Other Services Worth Knowing

1. AWS CloudFormation

CloudFormation is the declarative way of outlining your AWS infrastructure, and it works for almost every kind of resource. Instead of clicking your way through the Console one resource at a time, you write a template that states what you want. Inside a CloudFormation template you might say:

• I want a security group.
• I want two EC2 instances using that security group.
• I want an S3 bucket.
• I want a load balancer (ELB) in front of those machines.

CloudFormation then creates all of it for you, in the right order, with exactly the configuration you specified. That is the whole point of “declarative”: you describe the desired end state, you do not write the steps to get there.

Benefits of CloudFormation

Infrastructure as code:

• No resources are created manually, which is excellent for control.
• Every infrastructure change goes through a code review.

Cost:

• Each resource inside a stack is tagged with an identifier, so you can easily see how much a given stack costs you.
• You can estimate the cost of your resources straight from the template.
• A savings strategy that falls out of this: in a Dev environment you can safely automate deletion of the templates at 5 PM and recreate them at 8 AM.

Productivity:

• You can destroy and re-create an entire infrastructure on the cloud on the fly.
• Diagrams for your templates are generated automatically.
• Declarative programming means you never have to work out ordering and orchestration yourself.

Don’t re-invent the wheel:

• Reuse the templates that already exist on the web, and lean on the documentation.
• (Almost) all AWS resources are supported; for the ones that are not, you write “custom resources”.

CloudFormation + Infrastructure Composer

Infrastructure Composer is used alongside CloudFormation to visualize a stack. Take a WordPress CloudFormation stack as an example: you can see every resource it contains and see the relationships between the components. That is invaluable when you have to read a template somebody else wrote.

CloudFormation Service Role

A Service Role is an IAM role that allows CloudFormation to create, update and delete the stack’s resources on your behalf. What it really buys you is this: it gives users the ability to create, update and delete stack resources even when they themselves have no permissions to work with those resources.

Use cases:

• You want to honor the least privilege principle.
• But you do not want to hand the user every permission required to create the stack’s resources.

The mechanics, as the diagram lays them out: the user only needs cloudformation:* and iam:PassRole; the service role is the one that holds the heavy permissions on the resources, shown in the diagram as s3:*Bucket so that the stack can create an S3 bucket. The user hands the template to CloudFormation, CloudFormation borrows the service role and builds the stack. One detail you must not forget: the user must have iam:PassRole permissions.

Exam tip

A scenario that says “we want users to be able to deploy the stack but we do not want to grant them permissions on the resources inside it” is asking for a CloudFormation Service Role — and do not forget iam:PassRole.

2. Amazon SES and Amazon Pinpoint

Both services deliver messages to end users, but at two different levels of abstraction, and the deck compares them head on.

Amazon Simple Email Service (Amazon SES)

SES is a fully managed service for sending email securely, globally and at scale.

• It allows both inbound and outbound email.
• It comes with a reputation dashboard, performance insights and anti-spam feedback.
• It reports what became of each send: email deliveries, bounces, feedback loop results and email open.
• It supports DomainKeys Identified Mail (DKIM) and Sender Policy Framework (SPF), the two sender-authentication standards.
• Flexible IP deployment: shared, dedicated and customer-owned IPs.
• Your application sends mail through the AWS Console, APIs or SMTP.
• Use cases: transactional, marketing and bulk email communications.

Amazon Pinpoint

Pinpoint is a scalable two-way (outbound and inbound) marketing communications service.

• It supports email, SMS, push, voice and in-app messaging.
• It can segment and personalize messages so each customer gets the right content.
• It can receive replies from customers.
• It scales to billions of messages per day.
• Use case: running campaigns that send marketing, bulk and transactional SMS messages.

The comparison that matters most, Pinpoint versus SNS/SES:

• With SNS and SES, you manage each message yourself: its audience, its content and its delivery schedule.
• With Pinpoint, you create message templates, delivery schedules, highly-targeted segments and full campaigns.

Pinpoint also streams events (for example TEXT_SUCCESS, TEXT_DELIVERED) out to SNS, Kinesis Data Firehose or CloudWatch Logs so you can analyze them.

Exam tip

If the question has you managing the audience and content of every individual message, the answer is SES or SNS. If it talks about campaigns, templates, segments and delivery schedules, the answer is Pinpoint.

3. AWS Systems Manager (SSM)

Systems Manager is the operations toolkit for your servers, both EC2 instances and on-premises servers. Most of the components below act on machines that run the SSM Agent; IAM permissions are what the deck calls out specifically for Session Manager and Run Command.

SSM Session Manager

Session Manager lets you start a secure shell on your EC2 instances and on-premises servers.

• No SSH access, no bastion hosts and no SSH keys are needed.
• Port 22 never has to be opened, and that is the security win.
• It supports Linux, macOS and Windows.
• It can send session log data to S3 or CloudWatch Logs.

The flow: a user with the right IAM permissions asks Session Manager for a session, and Session Manager executes commands on the EC2 instance running the SSM Agent.

SSM Run Command

Run Command executes a document (which is a script), or just a single command, on your managed instances.

• It runs the command across multiple instances at once, using resource groups.
• No SSH needed.
• Command output can be shown in the AWS Console, or sent to an S3 bucket or CloudWatch Logs.
• It sends notifications to SNS about command status (In progress, Success, Failed and so on).
• It is integrated with IAM and CloudTrail.
• It can be invoked by EventBridge.

SSM Patch Manager

Patch Manager takes the chore of keeping your managed instances patched off your hands.

• In scope: OS updates, application updates and security updates.
• Targets: EC2 instances as well as on-premises servers.
• Platforms: Linux, macOS and Windows.
• Timing is yours to pick — on demand, or driven by a schedule through Maintenance Windows.
• It reports too: a scan of the instances produces a patch compliance report naming the patches they are missing.

Under the hood it is triggered from the AWS Console, the AWS SDK or Maintenance Windows, and it does its work through Run Command with the AWS-RunPatchBaseline document.

SSM Maintenance Windows

A Maintenance Window is the slot of time in which work on your instances is allowed to happen — patching the OS, refreshing drivers, installing software and similar chores.

A Maintenance Window is made of four things:

• A schedule (for example, trigger every 24 hours).
• A duration for the window.
• A set of registered instances.
• A set of registered tasks.

SSM Automation

Automation simplifies common maintenance and deployment tasks for EC2 instances and other AWS resources — restarting instances, creating an AMI, taking an EBS snapshot.

The unit of configuration is the Automation Runbook: SSM Documents that define the actions performed on your EC2 instances or AWS resources. Some are pre-defined, some you write yourself as custom runbooks; AWS-RestartEC2Instance is the example in the deck.

Automation can be triggered:

• Manually, using the AWS Console, AWS CLI or SDK.
• By Amazon EventBridge.
• On a schedule using Maintenance Windows.
• By AWS Config, as the remediation for a rule that has been violated.

Real-world example

An operations team runs 200 EC2 instances that must be patched for security vulnerabilities every Sunday at 2 AM. They create a recurring Maintenance Window, register the instances via a resource group, and register Patch Manager as the task. From then on they read a weekly patch compliance report instead of connecting to each machine by hand.

Exam tip

“Shell access to EC2 without opening port 22, without a bastion host and without managing SSH keys” points to SSM Session Manager. “Run a script across a fleet of instances” points to Run Command. “Automatically restart an instance or create an AMI when an event fires” points to SSM Automation with a runbook.

4. Cost management

Cost Explorer

Cost Explorer is where you see what your AWS costs and usage have done over time, make sense of it, and act on it.

• Build custom reports over the cost and usage data.
• Analyze the data at a high level: total costs and usage across all accounts.
• Or drill down to monthly, hourly and resource-level granularity.
• Choose an optimal Savings Plan to lower the prices on your bill — this is the alternative to Reserved Instances.
• Forecast usage up to 12 months based on previous usage.

The reports the deck walks through are Monthly Cost by AWS Service, Hourly and Resource Level, Savings Plan and Forecast Usage.

AWS Cost Anomaly Detection

Cost Anomaly Detection keeps a continuous machine learning watch over your cost and usage, and flags spend that does not look normal.

• It learns your own unique historic spend patterns in order to detect a one-time cost spike and/or continuous cost increases — you do not need to define any thresholds.
• It can monitor AWS services, member accounts, cost allocation tags or cost categories.
• It sends you an anomaly detection report with root-cause analysis.
• You get notified with individual alerts or a daily/weekly summary, delivered through SNS.

The service is presented as three steps: Create Cost Monitor (identify unusual spend at the granularity level you specify), Get Alerted (receive alerts when unusual spend is detected) and Analyze Root Cause (understand what caused the anomaly and what it did to your costs).

Exam tip

The dividing line: Cost Explorer is for viewing, analyzing and forecasting, with you doing the looking. Cost Anomaly Detection is machine learning spotting the unusual spend for you and alerting, with no thresholds to define.

5. AWS Outposts

Hybrid cloud describes businesses that keep an on-premises infrastructure alongside a cloud infrastructure. The consequence is that they end up with two ways of dealing with IT systems:

• One for the AWS cloud (the AWS Console, the CLI and the AWS APIs).
• One for their on-premises infrastructure.

AWS Outposts are “server racks” that put the same AWS infrastructure, services, APIs and tools inside your own data center, so an application written on-premises is written the way it would be in the cloud. AWS installs and runs the “Outposts Racks” that sit in your facility, and from then on AWS services are available to you locally. One responsibility stays on your side and is worth remembering: the physical security of the Outposts Rack.

Benefits:

• Low-latency access to on-premises systems.
• Local data processing.
• Data residency.
• Easier migration from on-premises to the cloud.
• It is a fully managed service.

Services that work on Outposts include Amazon EC2, Amazon EBS, Amazon S3, Amazon EKS, Amazon ECS, Amazon RDS and Amazon EMR.

6. AWS Batch

AWS Batch is batch processing run for you, at any scale, with nothing of your own to manage.

• It copes efficiently with 100,000s of computing batch jobs on AWS.
• A “batch” job is a job with a start and an end, as opposed to something that runs continuously.
• Batch dynamically launches EC2 instances or Spot Instances as the work demands.
• AWS Batch provisions the right amount of compute and memory.
• Your part ends at submitting or scheduling the batch jobs; the rest is Batch’s problem.
• A batch job is packaged as a Docker image and executed on ECS.
• It helps with cost optimization, and it means less attention spent on infrastructure.

The simplified example in the deck: a trigger starts AWS Batch; Batch runs the job on an EC2 instance or a Spot Instance by way of ECS; the job reads data from Amazon S3 and inserts the processed object back into Amazon S3.

Batch versus Lambda

	Lambda	AWS Batch
Run time	Has a time limit	No time limit
Runtime	Limited runtimes	Any runtime, as long as it is packaged as a Docker image
Disk	Limited temporary disk space	Relies on EBS / instance store
Infrastructure	Serverless	Relies on EC2 (which can be managed by AWS)

Exam tip

A job that runs too long, needs an unusual runtime or needs real disk space points to AWS Batch. A short, event-driven job with no infrastructure to manage points to Lambda.

7. Amazon AppFlow

AppFlow is a fully managed integration service whose job is moving data securely between Software-as-a-Service (SaaS) applications and AWS.

• Sources: Salesforce, SAP, Zendesk, Slack and ServiceNow.
• Destinations: AWS services such as Amazon S3 and Amazon Redshift, or non-AWS destinations such as Snowflake and Salesforce.
• Frequency: on a schedule, in response to events, or on demand.
• It has data transformation capabilities such as filtering and validation.
• Data is encrypted over the public internet, or travels privately over AWS PrivateLink.
• The core value: you do not spend time writing the integrations and can leverage the APIs immediately.

8. AWS Amplify

AWS Amplify bundles tools and services for building and shipping scalable full stack web and mobile applications.

• It covers authentication, storage, API (REST, GraphQL), CI/CD, PubSub, analytics, AI/ML predictions and monitoring, among others.
• You connect your source code from GitHub, AWS CodeCommit, Bitbucket, GitLab, or upload it directly.

How the pieces fit together, following the diagram: you configure the backend using the Amplify CLI, and that backend is made of services such as Amazon Cognito, Amazon S3, AWS AppSync, API Gateway, DynamoDB, Lambda, Amazon SageMaker and Amazon Lex; you connect the frontend to the backend using the Amplify Frontend Libraries; and you build and deploy the frontend using the Amplify Console together with Amazon CloudFront.

9. Instance Scheduler on AWS

This is a detail that is easy to skip over and often asked about: Instance Scheduler on AWS is an “AWS solution” deployed through CloudFormation — it is not a service.

• It automatically starts and stops your AWS services to reduce costs, by up to 70%.
• Example: stopping a company’s EC2 instances outside business hours.
• It supports EC2 instances, EC2 Auto Scaling Groups and RDS instances.
• Schedules are managed in a DynamoDB table.
• It uses the resources’ tags and Lambda to stop and start instances.
• It supports cross-account and cross-region resources.

Real-world example

A company’s dev/test environment is a few dozen EC2 instances and a handful of RDS instances that are only used from 8 AM to 6 PM on weekdays. Deploying Instance Scheduler through CloudFormation and tagging those resources with a schedule means Lambda shuts them down in the evening and brings them back in the morning, cutting most of the cost of an environment that is not serving production traffic.

Quick recap

Item	What to remember for the exam
CloudFormation	Declarative infrastructure, created in the right order; resources tagged per stack so you can see cost; destroy and rebuild environments at will; custom resources cover unsupported resources
Infrastructure Composer	Visualizes a stack and the relationships between its components
CloudFormation Service Role	Lets users deploy a stack without permissions on the resources inside it; the user needs iam:PassRole
Amazon SES	Email at scale, inbound and outbound, DKIM/SPF, shared/dedicated/customer-owned IPs, sent via Console, APIs or SMTP
Amazon Pinpoint	Multi-channel campaigns (email, SMS, push, voice, in-app) with templates, segments and delivery schedules; streams events to SNS, Firehose, CloudWatch Logs
SSM Session Manager	Secure shell with no port 22, no bastion, no SSH keys; logs to S3 / CloudWatch Logs
SSM Run Command	Runs a document or command across many instances via resource groups; output to Console, S3 or CloudWatch Logs; invokable by EventBridge
SSM Patch Manager	Automated OS/application/security patching through AWS-RunPatchBaseline, plus a patch compliance report
SSM Maintenance Windows	Schedule + duration + registered instances + registered tasks
SSM Automation	Runbooks such as AWS-RestartEC2Instance; triggered manually, by EventBridge, by Maintenance Windows, or by AWS Config remediation
Cost Explorer	Analyze cost monthly/hourly/per resource, pick a Savings Plan, forecast up to 12 months
Cost Anomaly Detection	ML finds unusual spend, no thresholds needed, root-cause analysis, alerts via SNS
AWS Outposts	AWS racks in your data center; low latency, local processing, data residency; you own physical security
AWS Batch	Jobs with a start and an end, defined as Docker images running on ECS, launching EC2/Spot; no time limit, unlike Lambda
Amazon AppFlow	Moves data between SaaS apps (Salesforce, SAP, Zendesk, Slack, ServiceNow) and AWS, encrypted over the internet or via PrivateLink
AWS Amplify	Full stack web/mobile toolkit — auth, storage, API, CI/CD, analytics; deployed with Amplify Console + CloudFront
Instance Scheduler on AWS	A CloudFormation-deployed solution, not a service; starts/stops EC2, ASG and RDS by tag using Lambda, schedules in DynamoDB, saves up to 70%