabus Glue. You can see that the log [623:22] streams are named after the glue jobs. [623:24] Um, and so you know we have the streams, [623:26] but let's talk about the actual data [623:27] that's made up of it. The log events. So [623:29] this represents a single event in a log [623:31] file. Log events can be seen within the [623:34] log stream. And so here's an example of [623:36] you would open this up in Cloudatch [623:38] logs. And you can actually see what what [623:40] was being reported back by your server. [623:42] It can filter these events to filter out [623:44] uh logs based on simple or pattern [623:46] matching uh syntax. So here I'm just [623:48] typing in saying give me all those debug [623:50] stuff. And you know this isn't very [623:51] robust, but Adabus does have a better [623:53] way of analyzing your logs which is log [623:55] insights which we'll look at here in a [623:56] moment. [624:01] So, you were just looking at uh [624:02] Cloudatch log events and how those are [624:04] collected. But there's an easier way to [624:06] analyze them and that's with log [624:07] insights. So, you can interactively [624:09] search and analyze your Cloudatch log [624:10] data and it has the following [624:12] advantages. More robust filtering than [624:14] using the simple filter in the in a log [624:15] stream. Less burdensome than having to [624:18] export logs to S3 and analyze them via [624:20] Athena. Cloudatch log insight supports [624:22] all types of logs. So Cloudatch log [624:24] insights is commonly used via the [624:26] console to do ad hoc queries against log [624:28] groups. So that's just kind of an [624:30] example of someone writing a query and [624:33] cloudatch log insights uses a query [624:35] syntax. So a single request can query up [624:38] to 20 logs. Query timeout after 50 [624:40] minutes if not completed and queries [624:43] result are available for 7 days. So as [624:46] provides sample queries that you can get [624:48] started for common tasks and uh and ease [624:50] the learning into the query syntax. A [624:52] good example is filtering VPC flow logs. [624:54] So you go there, you click it, and you [624:56] start to getting some data. You can [624:57] create and save your own queries uh to [624:59] make future repetitive tasks easier on [625:01] the certified cloud partitioner. They're [625:03] not going to ask you all these details [625:04] about this stuff, but I just [625:05] conceptually want you to understand that [625:07] in log insights, you can use it to uh [625:10] robustly filter your logs based on this [625:12] query syntax language. You get this kind [625:14] of visual and it's really really useful. [625:19] Let's take a look here at cloudatch [625:21] metrics which represents a timeordered [625:23] set of data points. It's a variable that [625:24] is monitored over time. So cloudatch [625:26] comes with many predefined metrics that [625:28] are generally named spaced by adabus [625:29] services. Uh so the idea is that like if [625:32] we were to look at the EC2 it has these [625:34] particular metrices so that we have CPU [625:36] utilization disc read ops disc write ops [625:40] disc read bytes disc write bytes network [625:42] in network out network packet in uh [625:45] network packets out. And the idea is [625:47] that you can just like click there into [625:49] EC2 and then kind of get that data [625:51] there. And so cloud metrics are [625:53] leveraged by other things like cloudatch [625:55] events, cloudatch alarms, cloudatch [625:57] dashboards. So just understand that. [625:59] Okay. [626:04] All right. So what I want to do in this [626:05] follow along is show you a bit about [626:07] cloud trail. So we're going to go to the [626:09] top here and type in cloud trail. The [626:11] great thing about cloud trail is it's [626:12] already turned on by default. So, it's [626:14] already kind of collecting some [626:16] information. And so, it's here it says [626:18] now use IM access analyzer on cloud [626:20] trails. That sounds pretty cool to me, [626:22] but uh we shouldn't have to create a [626:24] trail right off the bat because we'll [626:25] have some event history. And the event [626:27] history allows us to see things that are [626:29] happening within our account in the last [626:31] 90 days. Um but the thing is if you want [626:33] something beyond 90 days, you're going [626:35] to have to create a trail. Uh but if we [626:37] just take a look here, we can kind of [626:38] see as we've been doing a lot of things [626:40] all the kind of actions that's been [626:41] happening. So, here we have an instance [626:43] that I terminated. So if I go in here [626:45] and and look at it, I can kind of see uh [626:48] more information about it. So we can see [626:50] when it terminated, who had done that, [626:53] what access key they had used, the event [626:55] source, the request ID, [626:58] um the source IP, what whether it was [627:00] readonly, what was the event type that [627:02] was called, the resource there, and this [627:04] is the actual raw record. So this is [627:06] generally how I would look at it, or [627:08] this is how you had to look at it back [627:09] in the day. Um but the idea is that you [627:11] would have that uh user identity [627:13] described the event time, the source, [627:15] the event name, the region, the source [627:16] IP, the uh the agent, all the [627:19] information there. Okay. And so this is [627:21] a great way to kind of find stuff. So [627:23] you can go through here and try to debug [627:25] things this way. So you can go to the [627:27] event name. And so if you if you go [627:29] here, you can kind of get uh see a bit [627:32] of stuff here. So if I was just trying [627:34] to say like maybe create I'm just trying [627:36] to find something that I know that I've [627:37] been doing like create access keys. I [627:39] can see the access keys that have been [627:41] going be created within this uh sandbox [627:43] account here for the user and things [627:45] like that. So, it's a great way to kind [627:47] of find things, but generally you're [627:49] going to always want to turn on uh or [627:51] create your own trail. So, if you go [627:53] here and hit create trail, say my new [627:55] trail and um you're going to need an S3 [627:58] bucket for that. You'll probably want [627:59] encryption turned on, which sounds good [628:02] to me. You'll absolutely want log file [628:04] validation. And generally you don't want [628:06] to store your your cloud trail logs [628:08] within the existing account. You want to [628:10] have a isolated hardened account that's [628:13] that is uh infrequently accessed or only [628:17] by your your cloud security engineers um [628:19] away from here because you don't want [628:21] people tampering with it, deleting it or [628:22] changing stuff. But um let's take an [628:25] existing one here. I don't want a [628:28] customer managed. Don't I have one that [628:30] is managed by AWS here? new custom. [628:35] Um, we'll just choose that one. I don't [628:37] know which one that is. We'll just hit [628:38] next. Usually, Adabus gives you a [628:40] managed key there. So, I was kind of [628:41] surprised. Um, you can also include [628:44] additional data. So, if you do data [628:45] events, this would collect information [628:46] from S3. Um, but the thing is you might [628:49] not want to track everything because if [628:51] you track everything, it can get very [628:52] expensive very quickly. Uh, but if you [628:54] don't, you just leave on management [628:56] events. It'll save you more money. [628:57] There's inside events. Uh, this is new. [628:59] I haven't seen this yet. So identify [629:01] unusual activity errors, users of [629:03] behavior. That sounds really good, but [629:05] these could come also add additional [629:07] charges, but I'm going to hit next [629:08] anyway for fun. I'm going to create that [629:09] trail. [629:11] Okay. [629:14] And uh the key policy does not grant [629:16] sufficient access to etc., etc. So I'm [629:18] going to go turn that off even though I [629:20] should really have it turned on, but I [629:21] just want to be able to show you this. [629:24] Okay. And so we have this new trail. And [629:27] so this trail is being dumped to S3. So [629:30] we might not be able to see anything in [629:32] here as of yet, but I'm just going to [629:34] pop over here and just see. Right. [629:38] I probably have one in my other account, [629:39] but it's not um it's not that important. [629:42] We basically saw what the data would [629:44] look like. So we go into here. There's a [629:46] digest. I don't remember there being a [629:47] digest, so that's nice. So there's no [629:50] data yet, but when there is, it will pop [629:52] into there. Um, I'm not sure if we're [629:54] going to be able to do anything with [629:55] insights here, at least not in this [629:56] account. [629:58] Insights are events that are show [629:59] unusual API activity and things like [630:01] that. So, that's kind of cool. I don't [630:03] know what Cloudatch Insights looks like. [630:08] Uh, insight events are shown in the [630:10] table for 90 days. Okay. So, I'm just [630:13] curious if we can see kind of a [630:14] screenshot of what that looks like. [630:17] Whoops. [630:18] Well, at least on the article here. So, [630:21] I guess you could kind of get like some [630:22] kind of graphs or something saying like, [630:24] "Hey, this looks unusual." And they [630:26] might select it. So, not pretty clear in [630:29] terms of what that looks like, but I [630:30] mean, sounds like a cool feature. And [630:32] I'm sure when I I'm working on my uh [630:34] security certification course, I will [630:36] definitely include it there. But that's [630:38] pretty much all there is to it. Um, I'm [630:40] going to go ahead and delete um that [630:42] trail because I I just don't really need [630:44] it in this account. But uh generally you [630:47] always want to go in and create a trail. [630:49] Um and what you can do is if you're in [630:50] your root account, I'm not this is [630:52] actually a an account that's part of an [630:54] organization. But if you're at that [630:55] organization level, you can create a [630:57] trail that that spans all the regions [630:59] that spans all the accounts within [631:01] organization. And that's what you should [631:03] be doing. Okay. But uh that's about it. [631:10] Hey, this is Andrew Brown from Exam Pro. [631:12] We're looking at ML and AI services on [631:14] AWS. But let's first just define what is [631:16] AI, ML, and deep learning. So AI, also [631:20] known as artificial intelligence, is [631:22] when machines that perform jobs that [631:24] mimic human behavior. ML or machine [631:26] learning are machines that get better at [631:28] a task without explicit programming. And [631:30] deep learning or DL are machines that [631:33] are have an artificial neural network [631:35] inspired by the human brain to solve [631:37] complex problems. And a lot of times [631:38] you'll see this kind of onion where [631:40] they're showing you that um you know AI [631:44] can be using ML or deep learning and [631:46] then deep learning is definitely using [631:47] machine learning but it's using neural [631:49] networks. And so for AWS their flagship [631:52] product here is Amazon SageMaker. It is [631:54] a fully managed service to build, train, [631:56] deploy machine learning models at scale. [631:58] Um and there's a bunch of different kind [632:00] of open source frameworks you can use [632:01] with it like Apache MXNet on AWS which [632:04] is an open- source deep learning [632:06] framework. that is the one that decided [632:07] to say hey we are going to back this one [632:10] and so you'll see a lot of example code [632:11] for that one we have TensorFlow that you [632:14] can use PyTorch uh hugging face other [632:17] things as well okay um and so there's a [632:20] lot of uh services underneath some that [632:23] might be of interest to mention right [632:24] away is like Amazon SageMaker ground [632:26] truth which is a data labeling service [632:29] where you have humans that label a data [632:31] set that will be used to train machine [632:32] learning models or maybe something like [632:34] Amazon uh aug Augmented AI, so human [632:37] intervention review services when [632:39] SageMaker uses machine learning to make [632:40] a prediction that is not confident uh [632:43] and it has the right answer cue up to [632:44] the predict for a human review. And [632:46] these are all about just labeling data [632:49] um you know when you're using supervised [632:52] um supervised learning but there are a [632:55] lot of services under SageMaker itself [632:56] and just AI services in general. So [632:58] we'll look at that next. Okay. [633:04] All right. Let's take a look at all the [633:06] ML and AI services and there's a lot on [633:08] AWS. So the first is Amazon code guru. [633:11] This is a machine learning code analysis [633:12] service and code guru performs code [633:14] reviews and will suggest to improve the [633:16] code quality of your code. It can show [633:18] visual code profiles so show the [633:20] internals of your code to pinpoint [633:21] performance. Next we have Amazon Lex. [633:24] This is a conversation interface [633:26] service. With Lex you can build voice [633:28] and text chat bots. We have Amazon [633:30] Personalize. This is a real-time [633:32] recommendation service. It's the same [633:34] technology used to make product [633:35] recommendations to customers shopping on [633:37] the Amazon platform. Then we have Amazon [633:40] Poly. This is a texttospech service. [633:42] Upload your text and an audio file [633:44] spoken by syn synthesized voice. Uh and [633:47] that will be generated. You have Amazon [633:49] recognition. This is an image and video [633:52] recognition service. Uh analyze image [633:55] and videos to detect and label objects, [633:57] peoples and celebrities. Then we have [633:59] Amazon transcribe. This is a speechto [634:02] text service. So you upload your audio [634:03] and that'll be converted into text. We [634:06] have Amazon text extract. This is an OCR [634:08] tool. So it extracts text from scanned [634:11] documents. When you have uh paper forms [634:14] and you want to digitally extract that [634:15] data, you have Amazon translate. This is [634:18] a neural machine learning translation [634:21] service. So use deep learning modu [634:23] models to deliver more accurate and [634:25] natural sounding translations. We have [634:28] Amazon comprehend. This is an NLP. So [634:31] natural language processing service find [634:33] relationships between text to produce [634:35] insights looks at data such as customer [634:38] email support tickets, social media and [634:40] makes predictions. [634:41] Then we have Amazon forecasts. This is a [634:44] time series forecasting service and it's [634:47] you know uh I mean technically I guess [634:48] it's a bit of a database but the idea [634:50] here is that it can forecast business [634:52] outcomes such as product demand, [634:53] resource needs or financial uh [634:56] performance and it's powered by ML or AI [634:58] if you want to call it. We have AWS deep [635:00] learning AMI. So these are Amazon EC2 [635:03] instances. They're pre-installed with [635:04] popular deep learning frameworks and [635:06] interfaces such as TensorFlow, PyTorch, [635:08] Apache, MXNet, Chainer, Glu, uh, Gluon, [635:12] uh, Horova, and Kiraz. [635:15] We have Adabus deep learning containers. [635:17] So, Docker images instances [635:19] pre-installed with popular deep learning [635:21] frameworks and interfaces such as [635:23] TensorFlow, PyTorch, Apache, MXNet. Uh, [635:27] we have Adabus Decomposer. This is [635:28] machine learning enabled musical [635:30] keyboard. Uh I don't know many people [635:31] using this but it sounds like fun. Advis [635:33] deep lens is a video camera that uses [635:35] deep learning. It's more of like a [635:36] learning tool. So again we don't see [635:38] many people using this. Advis deepraer [635:40] is a toy race car that can be powered [635:42] with machine learning to perform [635:43] autonomous driving. Again this is [635:44] another learning tool for learning ML. [635:47] They like to do these at reinvent to [635:48] have like these racing competitions. Uh [635:50] Amazon elastic interface. So this allows [635:52] you to attach lowcost GPU performed uh [635:55] powered acceleration to EC2 instances to [635:57] reduce the cost of running deep learning [635:59] interfaces by 75%. [636:01] We have Amazon fraud detector. So this [636:03] is a fully managed fraud detection uh as [636:05] a service. Uh it identifies potentially [636:08] fraudulent uh online activities such as [636:10] online payment fraud and the creation of [636:11] fake accounts. Amazon Kendra. So this is [636:14] an enterprise machine learning uh search [636:16] engine service. It uses natural language [636:18] to suggest answers to questions instead [636:20] of just simple keyword matching. So [636:22] there you go. [636:27] Hey, it's Andrew Brown from Exam Pro and [636:29] we're going to do a quick review here of [636:31] the big data and analytic services that [636:33] are on AWS. But before we do, let's just [636:35] define what big data is. So it's a term [636:38] used to describe massive volumes of [636:40] structured or unstructured data that is [636:42] so large it is difficult to move and [636:44] process using traditional database and [636:47] software techniques. So the first here [636:49] we have is Amazon Athena. This is a [636:52] serverless interactive query service. It [636:55] can take a bunch of CSV or JSON files in [636:58] an S3 bucket and load them into a [636:59] temporary SQL table. And so you can run [637:02] SQL queries. So it's when you want to [637:04] query CSV or JSON files. If you have [637:07] ever heard of um Apache Presto, it's [637:10] basically that. Okay. Then we have [637:12] Amazon Cloud Search. So this is a fully [637:14] managed full text search service. So [637:16] when you want to add search to your [637:18] website, we have Amazon Elastic Search [637:21] um commonly abbreviated to ES. And this [637:24] is a managed elastic search cluster. And [637:27] Elastic Search is an open-source full [637:29] text search engine. It is more robust [637:30] than cloud search but requires more [637:32] server and operational maintenance. Then [637:34] we have Amazon elastic map produce [637:37] commonly known as EMR and this is for [637:39] data processing and analysis. It can be [637:41] used for creating reports just like [637:43] Redshift but is more suited when you [637:45] need to transform unstructured data into [637:47] structured data on the fly and it [637:49] leverages open-source um technology so [637:52] like spark um hive pig things like that. [637:56] Then we have Kinesis data stream. So [637:58] this is a real-time streaming data [638:00] service. It creates producers uh which [638:02] sends data to a stream. It has multiple [638:04] consumers that can consume data within a [638:06] stream and use uh it for real-time [638:09] analytics, click streams, ingestion data [638:11] from a fleet of IoT devices. [638:14] Then we have Kinesis Fire Hose. This is [638:16] a serverless and a simple version of a [638:18] data stream and you pay on demand based [638:21] on how much data is consumed through the [638:23] stream and you don't worry about the [638:24] underlying servers. [638:26] Then you have Amazon Kinesis data [638:28] analytics. This allows you to run [638:30] queries against data that is flowing [638:32] through your real-time stream. So you [638:34] can create reports and analysis on [638:35] emerging data. And last on the Kinesis [638:38] side here we have Amazon Kinesis video [638:40] streams. This allows you to analyze or [638:42] apply processing on real-time streaming [638:44] videos. Onto the second page here we [638:47] have manage Kafka service MSK. Um and it [638:51] might be MKS um now that I'm looking at [638:53] it here. So just be aware that that [638:55] might be incorrect. But a fully managed [638:58] Apache Kafka service. Kafka is an [639:00] open-source platform for building [639:01] real-time streaming data pipelines and [639:04] applications. It is similar to Kinesis [639:05] but with more robust functionality. Then [639:08] we have Redshift which is um it was his [639:11] flagship uh big data tool. It's a pabyte [639:15] size data warehouse. The data warehouses [639:17] are for online uh online analytical [639:20] processing OLAP. So data warehouses can [639:23] be expensive because they are keeping [639:24] data hot. Meaning that we can run a very [639:26] complex query in a large amount of data [639:28] and get that data back very fast. But [639:30] this is great when you need to quickly [639:31] generate analytics or reports from a [639:33] large amount of data. We have Amazon [639:34] Quicksite. This is a business [639:36] intelligence tool or a business [639:38] intelligence dashboard BI for short. You [639:40] can use it to create business dashboards [639:41] to power business decisions. It requires [639:43] little to no programming and connect and [639:46] ingest to many different types of [639:47] databases. If you ever heard of Tableau [639:49] or PowerBI, this is just the Adabus [639:51] equivalent. We have Adabus data [639:53] pipelines. This automates the movement [639:55] of data. You can reliably move data [639:57] between compute, storage, and services. [640:00] We have Adabus Glue. This is an ETL [640:02] service. So, it allows you to move data [640:04] from one location to another where you [640:06] need to perform transformations before [640:07] the final destination. It's similar [640:09] similar to DMS, but it's more robust. We [640:12] have AIS Lake Formation. This is a [640:14] centralized, curated and secured [640:16] repository that stores all your data. So [640:18] it's a data lakeink. It is a storage [640:20] repository that holds a vast amount of [640:21] raw data in its native format until it [640:24] is needed. And then last on here we have [640:26] as data exchange. This is a catalog of [640:28] thirdparty data sets you can download [640:29] for free uh or subscribe or purchase [640:32] data sets. So they might have like the [640:34] CO 19 foot traffic data, the IMDb, TV, [640:37] movie data, historical weather data. And [640:39] sometimes this is really great if you're [640:40] just trying to learn how to work with [640:42] these tools. Okay. [640:47] Hey, this is Andrew Brown from Exam Pro [640:49] and we are taking a look here at Amazon [640:50] Quicksite, which is a business [640:52] intelligence dashboard or BI dashboard [640:54] that allows you to ingest data from [640:55] various adab storage or database [640:57] services to quickly visualize business [640:59] data with minimal programming or data [641:01] formula knowledge. So, here's an example [641:04] of a Quicksite dashboard. Um, and so the [641:07] way Quicksite is able to make these [641:09] dashboards super fast is via Spice, the [641:11] super fast parallel in-memory [641:13] calculation engine. Um, and the thing is [641:16] you don't have to use Spice. Um, but [641:18] generally it is good to use it. Uh, and [641:20] there are some caveats when getting your [641:21] data into Quicksite. Sometimes it can't [641:24] ingest data directly from a particular [641:26] uh data store. So you might have to dump [641:28] it to S3 first, but it's not too bad [641:30] because you can use Adobe Glue to [641:31] transform that data over. Um there are [641:34] additional features sometimes marketed [641:35] as services but we have quicksite ML [641:37] insights. This detects anomalies perform [641:39] accurate uh forecasting. It can generate [641:42] natural language narrative. So basically [641:44] like you know describe it as if you're [641:45] going to read it out as a business [641:47] report you know. Then there's Amazon [641:49] Quicksite Q. This allows you to ask [641:51] questions using natural language on all [641:53] your data and receive answers in [641:54] seconds. So there you go. [642:00] Hey, this is Andrew Brown from Exam Pro [642:02] and let's go take a look at Amazon [642:04] Quicksites which is a or Quicksite which [642:06] is um a business intelligence tool. So [642:09] when you go here you have to uh sign up [642:11] because it's kind of part of AWS but on [642:14] its own separate thing and then you have [642:16] to choose what you want. So we have [642:17] enterprise and standard. Um I do not [642:21] want to pay that much so I'm going to go [642:23] to standard over here. I'm not really [642:25] sure what the difference is. It's not [642:26] really telling me what [642:28] um between standard and enterprise, [642:31] but I'm going to assume standard is more [642:33] cost effective. But here we it says user [642:36] use IM federated identities, which is [642:39] fine. Use IM federated identities only. [642:42] Um we can stick with the top one there. [642:45] That seems fine to me. We need to enter [642:48] a name. So we'll just say my quicksite [642:51] account. [642:54] And we probably have to fill something [642:55] in there. So let's say android [642:57] exampro.co and these are the services [642:59] that are going to integrate with it. [643:00] Athena, S3, RDS, things like that. I [643:02] guess we could select some of those [643:03] buckets. I'm not too worried about doing [643:05] that right now. The provided account [643:06] name is not available. That is a [643:08] terrible UI, but that's AWS for you. So [643:11] I'm just going to dump some numbers [643:12] there. I'm going to put my email in here [643:15] again. [643:17] Um, we probably want some S3 buckets. [643:20] I'm going to [643:23] make a new bucket [643:25] because I think that's how we're going [643:26] to do this. We're going to have to make [643:27] a bucket here and say uh quicksite [643:31] data. [643:33] Okay. And we're going to create [643:35] ourselves a bucket here. I'm going to go [643:38] back and hopefully that shows up. [643:42] Uh it does not. So, what I'll have to do [643:44] is just back out [643:47] and I'm just going to give it a hard [643:49] refresh here. And we're hit quick sign [643:50] up for Quicksite again and we'll choose [643:53] standard [643:54] and we'll say my Quicksite account. A [643:58] bunch of numbers there. [643:59] Andrewexampro.co. [644:01] I don't really care about ingesting data [644:02] from everywhere else. I just want it [644:03] from S3. [644:05] There's my data. [644:07] Uh, sure. We'll give it right [644:09] permissions even though I don't plan to [644:10] do anything with Athena here today. [644:17] and we'll give it a moment to load. [644:23] So, what I'm thinking is [644:28] So, what I'm thinking is just making [644:30] like an Excel spreadsheet here and just [644:32] filling in some data. So, oh, it says [644:35] our account is set up here. So, we'll go [644:36] to quicksite because I bet I can import [644:39] like a CSV or something. [644:42] Um I'm more of a Tableau or PowerBI kind [644:44] of person. Um but uh you know for the [644:47] purpose of the cloud practitioner I am [644:48] going to show you this. Amazon Quicksite [644:50] lets you easily visualize data and etc. [644:52] That sounds great. Next. Next. Next. I [644:54] know what I'm doing. Oh, do we have some [644:57] examples? Great. So I don't even have to [644:58] make a spreadsheet. Okay. So what we'll [645:00] do is just click on that. [645:04] And we have stuff. It looks like they've [645:06] really improved this since the last time [645:07] I've seen it, which is quite nice. [645:11] Um, but I could try and make my own. [645:17] I'm just trying to think how do we do [645:18] this again. [645:21] Yeah, we have the spice there. So, it's [645:23] a lot easier from starting from scratch. [645:24] I'm just going to say close and [645:28] user analysis. We want data sets in [645:30] here. Oh, we already have some data [645:32] sets. These are coming from S3. I think [645:34] that's the old S3 logo. I'm not sure why [645:36] they're using that one. We can go here [645:38] and create a new data set. Oh, we can [645:40] upload directly. So, I don't even have [645:41] to use S3. That's great. So, what I'm [645:42] going to do is just have some values in [645:44] here. So, I'm going to just say um [645:49] uh type value. So, we'll say banana [645:55] 125 123. We'll say apple [645:59] 11 [646:00] orange. [646:02] Nobody likes oranges. [646:05] I shouldn't say. I'm sure it's like lots [646:06] of people like oranges. [646:08] Oh, we got to put pears on there. [646:11] I actually really like pears. People [646:12] think I like bananas, which is not true. [646:14] I actually like pears. That's what I [646:17] like. So, I'm going to go ahead and save [646:19] this. Save as. [646:22] And I'm just going to save this to my [646:24] desktop here. So, just give me a moment. [646:26] Just doing this off screen. [646:30] And I'm going to save this uh data set [646:33] quicksite [646:35] CSV. It can even take an XLS. So I don't [646:38] have to save it as a uh I'll just save [646:40] it as an XLS. [646:43] Okay. And so we're going to just upload [646:44] that. So there is that data set. [646:48] It's going to scan that file. It's going [646:50] to see that sheet. You even preview it. [646:54] There's the information. We're going to [646:56] add that data. [646:58] Uh I add it as a data data set. [647:04] Well, how do I [647:06] where do I It's like it says add the [647:08] data. I just want to add it as a data [647:09] set. So data set up here. Maybe save and [647:11] visualize up here. [647:14] And is it autographing it? Maybe if I [647:18] drag in. Is it working? Is it thinking? [647:20] Okay, it's at 100%. So I'm going to just [647:23] drag that onto there. [647:26] And it says pear, orange, banana. [647:31] Just kind of trying to make sense of [647:33] this here. Is it taking in count the [647:35] value? Maybe put the value down there. [647:37] Wow, that's so much easier. I haven't [647:39] used this for like a year and um I'm [647:41] gonna tell you this has gotten a lot [647:43] easier to use. So, I'm quite impressed [647:44] with this. But yeah, I mean this is [647:46] pretty much what Quicksite is. If you [647:48] want to visualize things in different [647:49] types, you can drag them out. You can [647:51] probably like click on the the wheel [647:53] here and change it. Again, I'm not sure [647:57] exactly how all the uh the dials and [648:01] knobs work here, but I mean, another [648:03] thing we could do is just drag out like [648:04] another object and do the same thing. [648:06] So, maybe I'd want a pie chart. Um, so [648:11] add a visual. [648:14] Yeah, it's not as nice as PowerBI, but [648:16] like it's still great that it's here, [648:17] you know? Type value. [648:20] So, we got a nice pie chart there. [648:23] Uh, let's try something weird. Let's [648:26] give this one a go. [648:28] Doesn't color it, which is not very [648:30] nice. Um, there's probably some kind of [648:31] way to color it, but focus on banana [648:34] only. I don't know. I don't know the [648:37] point of there. But anyway, that's quick [648:38] site. So, um, I really don't want to pay [648:40] for this. So, what I'm going to do is go [648:43] up here. [648:45] Um, there's you have to deactivate. I'm [648:46] just trying to remember how [648:49] because they change the interface again. [648:51] They change everything on you. [648:54] So maybe we go I'm on a trial for four [648:56] days here. Maybe quantity four just the [648:59] four 29 day trial. So if I want to get [649:02] out of this trial, what do I do? I don't [649:06] want to use it anymore. Um so [649:10] how to delete as quicksite [649:15] cancelling your subscription. So before [649:18] you can unsubscribe uh you're signed in [649:20] the IM account, your Quicksite [649:22] administrator, you're the root IM [649:24] administrator. Sure. Uh you deleted any [649:27] secondary namespaces to find the [649:29] existing namespace, etc. So choose your [649:32] username in the application bar to [649:33] manage quicksite account settings. [649:35] Unsubscribe. [649:36] So I was almost there. I thought I was [649:39] in the right place. [649:42] Uh this one. No, [649:45] I was just there. [649:48] Manage quicksite [649:51] your subscriptions [649:54] edit. [649:56] There's no unsubscribe option. [649:59] So I'm not sure. [650:02] Can I cancel? [650:07] Unsubscribe. [650:12] Button does not appear in Quicksite. [650:28] and it could just be because we're on [650:30] trial and so maybe after the end of the [650:31] trial it will uh it will vanish there. [650:36] They are not making this easy for me. [650:38] Account settings. Ah, delete account. So [650:40] this is what we probably want to do. [650:41] Permanently delete the account. Yes. I [650:43] mean, that has to get rid of the [650:45] subscription because it gets rid of [650:46] everything. There we go. [650:50] We'll say confirm, [650:52] delete account, [650:55] unless you're using them in the [650:57] services, blah blah blah blah blah. Um, [651:00] successful. Okay, great. So, now I [651:02] should go back ads.amazon.com. And just [651:05] to confirm that it's gone, I'm going to [651:09] go to QuickSite again and just see if [651:11] it's trying to ask me to sign up again. [651:14] So, it is. So, I've gotten rid of my [651:15] account. So, we're all in good shape. [651:17] And uh yeah, that is that is QuickSite. [651:23] All right, let's take a look at some [651:24] more machine learning AI services [651:26] because Adabus won't stop making these [651:28] things. Um, and basically last time I [651:31] made uh the videos, all this generative [651:33] stuff did not exist. So we need to cover [651:35] it. The first is Amazon Bedrock. So the [651:37] uh this uses large language models and [651:39] makes it a cloud service offering to [651:41] generate text and images responses. If [651:43] you know what chat GPT is, you know what [651:45] Bedrock is. We have Amazon code [651:47] whisperer. It's an AI code generator [651:48] that will predict code to meet your use [651:50] case. Uh so if you've heard ever heard [651:52] of GitHub copilot, it's the same thing [651:55] basically. It's going to write code for [651:58] you or along with you I should say. Uh [652:00] we have Amazon DevOps Guru. This uses ML [652:03] or machine learning to analyze your [652:05] operational data and application metrics [652:07] and events to detect operational [652:09] abnormalities. Um, imagine if you had [652:12] kind of like a junior DevOps person [652:15] digging into your metrics to figure out [652:17] if there's something wrong. Then we have [652:19] Amazon Lookout. This is actually three [652:20] different um offerings. We have Amazon [652:22] Lookout for equipment, Amazon uh Lookout [652:24] for Metrics, and Amazon Lookout for [652:27] Vision. They all seem to have to do [652:29] something with quality control and [652:31] performing automated inspections. So [652:32] vision of course would use vision to [652:34] detect anomalies. Uh one would be for [652:37] equipment to detect if there's anything [652:38] wrong with operational equipment. Uh and [652:41] then metrics would be you know with [652:43] metric data. So something probably more [652:45] for um the hard industries uh to [652:48] utilize. And you have Amazon monetron. [652:51] So this uses machine learning models to [652:52] predict unplanned equipment downtime. [652:54] And so the way they do that is they have [652:56] these uh IoT sensors that's going to [652:58] capture vibrations and sensor data from [653:01] your hardware. Then we also have adabus [653:04] neuron. This is an ad SDK used to run [653:07] deep learning workloads on adabus uh [653:10] infer I can't say that word but I know [653:12] what it is. It's basically um it's a [653:15] machine learning acceleration on GPUs [653:17] that you can attach and ads trainium. [653:23] So yeah, I wish the words weren't so [653:24] hard. There's actually more um stuff [653:27] that Adus has for machine learning. I [653:29] didn't include them because they were [653:30] just too far out there and they're [653:32] definitely not going to show up in your [653:33] exam. You'll definitely never see them. [653:34] But we now have better coverage. What I [653:37] really wanted to show was Bedrock, Code [653:39] Whisperer, because I feel like those two [653:41] uh will show up on future exams. I'm [653:43] just trying to get those in front of you [653:45] now, even if they're not on the exam uh [653:47] at the time of this recording. Okay, [653:50] ciao. [653:55] All right. So, you probably already know [653:57] what generative AI is, but just in case [653:59] you don't, I want to just quickly cover [654:01] it and show a very tiny example. Uh, so [654:04] generative AI, which also could be [654:06] shortened to Gen AI, though most people [654:09] don't say that, uh, is a type of [654:11] artificial intelligence capable capable [654:13] of generating new content such as text, [654:15] images, music, or other forms of media. [654:18] So an example would be something like a [654:20] software that I like to use called [654:22] Midjourney uh where you can put in a [654:24] prompt and so it will then go ahead and [654:26] generate out an image. Um so all the [654:29] cloud service providers have some kind [654:31] of offering with both image and text. Um [654:34] but yeah hopefully that makes sense. The [654:36] idea is that you can plug stuff in and [654:39] you get stuff out. Okay, [654:45] let's let's take a look here at machine [654:47] learning and deep learning frameworks. [654:48] And so these are uh frameworks that uh [654:51] can be used with SageMaker or have [654:53] direct support for them. I just wanted [654:55] to get you some uh exposure and to uh [654:58] get you some context in terms of these [655:00] because machine learning and AI and all [655:02] this stuff is becoming more popular. So [655:04] you should at least have heard of these [655:06] things. So I have all the logos on the [655:08] lefth hand side. and we'll go through [655:10] them. The first is Apache MXNet. So this [655:13] is a machine learning framework adopted [655:15] by AWS. Basically um every single cloud [655:18] service provider backs their own kind of [655:21] open- source framework and they try to [655:23] make that the one that they suggest you [655:25] to use. But in practice uh there's ones [655:28] that are good and there's ones that [655:29] people just don't want to use. And Apach [655:31] MXNet is not fun to use whatsoever. Um, [655:34] and so you'll see it all over in the [655:35] marketing and pushed everywhere. But [655:37] really people want to use things like [655:38] Curus TensorFlow. But anyway, I just [655:41] wanted to point that out that it was has [655:43] a bias because they've invested energy [655:44] into uh their team of machine learning [655:48] frameworks. You got PyTorch optimized [655:50] for Tensor uh for deep learning using [655:53] GPU and CPU. It's created by Facebook. [655:56] Facebook does not necessarily um have [655:58] its own cloud service provider offering. [656:00] So it's kind of out there and so you'll [656:03] see good support for PyTorch and all the [656:05] major providers. U the next is [656:07] TensorFlow and this is made by Google. [656:09] What's interesting with TensorFlow is [656:12] Google made uh their own um GPU or TPU [656:16] they call it a tensor processing unit. [656:18] So Tensor is a a unit of thing in [656:21] TensorFlow and it they have optimized [656:24] hardware for it. I personally find [656:26] TensorFlow the easy to use or I should [656:28] say Kiraz. So um curious is a highlevel [656:31] machine learning framework built on top [656:33] of tensorflow because these lower level [656:35] ones were just really hard to use and so [656:37] basically pietorch came along and it was [656:38] much easier to use and then everyone [656:41] noticed how easier pietorch was and so [656:43] that's where curus came from was to be [656:47] competitive with pietorch and be easier [656:48] to use. Then you have apachi spark which [656:51] is a unified analytics engine for large [656:53] scale data processing but they do have [656:55] ML offerings within it called spark ml. [656:57] Um, so there's definitely things you can [656:59] do there. Uh, there's a piece of [657:01] software called Chainer. Um, and it's [657:03] for it's a deep learning framework that [657:04] supports CUDA. Then there's hugging [657:07] phase which is not exactly a framework [657:09] or tool. It's just a way of accessing a [657:12] lot of models online and data sets and [657:14] quickly launching them. For whatever [657:16] reason, I uh, Adabus has uh, strong [657:19] synergies with HuggingFace. I've seen [657:21] like developer advocates and other uh, [657:23] folks that worked at AdSugging [657:25] Face. And so there seems to be strong uh [657:28] relationships between hugging face and [657:30] AWS for whatever reason. There's a lot [657:33] of ML frameworks out there, but because [657:35] ML is uh just uh progressively [657:39] um or rapidly innovating, you'll see [657:42] frameworks come and go. And so I [657:44] remember when I researched this and I [657:45] was just trying to understand all the [657:46] frameworks out there. There's just a [657:48] lot. And I just kept digging into them [657:49] and finding, oh, they're not active [657:51] anymore. They're not active anymore. So [657:52] I just want to point out that we have [657:53] all these ones up on screen. if they [657:55] become unactive tomorrow, I would not be [657:58] surprised. But uh for the most part, all [658:00] of these seem to be very popular uh and [658:02] uh they're being well supported. Uh but [658:04] yeah, hopefully that gives you an idea [658:06] of these frameworks. Okay, ciao. [658:12] All right, let's take a look here at [658:14] Apache MXNet a little bit more in detail [658:16] because this is the framework that [658:18] Adabus wants you to use. Whether you [658:20] want to use it or not is a different [658:21] story. uh but you'll see it all over in [658:23] their marketing pages and things like [658:25] that. So, Apache MXNet is a deep [658:27] learning machine learning framework [658:28] which supports many many different [658:30] programming languages. So, that is one [658:32] advantage of it. Uh the key features uh [658:34] is that it's scalable, it's flexible, [658:36] it's portable, it's it supports multiple [658:38] programming language. Adabus has made [658:41] Apache axnet their framework of choice. [658:44] So, there's lots of support for it [658:45] within Adabus SageMaker and the ML [658:47] containers. But I have noticed that [658:49] they've been increasing support for [658:50] PyTorch. So maybe you know they're just [658:53] trying to meet the customer where they [658:55] are. But anyway um there is a lot of [658:58] stuff for MXNet. MXNet has two highlevel [659:01] interfaces. Uh one's called Gluon and [659:04] there is module API. So uh depending on [659:07] which one you use, one is imperative [659:08] programming, one symbolic programming. [659:10] Uh this is more of a deeper concept for [659:12] machine learning. But I'm going to tell [659:13] you one is really easy, one is really [659:15] hard. Um but uh let's look at a very [659:18] simple example of uh some code for using [659:21] the glue on API. So it kind of looks [659:24] like that and you can see that they are [659:25] using Python. So hopefully that gives [659:27] you an idea of uh MXNet and its [659:30] offering. The key thing is that it [659:31] offers it in a lot of different [659:32] programming languages. Will this appear [659:34] on your exam? Absolutely not. But should [659:36] you know it, you absolutely should. Um [659:39] just so you have good context with [659:40] Adabus and ML. So there you go. [659:46] I want to talk a little bit about Intel [659:48] because I think it's very important to [659:50] remember the hardware that is running [659:52] with these um cloud service providers [659:55] because it really does matter. Um and [659:57] there's a couple terms you might see [659:59] when using uh compute that you're not [660:01] aware of and I want to make sure you [660:02] know what they are. So let's talk about [660:04] what is Intel. So Intel is a [660:05] multinational corporation is one of the [660:07] world's largest semiconductor chip [660:10] manufacturers. Intel is the inventor of [660:12] the x86 [660:14] instruction set. So basically uh they [660:16] released this chip back in 1978. This [660:19] one's called the Intel 8086 chip and the [660:22] idea is that um they came up with an [660:24] instruction set um it's basically a [660:26] bunch of words that you can use um to [660:28] program the chip and it's a lower level [660:31] language. So um that lower level [660:33] language would be in assembly um if if [660:36] that makes any sense. So the idea is [660:38] that you have this um instruction set [660:41] and you have to write an assembly. And [660:43] so basically most modern programs like [660:45] when you use uh programming languages [660:47] like uh C it will actually compile down [660:50] to assembly um or other languages will [660:53] compile down to assembly because that is [660:55] what the chip understands and then [660:56] assembly is turned into machine code [660:58] like the zeros and ones. And the reason [661:01] I'm mentioning this is that when you go [661:02] and you uh launch uh a compute uh [661:06] instance on let's say on AWS uh you're [661:08] launching a EC2 instance you have to [661:11] choose uh whether it's x86 or a [661:14] different instruction set or [661:15] architecture and so the other one is ARM [661:18] and they're both really really good. It [661:19] just depends on whether uh uh your stuff [661:22] can support it but for the most part [661:24] Intel has ARM chips as well. So um there [661:27] is no company that produces ARM chips [661:29] per se. It's just an architecture and uh [661:32] the way it works is that it just has [661:34] fewer instruction sets. So there's fewer [661:36] uh rules that you can write in. So it's [661:38] a more limited writing in assembly. But [661:41] at the end of the day, it doesn't matter [661:42] because your programming language is [661:43] going to compile it down. So you don't [661:44] have to worry about those fewer [661:45] instructions. But because it has fewer [661:47] instructions, it generally results in a [661:50] better uh power efficiency and so it can [661:52] have better performance or better or [661:55] better cost to you the customer. So when [661:58] I can, I try to run ARM. And for the [662:00] most part, it's always great to run ARM, [662:02] but uh it really depends on if your [662:04] software is going to be able to run on [662:06] ARM um and stuff like that. So I just [662:08] wanted to point out those two things [662:10] there about uh at least Intel and then [662:13] instruction sets. Okay. [662:19] All right. I want to talk about two [662:20] things um that Intel has with AWS. And [662:23] the first is Intel Xeon scalable [662:24] processor. And the second is Intel [662:26] Gotti. Um so it of course does work with [662:29] or purchases um hardware from other um [662:33] uh other companies like they use AMD and [662:35] Nvidia. But I think it's worth [662:37] mentioning Intel in a little bit more [662:39] detail here because every time I go to [662:42] reinvent, Intel has a big giant booth [662:45] and you can go scour the Adabus website [662:48] and it just looks like Adabus works more [662:50] closely with Intel as opposed to the [662:52] other uh providers. Not to say that [662:54] Intel is not being utilized on GCP and [662:57] Azure and others, but uh I just noticed [662:59] uh something more going on there with [663:01] AWS. But let's first talk about Intel [663:03] Xeon scalable processors. These are high [663:05] performance CPUs designed for enterprise [663:06] and server applications commonly used in [663:08] ads instances. Um that scalable part [663:11] makes them very good for machine [663:13] learning. So you often are going to be [663:15] be using Intel Xeon processors whether [663:18] you know or not on AWS. [663:20] The Intel is the uh Intel uh Habana [663:23] Gotti uh processor. So this is a uh [663:26] processor specialized for AI training. [663:29] Uh you could say that this is a direct [663:31] competitor to Nvidia or a similar [663:33] competitor because uh they uh they uh do [663:37] something very similar. Um I believe [663:39] that Intel Gotti has their own SDK [663:42] called Synapse AI uh that you can use to [663:45] interact with it. So you could launch up [663:47] Sage Maker and then use uh that uh that [663:50] API or SDK in order to best utilize uh [663:54] that hardware there. But both of these [663:56] um pieces of hardware are offered uh on [663:59] AWS and I think it's just good to know [664:01] them at least in name uh what they are. [664:04] Okay. [664:09] Hey, this is Andrew Brown and let's talk [664:11] about GPUs. I'm sure most people know [664:13] what GPUs are here, but I'm going to [664:15] talk about it anyway because I want to [664:16] talk about CUDAS. So, a GPU stands for [664:19] general processing unit, and it's a [664:21] processor that is specialized to quickly [664:22] render high resolution images and videos [664:24] concurrently. If you've ever played [664:27] video games, you know you need a good [664:29] GPU because it's all about those images. [664:32] However, GPUs can perform parallel [664:34] operations on multiple sets of data. So, [664:36] they can also be used for non-graphical [664:39] tasks. And this makes it really good for [664:41] machine learning and scientific uh [664:42] computation. So, if you're trying to uh [664:46] convince your significant other that you [664:47] need a better graphics card, you can [664:49] just tell them it's for work. I need it [664:50] for machine learning and scientific [664:51] computation. It's not your fault that [664:54] you can also play video games with it. [664:56] And so, we have like a graphic there on [664:58] the right hand side. I think I got that [664:59] from Nvidia. And so they're kind of [665:01] trying to demonstrate the difference [665:03] between uh the parallelization with GPU [665:05] versus serial tasks with CPU. But let's [665:08] go and just read a little bit more. So [665:10] CPUs can have an average of four to 16 [665:12] processor cores. GPUs can have thousands [665:15] of processor cores. How that works, I [665:18] have no idea, but I just know that [665:20] that's how it works. Uh so we have 48 [665:23] GPUs can provide as many as 40,000 [665:25] cores. So that is a lot. GPUs are best [665:29] suited for repetitive and highly [665:30] parallel computing tasks such as [665:32] rendering graphics, cryptocurrency [665:34] mining, and people are even still doing [665:35] that and deep learning and machine [665:38] learning. So, you know, there you go. [665:40] That's GPUs. [665:47] All right, let's take a look here at [665:48] CUDA. But before we do, let's talk about [665:50] Nvidia. So, Nvidia is a company that [665:52] manufactures graphical processing units [665:55] for gaming and professional markets. If [665:57] you have ever played video games and you [665:59] build your own rig, um, a lot of people [666:01] like to choose Nvidia, but Nvidia can do [666:04] things other than video games. And this [666:06] is due to their framework uh called [666:09] CUDA, which stands for compute unified [666:11] device architecture. So, it's a parallel [666:13] computing platform and API. I said [666:16] framework, but I guess it's an API by [666:18] Nvidia that allows developers to use [666:20] CUDA enabled GPUs for general purpose [666:22] computing GPUs. and it says GPG GPU [666:26] because it's saying general purpose [666:27] GPUs. I know that's a mouthful there. Um [666:30] so over on AWS they have a bunch of [666:33] instances that um can utilize uh Nvidia [666:38] GPU. So I ads is always changing the [666:41] instances. So these could be old. But [666:44] you can see we have a P3 which has the [666:46] Tesla Tesla V100. You have the G3 with [666:50] the Tesla M M60. The G4 with the T4. uh [666:53] the P4 with the Tesla A00. [666:56] So there's probably these are probably [666:58] old ones. There's new instances with [667:00] newer Nvidia cards. But my point is is [667:02] that Adabus has uh GPUs that you can [667:05] utilize. Another thing I want to point [667:07] out with CUDA is that all major deep [667:09] learning frameworks are integrated with [667:10] Nvidia deep learning SDKs. there's a big [667:13] fight or war over um uh these companies [667:17] that make uh GPUs and CPUs because they [667:20] really want the uh theirs to be used for [667:23] machine learning. So you can definitely [667:24] be sure that AMD probably has some kind [667:26] of similar offering or something uh and [667:28] definitely Intel as well. Um but Nvidia [667:31] has done a very good job in uh making [667:34] sure that theirs is the most popular. Um [667:36] so NVIDIA deep learning SDK is a [667:38] collection of NV uh Nvidia libraries for [667:41] deep learning. So this is something that [667:42] this is the SDK you can use with CUDA to [667:45] interact with their API. Uh so one of [667:47] those libraries are called CUDA deep [667:49] neural network library. So that's [667:51] something you can use with it and it's [667:53] uh tuned for a bunch of stuff. If it [667:56] looks like it's getting a little bit too [667:58] um uh technical, it's because this slide [668:00] was a was for my machine learning uh [668:03] adabus specialty and I didn't do a whole [668:06] lot to change it and brought it over. Uh [668:08] so you don't ne don't really need to [668:09] know that last part there but just [668:11] understand what CUDA is and that it's uh [668:13] very important uh for working with [668:15] machine learning and ads has uh good [668:18] offerings uh for instances with it. [668:20] Okay. [668:25] Hey, this is Andrew Brown and we are [668:26] taking a look at Amazon Athena which is [668:28] an interactive query service that makes [668:30] it easy to analyze data directly from [668:33] S3. I love this service. It is super [668:36] useful. It's less if your uh bucket is [668:39] your data set for your database and you [668:41] can query against it. Athena is based [668:43] off the open source distributed query [668:45] engine Apache Presto which uh [668:47] technically is true but when this first [668:48] came out as far as I understood it was [668:50] based off of Presto but now I understand [668:53] it's based off a fork of Presto. So [668:55] Athena can do two things. Uh it has [668:57] Athena SQL which lets you run SQL [669:00] queries on an S3 bucket. Athena uses Tin [669:03] row SQL. I have no idea if that's the [669:05] proper way to pronounce it, but that's [669:07] the name of it, which is a fork of [669:08] Apache Presto. And that bunny is the [669:11] logo for Tinro. Uh, it can commonly [669:14] access, it can be commonly accessed via [669:16] the ads management console to enter [669:17] queries. So, that's generally how you'll [669:19] want to use it. You can programmatically [669:21] use it, but uh, usually I just use it in [669:23] the UI. In this case, the JDBC or OBC [669:28] drivers can be utilized to interact with [669:30] Athena. If you don't know what those [669:31] are, they're they're Java um interfaces [669:35] uh for querying things to to databases. [669:38] Okay, you can query it with the AD CLI [669:41] or SDK which is probably a very common [669:43] use case programmatically. Uh the other [669:46] part of Apache is it has Apache Spark on [669:48] Amazon Athena. So Athena used to just be [669:50] Athena SQL which is just called Athena [669:52] and so now they have this Amazon Athena [669:55] with Apache Spark. So this is where you [669:57] can interactively run data analytics [669:59] using Apache Spark. You access um uh you [670:03] access everything via Jupiter compatible [670:05] notebook with Apache Spark. So you [670:07] basically are writing code in a [670:08] notebook. Um Athena is serverless so you [670:11] only pay for what you use. Athena [670:14] integrates with the following ad [670:15] services. So we have cloud for [670:16] cloudfront cloud trail data zone elb so [670:19] that's elastic uh load balancer EMR it [670:22] glue data catalog IM quicksite s3 [670:25] inventory step function systems manager [670:27] inventory VPC I want to point out that [670:31] for Amazon Athena there are exams like [670:33] at least in the past um we could say [670:36] like the security certification where it [670:38] was very important to know what could [670:40] actually uh uh connect to Athena and [670:43] what Athena could uh like dump its data [670:46] to and things like that. So that is very [670:48] important to know. So understand the [670:50] application integration of Athena is [670:52] super important. So just try to know [670:54] that as best you can. Okay. [671:01] Hey, this is Andrew Brown and we are [671:02] taking a look at AWS Glue. Uh, I believe [671:05] it's Adas Glue, and not Amazon Glue, but [671:07] Adosglue is a serless data integration [671:09] service that makes it easy for analytics [671:13] users to discover, prepare, move, and [671:15] integrate data from multiple sources. [671:17] When this thing first came out, it was [671:18] junk for years. And they have really [671:21] done a lot of work to make this a much [671:23] more powerful tool. And it's a much more [671:25] important tool um in the Adabus [671:27] ecosystem that I think is worth knowing [671:28] because it does a lot of integrations [671:30] between data services. So, you [671:32] definitely need to know this one inside [671:33] and out. Uh the use cases for this one [671:35] is analytics, machine learning, [671:37] application development. Uh you can [671:40] discover and connect to more than 70 to [671:42] diverse data sources and manage your [671:44] data to a centralized data catalog. Uh I [671:47] just recently found out you can visually [671:48] create run and monitor uh ETLs [671:52] uh to load your data into your data [671:54] links. I almost wonder if Adabus did [671:55] this because Azure had such a great [671:57] offering for this. So maybe they are [671:59] trying to be competitive with Azure [672:01] Synapse I believe that one it's called [672:03] for uh visual ETLs. Um you can [672:07] immediately search and query catalogs [672:09] data using Amazon Athena and in Athena [672:12] you'll notice there's very strong [672:14] integrations with it. We have EMR [672:17] Redshift Spectrum. What can it do? It [672:20] does data discovery, modern ETL or ELT, [672:25] cleansing, transforming data. It's a [672:29] centralized cataloging. So, it does a [672:31] bit more than just one thing. And so, [672:34] you'll notice there's a couple things [672:35] that AdSlue does. Okay. [672:42] Hey, this is Andrew Brown from Exam Pro [672:44] and we are taking a look at the AWS [672:46] wellarchchitected framework. So this is [672:48] a white paper created by AWS to help [672:50] customers build using best practices [672:52] defined by AWS. You can find this at [672:54] ads.mazon.com/archchitecture/wwellarchchitected. [672:59] This idea is not unique to AWS. the [673:01] other providers have it, but I believe [673:02] Adabus was the first one to define this [673:05] and they have a really good uh a good [673:07] approach to this and this is pretty much [673:10] essential knowledge that you have to [673:12] have uh for certifications when we're [673:14] looking at the cloud practitioner the [673:15] solution architect associate and [673:16] professional because um there's a lot of [673:19] principles here or best practices that [673:20] adabus uses themselves to architect [673:23] their infrastructure. Okay. So the [673:25] framework is divided into five sections [673:27] called pillars which address different [673:29] aspects or lenses that can be applied to [673:31] a cloud workload. So imagine you have [673:34] your cloud workload. You're going to [673:35] want to adopt the ad as well [673:36] architecture framework. Some things that [673:38] you know people don't consider outside [673:40] of the five pillars is that you need to [673:41] know general definitions uh general [673:43] design principles and the review [673:45] process. Um and then from there you have [673:47] your five pillars. So you have [673:48] operational excellence, security, [673:50] reliability, performance, efficiency and [673:53] cost optimization. And all of these have [673:55] major sections in this uh white paper. [673:57] But outside of just the main white [674:00] paper, each of these have their own [674:01] white papers that go even into farther [674:03] detail. So if you really want to uh [674:05] really focus on security and get a lot [674:07] more information, they have that as [674:09] well. Okay, [674:15] let's take a look at the general [674:16] definitions for the well architecture [674:18] framework. Starting with the pillars. So [674:20] the operational excellent pillar is [674:22] there to run and monitor systems. The [674:24] security pillar is to protect data and [674:26] systems to mitigate risk. The [674:28] reliability pillar is to mitigate and [674:30] recover from uh disruptions. The [674:32] performance efficiency pillar is about [674:34] using computing resources efficiently or [674:37] effectively. And the cost optimization [674:39] pillar is about getting the lowest [674:41] price. And this is where you're going to [674:42] find all the business value. And I put [674:44] an asterk there because uh you know you [674:47] might obsess saying we need to meet the [674:49] requirements for all these pillars and [674:50] that's not the case. You can trade off [674:52] pillars based on the business context. [674:54] So you know don't take it as literally [674:57] implement every single thing but just [674:59] consider that uh you know you might have [675:01] to adapt it based on your workloads. [675:03] Then we have some general definitions [675:04] that we will come across. So there's [675:06] components so code configuration it was [675:08] resources against a requirement. A [675:10] workload so a set of components that [675:11] work together to deliver business value. [675:14] Milestones so key changes of your [675:16] architecture through the product life [675:17] cycle. Then there's architecture itself. [675:20] So how components work together in a [675:21] workload and then we have technology [675:24] portfolio. So a collection of workloads [675:26] required for the business to operate. [675:28] Okay. [675:34] So the well architected framework is [675:36] designed around a different kind of team [675:38] structure. So when you're looking at [675:40] enterprises they generally have a [675:41] centralized team with specific roles [675:44] where AWS structures their teams as [675:46] being distributed with flexible roles. [675:48] And so this new kind of methodology of [675:50] distributed teams uh has some major [675:53] advantages but it does come with some [675:54] risks and so adabus has baked in some uh [675:57] practices or uh things that they do to [675:59] mitigate these issues. Okay. So let's [676:01] compare on premise enterprise uh to what [676:03] adabus is proposing for your team [676:05] structure. So on premise what we'd see [676:08] is a centralized team consisting of [676:09] technical architects, solution [676:11] architects, data architects, network [676:14] architects, security architects and you [676:16] kind of see that they all have a [676:17] specialized vertical and they are [676:19] usually managed by either to oaf or zack [676:24] uh man framework. So those are just ways [676:26] of structuring your teams. Those are [676:27] very popular. And so what Adabus is [676:29] proposing here is that you have a [676:30] distributed team and uh the way you're [676:32] going to make that team work because [676:34] obviously just thinking about a [676:35] distributed team they're going to be a [676:36] lot more agile but to make sure that [676:38] they effectively work you have practices [676:40] like team experts who raise the bar uh [676:42] making sure that you know uh in any [676:44] areas we can always say how can we do [676:46] this better uh then there are mechanisms [676:48] in place for automated checks for [676:50] standards. So that's the great thing [676:50] about cloud can all be automated to say [676:52] hey does it meet our regulatory [676:54] compliance or or what have you and then [676:56] there's the concept of the Amazon [676:58] leadership principles which we will [677:00] cover on in the next slide in detail and [677:02] so um you know is not obviously using uh [677:05] these other frameworks because it has [677:07] its own which is this one here but the [677:09] the mechanism to which they stay [677:11] organized and up to date is they are [677:13] supported by a virtual community of [677:15] subject matter experts principal [677:16] engineers so that what they'll do is [677:18] they'll edit things like lunchtime talks [677:20] and then recycle that into their [677:21] onboarding material or into this [677:23] framework itself. Okay. [677:30] So, we're taking a look here at Amazon's [677:32] leadership principles and these are a [677:34] set of principles used during the [677:35] company's decision-making, problem [677:37] solving, simple brainstorming, and [677:39] hiring. All right. Um, and so I can't [677:41] say that I like all of these, but [677:43] definitely some of them really stand out [677:44] as being great, especially the first [677:46] one, which is customer obsession. So [677:48] instead of worrying about what your [677:49] competitors are doing, think about what [677:50] the customer wants. Work your way back [677:52] and uh you know really focus on the [677:54] customer's needs. Then there's [677:56] ownership. So if you're going to go do [677:57] something uh you know try to be your own [677:58] mini boss uh and uh take responsibility [678:01] for whatever it is you're building event [678:03] and simplify. So you know always look [678:05] for the simplest solution. Don't try to [678:07] engineer something super complicated if [678:09] it's not necessary are right a lot. So [678:11] you know try to be right. Uh learn and [678:14] be curious. So that's pretty [678:16] self-explanatory. Hire and develop the [678:18] best. Insist on the high standards. [678:20] Adabus always refers to this as raising [678:22] the bar, think big, buys for action, [678:24] frugality. And Adabus is really frugal [678:27] if you didn't know that. But not just [678:29] for like themselves, but also for their [678:30] customers. They want customers to uh [678:32] spend the least amount of money possible [678:34] when using their infrastructure. Earn [678:36] trust. Uh dive deep, have a backbone, [678:39] disagree and commit, deliver results, [678:41] strive to be the Earth's best employer, [678:43] success and scale bring responsibility. [678:46] And if you want to read these in detail [678:47] because they have a big block of text [678:49] for each of these uh you can go to [678:51] amazon jobs/principles [678:54] and read all about it. Okay. [679:01] All right. Let's talk about some general [679:02] design principles uh that you should be [679:04] considering when you are designing your [679:06] infrastructure no matter what pillar [679:08] that you are looking to adopt. The first [679:10] is stop guessing your capacity needs. So [679:12] the great thing with cloud computing is [679:13] you use as little or much based on [679:15] demand. Whereas on premise, you would [679:17] have to purchase a machine and you'd [679:19] have to make sure you have additional [679:20] capacity so that you could grow into it, [679:23] right? And so here with cloud, you do [679:25] not have to worry about that. Uh test [679:27] systems at production scale. So be able [679:28] to clone your production environment to [679:30] testing, tear down testing while not in [679:32] use to save money. So a lot of people [679:34] will have a staging server that they run [679:36] all the time. But the great thing here [679:38] is that with cloud, you know, it's you [679:40] can just spin it up and have it right [679:41] away and then tear it down and save [679:42] money. Um there's automating to make [679:45] architectural experimentation easier. [679:47] This is talking about using [679:48] infrastructure as a code. So for AWS, [679:50] this would be using cloud form, creating [679:51] change sets which kind of um uh say [679:54] exactly what is going to change, stack [679:56] updates, drift detection to see if your [679:58] stuff is uh uh being changed over time [680:00] by developers through manual [680:01] configuration, things like that. Then we [680:03] have allow for evolutionary [680:05] architectures. So this is about adapting [680:07] CI/CD um doing nightly releases or if [680:11] you're using serverless if you adopted [680:12] lambdas they deprecate over time forcing [680:15] you to use the latest version uh and so [680:17] that is evolutionary architectures. Then [680:20] we have drive architectures using data. [680:23] So um when you're using cloud there's a [680:25] lot of tooling in there to automatically [680:26] start collecting data. So cloudatch will [680:28] be collecting some things by default and [680:30] cloud trail will as well. So, you know, [680:33] that is another thing. And then [680:35] improving things through game days. So, [680:37] this is about simulating traffic on [680:38] production or purposely killing EC2 [680:40] instances or or messing with your [680:42] services to see how well they recover. [680:44] All right. [680:50] Before we jump into each of the pillars, [680:52] let's go open them up and take a look at [680:54] what structure we should expect to see. [680:57] So, we have design principles, [680:58] definition, best practices, and [681:00] resources. All the pillars follow this [681:02] to a te. So let's just talk about what [681:04] these are. So the design principles are [681:06] a list of design principles that needs [681:08] to be considered during implementation [681:10] and that's where we're going to focus a [681:11] lot of our energy. Then you have [681:13] definition. So this is an overview of [681:15] the best practice categories. Then you [681:17] have the best practices themselves. [681:19] These are detailed information about [681:20] each practice with uh various [681:23] services. And then you have resources. [681:24] These are additional documentation, [681:26] white papers and videos to implement [681:28] this pillar. And I just want to tell you [681:30] that if you're doing the certified cloud [681:32] practitioner, we're really just going to [681:33] cover the design principles. But for the [681:36] solutions architect associate or [681:37] anything uh that's associated or above, [681:39] that's where we're going to actually uh [681:40] dive deep into the implementation of the [681:43] best practices because there is a lot of [681:45] stuff there. So uh yeah, there we go. [681:52] Let's take a look here at the design [681:53] principles for operational excellence. [681:55] So the first here is perform operations [681:57] as code. to apply the same engineering [681:59] discipline you would to application code [682:01] to your infrastructure. So by treating [682:03] your operations as code, you can limit [682:06] human error and enable consistent [682:08] responses to events. Generally, we're [682:09] talking about infra infrastructure as a [682:11] code here. So this would probably be [682:12] like things like cloud form. There's [682:13] other things you could do like policy as [682:15] a code and a bunch of other ones. Then [682:17] we have make frequent small reversible [682:19] changes. So design your workloads to [682:21] allow components to be updated [682:23] regularly. Uh this could be talking [682:25] about doing rollbacks, incremental [682:26] changes, blue green deployments, having [682:28] a CI/CD pipeline. Refine operations [682:31] procedures frequently. So look for [682:32] continuous opportunities to improve your [682:34] operations. Uh here you'd use game days [682:36] to simulate traffic or event failure on [682:38] your production workloads. Anticipate [682:40] failure. So perform post modems on [682:42] system failures to better improve. Write [682:44] test code. Kill production servers. Um [682:47] there's a small spelling mistake. It [682:49] should have an R here. So servers to [682:51] test recovery. learn from all [682:53] operational failures. So share lessons [682:55] learned in a knowledge base for [682:57] operational events and failures across [682:59] your entire organization. But you know [683:00] if you can just remember these headings [683:02] here uh and be able to categorize what [683:04] would be under operational excellence, [683:05] you'll be okay. All right. [683:11] All right. Let's take a look at the [683:12] design principles for the security [683:14] pillar. So the first here is implement a [683:16] strong identity foundation. So implement [683:19] the principle of lease privilege or PP. [683:22] That's a very popular concept meaning [683:24] giving people only the permissions that [683:26] they need. Use centralized identity. So [683:28] that would be using Adabus AM. Avoid [683:30] long live credentials. Then we have [683:33] enable traceability. So monitor alerts [683:35] and audit actions and changes to your [683:37] environment in real time. Integrate log [683:39] and metric collection and automate [683:41] investigations and remediation. Then we [683:43] have apply security at all layers. So [683:46] take defense indepth approach with [683:49] multiple security controls for [683:50] everything from edge networks, VPCs, [683:52] load balancing instances, OS, [683:54] application code. Uh we might have a [683:56] slide in this course on defense and uh [683:58] depth where basically you see like a [684:00] ring of things and you can kind of see [684:02] how like there's layers that go from [684:04] outward to inward and that's what [684:05] they're talking about when they're [684:06] listing out all these things here. [684:08] Automate security best practices. Uh [684:11] protect your data in transit at rest. uh [684:14] keep people away from your data. The [684:16] reason I don't have descriptions there [684:17] is because those are pretty [684:18] self-evident. Prepare for security [684:19] events. So, incident management systems [684:22] and investigation policies and [684:23] processes, tools to detect, investigate, [684:25] and recovery from incidences. And uh [684:28] there are a lot of security tools out [684:29] there and they all have funny uh [684:30] initialisms. I didn't put any of them in [684:32] here, but I'm sure there are some there. [684:33] Um but yeah, there you go for security. [684:40] All right, let's take a look at design [684:41] principles for reliability. And the [684:43] first here is automatically recover from [684:45] failure. So monitor KPIs and trigger [684:47] automations when the threshold is [684:49] breached. Test recovery procedures. So [684:51] test how your workload fails and you [684:53] validate your recovery procedures. You [684:55] can use automation to simulate different [684:57] failures or to recreate scenarios that [684:59] led to failures before. Scale [685:01] horizontally to increase aggregate [685:02] system availability. So replace one [685:04] large resource with multiple small [685:05] resources to reduce the impact of a [685:07] single failure on the over overall [685:10] workload. Distribute requests across [685:12] multiple smaller resources to ensure [685:14] that they don't share a common point of [685:15] failure. So we're talking about multi-AZ [685:18] uh high availability. Okay. Stop [685:20] guessing capacity. We've seen this [685:21] multiple times. So in on premise it [685:23] takes a lot of guess work to determine [685:24] the elasticity of your workloads uh [685:26] workload demands. With cloud you don't [685:28] need to guess how much you need because [685:29] you can request the right size of [685:31] resources on demand. That's going to [685:33] give you better reliability. Okay. [685:35] Manage change and automation. So making [685:36] changes via infrastructure as a code [685:38] will allow for a formal process to track [685:40] and review infrastructure. You're going [685:41] to see IC show up a lot in this [685:43] framework. Okay. [685:48] Let's take a look at design principles [685:50] for performance efficiency. So the first [685:52] here is democratize advanced technology. [685:54] So focus on product development rather [685:56] than procurement, provisioning and [685:58] management of services because if you're [685:59] on prem you'd have to order those [686:01] machines, set them up and so take [686:03] advantage of advanced technologies [686:04] specialized and optimize for your use [686:06] case with on demand cloud services [686:07] because again if you're using onrem uh [686:09] you you know you might not have the [686:11] option to have Sage Maker, right? It's [686:13] just going to be a VM and you're going [686:14] to have to do all the work yourselves [686:16] whereas AWS has all these specialized [686:17] things so you can move quickly. Uh go [686:20] global a minute. So deploying your [686:21] workload in multiple ABS regions around [686:23] the world allows you to provide lower [686:25] latency and a better experience for your [686:26] customers at a minimal cost. We have [686:28] used serverless architecture. So [686:30] serverless architecture removes the need [686:32] for you to run and maintain physical [686:33] servers for traditional computing [686:34] activities. Removes the operational [686:36] burden of managing physical servers and [686:38] can lower transactional costs because [686:39] managed services operate at cloud scale [686:41] and ads can be a lot better at um [686:43] running them efficiently than you will. [686:46] Uh experiment more often. So with [686:48] virtual and automatable uh resources, [686:50] you can quickly carry out comparative [686:52] testing using different types of [686:53] instances, storage or configurations to [686:55] make the best choice. We call this right [686:57] sizing, choosing the right size. [686:59] Consider mechanical sympathy. So [687:01] understand how cloud services are [687:03] consumed and always use technology [687:05] approach that aligns best with your [687:06] workload goals. For example, consider [687:08] data access patterns when you select [687:10] database or storage approaches. [687:17] Let's take a look here at design [687:18] principles for cost optimization. So the [687:21] first one here is implement cloud [687:22] financial management. So dedicate time [687:24] and resources to build capacity uh via [687:27] cloud financial management and cost [687:28] optimization tooling. Sabus is saying [687:30] hey take advantage of all our tooling [687:32] that makes it easy for you to know [687:33] exactly what you're spending. Adopt a [687:35] consumption model. So pay only for [687:37] computing resources that you require uh [687:39] an increase or decrease using uh [687:41] depending on the business requirements. [687:43] We're talking about on demand pricing. [687:45] Measure overall efficiency. So measure [687:46] the business output of the workload and [687:48] the cost associ associated with [687:50] delivering. Use this measure to know the [687:52] gains you make from increasing output [687:54] and reducing costs. So stop spending [687:57] money on undifferentiated [687:59] that's a hard word to say [688:00] undifferentiated [688:02] heavy lifting. So Adabus does the heavy [688:04] lifting of the data center operations [688:06] like racking, stacking and power [688:07] servers. It also removes the operational [688:09] burden of managing operating systems and [688:12] applications with managed services. This [688:14] allows you to focus on your customers [688:15] and business projects rather than your [688:17] IT infrastructure. And the last one here [688:20] is analyze and attribute expenditure. So [688:23] the cloud makes it easier to uh [688:24] accurately identify the usage and cost [688:26] of systems which then allow transparent [688:29] uh attribution of IT costs to [688:31] individualize workload owners. This [688:33] helps measure return on investment and [688:35] gives workload owners an opportunity to [688:37] optimize their resources and reduce [688:38] costs. So there you go. [688:44] Hey, this is Andrew Brown from Exam Pro [688:46] and we are taking a look at the Adabus [688:48] wellarchchitected tool. So this is an [688:50] auditing tool to be used to assess your [688:52] cloud workloads for alignment with the [688:53] AWS wellarchchitected framework. And so [688:56] what it is, it's essentially a checklist [688:58] uh but it also has nearby references. [689:00] So, you know, as you're reading through [689:02] it, it will show you information uh and [689:05] resources so that it can help you with [689:07] this checklist here. And the idea is [689:09] when you're done, you can generate out a [689:11] report and then you can provide that [689:13] report to your executives and key [689:14] stakeholders to prove uh you know how [689:16] well architected your workload is on [689:18] AWS. Okay. [689:24] Hey, this is Andy Brown from Exam Pro [689:26] and in this video I want to show you two [689:27] things. the well architected framework [689:29] and the wellarchchitected tool. So first [689:31] let's go look for the well architected [689:33] framework. So we're going to look up [689:34] white papers uh AWS. And so if we go [689:38] here to ads amazon.com white papers we [689:41] have a bunch of pages here. And so I'm [689:42] going to just check box on white papers [689:44] so that we can kind of reduce the amount [689:46] there. And I'm going to check box well [689:48] architected framework. If we scroll all [689:50] the way top here, one of these you think [689:52] it'd be right at the top. Well, one of [689:54] these is the well architected framework. [689:56] And here it is. And so if we open it up, [689:59] it used to just directly open up as a [690:01] PDF. I'm sure you can still download it [690:02] as is, but generally you're going to [690:04] open up as this HTML page. And you can [690:07] basically read through it, see all the [690:08] stuff, see the multiple pillars. You can [690:11] click into here, see the design [690:13] principles, read the definitions, and [690:16] then start reading about uh the uh best [690:18] practices. And they have these things at [690:20] the bottom of each one. Uh very boring, [690:23] very, very boring. But um you know when [690:24] you get to the solutions architect and [690:26] things like that you're going to need to [690:27] know this stuff inside and out. It's [690:29] going to really help you out this cloud [690:31] practitioner. We only need to know [690:32] surface level information. Um but that's [690:34] the well architected framework. Let's [690:36] take a look at the well architected [690:38] tool. So we can type in well here. We'll [690:41] get the well architected tool. And if we [690:44] go here you can see that I've created a [690:45] couple before probably demos for our [690:49] videos. And so I'm going to go define a [690:51] new workload. I'm going to say my my [690:53] workload here. Uh my workload. [690:59] Whoops. My workload. It is messing up [691:01] because I probably have Grammarly [691:03] installed. So, it does not like [691:04] Grammarly. So, I'm just going to turn it [691:06] off for now. So, my workload [691:12] and it's still not typing correctly. So, [691:14] I have to kill out kill out Gramly here, [691:16] which is kind of frustrating. So, that's [691:18] a bug that that's not Gramly's fault. [691:20] Adabus's fault for not playing well with [691:23] Grammarly and that's something I will [691:25] definitely report to them because it's [691:27] very annoying. So, I'm going to go ahead [691:29] and refresh this page. [691:33] My workload. My workload. [691:37] Um, and this is Andrew Brown. [691:41] Production or pre-production doesn't [691:43] matter. Pick your regions. US East or US [691:47] East 2. Sure. [691:49] I'm selecting it. [691:52] There we go. Uh optional optional [691:55] optional optional. You go to next and [691:57] then you can choose your lens. Serless [691:58] lens FTR lens. So that's the [692:01] foundational technical review SAS lens. [692:03] We go with well architected framework. [692:05] And then once that is there, we can [692:08] start reviewing. [692:10] Okay. And then we get this big [692:11] checklist. And so we can go through this [692:13] and read each one. So we say ops one, [692:16] how do you determine what your [692:17] priorities are? and all these things [692:18] like ops and stuff like that. These are [692:20] all the summaries in each of the well [692:21] architected framework sections. So you [692:24] pretty much don't need to really read [692:25] the doc. You can just go through this. [692:26] So everyone needs to understand their [692:28] part in enabling business success. Have [692:30] shared goals in order to set priorities [692:32] of resources. This will maximize the [692:34] benefit of your efforts. So select the [692:36] form of the following. Evaluate the [692:38] customer's external needs. External [692:41] customer needs. Evaluate internal [692:42] customer needs. If you click info, it's [692:44] going to highlight each one here. So all [692:46] key stakeholders including business [692:48] development, operations, teams, this [692:49] will ensure etc. And so you just go [692:52] through this and uh you know once you [692:54] have that and you save and exit [692:58] okay uh you'll have uh the questions [693:01] that are answered. It'll say what's high [693:02] risk, what's not, things like that. Very [693:05] simplistic. It's really just a way of [693:07] making a very organized report or [693:09] checklist and proving that you went [693:10] through it uh to the executive level or [693:13] to the management level there. So [693:15] hopefully that makes sense to you. Um [693:16] it's not too complicated but there you [693:18] go. [693:23] Hey, it's Andy Brown from Exam Pro and [693:25] we are looking at the Adabus [693:26] architecture center. So the architecture [693:28] center is a web portal that contains [693:30] best practices and reference [693:32] architectures for a variety of different [693:34] workloads and you can find this at [693:35] adabus.amazon.com/archchitecture. [693:38] So if you're looking for best practices [693:40] in terms of security, they have a huge [693:42] section on that and they have it for [693:44] pretty much every kind of category on [693:45] AWS. Or if you're looking for uh [693:48] practical examples, you can view the [693:50] large library of reference [693:52] architectures. So here's one to make an [693:54] AWS Q&A bot and it will have an [693:56] architectural diagram, but you can also [693:59] uh deploy it via cloud for possibly CDK. [694:02] Um and this way you can get a working [694:04] example and then tweak it for your use [694:06] case. So this is a really great tool um [694:09] when you are done the adabus well [694:10] architected framework and you're saying [694:12] okay how do we apply it can we get more [694:13] concrete examples and I wouldn't be [694:15] surprised if a lot of the resources [694:17] within the well architectured framework [694:18] white paper are just pointing to this [694:20] center okay [694:26] this is brown from exam pro and we are [694:28] taking a look at the concept of total [694:29] cost of ownership also known as TCO. So [694:32] what is TCO? Well, it is a financial [694:34] estimate intended to help buyers and [694:36] owners determine the direct and indirect [694:38] cost of a product or service. So, here [694:40] is an example of, you know, TCO for [694:43] maybe like a data center. So, we have [694:44] hardware monitoring, installation, IT [694:46] personnel, training, software, uh, [694:49] security, licensing, and taxes. But [694:52] that's not just the limit of it. It's [694:53] just kind of the examples we show here. [694:55] Uh, the idea of creating a TCO is useful [694:57] when your company's looking to migrate [694:59] from on-rem to cloud. And we will have a [695:01] better uh kind of visual here to kind of [695:03] understand how you would contrast [695:05] against on premise to cloud. But let's [695:07] just talk about how it actually works in [695:09] practicality which I think gets kind of [695:10] overlooked when cloud service providers [695:13] are selling you on TCO. So the idea is [695:15] that Gardner um you know they uh they [695:18] were they wrote this article based on [695:20] this research where an organization had [695:22] moved uh 2,500 virtual machines over to [695:26] Amazon EC2. And so what you're seeing [695:29] here is that there is a an additional [695:31] cost that we're not considering which is [695:32] the migration cost. See this bar up [695:35] here. Um so the idea is that the company [695:37] was paying around 400,000 and so they [695:39] started to move over and as you see uh [695:42] their costs initially went up for a [695:44] short period of time here. Uh but then [695:46] once that migration cost was over uh you [695:49] can notice that they had a 55% [695:50] reduction. So it's uh totally possible [695:53] to save money. Uh and clearly there is [695:55] great savings. Uh now is it exactly what [695:58] AWS promises? Probably not. And that's [696:00] that could be the reason why they [696:01] updated their TCO calculator. But let's [696:03] now just do that contrast against the [696:05] two. So we have on premise on the left [696:07] and AWS on the right or any cloud [696:09] service provider. And what I want to do [696:11] is help you think about what costs do [696:13] people generally think about because if [696:15] we have like iceberg, the idea here is [696:17] that these are the costs that we always [696:18] think about above the iceberg and then [696:20] there's these hidden costs that we just [696:22] don't consider when factoring in our [696:23] move. And that's the idea of T TCO is to [696:25] consider all the costs, not just the [696:27] superficial ones. And so people say [696:29] these look like teeth and that's why I [696:30] add penguins and a whale here. Um, and [696:33] so when we're talking about on premise, [696:35] what we generally think are software [696:36] license fees and subscription fees, but [696:38] when you compare those against each [696:40] other, they might look the same. Um, [696:42] adabus might just look slightly cheaper [696:44] or even more. And so the idea is you [696:46] need to then factor in everything. So on [696:48] on premise there's implementation, [696:49] configuration, training, physical [696:51] security, hardware, IT personnel, [696:52] maintenance. And on the adabus side, you [696:55] know, you are you don't have to do as [696:57] much of that stuff. So you just have [696:58] implementation, configuration, and [696:59] training. And so Adabus with their TCO [697:02] calculator, their old one used to make a [697:04] promise of 75% in savings. Um, again, [697:07] you know, this is going to really vary [697:09] based on what your migration strategy [697:11] looks like. Um, but you know, it's [697:13] totally possible. you could save 75% or [697:16] you could save 50% over a third year, [697:19] three-year period and there's a an [697:21] initial spike. So, that's just something [697:23] you have to consider. But the nice thing [697:24] though is that once you've moved over, [697:26] all this stuff over here on the lefth [697:27] hand side will be AWS's responsibility. [697:29] Okay. [697:34] All right. So, let's take a look at [697:36] capital versus operational expenditure. [697:38] So, there's capex and opex. So on the [697:40] capex side, the idea here is you're [697:42] spending money upfront on physical [697:44] infrastructure, deducting that expenses [697:45] from your tax bill over time. Uh a lot [697:48] of companies that are running their own [697:49] data centers uh or have a lot of [697:52] on-remise stuff understand what capex is [697:54] because it's something that a lot of [697:56] times they get tax breaks on and that's [697:58] why we see a lot of people that have a [697:59] hard time moving away from the cloud [698:01] because you know they keep on thinking [698:03] about that money they save from the [698:04] government. But capex costs would be [698:06] things like server costs, storage, [698:08] network costs, backups and archives, [698:10] disaster recovery costs, data center [698:12] costs, technical personnel. So the idea [698:15] is with capital expend expenses, you [698:17] have to guess upfront what you plan to [698:19] spend. Okay. With operational [698:21] expenditure, the idea here is the cost [698:23] associated with an on-remise data center [698:24] that has shifted the cost to the service [698:27] provider. The customer only has to be [698:28] concerned with non-physical costs. So [698:30] leasing software and customizing [698:32] features uh training employees and cloud [698:34] services. Paying for cloud support uh [698:37] billing based on cloud metrics. So [698:39] compute usage, storage usage and so the [698:42] idea here is with operational expenses [698:44] you can try a product or service without [698:46] investing in equipment. So basically [698:49] capex is what we think about when we [698:50] think of on premise and then opex is [698:52] what we think about um you know we're [698:54] thinking about cloud or AWS. Okay. [699:02] All right, let's ask a very important [699:03] question about cloud migration. So, does [699:05] cloud make it personnel redundant? So, a [699:08] company is considering migrating their [699:09] workloads from on- premise to the cloud [699:11] to take advantage of the savings. There [699:13] is a concern among the staff that there [699:15] will be mass layoffs does cloud make it [699:18] personnel redundant and that's a very [699:21] important question to to have an answer [699:23] to. And this all talks about shifting [699:24] your IT team into different [699:26] responsibilities. So a company needs IT [699:29] personnel during the migration phase as [699:31] we saw with that gardener research [699:32] report that there was a period at least [699:35] like a year where they needed that for [699:37] you know depending on the size of your [699:38] company. So you're still going to need [699:39] those people around a company can [699:41] transition some roles to new cloud [699:43] roles. So a very traditional example [699:45] would be you have your traditional [699:46] networking roles or people have like [699:48] their CCNA and now they're moving over [699:50] to cloud networking. Uh they have a [699:52] reduced workload but there's other [699:54] things uh that they could be doing in [699:56] the cloud. um a company may decide to [699:58] take a hybrid approach. So they'll [699:59] always need to have a traditional IT [700:01] team and a cloud uh IT team. Um and the [700:05] last one and this one you'd actually see [700:07] on the exam which is a company can [700:09] change employees activities from [700:10] managing infrastructure to re revenue [700:12] generating activities. Okay, so the idea [700:15] is that you know if you're a company why [700:17] would you get rid of all your staff when [700:18] you can just put them all into revenue [700:19] generation? I suppose you know you could [700:22] uh you know lay them off and some [700:24] companies might do that. Um or you know [700:26] you could just retrain them because uh [700:28] if that IT personnel team has uh [700:30] technical expertise I'm sure they can [700:32] translate that to the cloud. [700:38] Let's talk about the adabus pricing [700:39] calculator. And this is a free cost [700:41] estimate tool that can be used within [700:43] your web browser without the need of an [700:44] adabus account to estimate the cost of a [700:46] various adabus services. And this is um [700:49] available at calculator.awws. [700:52] And the reason we're bringing this up is [700:53] because there used to be a TCO [700:55] calculator, but now this is the [700:57] calculator that you use. So the adabus [700:59] pricing calculator contains 100 plus [701:01] services that you configure for cost [701:02] estimate. And so you can just click [701:04] through a bunch of knobs and uh boxes to [701:08] uh you know uh exactly figure out a very [701:12] accurate cost. So the idea here is that [701:15] to calculate your TCO an organization [701:17] needs to compare that existing cost [701:19] against their adabus costs. And so the [701:21] adabus pricing calculator can be used to [701:22] determine uh you know the adabus cost [701:24] and obviously the organization knows its [701:26] cost so it can compare it against that. [701:28] Um and the way you can get data out of [701:31] this is you can export it as a final [701:33] estimate to a CSV. Okay. [701:39] Hey, this is Andrew Brown from Exam Pro [701:41] and we are taking a look at the AWS [701:42] pricing calculator. So to get there it's [701:44] calculator.WS. What you're going to do [701:46] is hit create estimate and then here you [701:48] have a bunch of services. So you just [701:50] choose what you want. So you type in [701:51] EC2. We're going to configure that. And [701:54] from there we can do a quick estimate or [701:56] an advanced estimate. So choose this [701:57] option for fast and easy route to [701:59] ballpark and estimate. Choose this [702:01] option for detailed estimate for [702:02] accounts, workloads and stuff. So notice [702:04] down below very simplistic. We hit [702:07] advanced [702:08] and we get all sorts of stuff. Okay. So [702:11] you know it's really up to you. I'm very [702:13] comfortable with the advanced options. [702:15] So I might be running a Linux machine. [702:17] What is my usage? it's going to have uh [702:21] daily spikes of traffic because of the [702:23] use cases. You could say it's not busy [702:25] on Saturday and Sunday, that it has a [702:27] baseline of one, a peak of two, eight, [702:29] things like that. Then you can choose [702:31] what you're using. Um T4G, I don't even [702:34] know what that is. Uh but we'll just say [702:36] like T [702:38] uh T2 micro, which is not that big. T3 [702:42] micro. And you can say we're doing on [702:45] demand because a lot of people would be [702:46] doing that. and you see like $7 a month. [702:49] It's not a lot of money. Then you're [702:51] looking at your storage data in, data [702:54] out. [702:55] Okay. So, we can add that. Another thing [702:58] that we might see is something like RDS. [703:02] So, we go to RDS and we add Postgress. [703:05] And not all of them have the simple and [703:07] complex. Sometimes they're simple. So, [703:08] production database, [703:11] we'll have one here. And we're just [703:14] going to be say a dB T2 micro, T3 micro. [703:18] There we go. Uh 100. That's fine. We're [703:22] not going to have multi-AZ. We'll have [703:23] single A on demand. Show the [703:25] calculation. $13 a month. Add that to [703:28] our estimate. So you're kind of getting [703:30] the idea there, right? [703:32] Um and so you know, we have our summary. [703:35] That's our monthly $391. [703:38] Um oh, sorry, over 12 months. Our [703:40] monthly cost is $32. [703:42] Okay, you can go back there, clone the [703:44] service, edit it, stuff like that. You [703:46] can export the estimate. I think it goes [703:48] out as a CSV. You can also hit share um [703:52] and then hit agree. And so then you have [703:55] a public link. And if I have that link, [703:58] we can just see what happens if I paste [704:00] it. Okay. And it just brings them to the [704:02] same estimate. So there you go. [704:09] Hey, this is Andy Brown from Exam Pro [704:11] and we are taking a look at migration [704:12] evaluators. So, it was formerly known as [704:15] TCL logic and then Adus acquired the [704:17] company and it is an estimate tool used [704:19] to determine an organization existing on [704:22] premise costs so it can compare it [704:23] against its adabus costs for planned [704:26] cloud migration. Uh so the idea is that [704:28] you can get a very very detailed [704:31] information and the way it collects [704:32] information is via an agentless [704:35] collector to collect data from your [704:36] on-remise infrastructure to extract from [704:38] your own on-remise costs. I don't know [704:40] if you can see there but you can see [704:41] that it works with a lot of different [704:42] kinds of on-remise technology like [704:45] VMware, Microsoft, uh TSQL, all sorts of [704:49] things. Okay, [704:56] one migration tool that we can use with [704:58] AWS is the VM import export and this [705:00] allows us to import virtual machines [705:02] into EC2. So it has import instructions [705:05] for VMware, Citrix, Microsoft HyperV, [705:09] Windows VHD from Azure and also Linux [705:12] VHD from Azure. And so the way this [705:15] works is that you prepare your virtual [705:16] image for upload and adabus has a bunch [705:18] of instructions for that. Once it is [705:20] ready, you're going to upload that to an [705:22] S3 bucket. And once it's uploaded to an [705:25] S3 bucket, then what you can do is use [705:27] the Adabus CLI to import your image. Um, [705:30] and so that is the CLI command down [705:32] below. And once it is produced, it will [705:36] generate out an Amazon machine image. [705:37] And so from an AMI, you can then go [705:39] launch your EC2. Okay. [705:46] Hey, this is Andrew Brown from Exam Pro [705:48] and we are taking a look at the database [705:50] migration service which allows you to [705:51] quickly and securely migrate one [705:53] database to another. DMS can be used to [705:55] migrate your on-remise database to AWS [705:56] and that's why we're talking about it. [705:58] Uh, and so here's a general diagram [705:59] where you have your source database [706:01] which connects to a source endpoint goes [706:03] through a replication instance. So [706:04] that's a EC2 instance that's going to [706:07] replicate the data to the target [706:09] endpoint onto the target database. Uh, [706:11] and so we have a bunch of possible [706:13] sources. So we have Oracle database, [706:15] Microsoft SQL, MySQL, Mariab, [706:18] PostgresSQL, MongoDB, SAP asse, IMDb [706:24] DB2, Azure SQL database, Amazon RDS, [706:28] Amazon S3, and I'm assuming these are [706:30] database dumps. Amazon Aurora, Amazon [706:34] Document DB, and so for possible [706:36] targets, it's very similar. We got [706:37] Oracle database, Microsoft SQL, MySQL, [706:41] Mariab, PostSQL, Reddus, SAPS, SE, [706:46] Amazon Redshift, Amazon RDS, Amazon [706:48] Dynamob, Amazon S3, Amazon Aurora, [706:51] Amazon Open Search Service, Amazon [706:54] Elastic for Reddus, Amazon Document DB, [706:57] Amazon Neptune, Apache Kafka. I'm just [707:00] showing you the list to give you an idea [707:01] of how flexible this service is. Uh, but [707:04] you can tell that the these are very [707:06] different databases. So how can it uh [707:08] move them over right and so in not all [707:10] cases can it easily do it like it's very [707:12] easy to go from myql to postgress um but [707:15] you know for ones that are like [707:17] relational to uh NoSQL this is where the [707:20] ads schema conversion tool comes into [707:22] play it's used in many cases to [707:23] automatically convert a source database [707:25] schema to a target database schema or [707:28] semi-automate it so that you can kind of [707:30] like uh you know uh figure out how to [707:32] map the new schema. uh each migration [707:34] path requires a bit of research since [707:36] not all combinations of sources and [707:37] targets are possible and it really comes [707:40] down to even versions of these things. [707:42] So, but I just want you to know about [707:43] that it's an option as a database [707:45] migration service and I've migrated a [707:47] very large database before and it's [707:49] super fast. Uh so, and it's not that [707:51] hard to use. So, something you [707:53] definitely want to remember when you're [707:54] migrating. [707:59] So, Adabus has free services that are [708:02] free forever, unlike the free tier that [708:04] are up to a point of usage or time. Um, [708:06] and so there are a lot here. This is not [708:08] even the full list. There's definitely [708:10] more. And we have IM, Amazon VPC, [708:12] Autoscaling, Cloud Formation, Elastic [708:14] Beantock, Ops Works, Amplify, AppSync, [708:16] Codear, Organizations, Consolidated [708:19] Building, AWS, Cost Explorer, uh, Sage [708:21] Maker, Systems Manager. There's a lot of [708:24] them. Okay. Um but the thing is is that [708:26] uh these services are free but some of [708:28] these um can spin up other resources. So [708:31] the services are free themselves. [708:33] However, ones that provision services [708:35] may cost you money. So cloud for which [708:37] is an infrastructure as a code tool [708:39] could launch virtual machines. Those [708:40] virtual machines will cost money, right? [708:42] Ops works can launch servers that can [708:44] cost money. Ampfly can launch um lambdas [708:47] that can cost money. So that's something [708:49] you just have to consider. Um but uh [708:51] yeah, there you go. [708:57] Hey, this is Andrew Brown from Exam Pro [708:59] and we are taking a look at the Adabus [709:01] support plans. So, we got basic, [709:03] developer, business, and enterprise. And [709:05] you absolutely absolutely need need to [709:07] know this stuff inside and out for exam. [709:09] They will ask you questions on this. [709:11] Okay, so basic for email support only, [709:15] uh such as billing and account. So, if [709:17] you think it got overbuild, and that's [709:19] something you should do if if you've uh [709:21] uh misconfigured something and you end [709:22] up with a big bill, just go um open up a [709:25] support uh ticket under basic for [709:27] billing and they're likely to refund [709:29] you. But if you do have questions about [709:30] billing accounts, that's what you're [709:31] going to be using. For everything else, [709:33] that is for tech support. Um and so for [709:35] developer, business, enterprise, you're [709:37] going to get email support, which [709:38] they'll uh roughly reply within 24 [709:41] hours. I believe this is business hours. [709:43] So if you message them on Friday um or [709:47] sorry Saturday you might be waiting till [709:49] Monday for it. Okay. Um in terms of [709:52] thirdparty support uh the only one that [709:54] doesn't have thirdparty support is [709:56] developer. So if you are using something [709:58] like Ruby on Rails or Azure or something [710:01] that has interops [710:04] and something else business enterprise [710:05] will absolutely help you out with it. [710:07] Same with enterprise but the developer [710:09] one not so much. Uh if you like to use [710:12] the phone or you like to chat with [710:14] people um that's available at the [710:16] business enterprise tier. This is the [710:18] way I end up talking to people. If you [710:20] are um you know like if you're in North [710:22] America and you're calling between 9 to5 [710:24] on a Monday and Friday you're likely to [710:25] get somebody that is within North [710:28] America. If not it'll be one of uh one [710:31] of the supports from some other area. So [710:34] just be aware of that. That can also [710:35] affect the time they pick up. Uh [710:37] sometimes it's five minutes, sometimes [710:38] it's 30 minutes to to an hour. Uh you [710:41] know, it just depends on what service [710:43] you're asking for and you know what time [710:46] of day. Okay. Um in terms of [710:49] responsiveness, uh for general guidance, [710:52] everything is 24 hours or less. For [710:54] developer business enterprise, if your [710:56] system is impaired, it's within 12 hours [710:58] or less. With production system [711:00] impaired, it's four hours or less. With [711:02] production system down, it's one hour or [711:04] less. And if you're for enterprise, um [711:07] it's going to be business critical [711:08] system down less than 50 minutes. So [711:10] just notice who has what for these [711:12] things. Um I've definitely waited like 3 [711:16] days on general guidance before. So just [711:18] take these with a grain of salt that [711:20] they're not, you know, they don't really [711:21] stick to these that or maybe I'm just [711:23] not paying enough for them to care. [711:24] Okay. Um in terms of uh getting actual [711:28] people assigned to you, this only [711:29] happens at the enterprise level where [711:30] they have their concierge team. that [711:32] they help your um organization uh learn [711:36] how to use AWS. You can ask them many [711:37] questions personally and then you have a [711:39] TAM a technical account manager that is [711:41] somebody that knows um a side and out [711:44] and they'll help you architect things [711:45] and make correct choices or they'll [711:47] check your bill and help you try to [711:48] reduce that bill things like that. Okay. [711:51] In terms of trusted advisor checks at [711:53] the basic developer, you get seven [711:54] advisor checks. Once you're paying for [711:56] business, you get all the checks. The [711:58] cost here for business is zero. Um, for [712:01] developer it's starting at $29 a month. [712:04] For business it's starting at $100 a [712:06] month. And then for enterprise it's [712:07] $15,000 uh a month. So I said starting [712:10] at because it's dependent on your usage. [712:13] Okay. So let's just look at developer [712:15] business enterprise here because basic's [712:17] not going to be applicable here. So for [712:19] developer it's $29 USD a month or 3% of [712:22] the monthly adabus usage which whichever [712:25] is greater. On the exam they're only [712:26] going to ask you like is it $2,900? like [712:29] generally do you know the tier of [712:30] expensiveness but they're not going to [712:32] ask you the percentage of usage. Okay, [712:34] there's not going to be formulas here. [712:35] Um when you get into business it's a [712:37] little bit uh different where they have [712:39] it in different brackets. So it's going [712:40] to be 10% for the first uh 10,000 and [712:44] the next is going to be the next 7,000 [712:45] stuff like that. Similar for enterprise [712:48] as well. So let's just do some math so [712:49] we know that we understand how this [712:51] works. So if you if you had a monthly [712:54] spend of $500 at the developer tier, [712:57] that's 3% of 500 is $15. So they go, [713:00] okay, what is greater? $29 or $15? So [713:02] you're paying $29. If your spend is [713:05] $1,000, that comes out to $30. Uh so [713:08] you're going to end up paying $30 [713:10] because that's greater than 29. Okay? [713:12] For business, uh if your monthly spend [713:14] is a,000, that's 10% of a,000. That's [713:16] $100. If your spend is $5,000, then [713:18] you're going to be paying $500. If your [713:20] monthly spend is 12,000, then the first [713:23] 10% of a of 10,000 is a,000 and then the [713:27] next is 7% of 2,000. So your total bill [713:30] is 140 USD. We're not going to do a [713:32] calculation for enterprise because it's [713:34] the same for business, but hopefully [713:35] that gives you an idea there. Okay. [713:41] Hey, it's Andy Brown from Exam Pro and [713:43] we are taking a look at a technical [713:45] account manager, also known as a TAM. [713:47] And these provide both proactive [713:48] guidance and reactive support to help [713:50] you succeed with your adabus journey. So [713:53] what does a TAM do and this is straight [713:56] from an adabus job posting. [713:58] What they would do is build solutions, [714:00] provide technical guidance and advocate [714:02] for the customer. Ensure ads [714:04] environments remain operationally [714:06] healthy while reducing cost and [714:08] complexity. Develop trusting [714:10] relationships with customers. understand [714:12] their business needs and technical [714:13] challenges. Using your technical uh [714:16] acumen and customer obsession, you'll [714:18] drive technical discussions regarding [714:20] incidents, trade-offs, risk management. [714:22] Consult with a range of partners from [714:24] developers through the seuite [714:25] executives. Collaborative with with [714:28] solutions architect, business [714:29] developers, professional service [714:31] consultants, and sales account managers. [714:34] Proactively find opportunities for [714:35] customers to gain additional value from [714:37] AWS. provide detailed reviews of service [714:40] disruptions, metrics, detailed [714:41] pre-launch planning, being uh part of a [714:44] wider enterprise support team, providing [714:46] postscale cons uh uh consolative [714:50] expertise, solve a variety of problems [714:52] across different customers as they [714:54] migrate their workloads to the cloud. [714:56] Uplift customer uh capabilities by [714:58] running workshops, brown bag sessions. [715:00] Brown bag sessions being sessions that [715:02] occur at lunchtime, something you can [715:03] learn in 30 minutes to an hour. And so [715:06] one thing that's really important to [715:07] understand is that TAMs follow the [715:09] Amazon leadership principles especially [715:11] about customer uh being customer [715:13] obsessed and we do cover the Amazon [715:16] leadership principles somewhere in this [715:17] course and TAMs are only available at [715:19] the enterprise support tier. So [715:21] hopefully that gives you an idea what a [715:22] TAM does. [715:27] Hey, this is Andrew Brown from Exam Pro [715:29] and this follow I'm going to show you um [715:31] Adabus support. And in order to use [715:33] Adabus support or to change your level [715:35] of support, you're going to need to be [715:37] logged into the root account. I should [715:39] say you can use support with IM users, [715:42] but if you want to change the support [715:43] plan, you're going to have to be the [715:44] root user. So the top right corner, I'm [715:46] going to support. And notice here in the [715:48] lefth hand side right now, I have a [715:50] basic plan. And so before we look at [715:53] changing our plan, I'm just going to go [715:54] create a case. and we're going to uh [715:57] just take a look at some of the options [716:00] that are open to us. So we have account [716:01] billing support, service limit, increase [716:03] technical support. Notice this is grayed [716:05] out. So we cannot select anything here. [716:08] I can go to here and increase our [716:10] service limit. And this is something [716:13] that you might have to do uh pretty soon [716:14] early in your account. You might say, [716:16] "Hey, I need more of something like EC2 [716:18] or um a very common thing is SCES." So [716:21] for SCES you might say hey um I need to [716:24] have this amount of emails for etc. [716:27] Okay. So um if we go over to account and [716:30] billing support uh we can go here and [716:32] ask anything we want. So if it's about [716:34] the free tier I could say ask a general [716:36] question getting started and saying uh [716:39] what is free on AWS? [716:43] Um, I want to know what is free on AWS. [716:49] And you can attach uh three attachments [716:51] there. You can choose via uh web and [716:54] phone, which is really nice. Um, but [716:56] today I'm just going to do web here and [716:57] submit that just to kind of show you [716:59] that as an example. And so what that is [717:01] going to do is open a case. And then we [717:03] will see probably respond in 24 hours to [717:06] 48 hours. Just depends on um whether [717:09] it's the weekend or not because it's [717:10] based on business hours, of course. So [717:14] now that we have an understanding of [717:15] basic, let's go take a look at what the [717:17] other tiers look like. So we have basic, [717:19] developer, business, and enterprise. [717:21] Enterprise being extremely expensive, [717:23] developer being affordable, and then [717:25] business being um you know, affordable [717:27] for businesses. So I would say developer [717:29] is okay. It gives you um uh it gives you [717:33] uh better support, but it's all via [717:35] email. And so, you know, if you really [717:37] want good support, you're going to have [717:38] to pay the business one. And that's the [717:40] one that I use quite a bit. So, if I [717:42] change my plan, I'm going to go over to [717:43] business. And this is going to cost me [717:45] 93 bucks just to do to show you here [717:47] today. So, I'm going to go ahead and [717:49] click that. And so, it's now processing [717:51] it. And so, what's going to happen is [717:54] I'm going to have to wait for this basic [717:56] to switch to business because if I go to [717:57] the case here, it hasn't happened as of [718:00] yet. So, notice I cannot select this. [718:03] So, I'm going to see you back here in [718:04] maybe like four or five minutes or [718:06] however long it takes and we'll take a [718:07] look then. Okay, great. Okay. So, after [718:09] a few minutes, it says my plant is now [718:11] business. And what I can do is go ahead [718:12] and create a new case. And so, I can go [718:14] over to technical support and ask a [718:16] question. So, if I was having issues [718:17] with anything, it doesn't matter what, I [718:19] could go over to EC2 Linux. And then I [718:22] could choose my category. So, I could [718:24] say I'm having an issue with um systems [718:27] manager. [718:29] And a lot of times they like you to [718:31] provide the instance ID. It's going to [718:32] change based on what service you choose [718:34] here. Um, but you'll get different [718:36] information. And I'll just say I need [718:38] help [718:39] with um [718:42] logging into my EC2 instance managed by [718:46] SSM. So I could say I created an EC2 [718:50] instance and I am attempting to access [718:55] uh the instance via [718:57] sessions manager [719:00] but it is not working. [719:02] I think I have a RO issue. And then I'm [719:05] just going to go down here and say this [719:07] is not a real question. [719:11] I am filming a demo video for or [719:16] tutorial video [719:20] on how to use support. Okay. And so once [719:23] we do that, we have the option of web [719:25] chat and phone. So if you use phone, [719:27] you're going to enter your phone number [719:28] in and they're going to call you back. [719:30] Uh usually you will be on hold for [719:33] anywhere for five minutes to an hour. It [719:35] just depends. Usually it's within 15 [719:37] minutes. So it's very good. Of course it [719:39] depends on the time of day and your [719:40] location, things like that and the [719:42] service because there's different uh [719:44] support engineers for different types of [719:45] services and the the balance of those [719:48] are different. But generally chat is [719:50] pretty good. So I can go here and I'm [719:52] just going to hit submit and it's going [719:53] to open a chat box. And so you just [719:55] wait. Okay. And sometimes it's super [719:59] fast and sometimes it takes uh minutes. [720:02] Okay. So, we are going to just sit here [720:05] for a bit and um you know I'll just pop [720:08] back here when there is somebody to talk [720:10] to. Okay. Okay. So, after waiting a [720:13] little while, looks like uh we've been [720:14] connected here. So, it took a bit of [720:16] time. So, we're just going to say hello. [720:18] Hi, Ume. Uh this is Andrew Brown. [720:23] Um, I am recording a video to teach [720:26] people how to use AWS and I wanted to [720:31] show them how it support works. [720:38] So, I'm just showing them how the chat [720:41] system works. [720:44] say hello [720:51] and hopefully they'll appreciate or they [720:54] won't. It just doesn't really matter. [721:05] We'll give him a moment. [721:19] There we go. [721:23] That's it. [721:26] Thanks for your help. [721:28] Okay. And so that's pretty much it. Um, [721:30] so you know, there's nothing really uh [721:33] uh special about that, but the idea is [721:34] when you are typing with them, it will [721:36] appear in the correspondence there. So, [721:38] I'm just going to end the chat. Okay. [721:41] Uh, and then I'm just going to mark that [721:43] case as resolved. Sometimes they will [721:44] ask you to resolve it. If I go to cases, [721:47] I probably have some previous ones here. [721:49] Um, and I have a lot, but I don't know [721:51] why they don't all show up here. So, you [721:53] can see this one is pending. This one is [721:55] resolved. I go back to this one, you can [721:57] kind of see that the uh history of a [721:59] conversation is kept, and you can go [722:01] back and forth uh with the people there. [722:04] Um, and yeah, that's pretty much it. Uh [722:05] you can also do screen sharing. So they [722:07] might send you a request to go on Zoom [722:10] or download this piece of software that [722:11] shares your screen. And so that is [722:14] another option as well. So they can get [722:15] pretty hands-on to help you uh with your [722:18] problems there. But that's pretty much [722:19] all I wanted to show you with support. [722:21] I'm going to downgrade this and I'm not [722:23] sure if they're going to give me back my [722:24] money. Sometimes they'll prorrate it for [722:25] you. But I go here and go back to basic. [722:28] Um, so we will also refund your credit [722:30] card directly in the months remaining [722:32] fees on your old plan which you [722:34] previously paid. You're obligated to pay [722:36] a minimum of 30 days of support each [722:38] time you register. So, I'm not going to [722:39] get any money back, which is totally [722:41] fine because I just wanted to show you [722:42] how that works. But business support is [722:44] definitely worth it. And uh, you know, [722:46] that's it. [722:52] So the adabus marketplace is a curated [722:55] digital catalog with thousands of [722:56] software listings from independent [722:58] software vendors uh easily find, buy, [723:01] test and deploy software that already [723:02] runs on ads. The product can be free to [723:05] use or can have an associated charge. [723:07] The charge becomes part of your ads bill [723:09] and once you pay ads market pays the [723:11] provider. The sales channel for ISV and [723:14] consulting partners allow you to sell [723:15] your solutions to other ads customers. [723:18] products can be offered such as AMIs, [723:20] ABIS cloudformation templates, software [723:22] as a service offerings, web ACL's, AIS [723:25] WAF and rules. So, it sounds great. Um, [723:28] if you want to sell here, I think you [723:29] need like a US bank account to do it. [723:31] Um, and you know, sometimes marketplace [723:34] is just part of AWS. So, like when [723:36] you're using the EC2 marketplace, you [723:38] are technically using the Adabus [723:39] marketplace. Um, but they also have like [723:41] a dedicated page for it. So, it's [723:43] integrated with some services and then [723:45] it's also standalone. Okay. [723:51] Hey, this is Andrew Brown from Exam Pro [723:53] and this follow along, we're going to [723:54] take a look at the Adabus marketplace. [723:56] So, what I want you to do is go on the [723:57] top and type in marketplace and that'll [723:59] bring us over to here. The marketplace [724:01] can be found in a variety of different [724:03] places on the platform. Here you can see [724:04] that uh previously I was using something [724:07] called Guacamole Bastion Host to launch [724:09] a server. Um, but the idea is that um [724:12] you can discover products and [724:13] subscriptions that you might want to [724:15] utilize. Okay. So, if I go over here, [724:17] there's a variety of different things. [724:20] And so, it could be like I want to have [724:23] something like a firewall. That might be [724:26] something that we might be interested [724:27] in. So, we could search there. And [724:28] there's like bring your own license [724:30] firewall. So, maybe you have a license [724:31] with this and you want to run it on an [724:33] EC2 instance, something like that. [724:36] Again, it's not like super complicated [724:38] uh what's going on here. But a lot of [724:40] times, you know, when you're using [724:41] services, you're accessing the [724:42] marketplace anyway. So like when I'm [724:44] launching an EC2 instance, [724:47] notice on the lefth hand side says ads [724:49] marketplace. And so I don't have to go [724:50] to the marketplace there. I can just [724:52] kind of like check out the thing I want. [724:54] Um and that's pretty much all there [724:55] really is to it. Okay. So you know, [724:57] hopefully that makes sense. [725:02] Well, let's take a look here at [725:03] consolidated billing. So this is a [725:05] feature of Adabus organizations that [725:06] allows you to pay for multiple accounts [725:08] via one bill. So the idea here is we [725:11] have a master account and we have member [725:13] accounts. And I'm pretty sure that we [725:15] probably call this root account. Now I [725:16] don't think uh master account might be a [725:18] data term, but it's still showing up in [725:19] the documentation. The idea is that if [725:21] you have member accounts within your [725:22] organization, they're all going to be [725:24] consolidated under this single account. [725:26] If you have an account outside of your [725:28] organization, um you know, this is not [725:30] going to give you uh this is going to be [725:32] basically a separate bill um as if it's [725:34] like a standalone organization or what [725:36] have you. Okay. So uh for billing Adabus [725:40] treats all accounts in an organization [725:42] as if they were one account. You can [725:44] designate one uh uh master or root [725:47] account that pays the charges for all [725:48] the other member accounts. Consolidate [725:50] billing is offered at no additional [725:52] cost. You can use uh cost explorer to [725:54] visualize usage for consolidated billing [725:57] which we can see I have the icon here. [725:59] Uh you can combine the usage across all [726:01] accounts in the organization to uh to [726:04] share the volume pricing discount which [726:06] we did cover in this course separately. [726:07] If you want an account to be able to [726:09] leave the organization, you do have to [726:11] attach it to a new payment method. So, [726:14] if let's say you had an account and you [726:15] want to give it to your friend or [726:17] whatever, they're have to hook up their [726:18] credit uh their credit card, but you can [726:19] totally have uh an account leave an [726:22] organization, but you have to deal with [726:23] that billing aspect. Okay. [726:30] All right. So, there's a really cool way [726:31] to save in AWS and that's through volume [726:33] discounts and it's available for many [726:35] services. is the more you use the more [726:36] you save is the idea behind it. Um and [726:39] so consolidating billing lets you take [726:40] advantage of volume discounts. This is a [726:43] particular feature of adabus [726:44] organization. So if you do not have the [726:45] orcs turn on you're not going to be able [726:47] to take advantage of that. Okay. So one [726:49] example would be something like data [726:51] transfer where it is build uh for the [726:53] first 10 terabytes at at 17 cents or [726:57] sorry 17 cents and then the next 40 [727:00] terabytes it will be at3 cents. Okay. So [727:04] if we had two accounts um such as Odo [727:07] and DAX and they're not within a [727:09] organization we can calculate those and [727:11] see what they are unconsolidated and [727:13] just so you know 1 TB equals 1024 GB and [727:16] that's what you're going to see in these [727:17] calculations. So for Odo uh you know if [727:19] he has four terabytes and that is uh we [727:22] calculate the gigabytes there and we [727:24] times it by uh the um cent value there [727:27] we're going to get $696. [727:29] Okay, for DAX, we're going to end up [727:32] with uh about 1392 there. And so if we [727:36] were to add those up, the bill would [727:37] come out to $2,88. [727:41] Okay. So the idea is that there's an [727:43] organization and they like your company [727:45] and they created two accounts, but [727:47] they're just not within an organization. [727:48] By having them in the organization, [727:50] you're going to save um about almost $80 [727:53] there. So um that is a reason why you'd [727:57] want to use volume discounts. Okay. [728:02] Hey, this is Andrew Brown from Examro [728:04] and we're taking a look at Abis Trusted [728:06] Advisor. So, Trusted Advisor is a [728:08] recommendation tool which automatically [728:10] and actively monitors your Adabus [728:12] accounts to provide actual [728:13] recommendations across a series of [728:15] categories. So, this is what it looks [728:17] like. I personally prefer the older [728:19] dashboard, but this is what they have [728:21] now. And you can see along the side we [728:23] have a bunch of categories and then we [728:24] have some checks here saying uh you know [728:27] what are we meeting what are we not and [728:29] you can go in and read each one and [728:31] they'll tell you so much information [728:32] they'll even show you like what things [728:35] are not meeting that requirements in [728:37] some case you can easily remediate by [728:38] pressing a button not in all cases but [728:40] the thing with ads trust advisor is [728:42] think of ads trusted advisor like an [728:44] automated checklist of best practices on [728:46] AWS and they kind of map to the pillars [728:50] of the well architected framework. Not [728:51] exactly but pretty close. But there are [728:53] five categories of ads trusted advisor. [728:56] So we have cost optimization. How much [728:58] money can we save? Performance. So how [729:01] can uh we improve performance? Security. [729:03] How can we improve security? Fault [729:05] tolerance. How we can we prevent a [729:07] disaster or data loss? And service [729:10] limit. So are we going to hit the [729:12] maximum limit for a service? And so uh [729:15] the next thing we need to discuss is um [729:18] there's a variation of the amount of [729:20] checks that are available to you based [729:21] on your support plan. So you know if [729:24] you're using basic or developer you have [729:25] seven trusted advisor checks and if you [729:28] have business enterprise you have all [729:29] the trusted advisor checks. So uh if [729:32] we're talking about just the ones that [729:33] are available to you, the ones that come [729:34] for free is MFA on root account, [729:36] security groups, specified ports of [729:38] unrestricted, Amazon S3 bucket [729:40] permissions, Amazon EBS public [729:42] snapshots, Amazon RDS public snapshots, [729:45] IMU. So this is just about alerting you [729:48] about discouraging the use of the root [729:49] account service limits. So all service [729:52] limit checks are free. Um, it's weird [729:54] because they call it the like seven [729:56] security checks, but if you counted all [729:58] the service limits, it' obviously be too [730:00] large of a number. But notice that one [730:02] through six are all security checks. So, [730:04] you're not getting anything from the [730:05] other tiers, just the security tier. And [730:08] what I want to do is just go over a [730:11] bunch of available checks out there. [730:13] It's probably not the full list because [730:14] I couldn't even be bothered to update it [730:16] if they've added more, but it'll give [730:18] you a general idea of what you could [730:19] expect under each category. So for cost [730:21] optimization, um it could be things like [730:23] looking at idle load balancers. So you [730:26] know, if you have load balancers you're [730:27] not using, you're paying for them. So [730:29] get rid of them. Unassociated elastic IP [730:31] addresses. So for every IP that's not [730:33] associated, you're paying for as well. [730:35] Maybe under performance, you have um [730:37] high utilization of Amazon EC2 [730:39] instances. So maybe you can save money [730:41] by switching to smaller instances. Under [730:44] security, we saw MFA on root account, [730:46] very popular one. making sure you turn [730:48] on key rotation could be something as [730:50] well there under fault tolerance. Um it [730:54] could be making sure that you're using [730:55] backups on your Amazon RDS database. [730:57] Maybe that's turned off. Uh for service [731:00] limits, there's just a ton of them. And [731:02] so uh one that that you know might be [731:04] pertinent to you is VPCs or EC2 limits. [731:06] So there you go. [731:12] Hey, this is Andrew Brown from Exam Pro [731:14] and we're going to take a look at [731:15] trusted advisors. So, what I want you to [731:17] do is go to the top and type in trusted [731:18] advisor. [731:20] And once you're there, you're going to [731:22] notice on the lefth hand side, we have [731:23] cost optimization, performance, [731:24] security, fault tolerance, service [731:26] limits. Right now, there are no [731:27] recommended actions because there's not [731:29] much going on this account. And when you [731:31] uh have the uh free level of support, [731:34] the basic support, you're not going to [731:35] have all these checks. But if we go in [731:37] here, we can still see kind of what they [731:39] do. Um, so we have like performance, [731:42] security, things like that. So, these [731:43] are the ones that we actually can see. [731:46] And they generally work all the same [731:47] way. If you expand here, it's going to [731:49] say Amazon EBS public snapshots. So [731:51] check the permission settings for the [731:53] EBS volume snapshots and alert you if [731:56] the any snapshots are marked as public. [731:58] And so if you scroll on down, if there [732:00] were ones that were an issue, it would [732:02] tell you right here. Okay. Then down [732:05] below here, we see like check buckets in [732:08] Amazon S3 that have open access [732:10] permissions or allow access to [732:12] authenticated AWS users. So yellow the [732:15] ACL allows uh list access for everyone. [732:19] Uh a bucket policy allows for any kind [732:21] of open access. Bucket policy statements [732:22] have public grant access. So maybe what [732:25] we can do is see if we can get this to [732:27] trigger. [732:28] And so what I'm going to do here is go [732:30] over to S3 and what we're going to do is [732:33] make a bug bucket that has full access. [732:36] Okay. So I'm going to create a new [732:37] bucket and it'll say my exposed bucket. [732:42] We'll scroll on down here and we'll just [732:43] check box that off and create the bucket [732:46] and say I acknowledge that is totally [732:48] fine. [732:50] Okay. And so now I have a bucket that is [732:52] 100% exposed. If we go back to trusted [732:55] advisor, give this a refresh. I'm not [732:57] sure how fast it will show up here, but [732:59] if I expand. [733:01] So it says the bucket ACL allows upload [733:05] delete for everyone. The trusted advisor [733:07] does not have permissions to check the [733:08] policy. uh bucket policy statements that [733:11] grant public access. [733:14] So what we could try to do is make a [733:17] policy [733:22] and try to grant all access here. So I'm [733:26] not writing these every single day, but [733:27] I'm sure we could try to figure this [733:28] out. [733:31] Um, [733:34] we'll say S3 bucket policy public access [733:39] public read. [733:47] And so that one might be a good example. [733:49] So I'm going to go ahead and copy this [733:50] one. Granting read only permission to [733:52] anominous users. [733:54] I don't recommend you doing this. I'm [733:56] just doing this to show you to see if we [733:57] can get the trusted advisor to check [733:59] because I don't want you to uh do this [734:00] and forget about it and then have a [734:02] serious issue. But the principle is set [734:04] to anybody so anyone can read it. And [734:06] here it's saying get object etc. Then [734:09] it's saying what particular resource. So [734:11] this one is going to be for uh the [734:13] bucket in question here which is my [734:15] exposed [734:17] bucket. [734:19] We're going to scroll on down save the [734:21] changes. [734:22] Okay. So this bucket is publicly [734:24] accessible. We're going to go back over [734:26] here, refresh, and see what we can see. [734:32] Okay, so checks buckets in S3, etc. So, [734:35] it should appear under here, [734:39] and it could be that it's just going to [734:40] take some time. So, what I'm going to do [734:42] is I'm just going to hang tight for a [734:43] little bit. Oh, there we go. Okay, so [734:46] it's showing up and I guess it just took [734:48] some time to populate. And so, here we [734:50] can see we have a a yellow symbol. It's [734:52] a warning saying, "Hey, there's a [734:54] problem here." If we go back to the [734:55] dashboard, I wonder if that shows up. [734:57] So, this one's for investigation and [734:58] recommendation. [735:00] So, you know, hopefully that kind of [735:02] makes sense to you. I think in some [735:03] cases you can do remediation from from [735:06] here or at least you can go and check [735:08] box and say, "Okay, um ignore could have [735:12] swore there was remediation for some of [735:14] these." [735:16] But in any case, you know, that's [735:18] generally what trusted advisor does. Um, [735:21] I think that you probably can have it so [735:22] it gives you alerts. So, yeah, you could [735:25] set recipients for particular things [735:27] like if there's a security issue that I [735:29] could email a particular person on your [735:30] team and they could deal with it. But [735:32] that's pretty much it. So, what I'm [735:33] going to do is go ahead and delete this [735:34] bucket. I'm all done with it. [735:37] We'll go delete [735:40] and say my delete uh my exposed bucket [735:43] here to delete it. And that is it. Okay. [735:53] Let's cover the concepts of service [735:55] level agreements also known as SLAs. So [735:57] an SLA is a formal commitment about the [735:59] expected level of service between a [736:01] customer and provider when a service [736:03] level is not met and if customer meets [736:04] its obligation under the SLA customer [736:06] will be eligible to receive [736:08] compensation. So financial or service [736:10] credits and so when we talk about SLAs's [736:12] then we talk about SLI. So a SLI service [736:15] level indicator is a metric or [736:17] measurement that indicates what measure [736:18] of performance a customer is receiving [736:20] at a given time. A SLI metric could be [736:23] uptime, performance, availability, [736:24] throughput, latency, error rate, [736:26] durability, correctness. And if we're [736:28] talking about SLI, then we're talking [736:29] about SLOs's, service level objectives. [736:31] So the objective that that the provider [736:33] has agreed to meet, SLOs's are [736:35] represented as a specific target [736:37] percentage over a period of time. And so [736:40] an example of a target percentage would [736:42] be something that says an availability [736:44] SLA of 99.99% [736:46] in a period of three months. All right. [736:49] And let's just talk about target [736:50] percentages and the way they can be [736:52] represented. Very common ones we will [736:54] see is 99.95% [736:56] 99.99%. [736:59] Uh then we have 99 followed by 9. [737:03] And so commonly we just say we call this [737:05] nine 9ines. Okay. And then there's one [737:08] 911s. So if somebody says we have an SLA [737:11] guarantine of of 911s, it's going to be [737:14] the 99 followed by 911s. All right, [737:22] let's take a look at Abus service level [737:24] agreements. And so there are a lot of [737:25] them and I just want to just show you a [737:28] few services to give you an idea how [737:30] they work. uh on the exam they're not [737:32] going to ask you like oh what's [737:33] Dynamob's SLA for global tables um but [737:37] generally we should just go through this [737:38] because it's good practice so let's take [737:39] a look at Dynamob SLA so Adabus will use [737:42] commercially reasonable efforts to make [737:43] Dynamob available with a monthly uptime [737:46] percentage of each adabus region during [737:48] any monthly billing cycle uh so for a at [737:51] least 99.999% [737:54] if global tables SLAs's applies or [737:56] 99.99% [737:58] if the standard SLA applies in the If [738:00] event Dynamo DB does not meet the [738:02] service commitment, you'll be eligible [738:04] to receive service credits described [738:05] below. So we have monthly uptime [738:08] percentage and the service credit [738:09] percentage we get global tables standard [738:11] tables. So let's take a look here. So if [738:15] less than 99.999% [738:17] but equal to or greater than 99.0% [738:20] is met. So if if the service ends up [738:23] being this, you'll get 10% back of what [738:25] you spent as service credits. If it [738:28] drops between 99.0 0 and 95.0 you get [738:32] 25% back. If it's less than 95 uh% [738:36] um then it's 100% back. Okay. And you [738:39] get the general idea here. SLA is going [738:41] to be slightly different with their [738:42] drops. Now let's take a look at um [738:45] compute. And so compute is going to [738:46] apply across a bunch of compute services [738:49] probably because they're all using EC2 [738:51] underneath. So that's probably the [738:53] reason for it. So we have EC2, EBS, ECS, [738:56] EKS and AIUS makes two SLA commitments [739:00] uh for the included services. So we have [739:02] a region level SLA that uh governs [739:04] included services deployed across [739:06] multiple AS or regions and an instance [739:09] level SLA that governs Amazon EC2 [739:11] instances individually. And again we [739:13] have our monthly uptime percentage our [739:15] service credit percentage region and [739:17] instance level. So you can just see the [739:19] same thing. It's like it's going to [739:21] change based on uh what it can meet. [739:24] Then we'll take a look at one more like [739:25] RDS. So a relational database service. [739:29] So it will use commercially reasonable [739:31] efforts to make multi-AZ instances [739:33] available with monthly uptime percentage [739:35] of 99.95% during any monthly billing [739:38] cycle. And again, you know, if if they [739:40] don't meet those requirements, you're [739:41] going to get service credits back, which [739:42] basically equal USD dollars on the [739:44] platform. And so for this, it looks like [739:46] that. So just notice that you know with [739:48] like compute it was for a a bunch of [739:51] services for DynamoB it was based on uh [739:54] particular features like global standard [739:55] tables SLA it's very straightforward. Uh [739:59] we didn't do S3 because I just did not [740:00] want to show you that one. It was just [740:02] too complicated. But my point is is that [740:04] it's going to vary. So you have to look [740:05] up per service. Okay. [740:11] Hey, this is Andy Brown from Exam Pro [740:13] and we are taking a look at Amazon's [740:15] service level agreements. And so the way [740:17] you find SLAs's is you pretty much just [740:19] type in SLA for whatever it is. So if [740:21] you're looking for compute, you type in [740:23] SLA or you look for a particular [740:24] service. So maybe you say SageMaker [740:27] SLA AWS. I don't think there's like a [740:29] generic SLA page. At least I don't know [740:32] where it is. I always just type in SLA [740:33] to find what it is. And through that, [740:35] you can just kind of read through and [740:36] try to find out uh the things that that [740:39] matter to you for your business. Okay. [740:46] Let's take a look here at the service [740:48] health dashboard. And so the service [740:50] health dashboard shows general status of [740:52] adabus services. And it's really simple. [740:54] The idea is that you can uh check based [740:56] on uh the geographic area. So you'd say [740:59] North America, Europe, etc. And what [741:01] you'll see is an icon that says whether [741:03] the service is in in in good standing [741:05] and the details whether the service is [741:07] operating normally, etc. Notice they [741:09] also have an RSS feed. The reason I'm [741:11] talking about service health dashboards [741:12] is because I want to talk about personal [741:14] health dashboards and because they're [741:15] both called health dashboards, it's [741:17] confusing. So, I wanted to tell you [741:18] about this one first. So, now we'll jump [741:20] into the Adabus personal health [741:22] dashboard. [741:26] So, we saw the service health dashboard. [741:29] Now, let's take a look at the Adabus [741:31] personal health dashboard. So, this is [741:33] what it looks like and it provides [741:35] alerts and guidance for Adabus events [741:36] that might affect your environment. All [741:38] adabus customers can access the personal [741:40] health dashboard. The personal health [741:42] dashboard shows recent events to help [741:44] you manage active events and show [741:46] proactive notifications so that you can [741:47] plan for scheduled activities. You uh [741:50] you can use these alerts to get notified [741:52] about changes that can affect your ID [741:54] resources and then follow the guidance [741:55] to diagnose and resolve the issue. So th [741:59] this is very similar to the service [742:01] health dashboard, but it's personalized [742:02] for you. Um, and it's uh, you know, I I [742:06] don't see it crop up very often, but if [742:08] you had to create alerts or be reactive [742:10] to uh, things that are happening within [742:12] your bus, this is where you'd do it. [742:14] Okay. [742:19] So, there's a team called Adabus Trust [742:21] and Safety that specifically deals with [742:23] abuses occurring on the Adabus platform. [742:25] And so, I'm going to just list of all [742:26] the cases where you'd want to be [742:28] contacting them as opposed to support. [742:30] So, the first is spam. So you're [742:32] receiving unwanted emails from an adus [742:34] owned IP address or adabus resources are [742:36] used to spam websites or forms. Port [742:38] scanning. Your logs show that one or [742:40] more adabus owned IP addresses are [742:41] sending packets to multiple ports on [742:43] your server. Uh you also believe uh this [742:46] is an attempt to discover unsecured [742:47] ports. Uh DOSs attack. So your logs show [742:50] that one or more owned IP addresses are [742:52] used to flood ports on your resources [742:54] with packets. You also believe this is [742:56] an attempt to overwhelm or crash your [742:57] server or the software running on your [742:59] server. Intrusion attempts. So your logs [743:02] show that one or more adabus owned IP [743:03] addresses are used to attempt to log [743:05] into your resources. Hosting prohibited [743:07] content. So you have evidence that [743:09] Adabus resources are used to host or [743:10] distribute prohibited content such as [743:12] illegal content or copyrighted content [743:14] without the consent of the copyright [743:16] holder. Distributing malware. So you [743:18] have evidence that AIS resources are [743:20] used to distribute software that was [743:21] knowingly created to compromise or cause [743:24] harm to computers machines that it's [743:26] installed on. And so in any of these [743:28] cases, you're not going to adabus [743:30] support. You're going to open up an [743:32] abuse ticket. And so you got to contact [743:33] abuse at amazonus.com [743:37] or fill out the uh uh Amazon abuse uh [743:40] form. So and this is whether it's coming [743:43] from uh an outside ads account or even [743:45] your internally if you think that [743:47] somehow someone has compromised your [743:48] account and it's being used in any of [743:50] these ways uh this is what you're going [743:52] to do. Okay. [743:57] Hey, this is Andrew Brown from Exam Pro [743:59] and we're looking at AWS abuse. So, uh, [744:01] we were saying that Adabus has the [744:02] Adabus trust and safety team. And what [744:05] you'll want to do is if you, uh, find [744:07] that there's an issue, you're going to [744:08] report it to this email at [744:10] abuseamazon.com [744:11] or you're going to use this form, which [744:13] is the report Amazon advis. So you'll go [744:16] down here, you'll sign in, you'll put [744:18] your email in, your first name, last [744:19] name, org, phone number, um the source [744:21] IP, the the details uh in uh here. You [744:25] can even select the type of abuse. So [744:27] you say if it's this kind or that kind, [744:29] things like that. It's very [744:30] straightforward. Um and that's pretty [744:32] much it. Okay. [744:37] Hey, this is Andrew Brown from Exam Pro [744:39] and we are taking a look at the Adabus [744:40] free tier. And this allows you to use [744:42] Adabus at no cost. Um, and when we say [744:45] free tier, there there there's the idea [744:47] of the first 12 months of sign up. [744:49] There's going to be special offerings or [744:51] it's free usage up to a certain monthly [744:53] limit forever. Um, and then there's just [744:55] services that are inherently free, which [744:57] we have a total separate slide on, but [744:59] let's talk about just the free tier [745:00] stuff. And this is absolutely not the [745:03] fullest. Um, but uh it's a good idea, [745:05] like it gives you a good um overview of [745:07] stuff that is free. So for EC2, which [745:10] you use a web server, you get a T2 micro [745:12] for 750 hours per month for one year. [745:15] And so there's about 730 hours um in uh [745:19] a month. And so that means you could [745:21] have a server running [745:23] uh the entire month for free uh and an [745:27] additional server for a bit as well. So [745:30] for RDS, which is a relational database [745:32] service for either MySQL or Postgress, [745:34] we can do a T2DB micro for 750 hours for [745:38] free. So there we get our free database [745:40] and you would be surprised how far you [745:42] can get with a uh a T2DB micro. Um you [745:46] know even for a mediumsiz startup you [745:48] can run it on uh a T2DB micro with no [745:50] problems. Then you have your elastic [745:52] load balancer. You get 70 hours per [745:54] month for one year. Um so that is a [745:56] really good thing. Uh load balancers [745:58] usually cost $15 a month. So that's [746:00] great. Actually all these pretty much [746:01] cost $15 a month. So that's about um [746:04] 1530 $45 month over month for a year [746:08] that's uh free. Then you have Amazon [746:10] CloudFront. This is where you'd have [746:11] your homepage, caching your videos, [746:13] things like that. So you get 50 [746:14] gigabytes data transfer out for the [746:16] total year. Then there's Amazon Connect. [746:18] You get your toll-free number there. 90 [746:20] minutes of a call time per month for one [746:21] month or for one year, sorry. Amazon [746:24] Elastic. So you could launch a Reddus or [746:27] Elasticash server. You get 70 hours on a [746:30] cache T3 micro for a year. um elastic [746:33] search service. So this full text search [746:35] so again 750 50 hours per month for one [746:38] year. Pinpoint campaign marketing email. [746:40] So you can send out 5,000 targeted users [746:42] per month for one year. SCES so um [746:44] simple email uh service. So this is for [746:47] um transactional emails um so that you [746:50] send out from your web app. So 62,000 [746:52] emails per month forever. It was code [746:54] pipeline. So one pipeline free. It was [746:56] code build. So uh this is for building [746:59] out uh projects or things like that. So [747:01] 100 build minutes per month forever. It [747:04] was Lambda service compute 1 million [747:06] free requests per month, 3.2 million uh [747:09] million seconds of compute time per [747:11] month for free. Uh and you know I like [747:13] to highlight these ones because for [747:15] traditional architecture you're always [747:16] going to have a web server, a database, [747:18] a load balancer. Um and you might even [747:21] have cloud front end there as well. But [747:23] uh yeah, again there's a huge list and [747:25] this does not even tap the surface of [747:27] what's free on AWS. [747:32] Hey, this is Andrew Brown from Exam Pro [747:34] and we are taking a look at ABUS [747:36] promotional credits and these are the [747:37] equivalent to USD dollars on the Adabus [747:39] platform. ABS credits can be earned [747:41] several ways. This could be joining the [747:43] Adabus activate startup program, winning [747:44] a hackathon, participating surveys, and [747:47] any other reason that Adus wants to give [747:49] credits out. Uh once you uh have um a [747:52] promotional code, you click the redeem [747:54] credit button in the billing console. [747:55] You enter it in and then your credits [747:57] will be shown there. You can monitor [747:59] them via budgets or uh via cost explorer [748:02] and probably even billing alarms. IBS [748:04] credits generally have an expired date [748:06] attached to them could be a few months [748:07] uh to a year credits can be used for [748:09] most services but there are exceptions [748:11] where its credits cannot be used like [748:12] purchasing a domain via RO 53 because uh [748:15] that domain costs money outside of AWS's [748:18] cost like for their infrastructure and [748:20] virtual stuff and so for things like [748:22] that uh you know they're not going to be [748:24] you're not going to be able to use [748:25] credits for that. Okay. [748:31] The adabus partner network also known as [748:33] APN is a global partner program for AWS. [748:35] So joining the APN will open your [748:37] organization up to business [748:39] opportunities and allow exclusive [748:41] training and marketing events. So when [748:43] joining APN you can either be a [748:45] consulting partner so you help companies [748:46] utilize ads or a technology partner. You [748:49] build technology on top of adabus as a [748:51] service offering and a partner belongs [748:53] to a specific tier. So, it's either [748:55] going to be select, advance, or [748:56] premiere. When you sign up, it's free to [748:59] sign up, but you're not going to be able [749:00] to do much until you start uh committing [749:02] to an annual fee. So, that's it's like a [749:05] certain amount of money to uh be able to [749:07] be part of that tier. And it starts in [749:09] the thousands. Okay? So, I think the [749:10] first tier is like something like a,000 [749:12] or $2,000. And it gets uh more expensive [749:14] as you go up as a tier. And you also [749:17] have to have particular knowledge [749:18] requirements. So this could be holding [749:20] uh particular adabus certifications at [749:23] the at the uh foundational level at the [749:25] associate level things like that. Um or [749:28] it could be uh adabus APN exclusive [749:30] certifications. So training that um it's [749:32] not adabus certifications but there's [749:34] certifications that are only available [749:35] to partners saying like how do you it [749:38] could be like something like how do you [749:39] uh talk to customers or communication [749:42] things like that. You can get back [749:44] promotional adabus credits. So, you [749:46] know, if you say, "Oh, well, man, I [749:48] spent uh $2,000 on just being able to uh [749:52] get into the APN," at least the idea is [749:54] that you can generally get back that uh [749:57] that spend on AWS. So, it's like you [749:59] committing if you give like $2,000, it's [750:01] like you're going to commit to keep [750:02] using AWS. I'm not showing the annual [750:05] fee commitments here and the promotional [750:07] credits that you get back just because [750:08] they've changed it a couple times on me [750:10] and I just don't want this slide to go [750:11] stale in case they happen to change it [750:13] again. So you'll have to look that up to [750:15] find out what they actually are right [750:16] now. Uh you can have unique speaking [750:19] opportunities in the official adabus [750:20] marketing channels like the blogs or [750:22] webinars. Being part of the APN is a [750:24] requirement to be a sponsor with a [750:26] vendor booth at Adus event. So when you [750:28] when you go to reinvent or any ads um [750:30] event all the vendors are part of the [750:32] APN. All right. So they've paid their [750:34] fee and now they paid an additional fee [750:36] to get their booth. But um yeah, the [750:39] partner network uh is very good for uh [750:41] uh helping you find new business and [750:43] connecting with other people that are [750:44] building workloads in AWS. But hopefully [750:46] that gives you an idea of how that [750:47] works. Okay. [750:52] Hey, this is Andrew Brown from Exam Pro [750:54] and we are taking a look at budgets. So [750:56] budgets gives you the ability to set up [750:58] alerts if you exceed or approaching your [751:00] defined budget, create cost, usage or [751:03] reservation budgets. It can be tracked [751:05] at the monthly, quarterly, or yearly [751:07] levels with customizable start and end [751:10] dates. Alerts support EC2, RDS, [751:12] Redshift, Elasticcast reservations. Uh, [751:15] and so the idea here is you can choose [751:17] your budget amount. So it could be like [751:19] a $100. It'll even show you what was the [751:21] last amount if you're uh resetting the [751:23] budget to something new. You can choose [751:26] based on a different kind of unit. So if [751:28] you wanted to be based on running hours [751:31] on EC2, you could totally do that. is [751:33] budgets can be used to forecast costs [751:35] but is limited compared to cost explorer [751:37] or doing your own analysis with adas [751:39] cost and usage reports along with [751:40] business intelligence tools. Budgets uh [751:43] based on a fixed cost or or you can plan [751:46] your cost uh upfront based on your [751:48] chosen level can be easily managed from [751:50] the ads budgets dashboard via the ads [751:53] budgets API. Get notified by providing [751:55] email or chatbot and threshold uh how [751:58] close to the current or forecasted [751:59] budget. Um, so you'd see a list of [752:01] budgets here, uh, current versus [752:03] forecasted, the amount used, things like [752:05] that. You can see your budget history. [752:07] You can download a CSV. Uh, it'll show [752:09] you the cost history right in line [752:11] there, which I can't show you. It It's [752:12] hard to see there. You get the first two [752:14] budgets are free. So, there's no reason [752:16] not to set a budget when you first get [752:17] into AWS. And each budget costs about uh [752:20] 02 cents a day. So, it's like 60 cents [752:23] um uh USD per month for a budget. So, [752:25] they're very cheap to use. And you got a [752:27] limit of 20,000 budgets, so you're going [752:28] to be in good shape. Okay, [752:34] let's take a look here at AIS budget [752:36] reports, which is used alongside AIS [752:38] budgets to create and send daily, [752:39] weekly, or monthly reports to monitor [752:41] the performance of your ads budgets that [752:43] will be emailed to specific emails. So, [752:45] it's not too complicated. Here you say [752:47] create the report budget, choose your [752:48] frequency, uh the emails you want, and [752:52] budget report serves as a more [752:53] convenient way of staying on top of [752:55] reports since they're delivered to your [752:56] email instead of logging into the [752:58] management console. So, it's just for [752:59] those people that just can't be bothered [753:01] to log in. Okay. [753:06] Well, let's take a look here at AIAS [753:07] cost and uses reports. So, generate a [753:09] detailed spreadsheet enabling you to [753:11] better analyze and understand your ads [753:12] cost. So, this is kind of what it looks [753:14] like. And when you turn this feature on, [753:16] it will place it into an S3 bucket. You [753:18] could use something like Athena to turn [753:20] the report into a queryable database [753:21] since it's very easy to consume S3 CSVs [753:24] into Athena. You could use uh Quicksite [753:26] to visualize your billing data as [753:28] graphs. So, Quicksite is a business [753:30] intelligence tool similar to Tableau or [753:33] PowerBI. You could also ingest this into [753:36] Redshift. Um, but the idea here is when [753:39] you turn it on, you can choose how [753:41] granular you want the data to be, [753:42] hourly, daily or monthly. If you turn on [753:44] daily, you'll be able to even say spikes [753:46] of uh of of of costs for EC2 instances, [753:50] which is kind of nice. The report will [753:52] contain cost allocation tags um which I [753:55] think we have a separate slide on that [753:57] type of tags and the data is stored in [753:59] either as either a CSV it'll be zipped [754:02] or it will be a parkquet format. It just [754:04] depends on how you want it um uh for [754:06] that. Okay, [754:11] let's talk about cost allocation tags. [754:14] So these are optional metadata that can [754:16] be attached to ads resources. So when [754:18] you generate out a cost and uses report, [754:20] you can use that data to better analyze [754:22] your data. So what you'd have to do is [754:25] make your way over to cost allocation [754:26] tags and need to activate the tags you [754:29] want to show up. There are two types of [754:30] tags. So we have userdeed. So whatever [754:33] you've previously tagged will show up [754:34] probably there you turn it on. So if you [754:37] made one with project, you turn on [754:38] project and there's a lot of ads [754:40] generated ones that you can turn on. So [754:42] there's a huge list there. But uh yeah, [754:45] that's particular with cost. um usage [754:48] and reports. If it says like cost [754:50] allocation reports, it's just that's [754:51] what cost and usage reports used to be [754:53] called. Um and some of the documentation [754:55] is a bit old there, but yep, there you [754:56] go. [755:01] So, you can create your own alarms in [755:04] Cloudatch alarms to monitor spend, and [755:05] they're commonly called building alarms. [755:08] Uh and so, it's just a regular alarm, [755:09] but it's just focused on spend. But in [755:11] order to do this, you have to turn on [755:13] building alerts first in order to uh be [755:15] able to use it. Uh, and then you'll go [755:17] to Cloudatch alarms and you can choose [755:19] billing as your metric and then you just [755:21] set your alarm however you'd want. [755:23] Billing alarms are much more flexible [755:25] than ads budgets and are ideal for more [755:27] complex use cases for monitoring spend [755:29] and usage in terms of alerting. So, you [755:32] just have to decide what you want to do. [755:34] Uh, before ads budgets, this was the [755:36] only way to do it. And so, this is the [755:38] way I'm used to doing it and I still do [755:39] it this way today. But, uh, you know, [755:41] both options are valid and just have to [755:43] decide what is your use case. Okay. [755:49] Let's take a look at AAS cost explorer [755:50] which lets you visualize, understand and [755:52] manage your ads cost and usage over [755:54] time. So, uh here's a big graphic of ads [755:57] cost explorer and you can specify time [756:00] and range and aggregation and it has a [756:02] lot of robust filtering. Um what's [756:04] really nice is that they have a bunch of [756:05] default reports for you. So, I'm just [756:08] going to get my pen tool just to show [756:09] you where that button is. It's over uh [756:11] here. Uh if you can see my marker there, [756:13] but but you know you can look at things [756:15] like monthly cost by service, monthly [756:17] cost by linked account, daily cost [756:20] marketplace, R utilization. So there's a [756:22] bunch there. You can also notice you can [756:24] create your own report. So if you do [756:26] find something that you like, you can [756:27] save it for later. Um you can you could [756:30] have access to forecasting here so you [756:31] get an idea of the future cost and [756:33] whether it's been it's gone up or down. [756:35] just to kind of zoom in on some of those [756:37] filteration options. You can choose um [756:40] either monthly or daily level of of how [756:43] you want the data to be grouped together [756:45] and you have a lot of filter control. So [756:47] if I want to just have EC2 instances for [756:50] a particular region then I can get that [756:52] filtered information over here and you [756:54] can see you have a breakdown of the [756:55] different types. So it's very detailed [756:57] and cost explorer shows up in US East1. [757:00] I'm pretty sure if you click on cost [757:01] explorer it will just switch you over to [757:02] that region but just understand that's [757:04] where it lives. Okay. [757:09] Hey, this is Andrew Brown from Exam Pro [757:11] and in this video I want to show you [757:13] Adus cost explorer. So what we'll do is [757:16] go to the top here and actually on the [757:17] right hand side we're going to click on [757:18] the right and go to my billing dashboard [757:21] and from there on the lefth hand side [757:23] we're going to look for cost explorer [757:25] and then click launch cost explorer and [757:27] this is where we're going to get to the [757:28] ads cost management dashboard where this [757:30] is where we find savings plans, [757:31] reservations, things like that. on the [757:33] lefth hand side, click on cost explorer [757:35] and you can get this nice chart. And so [757:36] the idea is you can change it from [757:38] monthly to daily if you if you uh [757:40] prefer. [757:42] Okay, you can change the scope here. [757:44] Maybe we don't need six months. We can [757:45] just go back [757:47] um [757:49] three months here. So there's less data. [757:55] It is a bit delayed when I'm clicking [757:56] here. So it also could be just because [757:58] I'm doing the daily instead of monthly. [758:00] So you just have to be a little bit [758:02] patient when uh using this interface. [758:05] You can change it to stack line graph. [758:07] You can kind of see the details there. [758:09] It's not always clear like what others [758:11] is or things like that. And so uh you [758:14] can drill down and there's like ways of [758:16] applying filters and things like that. [758:19] I always forget how to uh do this. It's [758:22] because it's it's bringing everything [758:23] in. So you have to hit clear all first, [758:24] I think. [758:27] And um [758:31] oh you have to click into it. So like if [758:32] you wanted to click into it and pick a [758:34] particular service we could go here and [758:35] type in EC2 [758:38] and say EC2 instances and then apply [758:41] that filter. So now we can just see [758:43] exactly that cost or if we want to [758:46] choose like maybe just RDS. [758:50] Okay. So you know that could be useful [758:54] for you to see. But yeah, sometimes it's [758:56] not always clear. And so what I [758:58] recommend is just go back to your [758:59] billing dashboard. And from there, just [759:01] go to bills. Okay, bills is really, [759:04] really useful because here it shows you [759:06] exactly every single little service that [759:09] you're being build for. You can expand [759:10] it and see exactly where. If there you [759:12] have other accounts, you can go into [759:13] this side here as well and find spend [759:15] that way. U but cost explorer is very [759:18] useful. Just it's useful in a different [759:20] way. Okay, so there you go. [759:26] Hey, this is Andrew Brown from Exam Pro [759:28] and we are taking a look at the Adabus [759:29] pricing API. So with Adabus, you can [759:32] programmatically access pricing [759:34] information to get the latest pricing [759:35] offerings for services. This makes sense [759:37] because Adabus can change them at any [759:39] time and so uh you know you might want [759:41] to know exactly what the current price [759:43] is. Uh there are two versions of this [759:44] API. So, we have the query API known as [759:47] the pricing service API and you access [759:49] this via JSON. And then there's the [759:51] batch API, also known as the price uh [759:54] list API via HTML. What's odd is that um [759:57] the batch API returns JSON, but you're [760:00] accessing it via HTML. So, you can [760:03] literally paste those links in your [760:04] browser. For the query API, you're [760:06] actually sending an an application JSON [760:08] request. So, you'd have to use something [760:10] like Postman or something. Uh you can [760:12] also subscribe to SNS uh notifications [760:15] to get alerts when pricing for the [760:16] services change ads prices change [760:18] periodically such as when adus cuts [760:21] prices when new instance types are [760:22] launched or when new services are [760:24] introduced. So there you go. [760:29] Hey, this is Andy Brown from Exam Pro [760:31] and what I want to do here is show you [760:33] savings plans and savings plan is going [760:35] to be found under the ads cost explorer. [760:37] So just type in cost explorer at the top [760:39] here or if you want you can type in [760:40] savings plan as well. And once we are [760:42] here on the lefth hand side we are going [760:44] to have a savings plans options. So [760:46] we're going to go to the overview and [760:48] here it just describes u what are [760:51] savings plans if you want to read [760:52] through it. But down below if you have [760:54] already some spend happening it's going [760:55] to make some suggestions. And in this [760:57] particular account it's saying that I [760:59] could save some money on compute. Before [761:01] we take a look here I'm just going to go [761:02] to the form here and see what we can [761:04] see. So up here we can say commitment [761:07] through three years. By the way, you [761:09] have compute savings which applies to [761:10] EC2, Fargate or Lambda. Then you have [761:13] the EC2 specific one where uh we can [761:15] select a very particular type of [761:17] instance family. And then there's the [761:18] SageMaker savings plans. Um but if we go [761:21] here and we just enter in like $2 [761:25] all up front. Uh I don't really [761:28] understand it from here because it [761:29] doesn't make it clear what the savings [761:31] are. Um, but uh I what it does make it [761:34] very easy is probably if we go over here [761:36] and then click down on the compute. So I [761:38] kind of feel like here it would autofill [761:40] it in for you. And so here I filled it [761:41] in or sorry it's filled it in for me. [761:44] And so here it's saying with a one-year [761:46] plan all up front for based on the past [761:49] 30 days that it's going to see that I'm [761:52] going to see a monthly savings of [761:54] $25.36. [761:56] And then I can add it to the cart that [761:57] way. And I kind of feel like that is the [761:59] easiest way to um figure that out where [762:03] with um with how it was going to that [762:06] form. I just couldn't figure it out [762:07] myself what the savings were. Uh there [762:10] are some utilization reports and [762:11] coverage reports. Honestly, I've never [762:13] really looked at these before. Um but uh [762:16] I'm just curious like what we're looking [762:18] at monthly, daily, [762:20] the last [762:22] let's go a few months here. I've been [762:23] running stuff in this account for a [762:24] while, so there should be something [762:27] apply. [762:30] So nothing nothing of interest, but um I [762:34] mean I guess you have a lot of use and [762:35] coverage report and utilization report [762:37] could be interesting. But I imagine it's [762:40] maybe you have to be using you have to [762:41] have a savings plan before you can see [762:43] this. So that's probably the reason why. [762:45] Um, but yeah, hopefully that gives you a [762:47] clear idea that, you know, you can just [762:48] go down to those recommendations and and [762:51] see exactly what you can save and you [762:53] just add it to your cart and then once [762:54] you want to pay for it, you just choose [762:56] to submit that order and you're all good [762:58] to go. All right, so that's savings [763:00] plans. [763:06] Let's take a look here at defense in [763:08] depth to understand the layers of [763:09] security AWS has to consider uh for [763:12] their data centers for their uh virtual [763:14] workloads and things that you also have [763:16] to consider when you are uh thinking [763:18] about security for your cloud resources. [763:21] So in the most interior we have data. So [763:24] this is access to business and customer [763:26] data and encryption to protect your [763:28] data. Then we have applications. So [763:30] applications are secure and free of [763:32] security vulnerabilities. Then you have [763:34] compute. So access to virtual machines, [763:36] ports, on premise and cloud. You have [763:39] the network layer. So this limits [763:40] communication between resources using [763:42] segmentation and access controls. You [763:44] have the perimeter itself. So [763:46] distributed denial of service protection [763:48] to filter large-scale attacks before [763:50] they can cause denial of service of [763:52] users. You could say that's part of the [763:54] network layer and that's when I say [763:55] there are variants on this, but we're [763:57] just separating it out u explicitly. [763:59] There we have identity and access. So [764:01] controlling access to infrastructure and [764:03] change control. And then there's the [764:05] physical layer. So limiting access to [764:08] data centers to only authorized [764:09] personnel. You'll notice I highlighted [764:12] identity and access in yellow. It's [764:14] because that is considered the new [764:16] primary um perimeter. From the [764:19] customer's perspective, of course, AWS [764:21] has concerned about the physical [764:22] perimeter and things like that. But as a [764:24] as a uh customer, that's what you're [764:26] going to be thinking about, especially [764:27] with the zero trust model. And when you [764:30] see these depths, the idea is that in [764:32] order to get here, you have to pass [764:33] through all this stuff. So, if this um [764:36] if this outward one is protected pretty [764:38] well, then you generally don't have to [764:40] worry about the interiors, but of [764:41] course, you should. Um but yeah, there [764:43] you go. [764:48] Let's take a look here at [764:49] confidentiality, integrity, and [764:51] availability. Also known as the CIA [764:54] triad is a model describing the [764:57] foundation to security principles and [764:58] their trade-off relationships. So here [765:01] is our triad. So we have [765:03] confidentiality. So confidentiality is a [765:05] component of privacy that implements to [765:07] protect our data from unauthorized [765:08] viewers. In practice, this can be using [765:10] cryptographic keys to uh encrypt our [765:13] data and using keys to encrypt our keys. [765:15] So, envelope encryption. Then we have [765:17] integrity. So, maintaining and ensuring [765:19] the accuracy and completeness of data [765:20] over its entire life cycle. In practice, [765:23] utilizing asset compliant databases for [765:24] valid transactions. Utilizing tamper [765:27] evident or tamper proof hardware [765:29] security modules, HSM availability. So, [765:31] information needs to be available when [765:33] needed in practice. So, high [765:35] availability, mitigating DOS, uh [765:37] decryption access. So the CIA triad was [765:40] first mentioned in a NIS publication in [765:42] 1977. There have been efforts to expand [765:45] and modernize or suggest alternatives [765:47] the CIA triad. So one was in 1998 for [765:50] the six atomic elements of information. [765:52] Uh or in 2004 we have the NIS [765:54] engineering principles for uh for [765:56] information technology security. So it [765:57] has 33 security principles. But this is [766:00] still a very popular um model for [766:03] security. Uh and it's just to kind of [766:05] tell you like you know you don't always [766:07] get everything. you don't get all three [766:09] of them. Sometimes you have to trade off [766:10] in your scenario. Um, you know, and [766:12] hopefully some of the terminology here [766:14] will resonate as we go through more [766:16] security content. [766:21] What I want to do here is just define [766:22] the term vulnerability. So, a [766:24] vulnerability is a hole or weakness in [766:25] an application which can be design a [766:28] design flaw or implementation bug that [766:29] allows an attacker to cause harm to [766:31] stakeholders or applications. And uh [766:35] there's a lot of great definitions of [766:36] vulnerabilities, but OAS has a ton of [766:39] them. And we talked about OAS when we [766:41] talk about Adus WF. Uh but it's an [766:43] organization that creates security [766:44] projects that help you know what you [766:46] should protect uh or gives you working [766:48] examples so that you can understand how [766:50] to get better at security. And so they [766:52] have a lot of ones here, but maybe [766:55] you'll might notice some here like using [766:56] a broken or risky cryptographic [766:58] algorithm. Maybe there's a memory leak, [767:01] lease privilege violation. So that's um [767:04] uh lease privilege is something that is [767:06] a thing that you're always worried about [767:07] in security improper data validation [767:09] buffer overflows. So you know just to [767:12] kind of set the tone of what a [767:13] vulnerability is and things you should [767:15] be thinking about. Okay [767:21] let's understand what encryption is but [767:23] before we do we need to understand what [767:25] is cryptography. So this is the practice [767:27] and study of techniques for secure [767:28] communication in the presence of third [767:30] parties called adversaries. An [767:32] encryption is the process of encoding or [767:33] scrambling information using a key and a [767:36] cipher to store sensitive data in an [767:38] unintelligible format as a means of [767:40] protection. Uh an encryption takes in [767:43] plain text and produces produces a [767:45] cipher text. So here's an example of a [767:48] very old um encryption machine. This is [767:50] the Ennigma machine used during World [767:52] War II and it has a different key for [767:55] each day that it was used to set the [767:56] position of the rotors and it relied on [767:59] simple cipher substitution. And so you [768:01] might be asking what is a cipher? And [768:03] that's what we're going to look at next. [768:09] So what is a cipher? It is an algorithm [768:11] that performs encryption or decryption. [768:14] So cipher is synonyominous with code. Uh [768:16] and the idea is that you use the code to [768:19] either unlock or or lock up the [768:21] information that you have. So what is a [768:23] cipher text? A cipher text is the result [768:25] of encryption performed on plain text [768:28] via an algorithm. So you lock that up, [768:31] you scramble it, it doesn't make sense [768:33] and you need that code to unlock it to [768:35] get the information. So a good practical [768:38] example back in the day was a code book [768:39] and this was the type of document used [768:41] for gathering and storing cryptographic [768:43] codes or ciphers. So the idea is if we [768:46] zoomed up on here notice where we have [768:48] cannot so uh and it would be 0 0 and [768:53] then there would be give them authority. [768:55] So the idea is 0 0 or if you had the [768:59] word cannot it would translate to 0 0 [769:01] and then you use 0 0 to match that up to [769:04] say what does that actually mean and so [769:05] that is kind of a very practical example [769:07] of ciphers in action. [769:13] So we just took a look at encryption but [769:15] what are cryptographic keys? So a cryp a [769:19] cryptographic key an easy way to think [769:20] of it is a variable used in conjunction [769:23] with an encryption algorithm in order to [769:25] encrypt or decrypt data and there are [769:29] different kinds of um ones we have. So [769:32] we have symmetric encryption. So this is [769:34] where we have the same key that is used [769:36] for encoding and decoding. Uh and a very [769:39] popular one and the one you will see on [769:40] AWS is called advanced encryption [769:42] standard AES. So just take a look at [769:45] that graphic very closely. So we have [769:48] one key and it is used to encrypt. So it [769:51] produces the cipher and then or cipher [769:54] text we should say and then it will uh [769:56] decrypt and we will get our plain text. [769:58] So one single key. Then we have [770:01] asymmetric encryption. So two keys are [770:04] used one to encode and one to decode. [770:07] And a very popular one here is RSA. If [770:10] you're wondering what those uh those [770:11] words are, it's three people's names put [770:13] together who helped uh invent this type [770:16] of algorithm. And so here we have uh one [770:19] key for encrypt and one key for decrypt. [770:22] And they're two different keys. All [770:24] right. [770:29] All right. Let's look at the concept of [770:31] hashing and salting. So for hashing, we [770:33] have a hashing function and this accepts [770:35] arbitrary size values and maps it to a [770:37] fixed size data structure. Hashing can [770:39] reduce the size of a store value. And [770:41] hashing is a one-way process and is [770:43] deterministic. So a deterministic [770:45] function always returns the same output [770:48] output for the same input. So if we have [770:50] something like John Smith and we pass it [770:52] to the hash function, it's going to [770:53] create something that is not human [770:55] readable, but it'll say something like [770:56] 02 fa xxy whatever. Um and it will [771:00] always produce the same thing if the [771:02] same key or you know value is being [771:04] inputed there. So the reason we use [771:06] hashing functions or hash in general is [771:08] to hash passwords. So hash functions are [771:11] used to store passwords in a database so [771:12] that the password does not reside in a [771:14] plain text format. So you've heard about [771:16] all these data breaches where they've [771:18] stored the password in plain text. This [771:20] is the thing that helps us avoid that [771:22] issue. Um and the thing again is it [771:24] because it's one way you can't take that [771:26] hash and unhash it. Um well there are [771:29] some conditions to it but so to [771:31] authenticate a user when a user inputs [771:33] their password it is then hashed. So the [771:35] one that was inputed at the time of you [771:37] know login and then that hash is [771:38] compared to the stored hash in the [771:40] database and if they match the user is [771:42] successfully logged in. So in that case [771:44] we never ever had to know what the [771:47] original password looked like. Uh [771:48] popular hashing functions are MD5 Shaw [771:51] 256 or brypt. Uh if an attacker knows [771:54] the function you are using uh and uh and [771:57] stole your database they could enumerate [771:59] a dictionary of passwords to determine [772:00] the password. So they'll never see it, [772:02] but they could just keep on going [772:04] through that. So that's why we salt our [772:06] passwords. So a salt is a random string [772:08] not known to the attacker that the hash [772:10] function accepts to mitigate the [772:12] deterministic nature of a hashing [772:14] function. So there you go. [772:20] Let's take a look here at digital [772:21] signatures and signing. So what is a [772:23] digital signature? It is a mathematical [772:25] scheme for verifying the authenticity of [772:27] digital messages or documents. And a [772:29] digital signature gives us tamper [772:31] evidence. So did someone mess or modify [772:33] the data. Is this data from uh someone [772:35] we did not expect it to be? Is it from [772:37] the actual sender? And so we kind of [772:39] have this diagram where we have a person [772:41] who sends or is going to send a message. [772:43] So they sign it and then uh Bob verifies [772:46] that it was for the person who it's [772:48] from. So there are three algorithms to a [772:50] digital signature. The key generation so [772:52] generates a public and private key. Um [772:55] then there is signing. the process of [772:57] generating a digital signature with a [772:59] private key and the inputed value. So [773:02] signing which is what is happening up [773:03] here. Signing verification verifies the [773:06] authenticity of the message with a [773:07] public key. So remember the private key [773:09] is used for signing and the public key [773:11] is used for verifying. SSH uses a public [773:15] and private key to authorize remote [773:17] access into a remote machine such as a [773:19] virtual machine. It is common to use RSA [773:22] and we saw that RSA is a type of [773:25] algorithm earlier and so SSH key gen is [773:28] a well-known command to generate a [773:30] public and private key on Linux. I know [773:32] this one off the top of my head. I [773:34] always know to do this. Um and so what [773:36] is code signing? So when you use a [773:38] digital signature to ensure computer [773:40] code has not been tampered. And so [773:43] that's just a like subset of digital [773:44] signaturing. So you can use this as a [773:47] means to get into a virtual machine or [773:49] you can use signing as a means to make [773:50] sure that the code being committed to [773:52] your repository is who you expect it to [773:54] be from. So there you go. [774:00] Let's talk about intransit versus at [774:03] rest encryption. So encryption in [774:05] transit this is data that is secure when [774:07] moving between locations and the [774:08] algorithms here are TLS and SSL. Then [774:11] you have encryption at rest. So this is [774:13] data that is secure when residing on [774:15] storage or within a database. So we're [774:17] looking at AES or RSA which we both [774:20] covered previously uh these algorithms. [774:23] So ones that we did not cover was TLS [774:26] and SSL. So we'll cover them now. So TLS [774:28] transport layer security is an [774:30] encryption protocol for data integrity [774:32] between two or more communic [774:33] communicating computer applications. So [774:36] 1.0 and 1.1 are no longer used but TLS [774:41] 1.2 two and 1.3 is the current best [774:43] practice. Then we have SSL secure socket [774:46] layers. So an encrypted protocol for [774:48] data integrity between two or more [774:50] communicating uh computer applications. [774:52] So 1.0, 2.0 and 3.0 are deprecated. Um [774:57] and honestly I always get these two [774:59] mixed up and I always figure uh uh get [775:02] confused which is being used but um you [775:04] know they're always changing on us but [775:06] just understand generally what these [775:07] concepts are and that you're familiar [775:08] with the terms. Okay. [775:14] Hey, this is Andrew Brown from Exam Pro [775:16] and we are taking a look at common [775:17] compliance programs. So, these are a set [775:19] of internal policies and procedures for [775:21] a company to comply with laws, rules, [775:23] and regulations or to uphold business [775:25] reputation. So, here we have a bunch of [775:28] different compliance programs. And so, [775:30] some popular ones are like HIPPA or um [775:33] PCIDSS. The question is, should you know [775:36] these? Yes, you should generally know [775:37] the most popular ones because you're [775:39] going to see them throughout your cloud [775:40] career. Um, and so just getting familiar [775:43] now is a good time. Uh, so let's jump [775:45] into it. Okay, so the first one I want [775:47] to introduce you to is for ISO and they [775:50] have a bunch of different ones. So ISO [775:52] is the international organization of [775:53] standardization and their uh other one [775:56] called IEC which is the international [775:58] electrottechnical commission. one deals [776:00] with uh you know like uh virtual things, [776:03] the other one deals with hardware things [776:04] but they have a lot of overlapping um [776:07] compliance programs. Okay. And so the [776:09] most popular absolutely most popular one [776:11] that I know of is the 270100. I know a [776:14] lot of organizations that are going for [776:16] their 2701. This is for control [776:18] implementation guidance. You have the [776:20] 2707. [776:22] This is enhanced focus on cloud [776:24] security. The 2708 this is protection of [776:27] personal data in the cloud. Then you [776:29] have the 27701. This is privacy [776:32] information management system. So PIM's [776:34] framework. This outlines controls and [776:36] processes to manage data privacy and [776:38] protect PII. So that's personally [776:40] identifiable information. Then you have [776:42] system and organization control. SOCK [776:44] and this is a very popular thing that [776:46] organizations go for especially the SOCK [776:48] 2. So Soc is 18 standards and report on [776:51] the effectiveness of internal controls [776:53] at the service organization relevant to [776:55] the client's internal control over [776:56] financial reporting. We have SOCK 2 [776:59] evaluates internal controls policies and [777:00] procedures that directly relate to the [777:02] security of the system at a service [777:04] organization and SOCK 3 a report based [777:07] on the trust uh service services [777:09] criteria that can be freely distributed. [777:12] Then we have PCIDSS, a set of security [777:15] standards designed to ensure that all [777:17] companies that accept process, store and [777:19] transmit credit card information [777:21] maintains in a secure environment. We [777:25] have a federal information procedure [777:26] standards or FIPS. So 140 hyphen 2. This [777:29] is US and Canadian government standard [777:31] that specifies the security requirements [777:33] for cryptographic modules that protect [777:36] sensitive information. Then we have uh [777:39] PHIPA. This is more relevant to me [777:41] because I'm actually in Ontario and [777:42] Canada, but it's also very uh well-known [777:45] um one out there outside of HIPPA. So, [777:48] this regulates patient protected health [777:50] information. Then you actually have [777:52] HIPPA. This is the US federal law that [777:54] regulates patient procedur. Then we have [777:58] uh cloud security alliance. So CSA, Star [778:01] Certification, independent third-party [778:03] assessment of a cloud provider's [778:06] security posture. If you've never heard [778:07] of CSA, they have a very uh well-known [778:10] fundamental uh security certification [778:12] called the CSSK or CCSK. I always get [778:15] that mixed up. Then we have uh Fed RAM, [778:17] which we covered earlier in this course [778:19] or in the future depending on where we [778:20] put it. But um Fed Ramp stands for [778:22] federal risk and authorization [778:24] management program. It's a US government [778:26] standardization approach to security [778:27] authorizations for cloud service [778:29] offerings. If you want to work with the [778:31] US government or places that sell the US [778:33] government, you need Fed Ramp. The [778:35] similar to criminal justice information [778:37] services, any US state or local agency [778:40] that wants to access the FBI's CGIS [778:42] database is required to adhere to the [778:44] CGIS security policy. Then we have GDPR, [778:49] uh, the General Data Protection [778:51] Regulation. Everyone knows what this is [778:52] in Europe, maybe not so much in North [778:54] America or other places. A European [778:56] privacy law imposes new rules on [778:59] companies, governments, agencies, [779:00] nonprofits, and other organizations that [779:02] offer goods and services to people in [779:04] the European Union or that collect [779:07] analyze data try tied to EU residents. [779:10] There's a lot of compliance programs out [779:11] there. One that's also very popular is [779:13] FIPS, but we'll get to that when we talk [779:14] about KMS. Um, but yeah, uh, there you [779:17] go. [779:22] So, I just wanted to quickly show you [779:24] here the Adabus compliance programs page [779:26] where they list out all the types of [779:28] compliance programs that Adabus is uh [779:30] working with and that it has different [779:32] types of certification and assessments [779:34] which we can use Adabus artifact or [779:36] Amazon artifact whichever prefix they [779:38] decide to use for the name there um to [779:41] uh ensure that IDS has in order to meet [779:44] those regulatory compliance. So you can [779:45] see them all there. And if you want to [779:48] know a little bit more about any of [779:49] these, you just go ahead and click them [779:50] and you can read and they have [779:52] additional information so you have a [779:54] better idea. Okay, [780:02] let's talk about pen testing. So pen [780:04] testing is an authorized simulated cyber [780:06] attack on a computer system performed to [780:07] evaluate the security of the system. And [780:09] on AWS, you are allowed to perform uh [780:12] pen testing, but um there are some [780:14] restrictions. So permitted services are [780:16] EC2 instances, Knack gateways, ELBs, [780:19] RDS. So that's um relational database [780:21] service, CloudFront, Aurora, API [780:24] gateways, Lambda, Lambda edge functions, [780:27] light cell resources, elastic beantock [780:29] environments. Things you cannot do or [780:31] you should not be doing is DNS zone [780:33] walking via rough hosted zones. Then [780:36] there's DOS simulation testing. So you [780:38] should not be doing D do or DOS DD do [780:40] DOSses or simulated DOSs or simulated [780:44] DDOSs. Okay. And that doesn't mean that [780:46] you can't necessarily do them. Uh again, [780:49] there's a lot of exceptions to the pen [780:50] testing. They have a whole page on this, [780:51] but generally you're not allowed to do [780:53] DDoSing. Uh port flooding, protocol [780:56] flooding, request flooding, can't do any [780:58] of those things. For other simulated [781:00] events, you need to submit a request [781:01] database. Your reply could take up to [781:03] seven days. uh you know, again, there's [781:05] a lot of uh uh little in intricacies [781:08] here, so you'd have to really read up on [781:09] it if you're interested in doing this. [781:11] Okay. [781:16] Hey, this is Andrew Brown from Exam Pro [781:17] and we are taking a look at pen testing [781:19] on the ads platform. So, they have this [781:21] page here that tells you what you're [781:23] allowed to do, what you're not allowed [781:24] to do. Um, and there's some additional [781:26] things you can read into like the stress [781:28] test policy, the DOS simula simulation [781:30] testing policy, which I didn't cover in [781:32] detail uh in the course content, but if [781:34] for whatever reason you're interested in [781:36] it, I just want you to be aware of that [781:38] kind of stuff. If you want to simulate [781:40] events, there is a simulate events form [781:42] that you have to fill out. So, you open [781:44] it up and you can kind of read about it [781:46] and it gives a heads up of what you're [781:48] going to be doing. Stress test, fishing, [781:50] malware analysis, other. So that way [781:53] that if you are doing it, you're not [781:54] going to get in trouble. They're aware [781:55] of what you are doing. Okay. So that's [781:57] pretty much it. [782:03] Hey, this is Andy Brown from Exam Pro [782:04] and we are taking a look at Adabus [782:06] Artifact which is a self-s serve portal [782:08] for ondemand access to Adabus compliance [782:10] reports. So here's an example of a a [782:13] bunch of different compliance reports [782:14] that Adabus could be meeting. And the [782:16] idea is that when you go to this portal [782:18] within the adabus management console, [782:20] you'll have a huge list of reports that [782:22] you can go and access. So here I'm [782:24] searching for Canada to get the [782:26] government of Canada partner package. [782:28] And then I go ahead and I download that [782:30] report as a PDF. And then within the PDF [782:32] we can click a link to get the [782:34] downloadable Excel. And that's pretty [782:36] much what it is. It's just if you want [782:37] to see that AWS is being compliant for [782:39] different programs. [782:45] Hey, this is Andrew Brown from Exam Pro [782:46] and we're going to take a look at Adabus [782:48] artifact. So in the top here, we're [782:50] going to type in artifact [782:52] and not to be confused with code [782:54] artifact, which I guess is a new [782:55] service. There's just always a new [782:57] services, eh? And so here we have a [783:00] video and some things, but it's not too [783:03] hard. All we got to do is go to view [783:05] reports. And from here we have all the [783:08] types of compliance programs or [783:10] regulatory compliance programs that ads [783:12] is uh meeting and we can do is search [783:15] for something. So we can type in Canada [783:18] and that's the government of Canada [783:19] partner package and I can go ahead and [783:21] download that report. So, when you [783:23] download it, you really want to open [783:24] this up in [783:27] um you're going to really want to open [783:28] this up in um Adobe Acrobat because if [783:32] you don't open it up in Adobe Acrobat, [783:34] you're not going to be able to access [783:36] the downloadables within it. I know [783:38] that's kind of uh odd to say, but that's [783:40] just what it is. You do have to install [783:42] Adobe Acrobat Reader. And once you have [783:45] it open, and I'm just moving it over [783:48] here, this is what you're going to see. [783:50] And um it's going to say like, hey um [783:53] oops, no I don't want to do that. So [783:55] please scroll to the next page to view [783:56] the artifact download. And so I think [783:59] that if we go here, you know, they say [784:03] scroll to the next page, but I'm pretty [784:04] sure we can just go here on the lefth [784:06] hand side. And this is what we're [784:07] looking for, that Excel spreadsheet. So [784:09] we're going to save that attachment [784:12] or actually we just going to open it up. [784:15] Open this file. [784:18] Okay. And we'll give it a moment. I have [784:19] Excel installed. [784:21] And there we go. [784:24] There it is. Okay. So, I know it's a [784:26] little bit odd way to get to those um uh [784:29] certificates or reports, but that's just [784:31] how it works. Um but yeah, I mean that's [784:34] the idea is like if you need to prove [784:36] that adus is meeting whatever those [784:37] standards are, you can just type them in [784:39] whatever it is. I mean like maybe [784:40] there's like fed ramp, right? Whatever [784:42] it is, and download those certificate [784:44] assessments, whatever. um and just [784:46] double check that Adabus is meeting [784:48] those standards. Okay. [784:54] Hey, this is Andrew Brown from Exam Pro [784:55] and we are taking a look at AUS [784:57] Inspector. But before we can answer what [784:59] it does, let's talk about hardening. So [785:01] hardening is the act of eliminating as [785:02] many security risks as possible. [785:04] Hardening is common for virtual machines [785:06] where you run a collection of security [785:08] checks known as a security benchmark. [785:11] So, Adabus Inspector runs a security [785:13] benchmark against specific EC2 instances [785:16] and you can run a variety of security [785:17] benchmarks and you can perform network [785:19] and host assessments. And so, here's an [785:21] example of those two check boxes there [785:24] which you'd say which assessments you [785:25] want to do. So, the idea is you have to [785:27] install the ads agent on your EC2 [785:28] instance. You run an assessment for your [785:30] assessment target. You review your [785:32] findings and remediate security issues. [785:34] And one very popular benchmark you can [785:36] run is the CIS which has 699 checks. So, [785:40] if you don't know what CIS, it stands [785:42] for the center of internet security. Uh, [785:44] and so they are this organization that [785:46] has a bunch of um uh security controls [785:49] or check marks uh that are published [785:51] that they suggest that you should check [785:53] on your machine. [785:57] Hey, this is Andrew Brown from Exam Pro [785:59] and we're looking at DDoS. So, DDoS is a [786:03] type of malicious attack to disrupt [786:04] normal traffic by flooding a website [786:06] with a large amount of fake traffic. So [786:08] the idea is we have an attacker and the [786:10] victim. The victim is us and it could be [786:12] our virtual machines, our cloud [786:15] services. The idea is that it's some [786:16] kind of resource which um can take in uh [786:21] incoming requests over the internet. So [786:22] the idea is the attacker is utilizing [786:24] the internet and so they may control a [786:26] bunch of uh virtual machines or servers [786:29] that are loaded up with malicious [786:30] software and the idea is that the [786:32] attacker is going to tell them all to [786:34] send a flood of traffic over the [786:37] internet. uh at your uh computing [786:39] resource and uh this is where your [786:42] website is going to either start to [786:44] stall or it's going to become [786:46] unavailable for your users. And so the [786:48] idea here is that you know if you want [786:50] to protect against DOS you need some [786:52] kind of DDoS protection. Traditionally [786:54] those used to be like thirdparty [786:55] services that you uh would have to pay [786:57] for and the and it would sit in front of [787:00] uh your load balancer or your uh end [787:03] server. But now the great thing with [787:05] cloud service providers is that [787:06] generally their networks have built-in [787:08] DOS protection. So the idea is just by [787:10] having your compute or your resources on [787:13] AWS, you're going to get uh built-in [787:15] protection for free via ads shield and [787:17] we'll talk about that next. [787:23] Hey, this is Andrew Brown from Exam Pro [787:25] and we are taking a look at ads shield [787:27] which is a managed DDoS protection [787:30] service that safeguards applications [787:32] running on AWS. So when you route your [787:35] traffic through RFD3 or cloudfront you [787:37] are using shield standard. So here's a [787:40] diagram to kind of show you that it's [787:42] not just those services but these are [787:44] the most common ones where you'll have a [787:45] point of entry into AWS. So here we [787:48] could also be including elastic IP. ads [787:50] global accelerator. But the idea is that [787:53] when you uh go through these services [787:55] into the ads network, it has shield [787:57] built in. And so you're going to get [787:58] that protection before those uh before [788:01] that traffic reaches your uh cloud [788:03] services. And in this case, we're [788:04] showing uh EC2 instances. So adabus [788:07] shield protects against layers three, [788:09] four, and seven attacks. Uh layer three, [788:12] four, and seven is based off the OSI [788:15] model, which is a um a fundamental [788:17] networking concept. So seven is for the [788:21] application layer, four is the transport [788:23] layer, three is the network layer. Um [788:27] there are two different types of plans [788:28] for shield. We have shield standard [788:30] which is free and then shield advance [788:32] which starts at 3,000 USD per year plus [788:36] some additional uh costs based on usage [788:39] of the size of the attack or what [788:40] services you're using, how much traffic [788:42] is moving in and out. So protection [788:44] against the most common DOS attacks is [788:46] what shield standard does. Uh you have [788:48] access to tools and best practices to [788:51] build DOS resilient architecture. It's [788:53] automatically available on all adabus [788:55] services for additional protection [788:57] against larger and more sophisticated [788:59] attacks. That's where shield advance [789:00] comes into play. It's available for [789:02] specific adabus services. So ref [789:06] cloudfront elbas global accelerator [789:10] elastic IP. Uh and some notable features [789:12] here is visibility reporting on layer [789:14] three, four and seven. You're only going [789:16] to get seven if you are using ADS W with [789:19] it. Uh you have access to team and [789:21] support. So these are DOS experts, but [789:23] you're only going to get it if you're [789:24] paying for business or enterprise [789:26] support as you're paying for this as [789:28] well. Uh you also get DDoS cost [789:30] protection to ensure that you know your [789:32] bills don't go crazy. Uh and it comes [789:34] with an SLA so you have a guarantee that [789:36] it's going to work. Both plants [789:38] integrate with adabus web application [789:41] firewall. So WFT to give you that layer [789:44] 7 application protection. So understand [789:46] that if you're not using WFT, you're not [789:48] going to be having that layer 7 [789:49] protection. Okay. [789:54] Hey, this is Andrew Brown from Exam Pro [789:56] and we are looking at Amazon Guard Duty. [789:58] So before we look at that, we need to [790:00] understand what is an IDS IPS. So an [790:04] intrusion detection system and intrusion [790:06] protection system is used as a device or [790:09] software application that monitors a [790:11] network or systems for malicious [790:13] activity or policy violations. So guard [790:16] duty is a threat detection service which [790:19] is IDS IPS that continuously monitors [790:22] for malicious and suspicious activity [790:24] and unauthorized behavior. It uses [790:26] machine learning to analyze the [790:28] following adabus logs. your cloud trail [790:30] logs, your VPC flow logs, your DNS logs, [790:34] and what it will do is report back to [790:36] you and say, "Hey, um, there's this [790:39] issue here, and this is actually one [790:40] that's very easy to replicate. It's just [790:42] saying somebody is using the root [790:44] credentials, and it's suggesting that [790:46] you should not be doing that, right? [790:48] Because you're never supposed to be uh [790:49] invoking API calls with the root [790:51] credentials or you should be limiting [790:53] that." You'll might also notice that if [790:55] you want to investigate, you can kind of [790:56] follow up that with uh Amazon detective [790:59] or adabus detective, whichever uh prefix [791:02] they decided to put on that service, it [791:04] will alert you of findings, which you [791:06] can automate an incident uh response via [791:08] cloudatch events, which this uh it's [791:11] been renamed to event bridge, just so [791:12] you know, or thirdarty services. So, you [791:14] can follow up a remediation action. Um, [791:18] and here is a graphic of Amazon Guard [791:21] Duty just a bit up closer so you can see [791:23] all the findings and you can just see [791:25] you have a lot of detailed information [791:26] there. Okay. [791:32] Hey, this is Andrew Brown from Exam Pro [791:34] and we're going to take a look at Guard [791:35] Duty. So, Guard Duty is um an intrusion [791:38] protection and detection uh service. And [791:40] so, what I've done is I've um done some [791:43] bad practices purposely so that I can [791:45] show you um some information in there. [791:47] So, I'm going to go over to Guard Duty. [791:49] Okay. And you do have to turn Guard Duty [791:51] on. And so, once Guard Duty is on, [791:53] you're going to start getting reports [791:54] coming in. So, notice here that we have [791:57] some anomalous behavior eight days ago. [791:59] And so, uh, that's Beo. He's my [792:01] co-founder. He's also named Andrew as [792:03] well. And so, we can kind of see some [792:05] details here about who's accessing what [792:07] and what they were doing. He's not doing [792:09] anything malicious, but we can have an [792:10] idea where they're from. even shows uh [792:12] generally where he is which he is near [792:14] Thunder Bay and his his provider would [792:16] be TBEL. Um and you can see that he is [792:19] making uh API calls to the scribe [792:22] account attributes and things like that. [792:24] Then the other issue is the root [792:25] account. So there's MFA. I turned it off [792:28] so that we can or maybe it's just usage [792:29] here. I actually do have it turned on I [792:31] suppose. Here we see root credential [792:33] usage. And so it's saying, "Hey, you [792:35] used it 77 times because sometimes I go [792:37] in and and use uh the root account for [792:40] tutorials, but saying you're using this [792:42] way too much. You got to stop doing [792:44] that." Okay, so that's something that is [792:46] uh pretty interesting with Guard Duty. [792:48] Um and it's really cost effective and [792:50] easy to turn on. So you can turn it on. [792:52] Looks like they have a new thing for S3. [792:54] Um have not looked at that as of yet, [792:56] but that's kind of cool. kind of feels [792:58] like that would overlap with uh Amazon [793:00] Macy, but whatever. And here we get a [793:02] breakdown of cost. So we see cloud [793:04] trail, VPC flow logs, DNS logs, and this [793:06] is where it would be ingesting data. If [793:08] you want to use that S3 protection, [793:10] you'd have to probably be turning or [793:11] creating a custom cloudatch trail that [793:14] has data events to consume that [793:15] information. Um, you know, so you know, [793:18] hopefully that gives you kind of an idea [793:20] of things you can do. And you can also [793:22] centralize Gard Duty uh into one [793:24] account. So you can have one thing that [793:25] takes care of everything and and move [793:27] all the data across all your accounts [793:28] into a single place. So that's kind of [793:30] interesting. And you can set up follow [793:33] follow-ups. Um and it's possible that uh [793:36] I'm not seeing this this here, but [793:39] generally it would show you [793:43] uh it would show you a way of like [793:44] triggering into cloudatch. Probably you [793:46] could do it programmatically. This is [793:47] something interesting like the list [793:48] management. You can add trusted IPs or [793:50] threat list. So if there's people that [793:52] you know are fine, you can just [793:53] whitelist them. Or if there's people [793:55] that you know that are bad, make sure [793:56] that they are never allowed to get [793:58] through. So that's pretty much it with [793:59] Guard Duty. Okay. [794:05] Hey, this is Andrew Brown from Exam Pro [794:07] and we are taking a look at Adus virtual [794:09] private network, also known as VPN. So [794:12] AdusVPN lets you establish a secure and [794:15] private tunnel from your network or [794:17] device to the Adabus global network. [794:19] It's very important to emphasize the [794:21] word secure here. Uh because when you're [794:23] using direct connect that will establish [794:25] a private connection, but it's not using [794:28] any kind of protocol to secure that data [794:30] in transit. Whereas advpn will be using [794:34] a secure protocol. There are two options [794:36] here. We have adabus sightto-sightVPN. [794:39] So securely connect on premise network [794:40] or branch office site to VPC and adabus [794:43] clientVPN. to securely connect users to [794:46] AWS or on premises networks. [794:49] Uh one thing that we need to understand [794:51] alongside VPNs is IPSE. This stands for [794:55] internet protocol security and it is a [794:57] secure network protocol suite that [794:59] authenticates and encrypts the packets [795:00] of data to provide secure encrypted [795:03] communication between two computers over [795:05] an internet protocol network and it is [795:08] used in VPNs and ABS definitely uses it. [795:11] Okay. [795:16] Hey, this is Andrew Brown from Exam Pro [795:18] and we are taking a look at AIUS web [795:20] application firewall also known as WFT [795:23] which protects you uh protects your web [795:25] application from common web exploits. So [795:28] the idea here is you write your own [795:30] rules to allow or deny traffic based on [795:32] the contents of an HTTP requests. You [795:35] use a rule set from a trusted adabus [795:37] security partner in the Adabus WFT rule [795:39] marketplace. WFT can be attached to [795:42] either CloudFront or an application load [795:44] balancer. So here is that diagram. The [795:47] idea is you see CloudFront with the WFT [795:49] or ALB with the WFT. And what it does is [795:53] it can protect uh web applications from [795:55] attacks covered and the OAS 10 uh top 10 [795:59] most dangerous attacks. If you don't [796:00] know OAS, they're the open web [796:03] application security project. And they [796:05] basically have all these uh security [796:07] projects which are things to say hey [796:10] these are things that you should [796:11] commonly protect against or they might [796:13] have like example applications that uh [796:16] serve as a means to learn security. So [796:18] when we look at the top 10, it's [796:20] injection, broken authentication, [796:22] sensitive data exposure, XML, external [796:25] entities, so XXE, broken access control, [796:29] security misconfigurations, cross-sight [796:31] scripting, so XSS, uh insecure des [796:34] serialization, using components with [796:36] known vulnerabilities, and insufficient [796:39] logging and monitoring. So there you go. [796:46] Hey, this is Andrew Brown from Exam Pro [796:48] and we are going to take a quick look at [796:49] Adabus web application firewall, also [796:52] known as WFT. And so, um, in this [796:54] account, I happen to have a WFT running. [796:56] Uh, so we don't have to create one. Uh, [796:58] we already have something we can take a [797:00] look here. So, I'm going to go to WFT [797:01] and shield. And then on the left hand [797:03] side, you'll notice it's a global [797:05] service, but on the lefth hand side, [797:06] we're going to be looking for our web [797:08] ACL's. And so the idea is that when you [797:10] want to w you create a web ACL and then [797:13] within within that web ACL you have uh [797:16] the overview and then you have it can [797:19] kind of show you kind of the traffic [797:20] that's going on here. We can have our [797:22] rules and so there's a lot of different [797:25] kind of managed rule groups that you can [797:26] use. So these are ones that are provided [797:28] by AWS. So and a lot of these some of [797:31] these can be paid, some of these are [797:32] free. So you see there's these free rule [797:34] groups where you're like hey I don't [797:37] want any anomous IPs. see checkbox that [797:39] on you know or I want to protect against [797:42] SQL injection. Now the interesting thing [797:44] is that AIS has this capacity unit. So [797:46] um you can't add all of these. You can [797:49] add a certain amount of capacity before [797:51] you have to um um pay for more or [797:55] something like that. It's just kind of a [797:56] way to um uh kind of cap the amount of [798:00] stuff that you can put in in terms of [798:02] rules. Um, but there's a lot of other [798:05] um, rule groups from thirdparty services [798:07] like security companies that know what [798:09] they're doing. So, if you like Fortnet's [798:11] OS top 10, you can uh, subscribe to that [798:14] in the marketplace and be able to use [798:16] it. But, uh, yeah, so that's how you [798:18] apply rules. There's something called [798:21] bot control. I've never used this [798:23] before. Get real-time visibility into [798:24] bot activity on your resource and [798:26] controllers. What bots allow and block [798:28] from your resources. That sounds really [798:30] cool. I cannot stand bots. So, I might [798:33] turn that on myself or take a look at [798:35] the cost there and see what we can find [798:37] out. But that's pretty much it with WFT. [798:39] Um, one thing I would say is that you [798:41] can block out specific IP addresses or [798:44] whitelist specific IP addresses. And you [798:47] might do that through rules. I'm just [798:48] going to see. Yeah, like maybe the [798:50] bypass here. And so these IP addresses [798:53] are some of our um cloud support [798:56] engineers where they're using our adid [798:58] panel and um uh WFT is being too [799:02] aggressive in terms of protection and so [799:04] sometimes you have to uh say hey allow [799:06] this IP address and let my um you know [799:09] let my cloud uh support engineer be able [799:12] to use the mid panel because they're not [799:13] malicious. Okay. So that's one little [799:15] exception there but that's pretty much [799:16] it. Okay. [799:35] Hey, this is Andrew Brown from Exam Pro [799:37] and we are taking a look at hardware [799:38] security modules, also known as HSM. And [799:41] it's a piece of hardware designed to [799:42] store encryption keys and it holds keys [799:45] in memory and never writes on the disc. [799:47] So the idea is that if the HSM was shut [799:49] down, uh that key would be gone and that [799:51] would be a guarantee of protection [799:53] because nobody could, you know, take the [799:55] drive and steal it. So here is an [799:57] example of an HSM. Uh these are [799:59] extremely expensive, so you definitely [800:01] don't want to have to buy them [800:02] yourselves. Uh they generally follow [800:05] FIPS. So FIPS is the federal information [800:07] processing standard. So it's a US and [800:10] Canadian government standard that [800:11] specifies the security requirements for [800:13] cryptographic modules that protect [800:14] sensitive information. FIPS is something [800:16] you want to definitely remember. Um and [800:19] there are two different um protocols [800:23] here. There's actually a bunch of [800:24] different uh FIPS versions, but we have [800:26] FIPS 142 level two and then FIPS 143 [800:31] level 3. So, let's talk about the [800:33] difference here. So, HSM that are [800:35] multi-tenant are going to be using FIPS [800:38] 142- 2 level two compliant where you [800:42] have multiple customers virtually [800:43] isolated on the HSM. And then there are [800:46] HSMs that are single tenant and so [800:49] they're going to be utilizing FIPS [800:50] 140-phen 2 level three compliant. So a [800:53] single customer on a dedicated HSM. [800:56] And so the reason why we have these two [800:59] levels is that when you have multiple [801:01] tenants, you can say, "Oh, right. This [801:03] thing is uh has temper evidence." So we [801:06] can see that somebody was trying to [801:07] break into it, but there's no guarantee [801:09] of uh tamp it being tamperproof. where [801:13] level three is tamperproof. There's also [801:16] uh FIPS 140 hyphen 3 which is the new uh [801:19] the newer um standard but not all uh [801:23] cloud resources uh can meet that [801:24] standard just because of how they offer [801:26] the service. Uh, so again, FIPS 142 is [801:30] really good, but just understand that [801:31] there are other ones out there. And it's [801:33] very easy to get FIPS 142 level three [801:36] mixed up with FIPS 140-3, something that [801:39] I always had um a hard time uh [801:41] remembering the distinguishing between [801:43] those two. So for multi-tenant, this is [801:45] where we're using Adabus key management [801:47] service. And for single tenant, we're [801:49] using Adabus Cloud HSM. And the only [801:52] time you're really using cloud HSM is if [801:53] you're a large enterprise and you need [801:55] that regulatory compliance of getting [801:57] FIPS 140 Haven to level three. Okay. [802:04] Hey, this is Andrew Brown from Exam Pro [802:06] and we are taking a look at key [802:08] management service also known as KMS and [802:10] is a managed service that makes it easy [802:12] for you to create and control the [802:14] encryption keys you use to encrypt your [802:16] data. So KMS is a multi-tenant HSM. So [802:19] it's a hardware security module and many [802:22] adabus services are integrated to use [802:24] KMS to encrypt your data with a simple [802:26] checkbox and K KMS uses envelope [802:29] encryption. So here's that example of a [802:31] simple checkbox. In this case it's for [802:33] RDS and what you'll do is choose a [802:35] master key. A lot of times ads will have [802:37] a default for uh key for you that's [802:39] managed by them that is free to use [802:41] which is really great. Uh so for KMS [802:44] it's using envelope encryption. So when [802:46] you encrypt your data, your data is [802:48] protected, but you have to protect your [802:49] encryption key. When you encrypt your [802:51] data key with a master key as an [802:53] additional layer of security. So that's [802:54] how it works. So just to make this [802:56] really clear, I have my data. I use this [803:00] key to encrypt this data. And now I need [803:01] to protect this key. So I use another [803:04] key to encrypt uh this key which forms [803:08] an envelope. And then I store this uh [803:11] master key in KMS. And this one's [803:13] considered the data key. All right. [803:20] Hey, this is Andrew Brown from Exam Pro [803:22] and we're going to take a look at key [803:24] management service, also known as KMS. [803:26] So, type in KMS on the top here and [803:29] we'll pop over here and KMS is a way for [803:31] you to create your own keys or you can [803:33] use Adabus manage keys. So, up here and [803:36] not all these appear right away, but as [803:38] you use services, um you will Adabus [803:40] will generate out manage keys for you [803:42] and these are free. You can uh create [803:44] your own keys. Um and these cost a [803:47] dollar each. So if I go ahead here and [803:48] create a key, I can choose whether it's [803:49] symmetric or asymmetric, which we [803:51] definitely learned in the course, which [803:52] is nice. For asymmetric, you can make it [803:54] encrypt and decrypt. Sign and verify. [803:56] And they're just kind of narrowing down [803:57] the type of key you would use. Um for [804:00] this, you know, if I went to symmetric, [804:02] I go here. I'm just kind of seeing if I [804:05] can enter the uh actual material into [804:07] the key here. Um so I'm just going to [804:10] keep clicking through here. uh my custom [804:12] key. Generally, you don't really need to [804:14] do this, but um you know, if it's [804:16] interesting, you can set up [804:17] administrators to say who's allowed to [804:19] administer the key. And then you have [804:21] someone that um is allowed to use the [804:24] key. And you usually want to keep those [804:25] two accounts separate. You don't want to [804:27] have the same person administrating and [804:28] using the key. Okay? Keep those two [804:30] separate. And so we would have a key [804:32] policy. So you can change this to say [804:34] the rules that is allowed to use. Um and [804:38] then we can go here and hit finish. And [804:40] so there we now have our own custom key. [804:44] And one thing we can do [804:47] is it's possible to rotate out these [804:49] keys when you need to be. Um, but [804:52] anyway, when we want to use KMS, it's [804:54] built into basically everything and [804:56] we've seen it multiple times throughout [804:58] this course. When we've gone over to [804:59] EC2, we'll just go take a peek at a few [805:02] different places here. So when we've [805:04] gone to go launch an EC2 instance and we [805:07] go over to uh storage, we say select [805:10] and review or next. And we go over to [805:14] storage. Notice that here this is using [805:17] encryption, right? So I can choose that [805:19] or even my custom key. If you're in [805:21] Dynamob or anywhere else, it's always [805:23] something like a checkbox and you choose [805:24] your key. So that's pretty much all [805:26] there really is to KMS. It's very easy [805:27] to use and there you go. [805:33] Hey, this is Andrew Brown from Exam Pro [805:35] and we are going to take a look here at [805:36] cloud HSM. It is a single tenant uh HSM [805:40] as a service that automates hardware [805:42] provisioning, software patching, high [805:44] availability and backups. So here's the [805:47] idea is that you have your ad as cloud [805:49] HSM. You have your developers [805:51] interacting with it, your application [805:53] interacting with it. You have an HSM [805:55] client installed in your uh EC2 instance [805:57] so that it can access uh the cloud HSM [806:00] keys. So Adabus cloud HSM enables you to [806:03] generate and use your encryption keys on [806:05] FIPS 140-2 level 3 validated hardware. [806:09] It's built on open HSM industry [806:11] standards to integrate with things like [806:13] PK uh CS1 [806:16] Java cryptography uh extensions. So JCE [806:20] Microsoft crypto and G libraries. You [806:23] can transfer your keys to other [806:25] commercial commercial HSM solutions to [806:27] make it easy for you to migrate keys on [806:29] or off AWS. configure Adabus KMS to use [806:32] Adabus cloud HSM uh cluster as a custom [806:36] uh key store rather than the default KMS [806:39] key store. Uh so cloud HSM is way more [806:43] expensive than KMS. KMS is like free or [806:46] a dollar per key where cloud HSM is a [806:48] fixed cost per month because you are [806:51] getting a dedicated piece of hardware. [806:53] Um and there's not a lot of stuff around [806:56] it. So other than the ads KMS [806:58] integration, a lot of times it can be [806:59] really hard to use this as well. So the [807:02] only time you're really going to be [807:03] using cloud HSM is if you're an [807:04] enterprise and you need to meet FIPS [807:07] 140-2 level 3 compliancy. Okay. [807:14] Hey, this is Andrew Brown and we are [807:16] taking a look at Adabus Security Hub. It [807:18] is a cloud security posture management [807:19] system, a CSPM, which allows you to [807:22] generate out a security score to [807:23] determine your security posture. And the [807:26] way way it works is that you'll enable [807:27] these security standards which are a [807:29] collection of security controls which in [807:31] turn are AIS config rules. If you have [807:34] seen conformance packs and config rules [807:36] and wondering if they're the same thing, [807:38] they possibly are the same thing. But [807:39] the key difference is that security hub [807:41] has um an additional layer of providing [807:44] you a a security standard score um with [807:47] a bunch of uh uh graphics uh or what do [807:51] you call it? um graphs or charts like [807:53] you have a pie chart there um and you [807:55] can investigate each finding. So that's [807:57] pretty much what it does. Um so yeah, [808:00] there you go. [808:05] Adabus audit manager uh is used to [808:07] continually audit your ad as usage to [808:09] simplify risk and compliance [808:10] assessments. Um and the way it works is [808:12] that it has framework libraries and [808:14] control libraries. So the idea is that [808:15] you will choose a framework library such [808:17] as sock 2 and that will uh set you up [808:19] with a bunch of um controls and these [808:23] things actually can be backed by adabus [808:25] config and other places if you decide to [808:27] integrate adabis config or ad security [808:29] hub security hub is using ads config so [808:31] it all comes back to ads config. Uh [808:33] what's nice is that you can create [808:34] assessments to review uh the evidence [808:37] collected and then generate an [808:39] assessment report. At first, this [808:41] service looks very similar to AD as [808:42] security hub. Um, but the key difference [808:44] is that AD security hub is producing a [808:46] security score, whereas the audit [808:49] manager is about creating assessments to [808:51] review against a specific compliance [808:54] standard. So, in the lab, I'm a bit [808:56] confused at the start, but then it [808:57] clicks because I realize that I'm [808:59] looking at something that's kind of like [809:01] a service like Vanta. The the only thing [809:04] though that you have to understand with [809:05] these framework libraries is that you [809:07] can implement them. But if you don't [809:09] have a thirdparty auditor, then they [809:11] don't necessarily meet that standard. So [809:13] those who just maybe have never done [809:15] SOCK 2 or um the ISO uh framework [809:18] standards, I can't remember the code off [809:19] the top of my head. Um it's not as [809:21] simple as just utilizing this. So you [809:24] can do it um and and technically meet [809:26] the requirements, but you will not meet [809:28] compliance unless you are working with a [809:30] third party. Okay. [809:36] as firewall manager allows you to [809:38] centrally configure and manage firewall [809:40] rules across accounts and applications [809:42] and ads services uh that can be managed [809:44] under the service would be adus w [809:47] classic shield advance security groups [809:50] network access controls adus network [809:52] firewall Amazon rep3 resolver DNS [809:56] firewall and no there's not a double A [809:58] in here that's just my mistake I [810:00] apologize cross that [810:02] um and third party firewall services. [810:04] And the interesting thing about the [810:06] service is that when you go to configure [810:07] any of these uh it's completely [810:10] different. So like this is an example [810:11] for for security groups and it shows you [810:13] some policy rules that you can select. [810:16] But this thing is wildly different based [810:18] on each service that you are creating a [810:21] um a rule for. This service is I would [810:24] describe as expensive at least. I don't [810:26] want to spin one up uh in the lab [810:28] because uh Bea would be like why are you [810:30] spending $50 for uh you know such a [810:33] simple rule but we do go and look at how [810:36] they vary and things like that even [810:37] though we don't actually create a rule [810:39] in the lab there are some prerequisites [810:41] here so your account must be a member of [810:42] the ads organization your account must [810:45] be the ads firewall manager [810:46] administrator you must have ads config [810:48] enabled to uh for your accounts in a [810:51] region um and you might need to have RAM [810:54] enabled as well for specific uh security [810:56] firewall services. I suspect that when [810:59] you use a service, it's creating ads [811:00] config rules. I'm noticing that there's [811:02] a lot of security services where adabs [811:04] will just leverage ads config underneath [811:06] and make a layer on top of it and then [811:08] charge an ungodly amount. Uh so I almost [811:11] feel like you could just make ads config [811:13] rules if you really wanted to um uh [811:17] enforce compliance for specific [811:19] configurations, but this is a service. [811:21] So yeah, there you go. [811:28] Hey, this is Andrew Brown from Exam Pro [811:30] and we are taking a look at know your [811:32] initialism. So, a lot of adabus services [811:35] and concepts and cloud technologies use [811:38] initialisms to just kind of shorten uh [811:41] common things that we need to use on a [811:43] frequent basis. And it's going to really [811:45] help if you learn these because then [811:47] what you can do is substitute them when [811:49] you are uh seeing a service name or [811:51] something in particular. And that's [811:53] going to get you through content a lot [811:55] faster. Um, and in the wild, you're [811:58] going to see these all over the place [811:59] because people aren't going to say the [812:00] full name. They're going to say the [812:02] initialism. So, let's go through them. [812:04] So, for it's identity and access [812:06] management. For S3, that's simple [812:08] storage. For SWF, it's uh SWF, that's [812:12] simple workflow service. SNS is simple [812:15] notification service. SQS is simple Q [812:18] service. SCS is simple email service. [812:21] SSM is simple systems manager but uh you [812:24] know when we see the name it's usually [812:26] just systems manager but we still use [812:28] the uh initialism SSM then there's RDS [812:32] relational database service VPC virtual [812:34] private cloud VPN virtual private [812:36] network CFN cloud for WAF web [812:40] application firewall and that is a very [812:42] common initialism not just native bus [812:44] but outside of it as well MQ for Amazon [812:48] active MQ ASG for autoscaling groups. [812:51] TAM for technical account manager. ELB [812:54] for elastic load balancer. ALB for the [812:56] application load balancer. NLB for the [812:59] network load balancer. GWLB for the [813:02] gateway load balancer. CLB for the [813:04] classic load balancer. EC2 for elastic [813:06] cloud or cloud compute. ECS for elastic [813:09] container service. ECR for elastic [813:11] container repository. EBS for elastic [813:14] block storage. EMR for uh elastic map [813:16] produce. EFS for elastic file store. EBS [813:20] or EB for elastic beantock. ES for [813:23] elastic search, EKS for elastic [813:25] kuberneti service, MSK for managed Kofka [813:29] service. And if you think I got the S [813:31] and K backwards, I did not. For whatever [813:33] reason, it's msk. Uh then uh there's [813:37] resource manager which is known as RAM, [813:38] ACM for Amazon certificate manager, POPL [813:42] for principle of lease privilege which [813:43] is a concept not a service. IoT, [813:46] Internet of Things. This is not a [813:47] service, but is a tech concept or cloud [813:50] concept. RARI for reserved instances. [813:52] And I'm sure there are more, but these [813:54] are the ones that I know off the top of [813:55] my head. Uh, and they're in my uh usual [813:58] use case uh for what I'm doing [814:00] day-to-day, but a lot of times you'll [814:02] probably just end up needing to remember [814:03] ASG, ELB, [814:06] um, EC2, S3, things like that. Okay. [814:14] All right. All right, let's compare ads [814:15] config and app config which both have [814:18] config in the name but they are two [814:20] completely different services. So ads [814:22] config and app config. So ads config is [814:24] a governance tool for compliance as [814:26] code. You can create rules that will [814:28] check to see if resources are configured [814:30] the way you expect them to be. If a [814:32] resource drifts from the expected [814:33] configuration, you are notified or ads [814:35] config can autorediate correct the [814:38] configuration back to the expected [814:39] state. For app config, it is used to [814:41] automate the process of deploying [814:43] application configuration variable [814:45] changes to your web application. You can [814:47] write a validator to ensure uh the [814:50] changed variable will not break your web [814:52] app. Uh you can monitor deployments and [814:54] automate integrations to catch errors or [814:55] roll back. So config is for compliance [814:58] governance. App config is for config [815:00] application configur configuration [815:02] variables. So there you go. [815:08] Let us take a look at SNS versus SQS. [815:11] And uh these things have something in [815:13] common and it's they both connect apps [815:15] via messages. Uh so they're for [815:18] application integration. So let's take a [815:20] look at SNS. So simple notification [815:23] service and then simple Q service. Okay. [815:25] So SNS is intended to pass along [815:28] messages via a pub sub model whereas SQS [815:31] cues up messages and has a guaranteed [815:33] delivery. So the idea with SNS you send [815:35] notifications to subscribers of topics [815:38] via multiple protocols. So it can be [815:40] HTTP, email, SQS, SMS and SNS is [815:45] generally used for sending plain text [815:46] emails which is triggered via other ad [815:49] services. The best example here is [815:51] billing alarms. I know we mentioned this [815:52] but I like to repeat it so that you [815:53] absolutely know. Uh it can retry sending [815:56] in the case of failures of HTBS's. So it [815:59] does have a retry attempt but that [816:01] doesn't mean there's a guarantee of [816:02] delivery. It's really good for web [816:04] hooks, simple internal emails triggering [816:06] lambda functions. If you had to compare [816:08] these to thirdparty services, it's [816:09] similar to pusher or uh pubnub. So SQS [816:13] is uh the idea here is that messages are [816:15] placed into a queue. Applications pull [816:17] the queue using the adabus SDK. You can [816:19] uh uh retain a message for up to 14 [816:22] days. You can send them in sequential [816:24] order, sequential order or in parallel. [816:27] You can ensure only one message is sent. [816:30] You can ensure messages are delivered at [816:31] least once. It's really good for delayed [816:34] tasks, queuing up emails. Um, comparable [816:37] uh stuff would be something like Rabbit [816:38] MQ or uh Ruby on Rails Sidekick. Okay. [816:46] Hey, this is Andy Brown from Exam Pro [816:47] and we're doing variation study with SNS [816:50] versus SCES versus Pinpoint versus [816:52] Workmail. And so SNS and SCS get [816:55] confused uh quite often, but all of [816:57] these services uh have something in [816:59] common. They all send emails but uh the [817:02] utility of email is completely different [817:04] for each one. So the first one is simple [817:07] notification service is for practical [817:09] and internal emails. So you send [817:11] notifications to subscribers of topics [817:13] via multiple protocols. So it's not just [817:15] for email. It can handle HTTP. It can [817:18] send to SQS. It can send SMS me or SMS [817:21] messages. So um messages to your phone. [817:25] Um but uh it does send emails. And so [817:27] SNS is generally used for sending plain [817:29] text emails which is triggered via other [817:32] AWS services. The best example of this [817:34] is a billing alarm. So most exam [817:37] questions are going to be talking about [817:39] SNS because lots of services can trigger [817:42] um SNS for notifications. And so that's [817:44] the idea. It's like oh um you know did [817:47] somebody spin up a server send off an [817:49] email through via SNS. Uh did we spend [817:52] too much money here? you know all sorts [817:54] of things can go through SNS to send out [817:56] emails and you need to know what are [817:58] topics and subscriptions regarding SNS [818:02] then you have SCES so simple email [818:04] service and this is for transactional [818:07] emails and when I say transactional [818:10] emails I'm talking about emails that [818:11] should be triggered based on inapp [818:13] actions so sign up reset password [818:15] invoices um so a cloud-based email [818:18] service that is similar to this would be [818:20] like send grid SCS sends HTML emails. Uh [818:24] SNS cannot. So that is the distinction [818:26] is that SCES can do HTML and plain text [818:29] but SNS just do does plain text and you [818:31] would not use SNS for transactional [818:33] emails. SCS can receive inbound emails. [818:37] Uh SCS uh can create email templates, [818:40] custom uh domain name emails. So when [818:43] you use SNS, it's whatever Amazon gives [818:45] you. It's going to be some weird [818:47] address, but SCS is whatever custom [818:49] domain you want. You can also monitor [818:51] email reputation for SCS. Then you have [818:54] Amazon Pinpoint. And so this is for [818:56] promotional emails. So these uh when we [818:59] say promotional, we're talking about [819:00] emails for marketing. So you can create [819:02] email campaigns. You can segment your [819:04] contacts. You can create customer [819:05] journeys via emails. Um it can do a [819:08] email testing. And so SCS and Pinpoint [819:12] get mixed up because a lot of people [819:13] think, well, can I just use my [819:15] transaction emails for promotion emails? [819:17] Absolutely you can. It's not recommended [819:19] because um you know Pinpoint has a lot [819:22] more functionality around promotional [819:24] emails. They're built differently. Uh [819:26] and so you know just understand that [819:28] those two have overlapping [819:29] responsibilities but generally you [819:31] should use them for what they're for. [819:33] Then you have Amazon Workmail and this [819:34] is just an email web client. So it's [819:36] similar to Gmail or Outlook. You can [819:38] create company emails, read, write and [819:40] send emails from a web client within the [819:41] ads management console. So there you go. [819:48] Let us compare Amazon inspector versus [819:50] adabus trusted advisor. So both of these [819:52] are security tools and they both perform [819:55] audits but what they do is slightly [819:58] different. So Amazon inspector audits a [820:00] single EC2 instance that you've selected [820:02] or I suppose you could select multiple [820:04] EC2s. It generates a report from a long [820:06] list of security checks. Um, and so [820:09] trusted advisor has checks, but uh the [820:12] the key difference here is that it [820:13] doesn't generate out a PDF report, [820:15] though I'm sure you could export CSV [820:17] data if you wanted to and then turn that [820:18] into a report. Uh, it it gives you a [820:20] holistic view of recommendations across [820:22] multiple services and best practices. [820:24] So, for example, if you have an open [820:26] port on the security groups, it could [820:27] tell you about about that. You should [820:29] enable MFA on your root account when [820:31] using trusted advisor, things like that. [820:33] Um, one thing though is that trust [820:35] adviser isn't just for security. does [820:37] checks across um uh five different [820:40] things. Um but they both do security and [820:42] they both technically do checks. Okay, [820:49] so there are a few services that have [820:52] connected the name. You'd think they [820:53] would be related in some way, but they [820:55] absolutely are not and they don't even [820:56] have similar functionality. But let's [820:58] take a look here so we know the [820:59] difference. The first is direct connect. [821:01] It is a dedicated fiber optics [821:03] connection from your data center to AWS. [821:05] It's intended for large enterprises with [821:07] their own data center and they need an [821:09] insanely fast and private connection [821:11] directly uh to AWS. And you'll notice I [821:14] give private and emphasis because if you [821:15] need a secure connection, you need to [821:17] apply uh an adabus virtual private [821:20] network connection on top of direct [821:22] connect. Then you have Amazon Connect. [821:23] This is a call center as a service. Get [821:26] a toll-free number, accept inbound and [821:27] outbound calls, set up automated phone [821:29] systems. Uh so if you ever heard of an [821:31] interactive voice system at IVS this is [821:34] basically what Amazon connect is. You [821:35] have media connect. This is the new [821:37] version of elastic transcoder. It it [821:39] converts videos to different video [821:41] types. So if you have let's say a [821:43] thousand videos you need to transcode [821:44] them into different video formats. Maybe [821:46] you need to apply watermarks insert [821:48] introduction videos in in front of each [821:50] one. This is what you use media connect [821:51] for. Okay. [821:57] Just in case you see elastic transcoder [821:59] as an option, I just want you to know [822:01] what it is compared to media connect. So [822:03] both these services are used for [822:05] transcoding and technically elastic [822:07] transcoder is the old way and ads [822:09] elemental media convert or just media [822:11] convert is the new way. So elastic [822:14] transcoder was the original transcoding [822:16] service. It may still have programmatic [822:18] APIs or workflows not available in media [822:20] convert. So this could be reasons why we [822:22] see the legacy customers still using it [822:24] or you know it's just too much effort [822:25] for them to upgrade to the new one. It [822:28] transcodes videos to streaming formats. [822:30] Uh media convert is more robust [822:32] transcoding service that can perform [822:33] various operations during transcoding. [822:36] So it also transcodes videos to [822:37] streaming different streaming formats [822:39] but it overlays images. It inserts uh [822:41] video clips, extracts captions data. It [822:44] has a robust UI. So generally it's [822:46] recommended to use the uh media convert. [822:48] Terms of costs are basically the same. [822:50] So there's no reason not to use media [822:52] convert. Okay. [822:57] So adus artifact versus Amazon inspector [823:00] get commonly mixed up all the time but [823:02] both artifact and inspector compile out [823:04] PDF reports. So that's where the [823:06] confusion comes from. But let's talk [823:07] about what is different about their [823:09] reports. So AIS artifact and AIS [823:11] inspector. So for artifact you're [823:13] answering why should an enterprise trust [823:15] AWS. It generates a security report [823:17] that's based on global compliance [823:19] frameworks such as SOCK or PCI or a [823:22] variety of others where Amazon Inspector [823:24] is all about how do we know the EC2 [823:26] instance is secure. Can you prove it? So [823:28] it runs a script that analyzes your EC2 [823:30] instance then generates a PDF report [823:32] telling you which security checks had [823:34] passed. Um so the idea here is it's an [823:36] audit tool for security of EC2 [823:38] instances. So there you go. [823:44] So let us compare ELB versus ALB versus [823:47] NLB versus JWLB versus CLB. Uh because [823:51] you know when I was first learning AWS I [823:53] was getting confused because there was [823:54] elastic load balancer but then there was [823:56] these other ones. So what gives right? [823:58] So what's happening here is that there [824:00] is a main service called elastic load [824:02] balancer elb and it has four different [824:05] types of possible load balancers. So [824:08] we'll go through all the types. So the [824:10] first is application load balancer [824:11] commonly uh initialized as ALB and so [824:15] this operates on layer 7 for HTTPS. This [824:18] makes sense because that is the [824:19] application layer and it has some [824:21] special powers in terms of routing [824:24] rules. So the idea here is you can [824:25] create rules to change routing based on [824:27] information found within the HTBS [824:30] request. So let's say you wanted some uh [824:32] routes to go that have a particular [824:34] subdomain to this server and a different [824:37] subdomain to another one. You could do [824:38] that and because it is an application [824:41] load balancer uh you can attach a web [824:44] application firewall for protection. You [824:47] can't attach this on the NLB or other [824:48] ones because they're not application [824:50] based. So that is just a little caveat [824:52] there. Then you have network load [824:54] balancer uh commonly abbreviated to NLB. [824:57] This operates on layer three and four. [824:59] So we're talking TCP UDP. This is great [825:02] for when you have extreme performance [825:04] that that requires T TCP and TLS [825:06] traffic. It's capable of handling [825:08] millions of requests per seconds uh [825:11] while maintaining ultra low latency. [825:12] It's optimized for sudden and volatile [825:14] traffic patterns while using a single [825:17] static IP address per availability zone. [825:20] Uh if you're making video games, this is [825:22] what they like to use is the network [825:23] load balancer, but it has other [825:25] utilities outside of that. Then you have [825:27] gateway load balancer, GWLB. This is [825:30] when you need to deploy a fleet of [825:31] thirdparty virtual appliances that [825:33] support uh I don't know how to say that [825:35] in abbreviation but I'll just uh say [825:37] it's g neve. [825:40] Um and there's not much we need to know [825:42] outside of that. Okay. Then there is the [825:44] classic load balancer. Uh commonly [825:46] initializes clb. This operates on layer [825:49] 3, four, and seven. It's intended for [825:51] applications that were built within the [825:52] EC2 classic network. It doesn't support [825:54] target groups. So ALBs, NLBs, uh use [825:58] target groups, which is just an easier [825:59] way of grouping together um a bunch of [826:02] uh target resources like compute uh that [826:05] we're going to load balance to. And with [826:06] classic load balancer, you just directly [826:08] assign EC2 instances. Uh and it's going [826:10] to be retired on August 15th of 2022. So [826:13] yeah, it looks like it can do a lot of [826:15] stuff, but um it also doesn't have any [826:17] of the superpowers of these specialized [826:19] ones and so uh there's no reason to keep [826:21] it around and generally you should not [826:23] be using it. Um, and so yeah, that's [826:25] about