AWS Certified SysOps Administrator Study Guide with Online Labs

SARA PERROTT is an accredited AWS Academy instructor at Bellevue College where she is an adjunct professor. She works full-time in the cybersecurity field and is passionate about her work. She has an MS in Cybersecurity and Information Assurance and holds several industry certifications such as the CISSP and GCIH, in addition to the AWS Certified Solutions Architect Associate and AWS Certified SysOps Administrator Associate certifications. You can contact Sara via her website at https://www.saraperrott.com. BRETT MCLAUGHLIN currently works in cloud computing, focusing on scalable cloud platforms and staging and distributing petabyte-scale data stores. He is an expert in cloud-based architectures and large data sets and has led projects for NASA and billion-dollar AUM hedge funds. He is currently the CTO for Volusion, as well as an active instructor in the AWS and serverless communities.

• Introduction xxviiAssessment Test xxxivPart I AWS Fundamentals 1Chapter 1 Introduction to Systems Operations on AWS 3The AWS Ecosystem 5The AWS Services Model 6The AWS Global Presence 7AWS Managed Services 8What is Systems Operations? 14The AWS Shared Responsibility Model 15The AWS Service Level Agreement 16The Seven Domains 16Working with AWS 17The AWS Management Console 17The AWS CLI 19AWS SDKs 19Technical Support and Online Resources 19Support Plans 20Other Support Resources 20Key Exam Resources 20Summary 21Exam Essentials 21Review Questions 24Part II Monitoring and Reporting 29Chapter 2 Amazon CloudWatch 31Monitoring on AWS 32Monitoring is Event-Driven 33Monitoring is Customizable 34Monitoring Drives Action 36Basic CloudWatch Terms and Concepts 36CloudWatch is Metric- and Event-Based 36Alarms Indicate Notifiable Change 36Events and CloudWatch Events are Lower Level 37CloudWatch Events Has Three Components 37Choosing Between Alarms and Events 37What’s in a Namespace? 37To the 10th Dimension 38Statistics Aggregate Metrics 38Monitoring Compute 39EC2 Instance Metrics 39EC2 EBS Metrics 40ECS Metrics 41Monitoring Storage 41S3 Metrics 42RDS Metrics 42DynamoDB2 Metrics 43CloudWatch Alarms 44Create an Alarm Threshold 45Set Off an Alarm 45Respond to an Alarm 45CloudWatch Events 46Events 46Rules 46Targets 47Summary 47Resources to Review 48Exam Essentials 48Exercises 49Review Questions 56Chapter 3 AWS Organizations 61Managing Multiple Accounts 62AWS Organizations Consolidates User Management 63AWS Organizations Consolidates Billing 63Core AWS Organizations Concepts 64An Organization is a Collection of Accounts 64Organizations Have a Master Account 65Manage Organizational Units Across Accounts 65Apply Service Control Policies 66AWS Organizations and Consolidated Billing 68Compliance Benefits 69Prefer AWS Organizations Over Tagging 69Summary 69Exam Essentials 70Exercises 70Review Questions 73Chapter 4 AWS Config 77Managing Configuration Changes 78Continuous Everything 79On-Premises Solutions 80Configuration in the Cloud 80Contents xviiAWS Config Use Cases 81Centralized Configuration Management 81Audit Trails 83Configuration as Security 83AWS Config Rules and Responses 83Rules are Desired Configurations 83A Configuration Item Represents a Specific Configuration 84Rules are Evaluated 85AWS Config or AWS CloudTrail? 87Summary 87Resources to Review 88Exam Essentials 88Exercises 89Review Questions 96Chapter 5 AWS CloudTrail 101API Logs are Trails of Data 102What Exactly is a Trail? 103The CloudTrail Process 105CloudTrail as a Monitoring Tool 106Viewing CloudTrail Logs 106Connect a CloudTrail Trail to SNS 107CloudTrail Handles Permissions…Sometimes 108Summary 108Resources to Review 108Exam Essentials 109Exercises 109Review Questions 115Part III High Availability 119Chapter 6 Amazon Relational Database Service 121Creating Databases with Amazon RDS 122Amazon RDS vs. Your Own Instances 123Supported Database Engines 125Database Configuration and Parameter Groups 125Scalability with Amazon RDS 127Amazon RDS Key Features 128Scaling Amazon RDS Instances 128Backing Up Amazon RDS Instances 128Securing Amazon RDS Instances 129Multi-AZ Configuration 129Creating a Multi-AZ Deployment 129Failing Over to the Secondary Instance 130Read Replicas 131Replication to Read Replicas 131Connecting to Read Replicas 132Read Replicas’ Requirements and Limitations 132Amazon Aurora 132Aurora Volumes 133Aurora Replicas 133Summary 133Resources to Review 134Exam Essentials 134Review Questions 136Chapter 7 Auto Scaling 141Auto Scaling Terms and Concepts 142Auto Scaling Groups 143Scaling In and Scaling Out 143Scaling More than EC2 144Minimums, Maximums, and Desired Capacity 145Auto Scaling Groups Auto Scale 145Auto Scaling Instances Must Be Maintained 146Launch Configurations 147EC2 Instances are Launch Configuration Templates 147One Auto Scaling Group Has One Launch Configuration 148Launch Templates: Versioned Launch Configurations 148Auto Scaling Strategies 149Manual Scaling 149Scheduled Scaling 149Dynamic Scaling 150Cooldown Periods 150Instances Terminate in Order 151When Auto Scaling Fails 152Summary 153Resources to Review 153Exam Essentials 153Exercises 154Review Questions 158Part IV Deployment and Provisioning 163Chapter 8 Hubs, Spokes, and Bastion Hosts 165VPC Peering 166Understanding the Use Case for Hub-and-Spoke Architecture 168Using a VPC Peering Connection Across Multiple Regions (Interregion Peering) 169Bastion Hosts 169Architecting for Bastion Host Use 170Options for Bastion Hosts 170Summary 171Resources to Review 172Linux Bastion Hosts on the AWS Cloud: 172Exam Essentials 172Exercises 173Review Questions 183Chapter 9 AWS Systems Manager 187AWS Systems Manager 188Communication with AWS Systems Manager 189AWS Managed Instances 190AWS Resource Groups 191Taking Action with AWS Systems Manager 191Summary 196Resources to Review 196Exam Essentials 197Exercises 197Review Questions 205Part V Storage and Data Management 209Chapter 10 Amazon Simple Storage Service (S3) 211Object Storage and Amazon S3 212What’s in a URL? 214Availability and Durability 215S3 Storage Classes 216Securing and Protecting Data in S3 217Access Control 217Versioning 220Encryption 221Amazon Glacier 222Amazon Glacier Deep Archive 223S3 Lifecycle Management 223Storage Gateways 224Summary 225Resources to Review 225Exam Essentials 226Exercises 226Review Questions 232Chapter 11 Elastic Block Store (EBS) 237Understanding Block Storage and EBS 238Types of EBS Storage 239EBS vs. Instance Stores 241Encrypting Your EBS Volumes 242EBS Snapshots 244Summary 244Resources to Review 244Exam Essentials 245Exercises 245Review Questions 248Chapter is Amazon Machine Image (AMI) 253Amazon Machine Images (AMIs) 254Accessibility of AMIs 255AMI Storage 257AMI Security 258Launch Permissions 258Encryption 258Moving AMIs Between Regions 258AWS Management Console 259AWS CLI 259Common AMI Issues 260Summary 260Resources to Review 260Exam Essentials 261Exercises 261Review Questions 264Part VI Security and Compliance 269Chapter 13 IAM 271Shared Responsibility Model: A Cloud Security Primer 272Building Blocks of IAM 273Users 273Groups 274Roles 274Policies 275Managing IAM 278Managing Passwords 278Managing Access Keys 279Securing Your AWS Accounts 281Protecting the Root Account 281IAM Best Practices 281Trusted Advisor 282Other Identity Services 282Cognito 282Federation 283AWS KMS 283Summary 283Resources to Review 284Exam Essentials 284Exercises 285Review Questions 290Chapter 14 Reporting and Logging 295Reporting and Monitoring in AWS 296AWS CloudTrail 296Applying a Trail to All Regions 298Management Events 298Data Events 298But You Said CloudTrail Was Free… 300Amazon CloudWatch 300Amazon CloudWatch Alarms 301Amazon CloudWatch Logs 302Amazon CloudWatch Events 303Amazon CloudWatch Dashboard 303AWS Config 304Summary 305Resources to Review 305Exam Essentials 306Exercises 306Review Questions 311Chapter 15 Additional Security Tools 315Amazon Inspector 316Amazon GuardDuty 318Summary 320Resources to Review 320Exam Essentials 320Exercises 321Review Questions 326Part VII Networking 331Chapter 16 Virtual Private Cloud 333Understanding AWS Networking 334Classless Inter-Domain Routing Refresher 335Virtual Private Cloud 336Subnets 337Route Tables 338Internet Gateways 339NAT Gateways and Instances 340VPC Endpoints 342Connecting to the Outside 344Securing Your Network 345Security Groups 345Network Access Control Lists 346Troubleshooting Network Issues 347VPC Flow Logs 347Other Resources 348Summary 348Resources to Review 349Exam Essentials 350Exercises 351Review Questions 356Chapter 17 Route 53 361Domain Name System 362DNS Records 363Amazon Route 53 364Amazon Traffic Flow 366AWS Private DNS 366Routing Policies 366Simple Routing Policy 366Failover Routing Policy 367Geolocation Routing Policy 368Geoproximity Routing Policy 368Latency Routing Policy 369Multivalue Answer Routing Policy 369Weighted Routing Policy 370Health Checks and Failover 371Summary 372Resources to Review 372Exam Essentials 373Exercises 373Review Questions 377Part VIII Automation and Optimization 381Chapter 18 CloudFormation 383An Introduction to IaaS 384CloudFormation Templates 385AWSTemplateFormatVersion 385Description 385Metadata 386Parameters 386Mappings 386Conditions 387Transform 388Resources 388Outputs 388Creating and Customizing Your Stacks 389Parameters 389Outputs 390Improving Your Templates 390Built-in Functions 390Mapping 391Pseudo Parameters 392Issues with CloudFormation Templates 392Summary 392Resources to Review 393Exam Essentials 393Exercise 394Review Questions 396Chapter 19 Elastic Beanstalk 401What is Elastic Beanstalk? 402Platforms and Languages 403Creating a Custom Platform 405Updates in Elastic Beanstalk 408All-at-Once Deployment 409Rolling Deployment 409Rolling with Additional Batches Deployment 409Immutable Deployment 409Testing Your Application with a Blue/Green Deployment 410Configuring Elastic Beanstalk 410Securing Elastic Beanstalk 412Data Protection 412Identity and Access Management 412Logging and Monitoring 412Compliance 412Resilience 413Configuration and Vulnerability Analysis 413Security Best Practices 413Applying Security Best Practices to Elastic Beanstalk 413AWS Elastic Beanstalk CLI 414Troubleshooting Elastic Beanstalk 414Summary 415Resources to Review 415Exam Essentials 416Exercise 416Review Questions 418Appendix Answers to Review Questions 423Chapter 1: Introduction to Systems Operations on AWS 424Chapter 2: Amazon CloudWatch 425Chapter 3: AWS Organizations 427Chapter 4: AWS Config 429Chapter 5: AWS CloudTrail 430Chapter 6: Amazon Relational Database Service 432Chapter 7: Auto Scaling 434Chapter 8: Hubs, Spokes, and Bastion Hosts 436Chapter 9: AWS Systems Manager 437Chapter 10: Amazon Simple Storage Service (S3) 439Chapter 11: Elastic Block Store (EBS) 440Chapter 12: Amazon Machine Image (AMI) 441Chapter 13: IAM 443Chapter 14: Reporting and Logging 444Chapter 15: Additional Security Tools 446Chapter 16: Virtual Private Cloud 447Chapter 17: Route 53 449Chapter 18: CloudFormation 451Chapter 19: Elastic Beanstalk 452Index 455