Show Menu
Cheatography
  1. Home >
  2. Cheat Sheets >

AWS Certified Developer Cheat Sheet (DRAFT) by

Cheatsheet about AWS Certified Developer

This is a draft cheat sheet. It is a work in progress and is not finished yet.

Cloud Computing Models (SI)

On-Premise
You are the owner of the infras­tru­cture
Cloud
Someone owns the servers, you are respon­sible for setting up the cloud services and the code
Hybrid
Mix of the previous approaches

Amazon Simple Storage Service (S3) SI

Object Storage Service. It will allow us to store objects in buckets, and each object can have a maximum of 5TB. Each object has a key, value, metadata, access control inform­ation and version ID.

Amazon S3 - Security & Policies (SI)

Effect
Allow/Deny
Principal
Who can perform an action over the bucket­/object
Action
What the user can do over the bucket­/object
Resource
Object­/bucket affected

Amazon S3 - Encryption (SI)

Server Side Encryption - S3
Amazon S3 manages the encryption key
Server Side Encryption - KMS
AWS KMS manages the encryption key
Server Side Encryption - C
The customer provides the encryption keys
Client Side Encryption
Encrypting data before sending it to Amazon S3
Dual-layer Server Side Encryption - DSSE-KMS
It applies two layers of encryption to objects when they are uploaded to Amazon S3

AWS CloudTrail (SI)

Monitor and record account activity across your AWS infras­tru­cture. For example, you can check the account that deleted an EC2 instance. There are two types of events:

- Data events: Visibility into the resource operations performed on or within a resource.
- Management events: Visibility into management operations performed in our AWS accounts.

A PARTIR DE AQUI TODO ES NEW

Amazon CloudFront - Cache

Edge Location
Each Edge Location has its own cache
Cache Key
Unique identifier for an object in the cache
Cache Policies
Based on HTTP headers, Cookies, or Query Strings. Automa­tically included in the origin request. You can use TTL
Cache Invali­dations
Entire Refresh (inval­idating all files) or Partial Refresh (inval­idating a set of files) of the cache
Cache Behaviors
Settings that describes how CloudFront processes requests

AWS CodeCommit - Authen­tic­ation

HTTPS
AWS Access Key
HTTPS
GIT creden­tials generated with IAM
SSH
SSH keys associated with IAM user

Files/­Folders Summary

CodeBuild
builds­pec.yml
CodeDeploy (Lambd­a/ECS)
appspe­c.yaml
CodeDeploy (EC2/O­n-p­remise)
appspe­c.yml
Elastic Beanstalk
ebexte­nsions
Elastic Beanstalk (Docker)
docker­run.aw­s.json

AWS STS - Main API Functions

AssumeRole
Returns a set of temporary security creden­tials that you can use to access AWS resources
Assume­Rol­eWi­thSAML
Request temporary security creden­tials for an IAM role for users authen­ticated via SAML. The user authen­ticates against an external SAML-based identity provider
Assume­Rol­eWi­thW­ebI­dentity
Returns a set of temporary security creden­tials for users who have been authen­ticated in a mobile or web applic­ation with a web identity provider
GetSes­sio­nToken
Used when using MFA to protect progra­mmatic calls
AWSRev­oke­Old­erS­ession
Revoke all active sessions.
Service to request temporary, limite­d-p­riv­ilege creden­tials for users. The AssumeRole functions have a duration of 15min - 12h. When assuming a role, you give up your original permis­sions.

You can pass session tags and use the aws:Pr­inc­ipalTag condition in your policies to allow/deny access based on these tags.


External ID for additional security control

AWS CONTROL TOWERR

Account Factory
Automate the provis­ioning and management of accounts
Guardrail
Framework to help you prepare for audits by detecting and remedi­ating policy violat­ions. Types: preventive and detective
TODO: ADD DESCRI­PTION QUE YA ESTÁ EN EL OTRO LADO

AWS Directory Services

AWS Managed Microsoft AD
It's a Microsoft Active Directory (AD) as an AWS managed service. You can also configure a trust relati­onship (not replic­ation) between AWS Managed Microsoft AD in the AWS Cloud and your existing on-pre­mises Microsoft Active Directory.
AD Connector
Gateway with which you can redirect directory requests to your on-pre­mises Microsoft Active Directory. It does not support Active Directory transitive trusts, it works as a 1-to-1 relati­onship with your on-premise AD domain. The on-premise network must be connected to your VPC through a VPN connection or AWS Direct Connect
Simple AD
Standalone managed directory. It does NOT support some features like MFA, trust relati­ons­hips, and more.

Migration Strategies - The 6 R’s

Rehosting (lift-­and­-shift)
Moving to the cloud without making signif­icant changes to the archit­ecture:
Replat­forming
Moving to the cloud making minor archit­ecture adjust­ments. For example, an on-premise DB to RDS
Repurc­hasing
Moving to a different product
Refact­oring
Re-arc­hit­ecting your applic­ation, typically using cloud native features
Retire
Get rid of the applic­ation
Retain
Do nothing (for now)

AWS Organi­zations

Main Components
Organi­zat­ional Units (OUs), and Service Control Policies (SCPs)
Type of Accounts
Main Account, and Member Account
Tag Policies
Standa­rdize tags across resources in your organi­zat­ion's accounts
Feature Sets
All features and Consol­idated Billing features
Move Accounts between Organi­zations
Remove Account from Org1, invite the account from Org2, and accept invite
You can progra­mma­tically create new AWS accounts and allocate resources, group them, apply policies, and simplify billing by using a single payment method for all your accounts

Spot Fleet - Allocation Strategies

priceC­apa­cit­yOp­timized (best choice)
Provide a balance between capacity availa­bility and cost optimi­zation
capaci­tyO­pti­mized
Analyzes the available Spot Instance pools across all selected instance types in an AWS Region and launches instances from the most available pools
divers­ified
Distribute Spot Instances across all pools
lowest­Price
Launches instances from the Spot Instance pool with the lowest price
A Spot Fleet is a set of Spot Instances and optionally On-Demand Instances that is launched based on criteria that you specify.

AWS IAM Policy Types

Identi­ty-­based policies
Grant permis­sions to an identity (users, groups, or roles)
Resour­ce-­based policies
Attach inline policies to resources. Amazon S3 bucket policies is an example
Permis­sions boundaries
Maximum permis­sions that the identi­ty-­based policies can grant to an entity (only users or roles). It doesn't grant permis­sions by itself
Organi­zations SCPs
Maximum permis­sions for account members of an organi­zation or organi­zat­ional unit (OU)
Access control lists (ACLs)
Cross-­account permis­sions policies that grant permis­sions to the specified principal. They are not in JSON format
Session policies
Permis­sions that the role or user's identi­ty-­based policies grant to the session created assuming a role or federated user
 

Elastic Compute Cloud (EC2) (SI)

EC2 is a web service to provide compute capacity in the cloud. It's one of the core services of AWS, including processor, storage, networ­king, operating system, and purchase model. It's composed of Virtual machines (EC2), Block-­storage service (EBS), Load Balancer (ELB) and Elasticity of the resources (Auto Scaling Group)

EC2 Instances Types (SI)

R
Applic­ation requires RAM
C
Applic­ation requires CPU
M
Balanced Applic­ations Medium
I
Applic­ation requires I/O
G
Applic­ation requires GPU
T2/T3
Burstable instances
T2/T3 Unlimited
Burstable instances that you can pay more to not lose perfor­mance
You can find a lot of different instance types at the following link. https:­//i­nst­anc­es.v­an­tag­e.sh/

EC2 Security Groups (SI)

Inbound Traffic
Traffic that tries to access the instance.
Outbound Traffic
Traffic that leaves the instance
Security Groups act as a virtual firewall to control inbound and outbound traffic for your instance. You can specify allow rules, but not deny rules. They live outside of EC2, so you can attach them to multiple instances.

EBS (SI - edit)

Block-­storage service for EC2. It's a network storage drive, and you pay for the capacity you provision. You can back up the data on your Amazon EBS volumes to Amazon S3 by taking point-­in-time increm­ental snapshots.

You will also need to create snapshots to migrate an EBS between AWS Regions. You'll have to restore the snapshot in the Region where you want to copy it.

EBS Types (SI)

GP2/GP3 SSD
General Purpose SSD volumes
IO1/IO2 SSD
Highest perfor­mance. They support EBS Multi-­Attach (attach IO1 or IO2 volume to multiple EC2 instances in the same AZ)
ST1 HHD
Frequently accessed, throug­hpu­t-i­nte­nsive workloads
SC1 HHD
Lowest cost per GB

Instance Store (SI)

Temporary physically attached storage for your instance. It provides high perfor­mance / IOPS.

Elastic File System (EFS) (SI)

Perfor­mance Modes
General Pupose & Max I/O
Storage Classes
Standard & Standa­rd-IA
EFS allows you to mount a file storage system across multiple AZs and instances. It provides massively parallel shared access to thousands of instances.

Main Serverless Services (SI)

AWS Lambda
Lambda­@Edge
DynamoDB
API Gateway
Amazon Cognito
AWS Serverless Applic­ation Model

A PARTIR DE AQUI TODO ES NEW (copy)

AWS Resources Access Manager (RAM)

Share your AWS resources across AWS accounts, within your organi­zation, or organi­zat­ional units (OUs). VPC Subnets, Prefix List, etc.

Identity Federation

Federation with IAM Identity Center (Successor to AWS SSO)adf
Centra­lized access manage­ment. You can manage access using permission sets to different AWS accounts and external services (Slack, SalesF­orce, custom apps) from the same place. Build-in and 3rd party IdPs.
Federation with SAML 2.0
Integr­ating AWS with an external identity provider (IdP) that supports the SAML 2.0 standard. You can use the Assume­­Ro­l­e­Wi­­thSAML API call or Active Directory Federation Services (AD FS)
Web Identity Federation
Allowing users to authen­ticate using identity providers like Amazon Cognito (recom­men­ded), Google, Facebook, or other OpenID Connect (OIDC) providers. Assume­Rol­eWi­thW­ebI­dentity API
Federation with Custom Identity Broker
A custom identity broker acts as an interm­ediary between AWS and your organi­zat­ion's authen­tic­ation system
Process of linking an organi­zat­ion's existing identity management system (for example, Active Directory) with AWS services to enable secure and seamless access to AWS resources. Users can log into the AWS Management Console or call the AWS API operations without you having to create an IAM user.

TODO: AGREGAR FOTO DEL PROCESO.