AWS Certified Solutions Architect Study Guide: Associate SAA-C01 Exam

402 Pages·2019·11.41 MB·English

by  Ben Piper, David Clinton

AWS
Certified Solutions Architect
Study Guide
Second Edition
AWS
Certified Solutions Architect
Study Guide
Associate (SAA-C01) Exam
Second Edition
Ben Piper
David Clinton
Senior Acquisitions Editor: Kenyon Brown
Development Editor: Kathi Duggan
Technical Editors: Shlomo Swidler and Sara Perrott
Senior Production Editor: Christine O’Connor
Copy Editor: Kim Wimpsett
Content Enablement and Operations Manager: Pete Gaughan
Production Manager: Kathleen Wisor
Executive Editor: Jim Minatel
Book Designers: Judy Fung and Bill Gibson
Proofreader: Nancy Carrasco
Indexer: Ted Laux
Project Coordinator, Cover: Brent Savage
Cover Designer: Wiley
Cover Image: Getty Images Inc. / Jeremy Woodhouse
Copyright © 2019 by John Wiley & Sons, Inc., Indianapolis, Indiana
Published simultaneously in Canada
ISBN: 978-1-119-50421-4
ISBN: 978-1-119-50419-1 (ebk.)
ISBN: 978-1-119-50417-7 (ebk.)
Manufactured in the United States of America
No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or
by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permit-
ted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written
permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the
Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, [phone], fax (978)
646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department,
John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, [phone], fax [phone], or
online at http://www.wiley.com/go/permissions.
Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or war-
ranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim
all warranties, including without limitation warranties of fitness for a particular purpose. No warranty
may be created or extended by sales or promotional materials. The advice and strategies contained herein
may not be suitable for every situation. This work is sold with the understanding that the publisher is not
engaged in rendering legal, accounting, or other professional services. If professional assistance is required,
the services of a competent professional person should be sought. Neither the publisher nor the author
shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this
work as a citation and/or a potential source of further information does not mean that the author or the
publisher endorses the information the organization or Web site may provide or recommendations it may
make. Further, readers should be aware that Internet Web sites listed in this work may have changed or
disappeared between when this work was written and when it is read.
For general information on our other products and services or to obtain technical support, please contact
our Customer Care Department within the U.S. at [phone], outside the U.S. at [phone] or
fax [phone].
Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material
included with standard print versions of this book may not be included in e-books or in print-on-demand.
If this book refers to media such as a CD or DVD that is not included in the version you purchased,
you may download this material at http://booksupport.wiley.com. For more information about Wiley
products, visit www.wiley.com.
Library of Congress Control Number: 2018957473
TRADEMARKS: Wiley, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of
John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used
without written permission. All other trademarks are the property of their respective owners. John Wiley
& Sons, Inc. is not associated with any product or vendor mentioned in this book.
10 9 8 7 6 5 4 3 2 1
For He who created all things.
Acknowledgments
We would like to thank the following people who helped us create this AWS Certifed
Solutions Architect Study Guide: Associate SAA-C01 Exam, Second Edition.
First, a special thanks to our friends at Wiley. Kenyon Brown, senior acquisitions editor,
got the ball rolling on this project and pushed to get this book published quickly. His
experience and guidance throughout the project was critical. Kathi Duggan, development
editor, helped push this book forward by keeping us accountable to our deadlines. Her
edits made many of the technical parts of this book more readable. Thanks also go to
Katie Wisor, production manager; Christine O’Connor, production editor; Pete Gaughan,
content enablement manager; and Nancy Carrasco, proofreader.
John Mueller reviewed the chapters and questions for technical accuracy. Not only did his
comments and suggestions make this book more accurate, he also provided additional ideas
for the chapter review questions to make them more challenging and relevant to the exam.
Thanks also go to Sara Perrott and Shlomo Swidler for providing technical proofreading.
Lastly, the authors would like to thank each other!
About the Authors
David Clinton is a Linux server admin who has worked with
IT infrastructure in both academic and enterprise environments.
He has authored books—including Learn Amazon Web Services
in a Month of Lunches (Manning Publications, 2017) and
Linux in Action (Manning Publications, 2018)—and created
more than 15 video courses teaching Amazon Web Services and
Linux administration, server virtualization, and IT security for
Pluralsight.
In a “previous life,” David spent 20 years as a high school
teacher. He currently lives in Toronto, Canada, with his wife and family and can be
reached through his website: https://bootstrap-it.com.
Ben Piper, a native of Augusta, Georgia, is an IT consultant who
works with clients in the Georgia-Carolina area. He has created
more than 20 training courses covering Amazon Web Services,
Cisco routing and switching, Puppet confguration management,
and Windows Server Administration. He’s also the author of
Learn Cisco Network Administration in a Month of Lunches
(Manning Publications, 2017). Over the years he has designed,
implemented, and maintained a variety of technologies includ-
ing VMware vSphere, Citrix XenApp, XenServer, NetScaler, and
Cisco network infrastructure. You can contact Ben by visiting his
website: https://benpiper.com.
Contents at a Glance
Introduction xv
Assessment Test xxxi
Part I The Core AWS Services 1
Chapter 1 Introduction to Cloud Computing and AWS 3
Chapter 2 Amazon Elastic Compute Cloud and Amazon
Elastic Block Store 21
Chapter 3 Amazon Simple Storage Service and Amazon
Glacier Storage 47
Chapter 4 Amazon Virtual Private Cloud 67
Chapter 5 Databases 95
Chapter 6 Authentication and Authorization—AWS Identity
and Access Management 123
Chapter 7 CloudTrail, CloudWatch, and AWS Config 141
Chapter 8 The Domain Name System and Network Routing:
Amazon Route 53 and Amazon CloudFront 169
Part II The Well-Architected Framework 189
Chapter 9 The Reliability Pillar 191
Chapter 10 The Performance Efficiency Pillar 217
Chapter 11 The Security Pillar 247
Chapter 12 The Cost Optimization Pillar 277
Chapter 13 The Operational Excellence Pillar 295
Appendix Answers to Review Questions 327
Index 353
Contents
Introduction xv
Assessment Test xxxi
Part I The Core AWS Services 1
Chapter 1 Introduction to Cloud Computing and AWS 3
Cloud Computing and Virtualization 4
Cloud Computing Architecture 5
Cloud Computing Optimization 5
The AWS Cloud 6
AWS Platform Architecture 11
AWS Reliability and Compliance 13
The AWS Shared Responsibility Model 13
The AWS Service Level Agreement 14
Working with AWS 14
The AWS CLI 15
AWS SDKs 15
Technical Support and Online Resources 15
Support Plans 15
Other Support Resources 16
Sumary 16
Exam Essentials 17
Exercise 17
Review Questions 18
Chapter 2 Amazon Elastic Compute Cloud and Amazon
Elastic Block Store 21
Introduction 2
EC2 Instances 22
Provisioning Your Instance 23
Configuring Instance Behavior 28
Instance Pricing 28
Instance Lifecycle 29
Resource Tags 30
Service Limits 30
EC2 Storage Volumes 31
Elastic Block Store Volumes 31
Instance Store Volumes 33
Accessing Your EC2 Instance 33
xiv Contents
Securing Your EC2 Instance 35
Security Groups 35
IAM Roles 36
NAT Devices 36
Key Pairs 37
Other EC2-Related Services 37
AWS Systems Manager 37
Placement Groups 37
AWS Elastic Beanstalk 37
Amazon Elastic Container Service and AWS Fargate 38
AWS Lambda 38
VM Import/Export 38
Elastic Load Balancing and Auto Scaling 38
AWS CLI Example 39
Sumary 40
Exam Essentials 40
Review Questions 42
Chapter 3 Amazon Simple Storage Service and Amazon
Glacier Storage 47
Introduction 48
S3 Service Architecture 49
Prefixes and Delimiters 49
Working with Large Objects 49
Encryption 50
Loging 51
S3 Durability and Availability 51
Durability 52
Availability 52
Eventually Consistent Data 53
S3 Object Lifecycle 53
Versioning 53
Lifecycle Management 54
Accessing S3 Objects 54
Access Control 55
Presigned URLs 56
Static Website Hosting 56
S3 and Glacier Select 57
Amazon Glacier 57
Storage Pricing 58
Other Storage-Related Services 59
Amazon Elastic File System 59
AWS Storage Gateway 59
AWS Snowball 59
Contents xv
AWS CLI Example 60
Sumary 61
Exam Essentials 61
Review Questions 63
Chapter 4 Amazon Virtual Private Cloud 67
Introduction 68
VPC CIDR Blocks 68
Secondary CIDR Blocks 69
IPv6 CIDR Blocks 69
Subnets 70
Subnet CIDR Blocks 70
Availability Zones 71
IPv6 CIDR Blocks 72
Elastic Network Interfaces 72
Primary and Secondary Private IP Addresses 72
Attaching Elastic Network Interfaces 73
Internet Gateways 73
Route Tables 74
Routes 74
The Default Route 75
Security Groups 76
Inbound Rules 76
Outbound Rules 77
Sources and Destinations 78
Stateful Firewall 78
Default Security Group 78
Network Access Control Lists 79
Inbound Rules 79
Outbound Rules 80
Using Network Access Control Lists and Security
Groups Together 81
Public IP Addresses 82
Elastic IP Addresses 82
Network Address Translation 83
Network Address Translation Devices 84
Configuring Route Tables to Use NAT Devices 85
NAT Gateway 86
NAT Instance 87
VPC Peering 87
Sumary 8
Exam Essentials 89
Review Questions 91