AWS Developer Associate Course Notes

EventBridge is a serverless event bus that connects AWS services, SaaS apps, and your apps. It's used to build event-driven applications – where components communicate through events instead of direct calls. Lambda can consume messages from SQS using Event Source Mapping (ESM). This automates polling, invocation, and supported filtering; SQS provides durable message storage. This objective covers integrating AWS services using APIs and service integrations. Key concepts include service contracts, API Gateway, EventBridge, and secure communication with PrivateLink and VPC Lattice. Use X-Ray and CloudWatch Application Monitoring to track application requests and identify performance issues. Microservices benefit from tracing tools like X-Ray for debugging and optimization. Focus on API Gateway throttling and the producer-consumer-queue architecture. API Gateway handles request validation and authentication, centralizing security concerns.

• Confusing EventBridge with CloudWatch Events – EventBridge has more features.

• Focus on defining EventBridge rules and understanding the different targets.

Apply identity, permission, and access decisions in production to reduce risk. Minimize production access – grant only with valid use cases. Use AWS Secrets Manager to securely store, retrieve, and rotate application secrets such as database credentials and API keys when those secrets are required. Secure AWS environments require eliminating root user access keys and transitioning to temporary credentials managed through IAM roles or Cognito. Secure your AWS environment by monitoring API calls, detecting threats, applying appropriate lifecycle management to any long-term credentials, and reviewing IAM policies. Encrypt data at rest to protect against unauthorized access. Use AWS KMS for centralized key management and mapping to data classifications. Apply least privilege to minimize security risks and operational overhead. AWS API requests that use IAM authentication are typically signed with AWS Signature Version 4 (SigV4); AWS SDKs and the AWS CLI normally perform signing automatically. Use temporary credentials whenever possible. Manage user access securely by leveraging temporary credentials and centralized identity management solutions. This objective covers implementing authentication and authorization in AWS, primarily using IAM. Key elements include credential lifecycle management and access control policies. Apply security through permission management, aligning with the Well-Architected Framework's Security Pillar. Secure IAM key management is paramount. Use temporary credentials for AWS service interactions whenever possible. Manage access keys strategically: prioritize temporary credentials and rotate long-term keys when programmatic access is needed. IAM access last used is critical for safe key management. Emergency access uses a dedicated account with IAM roles for cross-account access, strictly monitored to prevent misuse. Protect S3 dependencies by controlling public access and identifying sensitive data. Prioritize securing buckets containing PII, PHI, or credentials. Credential type depends on the machine identity and AWS service. Temporary credentials (IAM roles) are the standard for AWS workloads.

• Confusing permissions boundaries with ABAC – understand their distinct roles.

• Prioritize least privilege and immediate revocation.

Automated testing is key to reliable deployments. Test failures stop deployments. Automate your deployment pipeline for faster, more reliable releases. Use services like AWS CodeDeploy and CodePipeline to streamline the process. Infrastructure as Code (IaC) means defining your infrastructure using code, like AWS CloudFormation. This allows you to automate deployments and manage your infrastructure consistently. CodePipeline automates software releases, from code to production. Model the full release process – build, test, deploy. Integrate tools and custom steps at any stage. Code deployment follows a staged, automated process. Unit tests precede integration tests. Staging validates the integrated system before production. Automated load testing within the deployment pipeline is key. Use sanitized production data for tests. Clearly define testing objectives (throughput, response time).

• Ignoring test failures to speed up deployment.

• Understand the role of automation.

To troubleshoot issues effectively, you need to combine logs, metrics, and traces. Don't rely on just one – it's about correlation. Use metrics and CloudWatch alarms to identify resource-utilization conditions that can inform scaling and optimization decisions. Use composite alarms with KPI monitoring for operational logic. Analyze application behavior using AWS logging tools like CloudWatch Logs and Logs Insights. Composite alarms rely on a combined rule expression for state transitions. The resulting state depends on the configured Boolean expression, which can use AND, OR, and NOT. This objective centers on selecting the right AWS logging sources – CloudTrail Lake, VPC Flow Logs, and Route 53 resolver query logs – for security investigations. The key is understanding the *type* of data each source provides and how it aligns with the investigation's scope. Optimize network performance by collecting and analyzing network metrics. Don't just look at CPU – focus on latency, packet loss, and network traffic. Understand where performance is critical (e.g., high-interaction websites). Meet SLAs by optimizing architecture and operational changes. Improve application resilience by proactively monitoring with real-time processing and alarms. Use CloudWatch to create alerts based on defined metrics and thresholds. Troubleshooting application failures relies on dependency telemetry. Analyze reachability, timeouts, and performance metrics of dependent services.

• Over-reliance on logs without considering metrics or traces.

• Understand the strengths and weaknesses of each data source.