| Introduction |
|
xxvii | |
| Assessment Test |
|
xxxiv | |
| Part I AWS Fundamentals |
|
1 | (28) |
|
Chapter 1 Introduction to Systems Operations on AWS |
|
|
3 | (26) |
|
|
|
5 | (3) |
|
|
|
6 | (1) |
|
|
|
7 | (1) |
|
|
|
8 | (6) |
|
What Is Systems Operations? |
|
|
14 | (3) |
|
The AWS Shared Responsibility Model |
|
|
15 | (1) |
|
The AWS Service Level Agreement |
|
|
16 | (1) |
|
|
|
16 | (1) |
|
|
|
17 | (4) |
|
The AWS Management Console |
|
|
17 | (2) |
|
|
|
19 | (1) |
|
|
|
19 | (1) |
|
Technical Support and Online Resources |
|
|
19 | (1) |
|
|
|
20 | (1) |
|
|
|
20 | (1) |
|
|
|
20 | (1) |
|
|
|
21 | (1) |
|
|
|
21 | (3) |
|
|
|
24 | (5) |
| Part II Monitoring and Reporting |
|
29 | (90) |
|
Chapter 2 Amazon CloudWatch |
|
|
31 | (30) |
|
|
|
32 | (4) |
|
Monitoring Is Event-Driven |
|
|
33 | (1) |
|
Monitoring Is Customizable |
|
|
34 | (2) |
|
|
|
36 | (1) |
|
Basic CloudWatch Terms and Concepts |
|
|
36 | (3) |
|
CloudWatch Is Metric- and Event-Based |
|
|
36 | (1) |
|
Alarms Indicate Notifiable Change |
|
|
36 | (1) |
|
Events and CloudWatch Events Are Lower Level |
|
|
37 | (1) |
|
CloudWatch Events Has Three Components |
|
|
37 | (1) |
|
Choosing Between Alarms and Events |
|
|
37 | (1) |
|
|
|
37 | (1) |
|
|
|
38 | (1) |
|
Statistics Aggregate Metrics |
|
|
38 | (1) |
|
|
|
39 | (2) |
|
|
|
39 | (1) |
|
|
|
40 | (1) |
|
|
|
41 | (1) |
|
|
|
41 | (3) |
|
|
|
42 | (1) |
|
|
|
42 | (1) |
|
|
|
43 | (1) |
|
|
|
44 | (2) |
|
Create an Alarm Threshold |
|
|
45 | (1) |
|
|
|
45 | (1) |
|
|
|
45 | (1) |
|
|
|
46 | (1) |
|
|
|
46 | (1) |
|
|
|
46 | (1) |
|
|
|
47 | (1) |
|
|
|
47 | (1) |
|
|
|
48 | (1) |
|
|
|
48 | (1) |
|
|
|
49 | (7) |
|
|
|
56 | (5) |
|
Chapter 3 AWS Organizations |
|
|
61 | (16) |
|
Managing Multiple Accounts |
|
|
62 | (2) |
|
AWS Organizations Consolidates User Management |
|
|
63 | (1) |
|
AWS Organizations Consolidates Billing |
|
|
63 | (1) |
|
Core AWS Organizations Concepts |
|
|
64 | (4) |
|
An Organization Is a Collection of Accounts |
|
|
64 | (1) |
|
Organizations Have a Master Account |
|
|
65 | (1) |
|
Manage Organizational Units Across Accounts |
|
|
65 | (1) |
|
Apply Service Control Policies |
|
|
66 | (2) |
|
AWS Organizations and Consolidated Billing |
|
|
68 | (1) |
|
|
|
69 | (1) |
|
Prefer AWS Organizations Over Tagging |
|
|
69 | (1) |
|
|
|
69 | (1) |
|
|
|
70 | (1) |
|
|
|
70 | (3) |
|
|
|
73 | (4) |
|
|
|
77 | (24) |
|
Managing Configuration Changes |
|
|
78 | (3) |
|
|
|
79 | (1) |
|
|
|
80 | (1) |
|
Configuration in the Cloud |
|
|
80 | (1) |
|
|
|
81 | (2) |
|
Centralized Configuration Management |
|
|
81 | (2) |
|
|
|
83 | (1) |
|
Configuration as Security |
|
|
83 | (1) |
|
AWS Config Rules and Responses |
|
|
83 | (4) |
|
Rules Are Desired Configurations |
|
|
83 | (1) |
|
A Configuration Item Represents a Specific Configuration |
|
|
84 | (1) |
|
|
|
85 | (2) |
|
AWS Config or AWS CloudTrail? |
|
|
87 | (1) |
|
|
|
87 | (1) |
|
|
|
88 | (1) |
|
|
|
88 | (1) |
|
|
|
89 | (7) |
|
|
|
96 | (5) |
|
|
|
101 | (18) |
|
API Logs Are Trails of Data |
|
|
102 | (4) |
|
|
|
103 | (2) |
|
|
|
105 | (1) |
|
CloudTrail as a Monitoring Tool |
|
|
106 | (2) |
|
|
|
106 | (1) |
|
Connect a CloudTrail Trail to SNS |
|
|
107 | (1) |
|
CloudTrail Handles Permissions...Sometimes |
|
|
108 | (1) |
|
|
|
108 | (1) |
|
|
|
108 | (1) |
|
|
|
109 | (1) |
|
|
|
109 | (6) |
|
|
|
115 | (4) |
| Part III High Availability |
|
119 | (44) |
|
Chapter 6 Amazon Relational Database Service |
|
|
121 | (20) |
|
Creating Databases with Amazon RDS |
|
|
122 | (6) |
|
Amazon RDS vs. Your Own Instances |
|
|
123 | (2) |
|
Supported Database Engines |
|
|
125 | (1) |
|
Database Configuration and Parameter Groups |
|
|
125 | (2) |
|
Scalability with Amazon RDS |
|
|
127 | (1) |
|
|
|
128 | (1) |
|
Scaling Amazon RDS Instances |
|
|
128 | (1) |
|
Backing Up Amazon RDS Instances |
|
|
128 | (1) |
|
Securing Amazon RDS Instances |
|
|
129 | (1) |
|
|
|
129 | (2) |
|
Creating a Multi-AZ Deployment |
|
|
129 | (1) |
|
Failing Over to the Secondary Instance |
|
|
130 | (1) |
|
|
|
131 | (1) |
|
Replication to Read Replicas |
|
|
131 | (1) |
|
Connecting to Read Replicas |
|
|
132 | (1) |
|
Read Replicas' Requirements and Limitations |
|
|
132 | (1) |
|
|
|
132 | (1) |
|
|
|
133 | (1) |
|
|
|
133 | (1) |
|
|
|
133 | (1) |
|
|
|
134 | (1) |
|
|
|
134 | (2) |
|
|
|
136 | (5) |
|
|
|
141 | (22) |
|
Auto Scaling Terms and Concepts |
|
|
142 | (5) |
|
|
|
143 | (1) |
|
Scaling In and Scaling Out |
|
|
143 | (1) |
|
|
|
144 | (1) |
|
Minimums, Maximums, and Desired Capacity |
|
|
145 | (1) |
|
Auto Scaling Groups Auto Scale |
|
|
145 | (1) |
|
Auto Scaling Instances Must Be Maintained |
|
|
146 | (1) |
|
|
|
147 | (2) |
|
EC2 Instances Are Launch Configuration Templates |
|
|
147 | (1) |
|
One Auto Scaling Group Has One Launch Configuration |
|
|
148 | (1) |
|
Launch Templates: Versioned Launch Configurations |
|
|
148 | (1) |
|
|
|
149 | (3) |
|
|
|
149 | (1) |
|
|
|
149 | (1) |
|
|
|
150 | (1) |
|
|
|
150 | (1) |
|
Instances Terminate in Order |
|
|
151 | (1) |
|
|
|
152 | (1) |
|
|
|
153 | (1) |
|
|
|
153 | (1) |
|
|
|
153 | (1) |
|
|
|
154 | (4) |
|
|
|
158 | (5) |
| Part IV Deployment and Provisioning |
|
163 | (46) |
|
Chapter 8 Hubs, Spokes, and Bastion Hosts |
|
|
165 | (22) |
|
|
|
166 | (3) |
|
Understanding the Use Case for Hub-and-Spoke Architecture |
|
|
168 | (1) |
|
Using a VPC Peering Connection Across Multiple Regions (Interregion Peering) |
|
|
169 | (1) |
|
|
|
169 | (2) |
|
Architecting for Bastion Host Use |
|
|
170 | (1) |
|
Options for Bastion Hosts |
|
|
170 | (1) |
|
|
|
171 | (1) |
|
|
|
172 | (1) |
|
Linux Bastion Hosts on the AWS Cloud: |
|
|
172 | (1) |
|
|
|
172 | (1) |
|
|
|
173 | (10) |
|
|
|
183 | (4) |
|
Chapter 9 AWS Systems Manager |
|
|
187 | (22) |
|
|
|
188 | (8) |
|
Communication with AWS Systems Manager |
|
|
189 | (1) |
|
|
|
190 | (1) |
|
|
|
191 | (1) |
|
Taking Action with AWS Systems Manager |
|
|
191 | (5) |
|
|
|
196 | (1) |
|
|
|
196 | (1) |
|
|
|
197 | (1) |
|
|
|
197 | (8) |
|
|
|
205 | (4) |
| Part V Storage and Data Management |
|
209 | (60) |
|
Chapter 10 Amazon Simple Storage Service (S3) |
|
|
211 | (26) |
|
Object Storage and Amazon S3 |
|
|
212 | (3) |
|
|
|
214 | (1) |
|
Availability and Durability |
|
|
215 | (2) |
|
|
|
216 | (1) |
|
Securing and Protecting Data in S3 |
|
|
217 | (5) |
|
|
|
217 | (3) |
|
|
|
220 | (1) |
|
|
|
221 | (1) |
|
|
|
222 | (1) |
|
Amazon Glacier Deep Archive |
|
|
223 | (1) |
|
|
|
223 | (1) |
|
|
|
224 | (1) |
|
|
|
225 | (1) |
|
|
|
225 | (1) |
|
|
|
226 | (1) |
|
|
|
226 | (6) |
|
|
|
232 | (5) |
|
Chapter 11 Elastic Block Store (EBS) |
|
|
237 | (16) |
|
Understanding Block Storage and EBS |
|
|
238 | (4) |
|
|
|
239 | (2) |
|
|
|
241 | (1) |
|
Encrypting Your EBS Volumes |
|
|
242 | (2) |
|
|
|
244 | (1) |
|
|
|
244 | (1) |
|
|
|
244 | (1) |
|
|
|
245 | (1) |
|
|
|
245 | (3) |
|
|
|
248 | (5) |
|
Chapter 12 Amazon Machine Image (AMI) |
|
|
253 | (16) |
|
Amazon Machine Images (AMIs) |
|
|
254 | (4) |
|
|
|
255 | (2) |
|
|
|
257 | (1) |
|
|
|
258 | (1) |
|
|
|
258 | (1) |
|
|
|
258 | (1) |
|
Moving AMIs Between Regions |
|
|
258 | (2) |
|
|
|
259 | (1) |
|
|
|
259 | (1) |
|
|
|
260 | (1) |
|
|
|
260 | (1) |
|
|
|
260 | (1) |
|
|
|
261 | (1) |
|
|
|
261 | (3) |
|
|
|
264 | (5) |
| Part VI Security and Compliance |
|
269 | (62) |
|
|
|
271 | (24) |
|
Shared Responsibility Model: A Cloud Security Primer |
|
|
272 | (1) |
|
|
|
273 | (5) |
|
|
|
273 | (1) |
|
|
|
274 | (1) |
|
|
|
274 | (1) |
|
|
|
275 | (3) |
|
|
|
278 | (3) |
|
|
|
278 | (1) |
|
|
|
279 | (2) |
|
Securing Your AWS Accounts |
|
|
281 | (1) |
|
Protecting the Root Account |
|
|
281 | (1) |
|
|
|
281 | (1) |
|
|
|
282 | (1) |
|
|
|
282 | (1) |
|
|
|
282 | (1) |
|
|
|
283 | (1) |
|
|
|
283 | (1) |
|
|
|
283 | (1) |
|
|
|
284 | (1) |
|
|
|
284 | (1) |
|
|
|
285 | (5) |
|
|
|
290 | (5) |
|
Chapter 14 Reporting and Logging |
|
|
295 | (20) |
|
Reporting and Monitoring in AWS |
|
|
296 | (1) |
|
|
|
296 | (4) |
|
Applying a Trail to All Regions |
|
|
298 | (1) |
|
|
|
298 | (1) |
|
|
|
298 | (2) |
|
But You Said CloudTrail Was Free... |
|
|
300 | (1) |
|
|
|
300 | (4) |
|
|
|
301 | (1) |
|
|
|
302 | (1) |
|
|
|
303 | (1) |
|
Amazon CloudWatch Dashboard |
|
|
303 | (1) |
|
|
|
304 | (1) |
|
|
|
305 | (1) |
|
|
|
305 | (1) |
|
|
|
306 | (1) |
|
|
|
306 | (5) |
|
|
|
311 | (4) |
|
Chapter 15 Additional Security Tools |
|
|
315 | (16) |
|
|
|
316 | (2) |
|
|
|
318 | (2) |
|
|
|
320 | (1) |
|
|
|
320 | (1) |
|
|
|
320 | (1) |
|
|
|
321 | (5) |
|
|
|
326 | (5) |
| Part VII Networking |
|
331 | (50) |
|
Chapter 16 Virtual Private Cloud |
|
|
333 | (28) |
|
Understanding AWS Networking |
|
|
334 | (11) |
|
Classless Inter-Domain Routing Refresher |
|
|
335 | (1) |
|
|
|
336 | (1) |
|
|
|
337 | (1) |
|
|
|
338 | (1) |
|
|
|
339 | (1) |
|
NAT Gateways and Instances |
|
|
340 | (2) |
|
|
|
342 | (2) |
|
Connecting to the Outside |
|
|
344 | (1) |
|
|
|
345 | (2) |
|
|
|
345 | (1) |
|
Network Access Control Lists |
|
|
346 | (1) |
|
Troubleshooting Network Issues |
|
|
347 | (1) |
|
|
|
347 | (1) |
|
|
|
348 | (1) |
|
|
|
348 | (1) |
|
|
|
349 | (1) |
|
|
|
350 | (1) |
|
|
|
351 | (5) |
|
|
|
356 | (5) |
|
|
|
361 | (20) |
|
|
|
362 | (2) |
|
|
|
363 | (1) |
|
|
|
364 | (2) |
|
|
|
366 | (1) |
|
|
|
366 | (1) |
|
|
|
366 | (5) |
|
|
|
366 | (1) |
|
|
|
367 | (1) |
|
Geolocation Routing Policy |
|
|
368 | (1) |
|
Geoproximity Routing Policy |
|
|
368 | (1) |
|
|
|
369 | (1) |
|
Multivalue Answer Routing Policy |
|
|
369 | (1) |
|
|
|
370 | (1) |
|
Health Checks and Failover |
|
|
371 | (1) |
|
|
|
372 | (1) |
|
|
|
372 | (1) |
|
|
|
373 | (1) |
|
|
|
373 | (4) |
|
|
|
377 | (4) |
| Part VIII Automation and Optimization |
|
381 | (42) |
|
Chapter 18 CloudFormation |
|
|
383 | (18) |
|
|
|
384 | (1) |
|
|
|
385 | (1) |
|
|
|
385 | (4) |
|
|
|
385 | (1) |
|
|
|
386 | (1) |
|
|
|
386 | (1) |
|
|
|
386 | (1) |
|
|
|
387 | (1) |
|
|
|
388 | (1) |
|
|
|
388 | (1) |
|
|
|
388 | (1) |
|
Creating and Customizing Your Stacks |
|
|
389 | (1) |
|
|
|
389 | (1) |
|
|
|
390 | (1) |
|
|
|
390 | (2) |
|
|
|
390 | (1) |
|
|
|
391 | (1) |
|
|
|
392 | (1) |
|
Issues with CloudFormation Templates |
|
|
392 | (1) |
|
|
|
392 | (1) |
|
|
|
393 | (1) |
|
|
|
393 | (1) |
|
|
|
394 | (2) |
|
|
|
396 | (5) |
|
Chapter 19 Elastic Beanstalk |
|
|
401 | (22) |
|
What Is Elastic Beanstalk? |
|
|
402 | (6) |
|
|
|
403 | (2) |
|
Creating a Custom Platform |
|
|
405 | (3) |
|
Updates in Elastic Beanstalk |
|
|
408 | (2) |
|
|
|
409 | (1) |
|
|
|
409 | (1) |
|
Rolling with Additional Batches Deployment |
|
|
409 | (1) |
|
|
|
409 | (1) |
|
Testing Your Application with a Blue/Green Deployment |
|
|
410 | (1) |
|
Configuring Elastic Beanstalk |
|
|
410 | (2) |
|
Securing Elastic Beanstalk |
|
|
412 | (2) |
|
|
|
412 | (1) |
|
Identity and Access Management |
|
|
412 | (1) |
|
|
|
412 | (1) |
|
|
|
412 | (1) |
|
|
|
413 | (1) |
|
Configuration and Vulnerability Analysis |
|
|
413 | (1) |
|
|
|
413 | (1) |
|
Applying Security Best Practices to Elastic Beanstalk |
|
|
413 | (1) |
|
AWS Elastic Beanstalk CLI |
|
|
414 | (1) |
|
Troubleshooting Elastic Beanstalk |
|
|
414 | (1) |
|
|
|
415 | (1) |
|
|
|
415 | (1) |
|
|
|
416 | (1) |
|
|
|
416 | (2) |
|
|
|
418 | (5) |
| Appendix Answers to Review Questions |
|
423 | (32) |
|
Chapter 1: Introduction to Systems Operations on AWS |
|
|
424 | (1) |
|
Chapter 2: Amazon CloudWatch |
|
|
425 | (2) |
|
Chapter 3: AWS Organizations |
|
|
427 | (2) |
|
|
|
429 | (1) |
|
Chapter 5: AWS CloudTrail |
|
|
430 | (2) |
|
Chapter 6: Amazon Relational Database Service |
|
|
432 | (2) |
|
|
|
434 | (2) |
|
Chapter 8: Hubs, Spokes, and Bastion Hosts |
|
|
436 | (1) |
|
Chapter 9: AWS Systems Manager |
|
|
437 | (2) |
|
Chapter 10: Amazon Simple Storage Service (S3) |
|
|
439 | (1) |
|
Chapter 11: Elastic Block Store (EBS) |
|
|
440 | (1) |
|
Chapter 12: Amazon Machine Image (AMI) |
|
|
441 | (2) |
|
|
|
443 | (1) |
|
Chapter 14: Reporting and Logging |
|
|
444 | (2) |
|
Chapter 15: Additional Security Tools |
|
|
446 | (1) |
|
Chapter 16: Virtual Private Cloud |
|
|
447 | (2) |
|
|
|
449 | (2) |
|
Chapter 18: CloudFormation |
|
|
451 | (1) |
|
Chapter 19: Elastic Beanstalk |
|
|
452 | (3) |
| Index |
|
455 | |
