book

AWS for Solutions Architects - Third Edition

by Saurabh Shrivastava, Neelanjali Srivastav, Dhiraj Thakur

July 2025

Intermediate to advanced

788 pages

22h 16m

English

Packt Publishing

Read now

Unlock full access

Who this book is forWhat this book coversTo get the most out of this bookIf You Enjoyed This Book…Let’s keep the conversation going!Get in touchUnlock Your Book’s Exclusive BenefitsHow to unlock these benefits in three easy stepsStep 1Step 2Need help?
What is cloud computing?Software offerings in the cloud Private versus public cloudsWhat is Amazon Web Services (AWS)?Basic cloud and AWS terminologyWhy is AWS so popular?Elasticity and scalabilitySecurityPhysical securityEncryptionAWS supports compliance standardsAvailabilityFaster hardware cyclesSystem administration staffKnowledge check Summary
The AWS Well-Architected FrameworkThe six pillars of the WAFThe first pillar – SecurityThe second pillar – ReliabilityThe third pillar – Performance efficiencyThe fourth pillar – Cost optimizationThe fifth pillar – Operational excellenceThe sixth pillar – SustainabilityAWS Well-Architected LensesBuilding credibility and getting certifiedAWS Learning BadgesBuilding a non-tech AWS cloud careerAWS Certified Cloud Practitioner – FoundationalThe AWS Solutions Architect pathAWS Certified Solutions Architect – AssociateAWS Certified Solutions Architect – ProfessionalThe AWS Cloud DevOps Engineer pathAWS Certified SysOps Administrator – AssociateAWS Certified DevOps Engineer – ProfessionalThe AWS Cloud Developer pathAWS Certified Developer – AssociateThe AWS Specialty Solutions Architect pathAWS Certified Advanced Networking – SpecialtyAWS Certified Security – SpecialtyAWS Machine Learning Engineer pathAWS Certified Data Engineer – AssociateAWS Certified AI PractitionerAWS Certified Machine Learning Engineer – AssociateAWS Certified Machine Learning – SpecialtyLearning tips and tricks for obtaining AWS certificationsFocus on one cloud providerStart with Practitioner certificationsFocus on the Associate-level certificationsGet experience wherever you canThe best way to get certifiedGetting started in AWSOnline coursesPluralsight Packt PublishingUdemy coursesYouTube videosBooksGet your hands dirty with practice labsPractice exam websitesAWS practice question setsWhizlabsBrainCertTutorials DojoCertification preparation approachSome frequently asked questions about the AWS certificationsHow long will it take to get certified?The Cloud Practitioner certificationAssociate-level certificationsProfessional-level certificationsSpecialty certificationsTime management and focus tips for AWS Pro and Specialty certification examsHow to request additional exam timeWhat are some last-minute tips for the day of the exam?How to land a job as an AWS Solutions ArchitectKnowledge checkSummary
Exploring the various cloud computing modelsOn-premisesIaaSPaaSSaaSChoosing between SaaS, PaaS, and IaaSUnderstanding the cloud migration strategiesCloud migration patterns – The 7 RsRehost in the cloudReplatform in the cloudRefactor in the cloudRepurchase in the cloudRelocate to the cloudRetain on-premisesRetireAWS cloud migration toolsAWS Application Migration Services (MGN)Migration Evaluator (ME)Application Discovery Service (ADS) and Migration HubMainframe ModernizationAWS Database Migration Service (DMS)AWS Migration Acceleration Program (MAP)The three-phase migration processDriving enterprise transformation using the cloudCreating value for customersSuccess factors for enterprise transformationModern business model for customer-centric transformationImplementing an enterprise digital transformation programWhat exactly is an enterprise digital transformation?Enterprise digital transformation examplesEnterprise digital transformation tipsEnterprise digital transformation pitfallsThe AWS Cloud Adoption Framework (CAF)Building large deals in AWSWhat are large deals?Components of a large dealDrivers for large dealsKey business drivers for large dealsKey technology drivers for large dealsCustomer expectations in large dealsLarge deal commercial modelsCommon challenges in large dealsCommercial challengesOperational challengesBuilding large ITO deals using AWSKnowledge checkSummary
The AWS Global InfrastructureRegions, Availability Zones, and Local zonesAWS RegionsAWS AZsAWS LZsBenefits of the AWS Global InfrastructureAWS networking foundationsAmazon VPCAWS TGW and VPC peeringBest practiceUse casesAWS PrivateLinkEdge networkingAmazon Route 53Amazon CloudFrontCaching strategiesAWS Global AcceleratorAWS WavelengthBuilding hybrid cloud connectivity in AWSAWS Virtual Private Network (VPN)AWS Direct ConnectAWS Cloud WANHigh-speed networking with AWS Elastic Fabric AdapterAWS cloud network securityAWS Network Firewall (ANFW)AWS network security patterns – Best practicesAWS network security anti-patternsAWS network security with third-party solutionsKnowledge checkSummary
Understanding Amazon EBSChoosing the right EBS volumeAmazon EBS snapshotsBest practices for EBS cost optimizationInvestigating Amazon EFSUsing Amazon FSx to manage file systemsLearning about Amazon S3S3 StandardAmazon S3 Intelligent-TieringAmazon S3 Standard-IA Amazon S3 Express One ZoneAmazon S3 One Zone-IAAmazon S3 GlacierAmazon S3 on OutpostsBest practices to manage Amazon S3 storageManaging data with S3 Object LambdaVersioning in Amazon S3Amazon S3 multi-destination replicationEnhancing Amazon S3 performanceAmazon CloudFrontAmazon S3 Transfer AccelerationChoosing the right S3 bucket/prefix naming conventionSecurity best practices to protect your data in Amazon S3Blocking Amazon S3 public access to buckets and objects whenever possibleAvoiding wildcards in policy filesLeveraging the S3 APILeveraging IAM Access Analyzer to inspect S3Enabling AWS ConfigImplementing S3 Object Lock to secure resourcesImplementing data at rest encryptionEnabling data-in-transit encryptionTurning on Amazon S3 server access loggingConsidering the use of Amazon Macie with Amazon S3Implementing monitoring leveraging AWS monitoring servicesUsing VPC endpoints to access Amazon S3 whenever possibleAmazon S3 cost optimizationUsing S3 batch operationsStorage consistency in Amazon S3Amazon S3 TablesUnderstanding Amazon S3 analytics and metricsChoosing the right cloud storage typeBuilding hybrid storage with AWS Storage GatewayAWS Storage GatewayAmazon S3 File GatewayAmazon FSx File GatewayTape GatewayVolume GatewayAWS Storage Gateway comparisonAWS BackupApproach and best practices for AWS storage assessmentKey challenges in data migrationAWS storage assessment approachBest practices for AWS storage migrationKnowledge checkSummary
Compute in AWSAmazon EC2AWS GravitonAWS compute for AI/MLEC2 instance familiesAWS instance naming conventionsAWS General Purpose instancesAWS Compute Optimized instancesAWS Accelerated Computing instancesAWS Memory Optimized instancesAWS Storage Optimized instancesAWS HPC Optimized instancesEC2 pricing modelAWS Compute OptimizerAmazon Machine ImagesAmazon EC2 best practicesAccess managementStorage managementResource managementManaging Amazon EC2 limitsEC2 backup, snapshots, and recoveryContainerization in AWSCore container technologiesContainer services in AWSAmazon Elastic Load BalancerLoad balancer rulesElastic load balancer typesClassic Load Balancers (CLBs)Application Load Balancers (ALBs)Network Load Balancers (NLBs)Gateway Load Balancer (GWLBs)AWS load balancers comparisonServerless computing with AWS Lambda and FargateAWS LambdaAWS FargateHigh-performance computingHybrid computeAWS OutpostsAmazon Elastic VMware ServiceTips for choosing the right compute option in AWSKnowledge checkSummary

A brief history of databasesData-driven innovation trendsDatabase consistency modelACID data consistency modelBASE data consistency modelDatabase usage modelOnline Transaction Processing (OLTP) versus Online Analytical Processing (OLAP)AWS database servicesRelational databasesAmazon Relational Database Service (Amazon RDS)Amazon AuroraAmazon Aurora Distributed SQL (DSQL)Amazon RDS ProxyEnhancing database performance with Amazon DevOps Guru for RDSEnhancing Amazon RDS with machine learning and generative AI toolsAWS NoSQL databasesAmazon DynamoDBAmazon DocumentDBAmazon DynamoDB versus Amazon DocumentDBWide-column store databasesAmazon Keyspaces (for Apache Cassandra)In-memory databasesRedis versus Memcached: choosing the right in-memory databaseAmazon MemoryDB versus Amazon ElastiCacheGraph databasesAmazon NeptuneTime-series databasesAmazon TimestreamBenefits of AWS database servicesMoving to fully managed database servicesBuilding modern applications with purpose-built databasesMoving on from legacy databasesChoosing the right database for the jobMigrating databases to AWSAWS database management and operationsKnowledge checkSummary
Understanding the importance of security, identity, and compliance in AWSUnderstanding the Shared Responsibility ModelAWS security, identity, and compliance solutionsGetting familiar with IAMAWS IAMManaging resources, permissions, and identities using IAMAWS OrganizationsAWS Managed Microsoft AD ServiceAWS IAM Identity Center (successor to AWS SSO)AWS Control TowerAWS Resource Access ManagerAmazon CognitoApplying security controlsAmazon GuardDutyAmazon InspectorBuilding infrastructure protectionAWS WAFAWS Firewall ManagerAWS ShieldBuilding data protectionAmazon MacieAWS KMSAWS CloudHSMAWS Certificate ManagerAWS Secrets ManagerAmazon DetectiveAWS Security HubAWS IAM Access AnalyzerAmazon S3 Access PointsAmazon S3 Multi-Region Access PointsAdhering to complianceAWS Artifact reportsBest practices for AWS securityBuilding a security-aware architecture Knowledge checkSummary
What is the cloud operation (CloudOps) model, and what role does automation play?CloudOps pillarsFirst pillar – Set up governanceSecond pillar – Managing configuration, compliance, and auditAWS CloudTrailAWS ConfigAWS License ManagerAmazon CloudWatchAmazon EventBridgeAWS Audit ManagerAWS Systems ManagerThird pillar – Provision & orchestrateAWS CloudFormationAWS Service CatalogAWS ProtonAWS Cloud Development Kit (CDK)AWS AmplifyAWS LightsailFourth pillar – Monitor & observe Fifth pillar – Centralize operations Sixth pillar – Manage your cloud’s financesPlan and evaluateManage and ControlTrack and allocateOptimize and saveKnowledge checkSummary
Why use the cloud for data engineering and big data analytics?Data engineering componentsIngesting batch data in AWSIngesting and handling streaming data in AWSAmazon Managed Streaming for Apache Kafka (MSK)Amazon MSK cluster architectureAmazon KinesisChoosing between Amazon Kinesis and Amazon MSKBuilding a storage layer with Amazon S3Data cataloging and processingIntroduction to AWS GlueOperating the AWS Glue consoleAWS Glue DataBrewPutting AWS Glue components togetherAWS Glue best practicesChoosing the right worker typeOptimizing file splittingExceeding YARN’s memory overhead allocationLeveraging the Apache Spark UIProcessing many small filesData partitioning and predicate pushdownPartitioning data while writing to Amazon S3Amazon Elastic MapReduce (EMR)Understanding EMR clusters and nodesUnderstanding the EMR File System (EMFRS)Securing data in Amazon EMRChoosing between AWS Glue and Amazon EMRData warehouses in AWS with Amazon RedshiftAmazon Redshift’s architectureRedshift instance typesRedshift’s key featuresOptimizing Redshift workloadsQuerying your data lake in AWS with Amazon AthenaLearning about Amazon Athena workgroupsOptimizing Amazon AthenaOptimization of data partitionsData bucketingFile compressionFile size optimizationColumnar data store generation optimizationColumn selectionPredicate pushdownORDER BY clause optimizationJoin optimizationGROUP BY clause optimizationApproximate function useUsing Amazon Athena versus Redshift SpectrumVisualizing data with Amazon QuickSightPutting AWS analytics services togetherAmazon DataZoneKnowledge checkSummary
What is AI/ML?AI/ML in AWSAWS ML frameworks and infrastructureAmazon SageMakerML data preparationML model buildingML model training and tuningML model deployment and monitoringBuilding ML best practices with MLOpsIntroduction to Generative AIGenerative AI vocabularyGenerative AI use caseGenerative AI in AWSInfrastructure for FM training and inferenceAWS TrainiumAWS InferentiaNVIDIA GPUUltraClusterAmazon SageMaker HyperPodEnd-to-end infrastructure for the FM lifecycleCost-optimization strategies for FM infrastructureAmazon BedrockBenefitsFeaturesAmazon QAmazon Q CLIAmazon Q BusinessAmazon Q Developer and AWS TransformAmazon Q in QuickSightAmazon Q in Amazon ConnectKnowledge checkSummary
Definition of a data lakeThe purpose of a data lakeComponents of a data lakeData lake zonesData lakes in AWS with Lake FormationData lake best practicesCentralized data managementData governanceData catalogingData quality controlData quality metricsData securityData ingestionData lake scalabilityData lake cost optimizationData lake performance optimizationFlexible data processing in the data lakeKey metrics in a data lakeLakehouse in AWSData mesh in AWSChoosing between a data lake, lakehouse, and data mesh architectureAmazon SageMaker Lakehouse: a data lake for machine learningFeaturesBenefitsAWS data lake and generative AIBuilding a data lake for generative AIKnowledge check Summary
Understanding microservicesLayered architectureCommon patterns in microservices architectureAPI gateway patternCircuit breaker patternService registry patternEvent-driven architectureUnderstanding eventsProducers and consumersEDA modelsEvent streaming (a message queuing model)Publish and subscribe modelPoint-to-point modelBenefits of EDANo more pollingDynamic targetingCommunication simplicityDecoupling and scalabilityImproved performance and responsivenessDisadvantages of EDAEDA is not a silver bulletWhen things go wrongMicroservices best practicesBest practice #1 – Decide whether microservices are the right toolBest practice #2 – Clearly define the requirements and design of the microserviceBest practice #3 – Leverage DDD to create microservicesBest practice #4 – Ensure buy-in from all stakeholdersBest practice #5 – Leverage logging and tracing toolsBest practice #6 – Think microservices firstBest practice #7 – Minimize the number of languages and technologiesBest practice #8 – Leverage RESTful APIsBest practice #9 – Implement microservice communication asynchronouslyBest practice #10 – Implement a clear separation between microservice frontends and backendsBest practice #11 – Organize your team around microservicesBest practice #12 – Provision individual data stores for each microserviceBest practice #13 – Self-documentation and full documentationBest practice #14 – Use a DevOps toolsetBest practice #15 – Invest in monitoringBest practice #16 – Use least privilege IAM policies per service for securityBest practice #17 – Use serverless where appropriate for cost optimizationBest practice #18 – Two pizzas should be enough to feed your teamBest practice #19 – Twelve-factor designDomain-driven designDefinition of a domainPrinciples of DDDComponents of DDDImplementing DDD in AWSReasons to use DDDChallenges with DDDKnowledge checkSummary
An introduction to the use caseBuilding architecture in AWSDeciding which is the best languageSetting up servicesSetting up an AWS account with a billing alertInstalling the AWS CLISetting up IAM users, roles, and groupsBest practicesCreating the AWS infrastructureCreating the AWS infrastructure using CloudFormationCreating an EventBridge instance and a queueImplementing authentication and authorization for end usersDefining database attributesDefining order context and writing AWS Lambda functionsDeploying and testingDevOps in AWSLogging and monitoringOptimization with a well-architected reviewKnowledge checkSummary

Content preview from AWS for Solutions Architects - Third Edition

8 Best Practices for Application Security, Identity, and Compliance

In the early 2010s, when cloud started to pick up, a common refrain from companies was that they were hesitant to move to the cloud because they believed the cloud was not secure. A big part of this pushback was that companies didn’t understand the cloud or its capabilities. It is possible to have security vulnerabilities even if you use cloud infrastructure. However, as we will see in this chapter, AWS provides a comprehensive catalog of services enabling you to create highly secure sites and applications.

When creating applications and implementing workflows, it is imperative to consider security from the start of your design and not as an afterthought. First, you will understand ...