Section 1-5
Section 1: What is Cloud Computing?
- Network 网络: cables, routers and servers connected with each other.
- Router 路由器: A networking device that forwards data packets between computer networks. They know where to send your packets on the internet.
- Switch 交换机: Takes a packet and send it to the correct server / client on your network.
1.1 What is Cloud Computing?
- Cloud computing is the on-demand delivery of compute power, database storage, applications, and other IT resources
- Through a cloud services platform with pay-as-you-go pricing
- You can provision exactly the right type and size of computing resources you need
- You can access as many resources as you need, almost instantly
- Simple way to access servers, storage, databases and a set of application services
- Amazon Web Services owns and maintains the network-connected hardware required for these application services, while you provision and use what you need via a web application.
1.2 The Five Characteristics of Cloud Computing
- On-demand self service
- Users can provision resources and use them without human interaction from the service provider
- Broad network access
- Resources available over the network, and can be accessed by diverse client platforms
- Multi-tenancy and resource pooling 多租户和资源池
- Multiple customers can share the same infrastructure and applications with security and privacy. 多个客户可以在安全和隐私的情况下共享相同的基础架构和应用程序。
- Multiple customers are serviced from the same physical resources. 从相同的物理资源为多个客户提供服务。
- Rapid elasticity and scalability 快速的弹性和可扩展性
- Automatically and quickly acquire and dispose resources when needed
- Quickly and easily scale based on demand
- Measured service
- Usage is measured, users pay correctly for what they have used
1.3 Six Advantages of Cloud Computing
- Trade capital expense (CAPEX) for operational expense (OPEX)
- Pay On-Demand: don’t own hardware
- Reduced Total Cost of Ownership (TCO) & Operational Expense (OPEX). 降低总拥有成本和运营费用。
- Benefit from massive economies of scale
- Prices are reduced as AWS is more efficient due to large scale
- Stop guessing capacity
- Scale based on actual measured usage
- Increase speed and agility
- Stop spending money running and maintaining data centers
- Go global in minutes: leverage the AWS global infrastructure
1.4 Types of Cloud Computing
- Infrastructure as a Service (IaaS) 基础设施即服务
- Provide building blocks for cloud IT
- Provides networking, computers, data storage space
- Highest level of flexibility
- Easy parallel with traditional on-premises IT
- Examples: Amazon EC2, GCP, Azure, Rackspace, Digital Ocean, Linode
- Platform as a Service (PaaS) 平台即服务
- Removes the need for your organization to manage the underlying infrastructure
- Focus on the deployment and management of your applications
- Examples: AWS Elastic Beanstalk, Google App Engine, Microsoft Azure App Service
- Software as a Service (SaaS) 软件即服务
- Completed product that is run and managed by the service provider
- Examples: Dropbox, Google Apps, Zoom, Slack
1.5 AWS global infrastructure
- Regions: physical location in the world with multiple availability zones 具有多个可用性区域的世界物理位置
- Compliance with data governance and legal requirements: data never leaves a region without your explicit permission
- Proximity to customers: reduced latency
- Available services within a Region: new services and new features aren’t available in every Region
- Pricing: pricing varies region to region and is transparent in the service pricing page
- Availability Zones: one or more discrete data centers 一个或多个离散数据中心
- Each region has many availability zones (usually 3, min is 3, max is 6). Example:
ap-southeast-2a
,ap-southeast-2b
,ap-southeast-2c
- Each availability zone (AZ) is one or more discrete data centers with redundant power, networking, and connectivity
- They’re separate from each other, so that they’re isolated from disasters
- They’re connected with high bandwidth, ultra-low latency networking
- Each region has many availability zones (usually 3, min is 3, max is 6). Example:
- Edge Location: data center owned by a trusted partner of AWS 值得信赖的合作伙伴拥有的数据中心
- Get data fast or upload data fast to AWS
- The locations serve requests for CloudFront and Route 53. Requests going to either of these services will be routed to the nearest edge location automatically
- S3 Transfer Acceleration traffic and API Gateway endpoint traffic also use the AWS Edge Network
- Content is delivered to end users with lower latency. This allows for low latency no matter where the end user is geographically located
Section 2: IAM - Identity and Access Management 身份和访问管理
2.1 IAM: Users & Groups
- IAM = Identity and Access Management, Global service
- Root account created by default, shouldn’t be used or shared
- Users are people within your organization, and can be grouped
- Groups only contain users, not other groups
- Users don’t have to belong to a group, and user can belong to multiple groups
2.2 AWS CLI on Mac
# after install
aws --version
aws-cli/2.10.2 Python/3.9.11 Darwin/22.3.0 exe/x86_64 prompt/off
2.3 AWS CloudShell
aws iam list-users
{
"Users": [
{
"Path": "/",
"UserName": "ned-admin",
"UserId": "AIDATYYJMPUCXBOZCCFPE",
"Arn": "arn:aws:iam::259328343301:user/ned-admin",
"CreateDate": "2023-02-23T03:52:19+00:00"
}
]
}
2.4 IAM Guidelines & Best Practices
- Don’t use the root account except for AWS account setup
- One physical user = One AWS user
- Assign users to groups and assign permissions to groups
- Create a strong password policy
- Use and enforce the use of Multi Factor Authentication (MFA)
- Create and use Roles for giving permissions to AWS services
- Use Access Keys for Programmatic Access (CLI / SDK)
- Audit permissions of your account with the IAM Credentials Report
- Never share IAM users & Access Keys
2.5 IAM Section – Summary
- Users: mapped to a physical user, has a password for AWS Console. 映射到物理用户,具有 AWS 控制台的密码。
- Groups: contains users only
- Policies: JSON document that outlines permissions for users or groups
- Roles: for EC2 instances or AWS services. 为 EC2 实例或 AWS 服务。
- Security: MFA + Password Policy
- AWS CLI: manage your AWS services using the command-line
- AWS SDK: manage your AWS services using a programming language
- Access Keys: access AWS using the CLI or SDK
- Audit: IAM Credential Reports & IAM Access Advisor
Section 3: EC2 - Elastic Compute Cloud 弹性计算云
3.1 Amazon EC2
- EC2 is one of the most popular of AWS’ offering
- EC2 = Elastic Compute Cloud = Infrastructure as a Service
- It mainly consists in the capability of :
- Renting virtual machines (EC2)
- Storing data on virtual drives (EBS)
- Distributing load across machines (ELB)
- Scaling the services using an auto-scaling group (ASG)
3.2 Security Groups
- Security Groups are the fundamental of network security in AWS
- They control how traffic is allowed into or out of our EC2 Instances
- Security groups only contain allow rules
- Security groups rules can reference by IP or by security group
Security Groups Good to know
- Can be attached to multiple instances
- Locked down to a region / VPC combination
- Does live “outside” the EC2 – if traffic is blocked the EC2 instance won’t see it
- It’s good to maintain one separate security group for SSH access
- If your application is not accessible (time out), then it’s a security group issue
- If your application gives a “connection refused“ error, then it’s an application error or it’s not launched
- All inbound traffic is blocked by default
- All outbound traffic is authorised by default
Classic Ports to know
- 22 = SSH (Secure Shell) - log into a Linux instance
- 21 = FTP (File Transfer Protocol) – upload files into a file share
- 22 = SFTP (Secure File Transfer Protocol) – upload files using SSH
- 80 = HTTP – access unsecured websites
- 443 = HTTPS – access secured websites
- 3389 = RDP (Remote Desktop Protocol) – log into a Windows instance
3.3 SSH into EC2
# 在本机 mac。切换到带有 pem 文件的目录
cd xx
# 修改其权限
chmod 0400 EC2demo.pem
# ssh 连接
ssh -i EC2demo.pem ec2-user@52.86.126.72
3.4 EC2 Pricing Model 购买选项
1. On-Demand: short workload, predictable pricing, pay by second
- 工作量小,定价可预测,按秒付费
- Pay for what you use:
- Linux or Windows - billing per second, after the first minute
- All other operating systems - billing per hour
- Has the highest cost but no upfront payment
- No long-term commitment
- Recommended for short-term and un-interrupted workloads, where you can't predict how the application will behave. 推荐用于短期和不间断的工作负载,在这些工作负载中您无法预测应用程序的行为方式。
2. Spot: short workloads, cheap, can lose instances (less reliable)biggest savings
- 短期工作负载,便宜,可能会丢失实例(不太可靠),最大的节省
- The MOST cost-efficient instances in AWS. AWS wants to maximize the utility of those idle servers
- provide a discount of 90% compared to On-demand pricing
- can be terminated if the computing capacity is needed by on-demand customers
- instances can be terminated by AWS at anytime
- if your instance is terminated by AWS, you don't get charged for a partial hour of usage
- if you terminate an instance, you will still be charged for any hour that it ran
- Useful for workloads that are resilient to failure 适用于对故障具有弹性的工作负载
- Batch jobs
- Data analysis
- Image processing
- Any distributed workloads
- Workloads with a flexible start and end time
- Not suitable for critical jobs or databases 不适合关键工作或数据库
3. Reserved: best long-term
- Recommended for steady-state usage applications (think database)
- pricing is based on Term x Class Offering x Payment Option
- Offering Class:
- Standard: Up to 72% reduced pricing compared to on-demand
- Convertible Reserved Instance: Can change the EC2 instance type, instance family, OS, scope and tenancy. Up to 66% reduced pricing
- Scheduled: reserve instances for specific time periods, savings vary
- Reservation Period:
- commit to a 1Year or 3 Year contract
- the longer the term, the greater savings
- Payment Options:
- All Upfront 全部预付
- Partial Upfront 部分预付
- No Upfront 无需预付
4. Savings Plans: commitment to an amount of usage, long workload
- 承诺一定的使用量,长时间的工作量
- Get a discount based on long-term usage (up to 72% - same as RIs)
- Commit to a certain type of usage ($10/hour for 1 or 3 years)
- Usage beyond EC2 Savings Plans is billed at the On-Demand price
- Locked to a specific instance family & AWS region (e.g., M5 in us-east-1)
- Flexible across:
- Instance Size (e.g., m5.xlarge, m5.2xlarge)
- OS (e.g., Linux, Windows)
- Tenancy (Host, Dedicated, Default)
5. Dedicated: book an entire physical server, control instance placement. most expensive
- 预订整个物理服务器,控制实例放置,也是最贵的。
- designed to meet regulatory requirements
- when you have strict server-bound licensing that won't support multi-tenancy or cloud deployments
- Allows you address compliance requirements and use your existing serverbound software licenses (per-socket, per-core, pe—VM software licenses)
- multi-tenancy
- multi-tenant
- when multiple customers are running workloads on the same hardware
- virtual isolation is what separates customers
- single tenant
- when a single customer has dedicated hardware
- physical isolation is what separates customers
- multi-tenant
- Purchasing Options:
- On-demand – pay per second for active Dedicated Host
- Reserved - 1 or 3 years (No Upfront, Partial Upfront, All Upfront)
6. Capacity Reservations: reserve capacity in a specific AZ for any duration
- 在任何时间段内在特定 AZ 中保留容量。
- Reserve On-Demand instances capacity in a specific AZ for any duration. 在任何持续时间内在特定 AZ 中预留 On-Demand 实例容量
- You always have access to EC2 capacity when you need it
- No time commitment (create/cancel anytime), no billing discounts
- Combine with Regional Reserved Instances and Savings Plans to benefit from billing discounts
- You’re charged at On-Demand rate whether you run instances or not
- Suitable for short-term, uninterrupted workloads that needs to be in a specific AZ. 适用于需要在特定 AZ 中的短期、不间断工作负载。
Which purchasing option is right for me?
- On demand: coming and staying in resort whenever we like, we pay the full price. 我们愿意随时来度假村,我们支付全价。
- Reserved: like planning ahead and if we plan to stay for a long time, we may get a good discount. 比如提前计划,如果我们打算长期停留,我们可能会得到很好的折扣。
- Savings Plans: pay a certain amount per hour for certain period and stay in any room type (e.g., King, Suite, Sea View, …). 在一定时期内每小时支付一定金额并入住任何房型(例如,特大号床、套房、海景……)。
- Spot instances: the hotel allows people to bid for the empty rooms and the highest bidder keeps the rooms. You can get kicked out at any time. 酒店允许人们竞标空房间,出价最高的人保留房间。你随时可能被踢出局。
- Dedicated Hosts: We book an entire building of the resort. 我们预订了度假村的整栋建筑。
- Capacity Reservations: you book a room for a period with full price even you don’t stay in it. 您以全价预订了一段时间的房间,即使您不住在里面。
Price Comparison Example
3.5 EC2 Section – Summary
- EC2 Instance: AMI (OS) + Instance Size (CPU + RAM) + Storage + security groups + EC2 User Data
- Security Groups: Firewall attached to the EC2 instance. 附加到 EC2 实例的防火墙。
- EC2 User Data: Script launched at the first start of an instance. 在实例第一次启动时启动的脚本。
- SSH: start a terminal into our EC2 Instances (port 22)
- EC2 Instance Role: link to IAM roles
- Purchasing Options: On-Demand, Spot, Reserved (Standard + Convertible + Scheduled), Dedicated Host, Dedicated Instance
Section 4: EC2 Instance Storage 实例存储
4.1 EBS - Elastic Block Store 弹性块存储
What’s an EBS Volume?
- An EBS (Elastic Block Store) Volume is a network drive you can attach to your instances while they run. EBS(弹性块存储)卷是一个网络驱动器,您可以在实例运行时附加到它们。
- It allows your instances to persist data, even after their termination
- They can only be mounted to one instance at a time (at the CCP level)
- They are bound to a specific availability zone
- Analogy: Think of them as a “network USB stick”. 打个比方:将它们想象成“网络 U 盘”。
- Free tier: 30 GB of free EBS storage of type General Purpose (SSD) or Magnetic per month
- It’s a network drive (i.e. not a physical drive). 这是一个网络驱动器(即不是物理驱动器)
- It uses the network to communicate the instance, which means there might be a bit of latency
- It can be detached from an EC2 instance and attached to another one quickly
- It’s locked to an Availability Zone (AZ). 它被锁定到一个可用区
- An EBS Volume in us-east-1a cannot be attached to us-east-1b
- To move a volume across, you first need to snapshot it
- Have a provisioned capacity (size in GBs, and IOPS). 具有预配容量
- You get billed for all the provisioned capacity
- You can increase the capacity of the drive over time
EBS Snapshots 快照
- Make a backup (snapshot) of your EBS volume at a point in time. 在某个时间点制作 EBS 卷的备份(快照)。
- Not necessary to detach volume to do snapshot, but recommended
- Can copy snapshots across AZ or Region
4.2 AMI - Amazon Machine Image 亚马逊机器镜像
- AMI are a customization of an EC2 instance. AMI 是 EC2 实例的自定义。
- You add your own software, configuration, operating system, monitoring…
- Faster boot / configuration time because all your software is pre-packaged
- AMI are built for a specific region (and can be copied across regions). AMI 是为特定区域构建的(并且可以跨区域复制)。
- You can launch EC2 instances from:
- A Public AMI: AWS provided
- Your own AMI: you make and maintain them yourself
- An AWS Marketplace AMI: an AMI someone else made (and potentially sells)
AMI Process (from an EC2 instance)
-
- Start an EC2 instance and customize it
-
- Stop the instance (for data integrity)
-
- Build an AMI – this will also create EBS snapshots. 构建 AMI – 这还将创建 EBS 快照。
-
- Launch instances from other AMIs
4.3 EC2 Image Builder 镜像生成器
- Used to automate the creation of Virtual Machines or container images. 用于自动创建虚拟机或容器镜像。
- => Automate the creation, maintain, validate and test EC2 AMIs
- Can be run on a schedule (weekly, whenever packages are updated, etc…)
- Free service (only pay for the underlying resources)
4.4 EC2 Instance Store 实例存储
- EBS volumes are network drives with good but “limited” performance. EBS 卷是具有良好但“有限”性能的网络驱动器。
- If you need a high-performance hardware disk, use EC2 Instance Store. 如果您需要高性能的硬盘,请使用 EC2 Instance Store。
- Better I/O performance
- EC2 Instance Store lose their storage if they’re stopped (ephemeral)
- Good for buffer / cache / scratch data / temporary content
- Risk of data loss if hardware fails. 如果硬件出现故障,数据丢失的风险。
- Backups and Replication are your responsibility. 备份和复制是您的责任。
4.5 EFS – Elastic File System 弹性文件系统
- Managed NFS (network file system) that can be mounted on 100s of EC2 可以在数百个 EC2 实例上挂载的托管 NFS(网络文件系统)。
- EFS works with Linux EC2 instances in multi-AZ
- Highly available, scalable, expensive (3x gp2), pay per use, no capacity planning. 高可用、可扩展、昂贵 (3x gp2)、按使用付费、无容量规划