Aws Cloud

AWS Cloud

Core Capabilities

Provides expert guidance for AWS infrastructure and services:

1. Compute Services - EC2, Lambda, ECS, EKS, Fargate, Batch, Elastic Beanstalk 2. Storage Services - S3, EBS, EFS, FSx, Glacier, Storage Gateway 3. Database Services - RDS (MySQL, PostgreSQL, Oracle, SQL Server), Aurora, DynamoDB, ElastiCache, DocumentDB 4. Networking - VPC, ALB/NLB, Route 53, CloudFront, Direct Connect, VPN, Transit Gateway 5. Container Services - ECS (Elastic Container Service), EKS (Elastic Kubernetes Service), ECR (Elastic Container Registry) 6. Serverless - Lambda, API Gateway, Step Functions, EventBridge, SQS, SNS 7. Infrastructure as Code - CloudFormation, Terraform, CDK (Cloud Development Kit), SAM 8. Security - IAM, KMS, Secrets Manager, Security Hub, GuardDuty, WAF, Shield 9. Migration - Cloud migration strategies from on-premise, GCP, Azure to AWS

Key Principles

General Best Practices

• Follow least privilege - Use IAM roles with minimal required permissions
• Enable monitoring - Configure CloudWatch for all services with appropriate alarms
• Use managed services - Prefer RDS over self-managed databases, ECS Fargate over EC2
• Implement IaC - Use CloudFormation, Terraform, or CDK for reproducible infrastructure
• Tag resources - Apply tags for cost allocation, automation, and compliance
• Design for HA - Use Multi-AZ deployments and Auto Scaling Groups
• Secure by default - Enable encryption, use private subnets, configure security groups properly
• Optimize costs - Use Reserved Instances, Savings Plans, Spot Instances, and right-sizing

Architecture Patterns

• Multi-tier web apps: VPC + ALB + EC2/ECS + RDS Multi-AZ
• Serverless APIs: API Gateway + Lambda + DynamoDB with CloudFront caching
• Container workloads: ECS/EKS with Fargate + RDS + ElastiCache
• Data processing: S3 + Lambda/Glue + Athena/EMR + QuickSight
• Microservices: EKS + Service Mesh + RDS Aurora + ElastiCache

When to Use What

• EC2: Full control, Windows workloads, lift-and-shift migrations, specialized hardware
• Lambda: Event-driven processing, APIs, scheduled tasks, short-lived workloads (<15 min)
• ECS/EKS: Containerized applications, microservices, long-running services
• RDS: Relational databases with automated backups, Multi-AZ, read replicas
• Aurora: High-performance MySQL/PostgreSQL, serverless option, global databases
• DynamoDB: NoSQL, single-digit millisecond latency, serverless, automatic scaling
• S3: Object storage, static websites, data lakes, backups, archival
• Elastic Beanstalk: Quick deployment, managed platform, minimal configuration

Detailed References

Load reference files based on specific needs:

• Best Practices by Service: See best-practices.md for:
• EC2 instance selection, security, HA, performance, and cost optimization
• S3 security, encryption, data management, performance, and cost strategies
• RDS and Aurora HA, security, performance tuning, and cost optimization
• VPC networking, security groups, NACLs, load balancing, and DNS
• Lambda function design, performance, security, reliability, and cost
• ECS/EKS container orchestration and security
• IAM access control, credential management, and compliance
• Security threat detection, data protection, and compliance
• Comprehensive cost optimization strategies across all services

• Compute Services: See compute-services.md for:
• EC2 instance types, families, and selection guide
• Auto Scaling Groups configuration and policies
• Lambda function patterns and event sources
• Elastic Beanstalk deployment strategies
• AWS Batch job scheduling and compute environments

• Storage Solutions: See storage-solutions.md for:
• S3 bucket configuration and lifecycle management
• EBS volume types and performance optimization
• EFS file system setup and mounting
• FSx for Windows and Lustre use cases
• Storage tier selection and cost optimization

• Database Services: See database-services.md for:
• RDS instance configuration and best practices
• Aurora serverless and global database setup
• DynamoDB data modeling and performance optimization
• ElastiCache (Redis/Memcached) patterns
• Database migration strategies with DMS

• Networking Architecture: See networking-architecture.md for:
• VPC design patterns and CIDR planning
• ALB/NLB configuration and target group management
• Route 53 DNS routing policies
• CloudFront distribution setup and caching strategies
• Direct Connect and VPN Gateway configuration
• Transit Gateway hub-and-spoke architecture

• Container Orchestration: See container-orchestration.md for:
• ECS cluster setup and task definition patterns
• EKS cluster provisioning with eksctl/Terraform
• Fargate vs EC2 launch type decision guide
• ECR repository management and image lifecycle
• Service mesh with AWS App Mesh

• Serverless Architecture: See serverless-architecture.md for:
• Lambda function design patterns and best practices
• API Gateway REST/HTTP/WebSocket APIs
• Step Functions state machine workflows
• EventBridge event-driven architectures
• SQS/SNS messaging patterns
• SAM and Serverless Framework usage

• Infrastructure as Code: See infrastructure-as-code.md for:
• CloudFormation templates and stack management
• Terraform AWS provider modules and patterns
• CDK (Cloud Development Kit) constructs and stacks
• SAM templates for serverless applications
• Multi-environment deployment strategies
• State management and remote backends

• Cloud Migration: See cloud-migration.md for:
• Migration strategies (6 R's: Rehost, Replatform, Refactor, Repurchase, Retire, Retain)
• AWS Migration Hub and Application Discovery Service
• Database migration with DMS (Database Migration Service)
• Server migration with AWS MGN (Application Migration Service)
• Data transfer with DataSync, Transfer Family, Snowball
• Migration readiness assessment and planning

• Security Configuration: See security-configuration.md for:
• IAM policy examples and best practices
• KMS key management and encryption patterns
• Secrets Manager integration patterns
• Security group and NACL rule templates
• CloudTrail multi-region setup
• GuardDuty and Security Hub configuration
• WAF rules and Shield Advanced setup
• Compliance frameworks (PCI-DSS, HIPAA, SOC 2)

• Monitoring and Operations: See monitoring-operations.md for:
• CloudWatch metrics, logs, and alarms
• CloudWatch Insights queries for log analysis
• X-Ray distributed tracing setup
• EventBridge rules for event-driven automation
• Systems Manager for fleet management
• AWS Backup for centralized backup management
• Disaster recovery strategies

• Cost Management: See cost-management.md for:
• Cost allocation tagging strategies
• Reserved Instance and Savings Plan planning
• Spot Instance strategies and best practices
• Cost Explorer reports and analysis
• AWS Budgets and anomaly detection
• Trusted Advisor recommendations
• FinOps best practices for cloud financial management

• Well-Architected Framework: See well-architected.md for:
• Operational Excellence pillar best practices
• Security pillar implementation guide
• Reliability pillar design patterns
• Performance Efficiency optimization techniques
• Cost Optimization strategies
• Sustainability best practices

AWS Best Practices by Service

EC2 (Elastic Compute Cloud)

Instance Selection

• Select appropriate instance types based on workload characteristics:
• General Purpose (T, M): Balanced compute, memory, networking
• Compute Optimized (C): High-performance processors for CPU-intensive workloads
• Memory Optimized (R, X): Large memory for in-memory databases and caches
• Storage Optimized (I, D): High IOPS and sequential throughput
• Accelerated Computing (P, G, Inf): GPU/FPGA for ML and graphics

Security

• Use AMIs (Amazon Machine Images) for consistent, secure deployments
• Configure security groups with least privilege principle (deny by default)
• Use Instance Metadata Service v2 (IMDSv2) for enhanced security
• Enable EBS encryption for data volumes and snapshots
• Use Systems Manager Session Manager instead of SSH keys
• Implement VPC endpoints for AWS service access without internet
• Apply security patches regularly using Systems Manager Patch Manager

High Availability

• Enable Auto Scaling for dynamic capacity management
• Distribute instances across multiple Availability Zones
• Use Elastic Load Balancing for traffic distribution
• Implement health checks for automatic replacement of unhealthy instances
• Use spot instances with Auto Scaling for fault-tolerant workloads

Performance

• Use EBS-optimized instances for consistent storage performance
• Choose appropriate EBS volume types (gp3, io2, st1, sc1)
• Use placement groups for low-latency applications
• Enable Enhanced Networking (SR-IOV) for high throughput
• Monitor CloudWatch metrics and set up alarms

Cost Optimization

• Use user data scripts for automated instance initialization
• Tag resources for cost allocation and management
• Right-size instances based on CloudWatch utilization metrics
• Use Reserved Instances or Savings Plans for steady-state workloads
• Implement Instance Scheduler for dev/test environments
• Delete unused AMIs and associated snapshots

S3 (Simple Storage Service)

Security

• Block public access by default at account and bucket level
• Use bucket policies and IAM policies for access control
• Enable MFA delete for critical buckets
• Implement S3 Object Lock for compliance (WORM)
• Use S3 Access Points for application-specific access
• Enable CloudTrail logging for S3 data events
• Use AWS PrivateLink for VPC endpoints

Encryption

• Enable server-side encryption by default
• Choose encryption method:
• SSE-S3: AWS-managed keys (simplest)
• SSE-KMS: Customer-managed keys with audit trail
• SSE-C: Customer-provided keys (full control)
• Enable encryption in transit (HTTPS)
• Use bucket policies to enforce encryption

Data Management

• Enable versioning for critical data protection
• Configure lifecycle policies for automatic tiering:
• S3 Standard → S3 Standard-IA (30+ days)
• S3 Standard-IA → S3 Glacier (90+ days)
• S3 Glacier → S3 Glacier Deep Archive (180+ days)
• Use S3 Intelligent-Tiering for automatic optimization
• Implement S3 Replication (CRR/SRR) for disaster recovery
• Use S3 Inventory for asset management

Performance

• Use CloudFront for content delivery and edge caching
• Implement multipart upload for objects >100MB
• Use S3 Transfer Acceleration for long-distance uploads
• Design key names to avoid hot partitions
• Use byte-range fetches for large objects
• Enable S3 Select for in-place query processing

Cost Optimization

• Use appropriate storage classes based on access patterns
• Delete incomplete multipart uploads automatically
• Use lifecycle policies to transition or expire objects
• Monitor storage metrics with S3 Storage Lens
• Use Requester Pays for sharing data

RDS and Aurora

High Availability

• Enable Multi-AZ deployment for automatic failover
• Use read replicas for read scaling and disaster recovery
• Configure automated backups with appropriate retention (7-35 days)
• Take manual snapshots before major changes
• Enable deletion protection for production databases

Security

• Deploy in private subnets with no internet access
• Use security groups to restrict database access
• Enable encryption at rest using KMS
• Enable encryption in transit (SSL/TLS connections)
• Use IAM database authentication where supported
• Store credentials in AWS Secrets Manager
• Enable CloudWatch Logs for audit and error logs

Performance

• Choose appropriate instance classes based on workload
• Use Parameter Groups for database configuration
• Enable Performance Insights for query analysis
• Enable Enhanced Monitoring for detailed metrics
• Use appropriate storage type (gp3, io1)
• Configure connection pooling in applications
• Implement read replicas to offload read traffic

Aurora Specific

• Use Aurora Serverless v2 for variable workloads
• Implement Aurora Global Database for disaster recovery
• Use Aurora cluster endpoints for read/write splitting
• Enable Aurora backtrack for point-in-time recovery
• Use Aurora parallel query for analytical workloads

Cost Optimization

• Use Reserved Instances for production databases
• Stop non-production instances during off-hours
• Right-size instances based on CloudWatch metrics
• Use Aurora Serverless for intermittent workloads
• Monitor storage growth and optimize indexes

VPC and Networking

VPC Design

• Design VPC CIDR blocks carefully to avoid conflicts
• Use /16 for VPC, /24 for subnets (allows 251 hosts)
• Reserve IP space for future growth
• Use public subnets for internet-facing resources
• Use private subnets for internal resources
• Create subnets in multiple Availability Zones

Security

• Configure security groups (stateful) as primary defense
• Use Network ACLs (stateless) for additional layer
• Implement defense in depth with multiple security layers
• Enable VPC Flow Logs for network monitoring
• Use AWS Network Firewall for advanced protection
• Implement VPC endpoints for private AWS service access

Connectivity

• Use NAT Gateways (high availability) instead of NAT Instances
• Deploy NAT Gateways in multiple AZs for redundancy
• Use Transit Gateway for multi-VPC connectivity
• Implement AWS PrivateLink for SaaS connectivity
• Use VPN or Direct Connect for hybrid connectivity
• Configure route tables properly for each subnet

Load Balancing

• Use Application Load Balancer (ALB) for HTTP/HTTPS
• Use Network Load Balancer (NLB) for TCP/UDP
• Enable access logs for troubleshooting
• Configure health checks appropriately
• Use target groups for routing flexibility
• Enable cross-zone load balancing

DNS and CDN

• Use Route 53 for DNS with health checks
• Implement failover routing for disaster recovery
• Use CloudFront for content delivery
• Configure CloudFront origin failover
• Enable CloudFront access logs

Lambda and Serverless

Function Design

• Design functions with single responsibility principle
• Keep deployment packages small (<50MB)
• Initialize SDK clients outside handler function
• Use Lambda Layers for shared dependencies
• Set appropriate timeout (default 3s, max 900s)
• Configure appropriate memory (128MB-10GB)
• Use environment variables for configuration

Performance

• Configure memory to optimize CPU allocation (1,769MB = 1 vCPU)
• Use Provisioned Concurrency for consistent performance
• Enable SnapStart for Java functions (faster cold starts)
• Minimize cold start time:
• Reduce package size
• Minimize dependencies
• Avoid VPC unless necessary
• Use ARM (Graviton2) for better performance

Security

• Use IAM roles with least privilege
• Store secrets in Secrets Manager or Parameter Store
• Enable X-Ray tracing for debugging
• Use VPC endpoints for private resource access
• Implement function URL authentication
• Enable code signing for deployment integrity

Reliability

• Use Dead Letter Queues (DLQ) for failed events
• Configure retry attempts appropriately
• Use Step Functions for complex workflows
• Implement circuit breakers for external dependencies
• Monitor with CloudWatch metrics and alarms
• Use Lambda Destinations for async invocations

Cost Optimization

• Right-size memory allocation
• Use ARM (Graviton2) for 20% cost savings
• Minimize execution duration
• Use reserved concurrency only when needed
• Clean up old function versions
• Monitor invocation costs with Cost Explorer

ECS and EKS

ECS Best Practices

• Use Fargate for serverless container execution
• Use EC2 launch type for more control and cost optimization
• Configure task definitions with appropriate CPU/memory limits
• Implement container health checks
• Use Application Load Balancers for service discovery
• Enable Container Insights for monitoring
• Store secrets in Secrets Manager
• Use ECR with image scanning
• Implement auto-scaling policies
• Use task IAM roles for AWS service access

EKS Best Practices

• Use managed node groups for simplified operations
• Implement cluster autoscaler for dynamic scaling
• Configure RBAC for proper access control
• Use IAM roles for service accounts (IRSA)
• Implement network policies for pod-to-pod traffic
• Use Kubernetes secrets or external secrets operator
• Enable control plane logging
• Use EKS add-ons (VPC CNI, CoreDNS, kube-proxy)
• Implement pod security policies
• Use AWS Load Balancer Controller for ingress

Container Security

• Scan images for vulnerabilities
• Use minimal base images (Alpine, Distroless)
• Run containers as non-root users
• Implement read-only root filesystems
• Use AWS App Mesh for service mesh
• Enable encryption in transit
• Implement network segmentation

IAM (Identity and Access Management)

Access Control

• Follow principle of least privilege
• Use IAM roles instead of access keys for AWS resources
• Use temporary credentials (STS) for users
• Enable MFA for root account and privileged users
• Use IAM policies with conditions for fine-grained control
• Implement resource-based policies where appropriate
• Use service control policies (SCPs) in AWS Organizations

Credential Management

• Rotate access keys regularly (every 90 days)
• Use IAM Access Analyzer to identify unintended access
• Enable CloudTrail for API auditing
• Use AWS Single Sign-On (AWS SSO) for workforce access
• Implement cross-account roles for multi-account access
• Store secrets in AWS Secrets Manager
• Use Systems Manager Parameter Store for configuration

Policy Management

• Use managed policies for common permissions
• Create customer-managed policies for custom permissions
• Avoid inline policies (hard to audit)
• Use policy variables for dynamic permissions
• Test policies with IAM Policy Simulator
• Document policy purpose and approvals
• Review policies regularly for over-permissions

Monitoring and Compliance

• Enable CloudTrail in all regions
• Use AWS Config for compliance monitoring
• Set up CloudWatch alarms for suspicious activities
• Use Access Analyzer for cross-account access
• Implement automated remediation with Lambda
• Conduct regular access reviews
• Use permission boundaries for delegated administration

Security Best Practices

Data Protection

• Enable encryption at rest for all data stores (EBS, S3, RDS)
• Use AWS KMS for key management
• Implement encryption in transit (TLS/SSL)
• Use VPC endpoints for private connectivity
• Implement data classification and tagging
• Enable S3 Object Lock for compliance
• Use AWS Backup for centralized backup management

Threat Detection

• Enable GuardDuty for threat detection
• Use Security Hub for centralized security findings
• Enable CloudTrail for API auditing
• Use AWS Config for configuration compliance
• Implement AWS Macie for sensitive data discovery
• Use Amazon Detective for security investigation
• Set up CloudWatch alarms for security events

Network Security

• Implement security groups with least privilege
• Use Network ACLs for subnet-level protection
• Enable VPC Flow Logs for network monitoring
• Use AWS Network Firewall for advanced protection
• Implement AWS WAF for web application protection
• Use AWS Shield for DDoS protection
• Restrict internet gateway access

Application Security

• Implement AWS WAF rules for common attacks
• Use AWS WAF managed rules for OWASP Top 10
• Enable AWS Shield Advanced for critical applications
• Use CloudFront with origin access identity
• Implement rate limiting and geo-blocking
• Use AWS Certificate Manager for TLS certificates
• Conduct regular security assessments

Compliance

• Use AWS Artifact for compliance reports
• Implement tagging for resource tracking
• Enable AWS Config rules for compliance checks
• Use AWS Audit Manager for audit preparation
• Document security controls and procedures
• Conduct regular compliance assessments
• Implement automated compliance remediation

Cost Optimization

Compute Cost Optimization

• Use Reserved Instances for predictable workloads (1-3 year terms)
• Use Savings Plans for flexible commitment-based discounts
• Use Spot Instances for fault-tolerant workloads (up to 90% savings)
• Right-size instances based on CloudWatch metrics
• Use Auto Scaling to match demand
• Stop non-production instances during off-hours
• Use Graviton instances for 20% better price-performance

Storage Cost Optimization

• Use S3 lifecycle policies to transition to cheaper tiers
• Use S3 Intelligent-Tiering for automatic optimization
• Delete incomplete multipart uploads
• Use EBS gp3 instead of gp2 (20% cheaper)
• Delete unused EBS volumes and snapshots
• Use EFS Infrequent Access for rarely accessed files
• Compress data before storing

Database Cost Optimization

• Use Reserved Instances for production databases
• Right-size database instances
• Use Aurora Serverless for variable workloads
• Delete old manual snapshots
• Use read replicas for read scaling instead of larger instances
• Optimize queries and indexes
• Use DynamoDB on-demand for unpredictable workloads

Monitoring and Management

• Enable AWS Cost Explorer for cost analysis
• Set up AWS Budgets with alerts
• Implement cost allocation tags
• Use AWS Cost Anomaly Detection
• Review Trusted Advisor recommendations
• Use AWS Compute Optimizer for right-sizing
• Implement FinOps practices with stakeholder engagement

Network Cost Optimization

• Use VPC endpoints to avoid data transfer charges
• Use CloudFront to reduce data transfer costs
• Keep data transfer within same AZ when possible
• Use Direct Connect for large data transfers
• Implement data compression
• Monitor data transfer costs with Cost Explorer
• Use Regional Data Transfer instead of Internet Transfer

Architectural Optimization

• Use serverless architectures (Lambda, Fargate)
• Implement caching (CloudFront, ElastiCache)
• Use managed services to reduce operational costs
• Optimize for multi-tenancy where appropriate
• Implement workload scheduling for batch jobs
• Use spot instances for batch processing
• Leverage AWS Free Tier for development

AWS Compute Services

EC2 (Elastic Compute Cloud)

Instance Types and Families

General Purpose (T, M series)

• T4g, T3, T3a: Burstable performance for variable workloads
• M7g, M6i, M5: Balanced compute, memory, networking
• Use cases: Web servers, development environments, small databases

Compute Optimized (C series)

• C7g, C6i, C5: High-performance processors
• Use cases: Batch processing, media transcoding, HPC, game servers, scientific modeling

Memory Optimized (R, X, High Memory series)

• R7g, R6i, R5: Memory-intensive applications
• X2idn, X2iedn: Highest memory-to-vCPU ratio
• Use cases: In-memory databases, big data processing, SAP HANA

Storage Optimized (I, D, H series)

• I4i, I3: High IOPS NVMe SSD storage
• D3: High sequential read/write for data warehouses
• Use cases: NoSQL databases, data warehousing, Elasticsearch

Accelerated Computing (P, G, Inf series)

• P4, P3: GPU for machine learning training
• G5, G4: Graphics-intensive applications
• Inf2, Inf1: Machine learning inference
• Use cases: ML training/inference, video rendering, genomics

Graviton Processors (instances ending with 'g')

• ARM-based AWS Graviton2/3 processors
• Up to 40% better price-performance vs x86
• Available across T4g, M7g, C7g, R7g families

Instance Purchasing Options

On-Demand

• Pay by the second (Linux) or hour (Windows)
• No upfront commitment
• Use for: Short-term, unpredictable workloads

Reserved Instances

• 1 or 3-year commitment
• Up to 75% discount vs On-Demand
• Standard RI: Specific instance type, region
• Convertible RI: Can change instance type
• Use for: Steady-state, predictable workloads

Savings Plans

• 1 or 3-year commitment to consistent usage ($$/hour)
• Up to 72% discount vs On-Demand
• Compute Savings Plans: Flexible across instance families, regions
• EC2 Instance Savings Plans: Specific instance family in region
• Use for: Flexible workloads with predictable usage

Spot Instances

• Up to 90% discount vs On-Demand
• Can be interrupted with 2-minute warning
• Use for: Fault-tolerant, flexible workloads (batch processing, CI/CD, big data)

Dedicated Hosts

• Physical server dedicated for your use
• Compliance requirements (licensing, regulatory)
• Most expensive option

Auto Scaling

Launch Templates

LaunchTemplate:
  Type: AWS::EC2::LaunchTemplate
  Properties:
    LaunchTemplateName: my-app-template
    LaunchTemplateData:
      ImageId: ami-0123456789abcdef0
      InstanceType: t3.micro
      KeyName: my-keypair
      SecurityGroupIds:
        - sg-0123456789abcdef0
      IamInstanceProfile:
        Arn: !GetAtt EC2InstanceProfile.Arn
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          yum update -y
          yum install -y httpd
          systemctl start httpd
          systemctl enable httpd
      TagSpecifications:
        - ResourceType: instance
          Tags:
            - Key: Name
              Value: my-app-instance

Auto Scaling Group

AutoScalingGroup:
  Type: AWS::AutoScaling::AutoScalingGroup
  Properties:
    AutoScalingGroupName: my-app-asg
    LaunchTemplate:
      LaunchTemplateId: !Ref LaunchTemplate
      Version: $Latest
    MinSize: 2
    MaxSize: 10
    DesiredCapacity: 2
    HealthCheckType: ELB
    HealthCheckGracePeriod: 300
    VPCZoneIdentifier:
      - !Ref PrivateSubnet1
      - !Ref PrivateSubnet2
    TargetGroupARNs:
      - !Ref TargetGroup
    Tags:
      - Key: Name
        Value: my-app-instance
        PropagateAtLaunch: true

Scaling Policies

Target Tracking Scaling:

ScalingPolicy:
  Type: AWS::AutoScaling::ScalingPolicy
  Properties:
    AutoScalingGroupName: !Ref AutoScalingGroup
    PolicyType: TargetTrackingScaling
    TargetTrackingConfiguration:
      PredefinedMetricSpecification:
        PredefinedMetricType: ASGAverageCPUUtilization
      TargetValue: 70.0

Step Scaling:

StepScalingPolicy:
  Type: AWS::AutoScaling::ScalingPolicy
  Properties:
    AutoScalingGroupName: !Ref AutoScalingGroup
    PolicyType: StepScaling
    AdjustmentType: PercentChangeInCapacity
    MetricAggregationType: Average
    EstimatedInstanceWarmup: 60
    StepAdjustments:
      - MetricIntervalLowerBound: 0
        MetricIntervalUpperBound: 10
        ScalingAdjustment: 10
      - MetricIntervalLowerBound: 10
        ScalingAdjustment: 20

EC2 Best Practices

1. Use Latest Generation Instances: Better price-performance 2. Enable Detailed Monitoring: 1-minute metrics for better scaling decisions 3. Use IMDSv2: Enhanced security for instance metadata 4. Enable EBS Optimization: Better storage performance 5. Use Placement Groups:

• Cluster: Low latency, high throughput
• Spread: Reduce correlated failures
• Partition: Large distributed workloads

6. Configure Health Checks: ALB health checks for Auto Scaling 7. Use Systems Manager: Fleet management, patching, automation

AWS Lambda

Lambda Function Configuration

Memory and CPU

• Memory: 128 MB to 10,240 MB (10 GB)
• CPU scales with memory (1,769 MB = 1 vCPU)
• Timeout: Maximum 15 minutes (900 seconds)
• Ephemeral storage (/tmp): 512 MB to 10,240 MB

Execution Model

• Synchronous: API Gateway, ALB, SDK invoke
• Asynchronous: S3, SNS, EventBridge, SES
• Stream-based: DynamoDB Streams, Kinesis

Cold Start Optimization

• Use Provisioned Concurrency for predictable performance
• Initialize SDK clients outside handler
• Use Lambda Layers for shared dependencies
• Minimize deployment package size
• Use SnapStart for Java functions (up to 10x faster)

Lambda Function Patterns

API Backend

import json
import boto3

dynamodb = boto3.resource('dynamodb')
table = dynamodb.Table('users')

def lambda_handler(event, context):
    # Parse API Gateway event
    http_method = event['httpMethod']
    path = event['path']
    
    if http_method == 'GET' and path == '/users':
        response = table.scan()
        return {
            'statusCode': 200,
            'headers': {'Content-Type': 'application/json'},
            'body': json.dumps(response['Items'])
        }
    
    return {
        'statusCode': 404,
        'body': json.dumps({'error': 'Not found'})
    }

S3 Event Processing

import boto3
import json
from PIL import Image
import io

s3 = boto3.client('s3')

def lambda_handler(event, context):
    for record in event['Records']:
        bucket = record['s3']['bucket']['name']
        key = record['s3']['object']['key']
        
        # Download image
        obj = s3.get_object(Bucket=bucket, Key=key)
        image_data = obj['Body'].read()
        
        # Process image
        image = Image.open(io.BytesIO(image_data))
        thumbnail = image.resize((200, 200))
        
        # Upload thumbnail
        buffer = io.BytesIO()
        thumbnail.save(buffer, 'JPEG')
        buffer.seek(0)
        
        thumbnail_key = f"thumbnails/{key}"
        s3.put_object(Bucket=bucket, Key=thumbnail_key, Body=buffer)

DynamoDB Stream Processing

import boto3
import json

def lambda_handler(event, context):
    for record in event['Records']:
        event_name = record['eventName']
        
        if event_name == 'INSERT':
            new_image = record['dynamodb']['NewImage']
            # Process new record
            process_new_record(new_image)
            
        elif event_name == 'MODIFY':
            old_image = record['dynamodb']['OldImage']
            new_image = record['dynamodb']['NewImage']
            # Process modification
            process_update(old_image, new_image)
            
        elif event_name == 'REMOVE':
            old_image = record['dynamodb']['OldImage']
            # Process deletion
            process_deletion(old_image)

Lambda Best Practices

1. Use Environment Variables: Configuration without code changes 2. Enable X-Ray Tracing: Distributed tracing for debugging 3. Use Lambda Layers: Share code across functions 4. Implement Error Handling: Try/catch and retry logic 5. Use Dead Letter Queues: Capture failed async invocations 6. Monitor with CloudWatch: Metrics, logs, and alarms 7. Use Secrets Manager: Store sensitive configuration 8. Version and Alias: Blue/green deployments 9. Reserve Concurrent Executions: Prevent throttling critical functions 10. VPC Access: Only when needed (adds cold start time)

Elastic Beanstalk

Platform Support

• Docker, Go, Java, .NET, Node.js, PHP, Python, Ruby
• Preconfigured platforms with web server (nginx, Apache)
• Custom platforms with Packer

Deployment Strategies

All at Once

• Fastest deployment
• Brief downtime
• Use for: Development environments

Rolling

• Deploy in batches
• Reduced capacity during deployment
• No downtime
• Use for: Production with acceptable temporary capacity reduction

Rolling with Additional Batch

• Deploy to new instances first
• Maintain full capacity
• No downtime
• Use for: Production requiring full capacity

Immutable

• Deploy to new instances in new ASG
• Zero downtime
• Quick rollback
• Use for: Production requiring safest deployment

Blue/Green

• Deploy to separate environment
• Swap CNAMEs when ready
• Zero downtime
• Instant rollback
• Use for: Mission-critical production

Configuration

.ebextensions/01-app.config

option_settings:
  aws:elasticbeanstalk:container:nodejs:
    NodeCommand: "npm start"
  aws:autoscaling:launchconfiguration:
    InstanceType: t3.small
    EC2KeyName: my-keypair
  aws:autoscaling:asg:
    MinSize: 2
    MaxSize: 10
  aws:elasticbeanstalk:environment:
    EnvironmentType: LoadBalanced
    LoadBalancerType: application

Resources:
  MyBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: my-app-bucket

AWS Batch

Use Cases

• Batch processing jobs
• ETL (Extract, Transform, Load)
• Financial modeling
• Drug discovery simulations
• Image/video processing

Components

Compute Environment

• Managed: AWS provisions and manages EC2/Fargate
• Unmanaged: You manage compute resources
• Can use Spot Instances for cost savings

Job Queue

• Jobs submitted to queue
• Priority-based scheduling
• Multiple queues for different workloads

Job Definition

• Container properties (image, vCPUs, memory)
• IAM role for task execution
• Environment variables and secrets
• Retry strategy

Example Job Definition

{
  "jobDefinitionName": "my-batch-job",
  "type": "container",
  "containerProperties": {
    "image": "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:latest",
    "vcpus": 2,
    "memory": 4096,
    "command": ["python", "process.py"],
    "jobRoleArn": "arn:aws:iam::123456789012:role/BatchJobRole",
    "environment": [
      {"name": "ENVIRONMENT", "value": "production"}
    ],
    "resourceRequirements": [
      {"type": "GPU", "value": "1"}
    ]
  },
  "retryStrategy": {
    "attempts": 3
  },
  "timeout": {
    "attemptDurationSeconds": 3600
  }
}

Best Practices

1. Use Managed Compute: Simplifies operations 2. Use Spot for Cost Savings: 70-90% savings for interruptible jobs 3. Set Appropriate Timeouts: Prevent runaway jobs 4. Configure Retry Strategy: Handle transient failures 5. Use Array Jobs: Process large datasets efficiently 6. Monitor with CloudWatch: Track job metrics and logs 7. Use Multi-node Parallel Jobs: For MPI workloads