Skip to content

CLF-C02 Study Notes: Task Statement 3.1

Define methods of deploying and operating in the AWS Cloud

This task tests your understanding of:

  • Ways to manage AWS resources
  • Cloud deployment models
  • AWS public and private network access
  • Connectivity options between users, on-premises environments, and AWS
  • When to use different AWS operational methods

1. Methods of Accessing and Managing AWS

AWS resources can be created and managed in several ways.

AWS Management Console

The AWS Management Console is a browser-based graphical interface.

Best suited for:

  • Exploring AWS services
  • Performing occasional administrative tasks
  • Learning and testing configurations
  • Managing resources manually

Advantages:

  • Easy to use
  • Provides visual access to services and settings
  • Useful for beginners and one-time tasks

Limitations:

  • Manual and time-consuming for repeated tasks
  • Difficult to ensure consistent configurations
  • Not ideal for large-scale or automated deployments

AWS Command Line Interface (AWS CLI)

The AWS CLI allows you to manage AWS services by entering commands in a terminal or command prompt.

Best suited for:

  • Repeating administrative tasks
  • Automating operations with scripts
  • Managing resources without using a browser
  • Working across multiple resources or accounts

Advantages:

  • Scriptable and repeatable
  • Useful for automation
  • Supports most AWS services
  • Faster than manually using the console for repetitive tasks

Limitations:

  • Requires knowledge of AWS commands and options
  • Incorrect commands can make unintended changes
  • Configuration and scripting errors are possible

AWS SDKs

AWS Software Development Kits (SDKs) provide programming-language libraries for accessing AWS APIs.

Examples include SDKs for:

  • Python
  • Java
  • JavaScript
  • .NET
  • Go

Best suited for:

  • Building applications that interact with AWS
  • Automating AWS operations within application code
  • Calling AWS services programmatically

For example, an application might use an SDK to:

  • Upload files to Amazon S3
  • Send messages to Amazon SQS
  • Store data in Amazon DynamoDB
  • Start or stop Amazon EC2 instances

Advantages:

  • Integrates AWS functionality into applications
  • Supports programmatic access
  • Can implement application-specific logic and automation

Limitations:

  • Requires programming knowledge
  • Application code must handle errors and permissions correctly

AWS APIs

AWS services expose APIs that allow programmatic access to AWS functionality.

The following are commonly used interfaces to AWS APIs:

  • Management Console
  • AWS CLI
  • AWS SDKs
  • Infrastructure as code tools

You usually do not call the underlying API directly. Instead, you use one of these tools to interact with it.

Infrastructure as Code (IaC)

Infrastructure as code allows you to define infrastructure in a template or configuration file instead of creating it manually.

The primary AWS IaC service covered at this level is AWS CloudFormation.

CloudFormation can create and manage resources such as:

  • Amazon VPCs
  • Subnets
  • Security groups
  • Amazon EC2 instances
  • Amazon S3 buckets
  • Load balancers

Advantages:

  • Repeatable deployments
  • Consistent configurations
  • Version control for infrastructure templates
  • Easier recovery and replication
  • Can manage related resources as a stack

Limitations:

  • Requires knowledge of templates and resource dependencies
  • A template can create or modify many resources at once
  • Incorrect templates can cause deployment failures or unintended changes

Comparison of AWS Management Methods

Method Primary use Strength Limitation
Management Console Manual administration and exploration Easy graphical interface Not easily repeatable or automated
AWS CLI Commands and scripting Fast and scriptable Requires command-line knowledge
AWS SDK Application integration Adds AWS functionality to code Requires programming
CloudFormation/IaC Infrastructure deployment Repeatable and consistent Requires template knowledge

Exam Tips

  • Choose the Management Console for simple, occasional, or exploratory tasks.
  • Choose the AWS CLI for command-line administration and scripting.
  • Choose an AWS SDK when an application needs to interact with AWS.
  • Choose CloudFormation when infrastructure must be deployed repeatedly and consistently.
  • CloudFormation is not simply another command-line tool; it is an infrastructure as code service.

2. Cloud Deployment Models

Public Cloud

A public cloud is a cloud environment made available to customers over the internet by a cloud provider.

Examples:

  • AWS
  • Microsoft Azure
  • Google Cloud

In a public cloud:

  • The provider owns and operates the underlying infrastructure.
  • Customers share the provider's overall infrastructure but have logically isolated resources.
  • Customers generally pay for the resources they consume.

AWS is a public cloud provider.

Private Cloud

A private cloud is a cloud environment dedicated to one organization.

A private cloud:

  • Is not shared with other organizations
  • Provides dedicated resources for the organization
  • Can be operated on-premises or by a third party
  • Still needs to provide cloud characteristics such as self-service, resource pooling, and elasticity

An AWS technology that can help run AWS infrastructure in an on-premises location is AWS Outposts.

For the exam, focus on the distinction between a cloud dedicated to one organization and a public cloud shared among multiple customers.

Hybrid Cloud

A hybrid cloud combines:

  • A public cloud, such as AWS
  • A private cloud environment

The two environments can work together.

Example:

  • Sensitive workloads run in a private cloud.
  • Scalable web applications run in AWS.
  • Applications exchange data between the two environments.

Hybrid Environment

A hybrid environment generally refers to using both:

  • An on-premises data center
  • AWS or another public cloud

For example, an organization might keep its existing database in an on-premises data center while running its application servers in AWS.

Some references use “hybrid cloud” broadly to include on-premises infrastructure connected to a public cloud. For this exam task, understand the distinction presented in the course:

  • Hybrid cloud: public cloud plus private cloud
  • Hybrid environment: on-premises infrastructure plus AWS

Multi-Cloud

A multi-cloud environment uses more than one public cloud provider.

Examples:

  • AWS and Microsoft Azure
  • AWS and Google Cloud
  • AWS, Azure, and Google Cloud

Organizations may use multi-cloud strategies to:

  • Avoid depending on one provider
  • Use specialized services from different providers
  • Meet regulatory or geographic requirements
  • Support acquisitions or existing technology choices

Challenges include:

  • More complex architecture
  • Different tools, APIs, and security models
  • Additional operational and skills requirements
  • More difficult monitoring and governance

Deployment Model Comparison

Model Description Example
Public cloud Cloud services provided to many customers by a provider AWS
Private cloud Cloud environment dedicated to one organization Dedicated on-premises cloud
Hybrid cloud Public cloud combined with private cloud AWS connected to a private cloud
Hybrid environment On-premises infrastructure used with AWS On-premises database and AWS application
Multi-cloud Two or more public cloud providers AWS and Azure

Exam Tips and Traps

  • AWS plus an on-premises data center is commonly described as a hybrid environment.
  • AWS plus Azure is a multi-cloud deployment.
  • A private cloud is not merely a traditional data center. It must provide cloud characteristics and be dedicated to one organization.
  • Do not confuse private cloud with a private subnet. A private subnet is a networking concept inside a VPC, not a private cloud deployment model.

3. AWS Public and Private Network Services

AWS may describe services as public or private based on their network accessibility.

AWS Public Services

A public AWS service can be accessed through a public endpoint, generally over the internet.

Example:

  • Amazon S3 public service endpoints

This does not mean that all data in the service is public. Access is still controlled by:

  • IAM permissions
  • Resource policies
  • Service-specific controls
  • Encryption and other security settings

A service being publicly reachable is different from data being publicly accessible.

AWS Private Services

Private AWS resources are not directly connected to the public internet by default.

Examples include resources deployed in a VPC, such as:

  • Amazon EC2 instances
  • Private subnets
  • Internal application components

A VPC is logically isolated from other networks. Resources inside a private subnet generally cannot receive direct inbound traffic from the internet.

To provide connectivity, you must configure appropriate:

  • Routes
  • Gateways
  • Security groups
  • Network ACLs
  • Permissions

Public Service vs. Publicly Accessible Data

Concept Meaning
Public AWS service The service provides a public network endpoint
Public resource or data Permissions allow unauthenticated or broad access
Private AWS resource Resource is isolated from the public network by default

Exam Trap

Amazon S3 is a public AWS service because it has public endpoints, but an S3 bucket is not automatically public. Bucket permissions must explicitly allow access.

4. AWS Connectivity Options

AWS can be accessed through several types of connectivity.

Public Internet

The public internet is the simplest connectivity option.

It can be used for:

  • Accessing the AWS Management Console
  • Accessing public AWS service endpoints
  • Connecting users to public applications
  • Connecting public EC2 instances

Advantages:

  • Widely available
  • Generally easy to configure
  • No dedicated physical connection required

Limitations:

  • Traffic uses the public internet
  • Performance and latency can vary
  • Requires secure protocols and proper security controls
  • Not ideal for all private or predictable connectivity requirements

AWS Site-to-Site VPN

An AWS VPN creates an encrypted connection between an on-premises network and an AWS VPC over the internet.

Common use cases:

  • Connecting an on-premises data center to AWS
  • Providing encrypted connectivity
  • Quickly establishing hybrid connectivity
  • Backup connectivity for Direct Connect

Advantages:

  • Encrypted over the public internet
  • Usually faster to provision than Direct Connect
  • Useful for hybrid environments

Limitations:

  • Performance depends on the internet connection
  • Latency can vary
  • It is not a physically dedicated connection

AWS Direct Connect

AWS Direct Connect provides a dedicated network connection from an organization’s network to AWS.

The key exam phrase is:

Direct Connect = dedicated private connection

Common use cases:

  • Predictable network performance
  • High-volume data transfer
  • Consistent latency requirements
  • Connecting an on-premises data center to AWS

Advantages:

  • Dedicated connection
  • More consistent performance than internet-based connectivity
  • Can reduce reliance on the public internet
  • Useful for hybrid architectures

Limitations:

  • Requires planning and physical connectivity
  • Takes longer to provision than a VPN
  • Can be more expensive
  • Direct Connect does not automatically encrypt traffic; additional encryption may be required if encryption is needed

VPN vs. Direct Connect

Feature AWS VPN AWS Direct Connect
Connection path Public internet Dedicated private connection
Encryption Encrypted tunnel Not encrypted by default
Provisioning Usually faster Usually slower
Performance Depends on internet More predictable
Typical use Quick, encrypted hybrid connectivity Consistent, high-volume private connectivity

VPC Connectivity Components

Internet Gateway

An internet gateway (IGW) enables communication between a VPC and the public internet.

It is used for resources such as EC2 instances in a public subnet.

For an EC2 instance to communicate with the internet, the design generally requires:

  1. An internet gateway attached to the VPC
  2. A route table route to the internet gateway
  3. A public IP address or Elastic IP address
  4. Appropriate security group and network ACL rules

An internet gateway is:

  • Horizontally scaled
  • Redundant
  • Highly available
  • Managed by AWS

NAT Gateway

A NAT gateway allows resources in a private subnet to initiate outbound connections to the internet.

Typical example:

  • A private EC2 instance needs to download software updates.
  • The instance sends outbound traffic through a NAT gateway in a public subnet.

A NAT gateway does not normally allow unsolicited inbound internet connections to private instances.

Internet Gateway vs. NAT Gateway

Component Main purpose
Internet gateway Allows public resources to communicate with the internet
NAT gateway Allows private resources to initiate outbound internet connections

Exam Trap

Question wording often asks:

What allows public EC2 instances in a public subnet to connect to the public internet?

The answer is an internet gateway, not a NAT gateway.

A NAT gateway is used when private subnet resources need outbound internet access.

5. Choosing the Appropriate Method

Use the Management Console when:

  • You are inspecting resources
  • You are performing a one-time task
  • You are learning or testing a service
  • You need a visual interface

Use the AWS CLI when:

  • You need repeatable commands
  • You are writing administrative scripts
  • You want to automate routine operations
  • You are working from a terminal

Use an AWS SDK when:

  • Application code must call AWS services
  • You are integrating AWS into a software solution
  • You need programmatic control from a supported programming language

Use CloudFormation when:

  • You need repeatable infrastructure
  • Multiple resources must be deployed together
  • You want consistent environments
  • Infrastructure should be managed through templates

Use a VPN when:

  • You need a relatively quick encrypted connection
  • You are connecting on-premises networks to AWS over the internet
  • Network performance does not need to be fully predictable

Use Direct Connect when:

  • You require a dedicated private connection
  • You need predictable network performance
  • You transfer large volumes of data
  • You have consistent latency requirements

Example Exam Questions

Question 1

A company wants to deploy the same VPC, subnets, and security groups consistently in development, test, and production environments. Which AWS service should it use?

A. AWS Management Console
B. AWS CloudFormation
C. AWS Direct Connect
D. AWS SDK

Answer: B. AWS CloudFormation

Explanation: CloudFormation is an infrastructure as code service that uses templates to create repeatable and consistent deployments.

Question 2

A developer is building an application that must upload customer documents to Amazon S3 automatically. Which method is most appropriate?

A. AWS Management Console
B. AWS SDK
C. AWS Direct Connect
D. AWS CloudFormation

Answer: B. AWS SDK

Explanation: SDKs allow application code to interact with AWS services programmatically.

Question 3

An organization uses AWS and Microsoft Azure to run workloads. Which deployment model does this represent?

A. Private cloud
B. Hybrid cloud
C. Multi-cloud
D. On-premises cloud

Answer: C. Multi-cloud

Explanation: Multi-cloud means using two or more public cloud providers.

Question 4

A company runs a database in its on-premises data center and application servers in AWS. What type of environment is this?

A. Public cloud
B. Multi-cloud
C. Hybrid environment
D. Private cloud only

Answer: C. Hybrid environment

Explanation: The company is using on-premises infrastructure together with AWS.

Question 5

Which AWS service provides a dedicated private network connection between an on-premises data center and AWS?

A. AWS Site-to-Site VPN
B. AWS Direct Connect
C. Internet gateway
D. NAT gateway

Answer: B. AWS Direct Connect

Explanation: Direct Connect provides a dedicated connection to AWS. A VPN uses an encrypted tunnel over the public internet.

Question 6

An EC2 instance in a public subnet needs to communicate with the public internet. Which component is required?

A. NAT gateway
B. Internet gateway
C. AWS Direct Connect
D. VPC peering connection

Answer: B. Internet gateway

Explanation: An internet gateway enables communication between a VPC and the public internet. A NAT gateway is primarily used for outbound internet access from private subnets.

Question 7

Which statement about Amazon S3 is correct?

A. All S3 buckets are publicly accessible by default.
B. S3 is a private AWS service with no public endpoints.
C. S3 is a public AWS service, but bucket access still requires appropriate permissions.
D. S3 buckets can be accessed only through Direct Connect.

Answer: C. S3 is a public AWS service, but bucket access still requires appropriate permissions.

Explanation: S3 has public service endpoints, but individual bucket and object permissions determine whether data can be accessed.

Question 8

A private EC2 instance needs to download operating system updates from the internet but should not accept inbound internet connections. Which component should be used?

A. Internet gateway
B. NAT gateway
C. AWS Direct Connect
D. AWS Management Console

Answer: B. NAT gateway

Explanation: A NAT gateway allows resources in private subnets to initiate outbound internet connections while preventing direct inbound connections from the internet.

Final Exam Reminders

  • Console: graphical, manual management.
  • CLI: command-line management and scripting.
  • SDK: application code interacts with AWS.
  • CloudFormation: repeatable infrastructure as code.
  • Public cloud: provider-operated cloud available to customers.
  • Private cloud: cloud dedicated to one organization.
  • Hybrid cloud: public cloud combined with private cloud.
  • Multi-cloud: two or more public cloud providers.
  • VPN: encrypted connection over the public internet.
  • Direct Connect: dedicated private connection to AWS.
  • Internet gateway: connects public VPC resources to the internet.
  • NAT gateway: provides outbound internet access for private subnet resources.
  • A public AWS service does not mean that all customer data in that service is public.