AWS SAA · Domain 2
Design Resilient Architectures
About 26% of the exam
Regions, zones and blast radius
- Single instance
- Multi-AZ
- Multi-Region
- Active-active
- Region
- separate geography, separate failure domain
- Availability Zone
- isolated data centers, low latency
- Subnet
- belongs to exactly one zone
- Multi-AZ
- survives one zone failing
- Multi-Region
- survives a whole Region failing
- Edge location
- CloudFront and Global Accelerator
- Local Zone
- compute closer to the user
- Outposts
- AWS hardware in your building
Spreading across zones is cheap resilience while spreading across Regions costs money and complexity, so match it to the objective
Load balancer choices
- Application Load Balancer
- routes by path or host
- Network Load Balancer
- TCP and UDP, static addresses
- Gateway Load Balancer
- sends traffic to inspection appliances
- Target group
- health checks decide membership
- Cross-zone
- spreads across every zone
- Sticky sessions
- pins a client to one target
- Connection draining
- finishes in-flight requests
- Global Accelerator
- anycast addresses for non-HTTP traffic
Auto Scaling essentials
- Desired, minimum and maximum capacity
- Target tracking is the usual choice
- Step scaling for sharper reactions
- Scheduled scaling for known peaks
- Health check type set to ELB
- Warm-up stops premature scaling decisions
- Mixed instances policy blends Spot types
- Instance protection survives scale-in
Multi-AZ against read replicas
- Multi-AZ
- synchronous standby, automatic failover
- Standby
- not readable, availability only
- Read replica
- asynchronous, serves read traffic
- Replica lag
- reads may be stale
- Promotion
- manual, replica becomes standalone
- Cross-Region replica
- recovery and local reads
- Multi-AZ cluster
- readable standbys, faster failover
- Endpoint
- name stays, address moves
Aurora and DynamoDB resilience
- Aurora storage spans three zones
- Six copies of every data block
- Reader endpoint balances read traffic
- Global Database replicates across Regions
- DynamoDB is multi-zone by design
- Global Tables give multi-Region writes
- Point-in-time recovery to any second
- On-demand mode absorbs unpredictable traffic
Decoupling with queues, topics and events
SQS
- Pull based, consumers set the pace
- Visibility timeout hides in-flight messages
- Dead-letter queue after maximum receives
- FIFO orders within a message group
- Long polling reduces empty receives
SNS
- Push to many subscribers at once
- At-least-once delivery by default
- Fan out into several queues
- Filter policies per subscription
EventBridge
- Rules match event patterns
- Schedules trigger on a cadence
- Buses connect partners and accounts
- Step Functions orchestrate long workflows
Disaster recovery strategies
- Backup and restore
- cheapest, hours to recover
- Pilot light
- core data replicated, rest dormant
- Warm standby
- scaled down but always running
- Multi-site active-active
- full capacity, near zero downtime
- RTO
- how long until service returns
- RPO
- how much data you can lose
- Elastic Disaster Recovery
- block level replication into staging
- Test cadence
- an untested plan is a guess
Backup and restore
- AWS Backup centralizes plans across services
- Vault Lock stops early deletion
- Copy backups to another account
- Cross-Region copies need a destination key
- Snapshots are incremental after the first
- Restore testing runs on a schedule
- Retention driven by the business
Route 53 routing policies
- Simple
- one record, no logic
- Failover
- health-checked primary, then secondary
- Weighted
- split traffic by assigned weight
- Latency
- sends to the fastest Region
- Geolocation
- answers based on user location
- Geoproximity
- bias traffic toward a Region
- Multivalue answer
- several healthy records returned
- Health check
- drives every failover decision
Storage resilience
- S3 stores across three zones
- One Zone classes trade durability away
- Versioning protects against overwrites
- Cross-Region replication needs versioning on
- EBS snapshots are held in S3
- EFS spans zones by default
Recovery objectives in practice
- Tier one
- minutes, active-active or warm
- Tier two
- hours, pilot light
- Tier three
- a day, restore from backup
- Cost curve
- shorter objectives cost more
- Dependency map
- recover in the right order
- Runbook
- any engineer can follow it
- Game day
- practice the failover for real
Resilience anti-patterns
- One NAT gateway serving every zone
- Failover script living in the failed Region
- Quotas never raised in the standby
- Backups kept in the same account
- Health check that only pings
- Peering assumed to be transitive
Rapid recall: resilience picks
- Zone failure for a database
- RDS Multi-AZ
- Read load too high
- read replicas
- Region failure in minutes
- warm standby
- Cheapest recovery option
- backup and restore
- Active-passive DNS
- failover routing policy
- Smooth a traffic spike
- SQS between the tiers
- Global non-HTTP entry
- AWS Global Accelerator
- Poison message handling
- dead-letter queue
Reference strip: availability, data, decoupling, recovery, routing
Availability
- Two zones as a minimum
- Load balancer health checks
- Auto Scaling across zones
- Stateless application tier
Data
- Multi-AZ for availability
- Read replicas for scale
- Point-in-time recovery enabled
- Versioning and replication
Decoupling
- Queues absorb bursts
- Topics fan out events
- Dead-letter queues catch failures
- Idempotent consumers everywhere
Recovery
- Backup, pilot light, warm, active
- RTO and RPO drive cost
- Copy backups across accounts
- Test the plan regularly
Routing
- Failover with health checks
- Latency for global users
- Weighted for gradual shifts
- Global Accelerator for TCP
Quick exam traps
- Trap: A read replica takes over automatically when the primary fails
- Trap: The Multi-AZ standby can serve read traffic
- Trap: Cross-Region replication in S3 works without versioning
- Trap: Zone names map to the same physical data center in every account
- Trap: A FIFO queue guarantees ordering across every message group
- Trap: Pilot light means the standby is already serving traffic
- Trap: SNS guarantees exactly-once delivery to each subscriber
cybercertprep.com · original revision sheet written from the public body of knowledge