Content Domain 3: Cloud Technology and Services

Task Statement 3.1: Define methods of deploying and operating in the AWS Cloud

Let's get started with the first task statement to define methods of deploying and operating in AWS. There are various methods that can be used to communicate to AWS for the provisioning and necessary operations you might need to manage. Methods available are programmatic access to the application programmatic interfaces, or APIs, through the software defined kits, or SDKs, API access through the AWS Command Line Interface, or CLI, graphical interface through the AWS Management Console, and the ability to create and deploy through various infrastructure as code offerings. Not only is it important for you to know what methods exist but you should also be aware of the strengths and limitations of each. Think about when you would use the Management Console over the software development kits, or the Command Line Interface versus something like CloudFormation, which is the AWS infrastructure as code service. What benefits do you see in accessing a service like Amazon S3 in the console or running the commands in the CLI? It's one thing to know that different methods exist but it's more important to know how and when you would use them. What about cloud deployments? Models such as cloud native in AWS or hybrid in on-premises, similar to the way of provisioning and operating, it's not only important that you know how to define these different deployment types, but that you are also aware of how they would look in action. Would applications working together between your local data center and AWS be considered an on-premises or hybrid deployment? Why would you choose to keep certain resources on-premises instead of moving everything directly into AWS? What are some considerations that you need to note when utilizing the various types of deployment? These are some questions that you should be asking yourself when trying to understand the cloud deployment models. Let's dive a bit deeper. There are different models to deploy and operate in AWS. There is a public cloud, private cloud, hybrid cloud, and multi-cloud. Ensure you know the differences for the exam and the real world usage too. We already talked about cloud computing so now let's talk about the different types of cloud. Let's start with the public cloud. What do you think makes a public cloud environment? Well, it is simply a cloud environment that is available to the public that meets the cloud criteria that we discussed earlier in our cloud computing lesson. And as we know, AWS offers a public cloud platform just like Azure and also Google. And this leads us into the multi-cloud environments. So what do you think a multi-cloud environment looks like? Well, it is still the public cloud but you are using more than one public cloud. So maybe you're using AWS and Azure, or AWS and Google, or maybe you're using all three, which sounds really cool but it can be difficult to design and build. Next, we have private cloud. Private cloud has dedicated services for your environment, and those services are actually on-premises. So these services are dedicated directly to your environment, and each cloud vendor has a private cloud service such as AWS Outposts. The main difference between having other services on-premises and having a private cloud on premise is that the private cloud still has to meet the cloud computing criteria we already discussed but also be directly dedicated to your business. And then that leads us into a hybrid cloud, which is using the public cloud and the private cloud together. Some people think a hybrid cloud is using AWS in your on-premises data center, but it's not. If you use AWS and your on-premises data center together, that is actually a hybrid environment. The difference is there, and it is easy to get the two confused, but a hybrid cloud model is public and private cloud meeting the cloud computing criteria, and a hybrid environment is using your on-premises data center and AWS. The exam, similar to the real world, will require more of you than just a textbook definition. Let's dive a bit deeper and look at the architecture for public and private AWS services. What do you think AWS means when they label a service as public or private? Well, it is probably not what you're thinking. AWS determines whether a service is private or public by its network. And this is something I really struggled with when I was starting out. So what is an AWS public service? Well, it is a service that can be connected to from anywhere there's an internet connection. So if we look at this diagram, inside of AWS, we have an AWS public zone. And this public zone can communicate openly with the public internet. And AWS public services sit inside this public zone. This is not the public internet. Remember, AWS has its own network and the AWS public zone sits inside AWS but it sits adjacent or sits beside the public internet. And inside of AWS and inside of the AWS public zone is a network that is attached directly to the public internet. So any AWS service that is considered a public service sits and runs from this public zone with the network attached to the open internet. And an example of an AWS public service is Amazon S3. So when users are connecting to an Amazon S3 bucket, they are connecting through the public internet. Now, what is an AWS private service? Well, it is a private AWS service that lives inside the AWS private zone. And from this diagram, you can see it has no direct connection to the open internet or to the AWS public zone. And inside the AWS private zone, you can create an isolated environment like an Amazon VPC or create an Amazon EC2 instance, and by default it is completely isolated. But you can add permissions for your Amazon EC2 instance or for your Amazon VPC to access the public zone or the public internet. We simply have to configure this routing or make the instance public, and we'll be going much deeper into that later on in this course. And by default, the only services that can access the services inside the private zone are the services inside the private zone. Also, by default, there are no permissions for the private zone except for your local routes. As we go through this course, we'll be discussing if AWS services are private or public, and you may see some exam questions asking how to give a user or customer access to a specific AWS service. And if you understand what makes a service a public AWS service or a private AWS service and how to design that connectivity, then you will be able to confidently answer any questions you may see. This task statement also covers the connectivity options. The focus here is how network connectivity can be handled to various AWS services, and include creating a virtual private network, or VPN, setting up Direct Connect, and using the public internet. You should be able to identify the advantages and limitations of each of the connectivity types, understand use cases where one might be preferred or avoided, and know the generalities of how they work. For example, AWS Direct Connect connections are a private dedicated connection, and dedicated connection is a keyword for Direct Connect. Here's a question. What do you use to connect public Amazon EC2 instances in a public subnet to the public internet? An internet gateway or a NAT gateway? An internet gateway is a horizontally scaled, redundant, and highly available gateway to allow communication and traffic between instances in your VPC and the public internet. You're expected to know how these connectivity, deployment, and operational methods can be utilized, and when you would choose one option over another. And as you continue through the technology domain, keep in mind that it's more than just definitions. Envision how you would use the components, tools, features, and services, and how they interact with each other. You're not going to be expected to be an expert on everything, but part of the base understanding is comprehending the interactions. Let's get started with the second task statement and dive deeper into the AWS global infrastructure.