DEV Community: Julie Elkins

What is Machine Learning?

Julie Elkins — Tue, 23 Feb 2021 17:15:03 +0000

Hi and welcome! Let’s talk about Machine Learning, which is a subnet of Artificial Intelligence. Machine learning is everywhere these days, so lets see how machine learning works and how it can help you with your data!
So to look at how machine learning works, let’s image that we work for Scuba Syndrome
and have just completed an expedition where we have been monitoring sharks. We have looked at the length, girth, and weight of sharks and now we can plot a graph of this data that we collected. So if we have a simple graph of length on our x axis and weight on the y axis, we can take each of the data points we collected in our sea exploration and plot them on our graph.
So as we plot our sharks on our graph
we can see there is a linear relationship, and we can easily draw a line, or a trend line, through our data set. And this trend line can be used to predict the weight of other sharks.
And if we went on another explorations and saw other sharks, we could put each those sharks on our graph, and we could determine that if a shark is this length, then it probably weighs this amount.
And if we saw another shark that was longer, then it will most likely be heavier as well. And this data becomes our Training Data. But we have to ask ourselves, is this the best line or is there a better line to predict the weight of sharks based on the length. What if we drew a line through all of our sharks (the data points we collected); maybe that line is a better way to predict the weight of sharks.
Well, we just do not know, but we can add more data from our exploration. Because on our exploration we collected lots of data about sharks. And this new data is our Testing Data.
And testing data is simply data that was not used to draw our trend line, but we can use testing data to test our trend line to make sure our trend line is great at predicting the weight of a shark based on the shark’s length.
And this type of machine learning model is called Linear Regression. Linear Regression is great to use when we want to get a numeric value from our model. And in our example, we used Linear Regression to get the weight of the shark based on the shark’s length. But there is also Logistic Regression which is great when you want your outcome to be a binary output, so a yes or no, a 1 or 0. So if we used Logistic Regression as our model, we would be looking to see if yes, that is a shark or no, that is not a shark.
And there are lots of other types of machine learning models out there. Support Vector Machines and Decision Trees are both categorization models.

So at a very basic level, the way machine learning works is that it starts off with our data, then we choose an algorithm which we believe will best represent our data (and here we can use our testing data too). Then we take our data plus the algorithm and we train our model which is trying to find the best line to fit our data. And then the output of the training is the model itself which we can use to make our predictions.
This is a very basic level of how machine learning works. In reality there is so much more to it and so many attributes we could use from our exploration like what is the size of the shark’s eyes? what is the tooth shape? is the shark oviparous or viviparous? does the shark have a spiracle? what is the color of the shark? does the shark have a pointed snout? what is the shark’s body shape?

Most data sets you will see have much more than the two attributes (length and weight) we are using in this example,
and that is the power of machine learning. The machine learning algorithms can take all the dimensions of our data, perform calculations across those dimensions, and then infer answers across multi-dimensional large data sets.

I am just starting to learn about machine learning myself, but please reach out with any questions or if I can help!

Check out AWSJulie for more information!

AWS Web Identity Federation Playground - let's dive deeper

Julie Elkins — Wed, 17 Feb 2021 21:55:23 +0000

Hi and welcome back! Let’s take a deeper dive into hybrid environments learn about Web Identity Federation and AWS Cognito.

In my Designing Resilient Architectures course, we learn about hybrid environments, and that a hybrid environment consists of an on-premise network and AWS, and that there are ways to integrate your hybrid environments with your AWS environment.

So lets start with Identity Federation (IDF) which is an architecture where identities of an external identity provider (IDP) are recognized and it allows Single Sign On (SSO). So the credentials of the external user’s external identity is allowed access to your AWS resources or another local system.

So an example of this is when you sign-in to an online application or mobile application and you are allowed to sign in with your Amazon or Google credentials. And the way it works is that application is taking the identity, and allowing access using the credentials of identity provider such as Google, Amazon, etc. This process is known as identity federation. An IDP is simply a provider of identities. Another example of IDP is Micorsoft Active Directory, FaceBook, etc. You use your credentials to log in to these platforms, but can use these credentials to log into others as well.

There are three types of Identity Federation:

Cross account role: this is where a remote account, so a remote IDP, is allowed to assume a role and access your account resources. And we saw this when we switched roles in our AWS organization inside the Designing Resilient Architectures course, we federated our identity to swap our credentials to get access to the other AWS accounts, but the key here is that with AWS cross account roles we are using the same identity provider, AWS.

SAML 2.0 is a standard that is used mostly for on-premise systems, usually Microsoft Active Directory or others, so in this case users can log into AWS with their on-premise credentials.

Web Identity Federation is where we use an IDP (like Amazon, Google, etc.) and allow users to assume roles and access our AWS resources using their IDP credentials. check out AWS Web Identity Federation Playground for a behind the scenes look!

And for SAML 2.0 and Web Identity Federation, AWS uses the Secure Token Service and Cognito for IDF. So the federated identity is verified using an External IDP and provides the identity a secure token, and then the user can swap the secure token for temp credentials into AWS by assuming roles.

STS is AWS services that allows you to receive short term credentials.

Cognito is an AWS’s Web Identity Provider service that brokers the SSO or ID Federation by creating Cognito ID Pools, these are pools of identities. So you can have three different identities, so you have a FaceBook log in, a Google, log in, and an Amazon login, and AWS Cognito allows you to merge these identities and treat them as one identity, bc really all three are your identities anyway. So Cognito acts as an ID broker between your web application and web ID Providers, no additional code it needed.

A user who is wanting to log in to your application, will fist be sent to the IDP like Google, FB, Amazon etc.

When they log into Amazon they will receive an authentication token, that authenticated token will be sent to Cognito, Cognito will respond with temporary security credentials that map to an IAM role to allow access to the required AWS resources in your application.

The updated AWS Certified Solutions Architect exam has added Cognito, and I have seen two types of Cognito questions on Cognito User Pools and Cognito ID Pools.

So a Cognito User Pool are directories used to manage sign up and sign in functionality for mobile and web applications. Your users can sign in directly to the Cognito User Pool, and Cognito User Pool will store their user name and password or they can sign in using Amazon, FB, Google, and then Cognito acts as an ID Broker between the identity provider they choose. Let’s say they choose Amazon and AWS, and when successfully authenticated, a JSON web token will be generated and passed back to the user that maps to an IAM role with the needed permissions. So a Cognito User Pool is all about the access for your users.

Cognito ID Pools are enabled to provide temporary security credentials to access AWS services like S3 or DynamoDB.

Cognito ID Pools are all about authorization of access to AWS resources. So about the services not really about the user.

With Cognito, you and your users can sign up or sign in to your applications, and with Cognito you can grant access for guest users.

With Cognito the user ID is synchronized between multiple devices, so if you update your email address, etc., then those changes are updated to your other devices too. Cognito does this using push synchronization to push these updates and synchronize the user data across multiple devices, and uses SNS (which we will be covering another lesson for the course) to send notifications to all the devices associated with the user ID when that data stored in the cloud changes.

Make sure for the exam you know the differences between Cognito User Pools and Cognito ID Pools.

So remember with AWS, you can not access AWS services, features, products, etc. without a set of credentials, remember by default users have no access. We must explicitly grant permission for our AWS accounts. So you cannot access S3 or an EC2 instance using an IDP, like your Google or Amazon credentials, there has to be an identity exchange behind the scenes.

So lets look at the architecture so we can see what is happening behind the scene:

So let’s start with SAML 2.0 and remember with SAML 2.0 this federation is usually used with Active Directory, so if you see a question on your exam asking with IDP is used with Active Directory, then the answer is probably SAML 2.0.

So for this example, let’s say you are at work, and you need to access AWS, and your office uses Active Directory to manage your corporation’s identities.

So our first step is going to be to log in, so you will browse to your ADFS, which stands for your Active Directory Federation Server, and then you authenticate using your internal AD credentials, or perhaps you are already logged in earlier that morning, but when you authenticate with the ADFS, you are returned a SAML assertion. That SAML assertion is simply a token that proves you are who you say you are, and that SAML assertion is sent to the AWS SSO endpoint, and this endpoint is configured when you design your AWS environment to when you decide to use SAML Federated Identity. The SSO endpoint verifies your ID because there is a trust established between the ADFS server and the SSO endpoint. So the SSO will now communicate with STS and assume a role using the SAML Assertion token that identifies you. The SSO Endpoint will then return to the user a URL redirect, to the AWS Management Console.

Now lets look at Web ID Federation:

Now in this scenario let’s pretend that we are trying to log into an application, well when we browse to the application, we are re-directed for our log in to the IDP Provider and again this can be Google, Amazon, etc. So you log in using your Amazon ID and you are given a token, so now the web application takes your token and then communicates with either STS or Amazon Cognito, and passes in the token received from your Amazon log in and asks STS or Cognito to Assume Role, and then the role assumption happens and you are given temp security credentials and the role is sent back to the user, you can then use those temporary security credentials to access the application

Let’s also look at when we would use Identity Federation bc you will most likely get questions on your certification exam asking when you would use ID federation in different scenarios.

First, it is a great to use Web ID Federation when you have a large enterprise because you already have an existing pool of Identities, and those IDs are used across all of your systems and you want the IDs to be used for the AWS environment as well.

Using Web Identity Federation you can use your AWS resources using SSO. And this is important for the exam, Web ID Federation is a great choice if you have over 5,000 employees bc remember with IAM you can only have 5,000 users in each AWS accounts, so Web Identity federation gives you the ability to allow everyone in the organization the access that they need. IAM can only handle so much, so SAML 2.0 or Web Identity Federation is a great option.

Second, IDF is great for mobile and web applications that require access to your AWS resources. Customers log in with their other identities, Google, Amazon, etc. You do not have to store credentials within your application, and it allows hundreds, thousands, or millions of users, and again IAM again cannot handle this capability.

If you want to grant further access to the users once logged in you can use Cognito to grant them further access using the Cognito ID Pools using the External IDP.

Third, if you are a large organization, you may have tens or hundred of AWS accounts, so you can use your existing corporate IDs, and you can use role switching from the external ID to get credentials to assume roles in other AWS accounts.

I also want to talk about AWS Directory Services because it is service that provides managed directory service. It runs within a VPC, and for high availability make sure your deploy AWS directory services into multiple AZs.

Certain services like Amazon workspaces needs a directory, so AWS Directory Services works great with these types of services and can also be integrated with on-premise systems.

So we have Simple AD which is an implantation and compatible with basic AD functions and can handle 500 users to 5000 users. Simple AD is for simple requirements.

Managed Microsoft AD is an actual Microsoft AD Directory service and you can create a trust relationship with your on-premise directory.

AD Connector provides a proxy request back to an on-premise directory, and is great for proxy identities to integrate with AWS services when you do not want to store any directory information in the cloud.

I hope this helps! I struggled with web identity when I was getting started, so please reach out if you are struggling too! And check out my course, Application Services, on A Cloud Guru!

What is the brand new AWS SysOps Administrator Associate exam (SOA-C02) all about?

Julie Elkins — Wed, 17 Feb 2021 20:44:07 +0000

I just sat for the new beta AWS Certified SysOps Administrator certification exam with the added hands-on labs, and it is a great exam with some AWSome labs! I think that the addition of adding labs will be testing real-world skills. So with this new style of the certification exam, it is going to be harder to pass with memorization of the content. Let me know what you think, but I believe memorization alone is no longer going to get you a pass for this certification exam.

The first part of the beta exam was was 55 questions, and then after the 55 questions, you get a chance to review your answers. Please hear this… once you complete your review of the questions and answers, you cannot return back to the questions at the end of the exam. So review your questions before moving onto the next section.

The second part of exam was the new addition, the labs!!! I had three labs in my beta exam!

For my first lab, I had to log in, then the AWS console loads, and you will see on the right hand side a given scenario with instructions. To get through the lab, you have to follow instructions, implement the tasks, click next, and then you move on to the second and third lab where you follow the same process.

My labs covered setting up a scalable application, configuring S3 buckets, and using AWS Config.

Overall, I found this section of the exam fun and the labs were great!! I do not want to talk too much about the labs themselves, but interested if you took the beta, did you get similar labs to mine? What were your labs?

I do believe the addition of these labs to the exam will make it harder to pass this exam on memorization alone, but if you have the foundational knowledge and hands on practice you should do great!

So let’s jump back and talk more about the first section and the questions covered. I would recommend being familiar with all the DNS Record types and when to use each type; CloudFront Security – OAI, public, private, signed URL/Cookie, and restricting direct S3 Access; for EFS understand the availability, latency, and architecture; understand pre-signed URLs for S3; understand VPC Flow Logs, ALB logs, S3 logs, CloudTrail and CloudFront logs too; be able to troubleshoot EC2 instances – routing, security, IPs; be able to architect for High Availability as well as when and how to use auto scaling groups; know how to install the CloudWatch agent on an EC2 instance; know how to configure gateway endpoints; understand Lambda and Step Functions; I had a few questions around restricted S3 buckets and how to secure them; I also saw a question around protecting your S3 bucket from accidental deletion; know S3 storage classes as well as encryption, versioning, and lifecycle policies; for CloudFormation know your CF template structure along with cross stack references and nested stacks; as well as how to work with templates across regions; know how to diagnose storage performance as well as EBS and EFS storage performance issues; understand ElasticSearch architecture, migration, and high availability; for networking, understand NACLs, Security Groups, ports, the ephemeral port range, and how your set up affects your traffic; also understand DDoS protection, AWS Shield, and the AWS WAF; I also had a question on spot fleet around the features of spot fleets and how they can work along side on-demand instances; I would definitely review your RTO and RPO and know how to architect; know KMS and IAM policies; also be familiar with developer environments; for access, know how to set up cross account access, access for people without an account, as well as SSO and directory services; and then of course, I had three questions around *cost optimization. Cost Optimization is making its way into all the new updated exams!

And remember, I’m here to help, so if you have any questions please just ask! I’m always happy to help! Check out more at AWSJulie.com

I recommend to get started preparing to ace this certification, first choose your training course, and then second, get your hands dirty: use our hands-on labs or start building in your own AWS account!

AWS Certified Solutions Architect Associate exam and the new AWS CSA Certification Track

Julie Elkins — Thu, 28 Jan 2021 19:40:02 +0000

Hi and welcome!! I am Julie, and today we are going to take a deep dive into preparing for the AWS Certified Solutions Architect Associate certification exam and cover the new certification track I created to help you ACE this exam!

Is it time to dive deep in your CSA studies? YES, IT IS!!!

I created a new AWS Certified Solutions Architect Associate Certification Track that will help you to prepare and pass the new updated AWS Certified Solutions Architect associate exam.

But you may be asking, "Why would I take a certification track when I can just take a certification course?”"

Well, the six courses I created in the new AWS Certified Solutions Architect – Associate certification track will give you the knowledge and skills you need to pass the newly released and updated AWS Certified Solutions Architect SAA-C02 and (bonus) prepare you to work as a solutions architect in the real world. (That’s a big bonus since the AWS Certified Solutions Architect – Associate cert is one of the top-paying cloud certifications out there.)

I split the certification track into 6 essential courses:

The first course is Designing Resilient Architectures and this course covers AWS fundamentals including AWS accounts, IAM, and core services too!

The second course is covers Networking and Compute and the new updated exam has a heavy focus on network and compute questions!

The third course covers Storage, Databases, and Migration and when I sat for the beta exam I had a lot of questions around S3, especially questions dealing with performance and security, as well as questions on FSx and a lot of questions on Aurora and how to design highly available regional and global architectures!

Now the fourth covers High Availability and Scalability which we touch on in the first course under AWS Fundamentals and I saw a lot more questions around Elastic Load Balancers, CloudFront, and Route 53!

The fifth course covers AWS Application Services, but also explores deployments and hybrid environments!

And to wrap up the certification track we have the sixth course covering Logging and Security!

And I saw a huge focus on AWS security in my beta exam as well as the AWS Key Management Service, WAF, and especially cost optimization and I added in cost optimization to each course to make sure we get a solid understanding of how to build a cost optimized environment.

So overall I did see a shift in the design of the questions and the focus of the exam and built this certification track with that focus in mind.

If you’re a student like myself, trying to learn all the things, come join me!

As a former and current student, I’m also excited to help others prepare for the updated SAA C02 certification exam!!! We can do it together!

Please let me know what you think of this new certification track and the supporting courses.

And let me know: Are you a newbie like me, or are you years beyond me?

Our team here at A Cloud Guru prides itself on learning all the things. And wherever you are in your learning journey, come join us in learning all the things!

Check out A Cloud Guru for more AWS training and also check out AWS Julie too!