AWS

AWS — hisoblash, storage, database, network, security, analytics va boshqa infratuzilma xizmatlarini internet orqali taqdim etadigan cloud computing platforma. To‘liq nomi Amazon Web Services. Platforma resurslarni talab bo‘yicha yaratish, avtomatlashtirish va foydalanilgan hajm asosida boshqarish imkonini beradi.

AWS bitta xizmat emas; u turli vazifalarga mo‘ljallangan ko‘plab managed va infrastructure service’lardan tashkil topgan ekotizim.

Cloud modeli

AWS orqali tashkilot fizik server sotib olmasdan virtual resurs yaratishi mumkin.

Asosiy model:

Infrastructure as a Service;
Platform as a Servicega yaqin managed xizmatlar;
serverless;
storage;
managed database;
global network.

Shared responsibility modeli qo‘llanadi.

Region va zone

AWS infratuzilmasi regionlarga bo‘linadi.

Region ichida bir nechta Availability Zone mavjud.

Resource scope service’ga qarab:

global;
regional;
zonal

bo‘lishi mumkin.

High availability uchun resurslar bir nechta zonaga tarqatiladi.

Account

AWS account billing, resource va security boundary hisoblanadi.

Katta tashkilot development, production, security va log uchun alohida accountlardan foydalanishi mumkin.

Organization markaziy policy va billingni boshqaradi.

Root user kundalik ish uchun ishlatilmaydi.

IAM

Identity and Access Management user, role va policy orqali ruxsatlarni boshqaradi.

Policy action, resource va conditionni belgilaydi.

Temporary role credential static access keydan xavfsizroq.

Least privilege va multi-factor authentication qo‘llanadi.

Compute

Virtual serverlar compute instance sifatida yaratiladi.

Boshqa compute modellari:

Workload state, startup va execution vaqtiga qarab model tanlanadi.

Object storage

Object storage bucket va object modelida ishlaydi.

Media, backup, log, data lake va static asset saqlanadi.

Versioning, lifecycle, replication va policy qo‘llanadi.

Public access default holatda cheklanadi.

Block va file storage

Virtual machine uchun block volume ulanadi.

Shared file workload uchun managed file service ishlatilishi mumkin.

Performance IOPS, throughput va latency bo‘yicha tanlanadi.

Snapshot backup va clone uchun xizmat qiladi.

Database

Platforma turli database modelini taklif qiladi:

relational;
key-value;
document;
cache;
graph;
time series;
warehouse.

Managed service patch, backup va failoverning bir qismini boshqaradi.

Schema va query design mijoz javobgarligida qoladi.

Virtual network

Virtual Private Cloud logical network boundary beradi.

Unda:

subnet;
route table;
internet gateway;
NAT;
security group;
network ACL;
private endpoint

mavjud bo‘lishi mumkin.

Public va private subnet architecturega mos ajratiladi.

Load balancing

Load balancer trafficni bir nechta backendga tarqatadi.

Layer va protocolga qarab turli model qo‘llanadi.

Health check unhealthy backendni pooldan chiqaradi.

TLS certificate va routing qoidalari markaziy boshqarilishi mumkin.

Autoscaling

Metric, jadval yoki demandga qarab instance soni o‘zgaradi.

Minimal, maksimal va desired capacity belgilanadi.

Scaling faqat CPUga tayanmasligi mumkin.

Queue depth yoki request latency kuchliroq signal bo‘lishi ehtimoli bor.

Serverless

Function yoki managed runtime server provisioningni yashiradi.

Code eventga javoban ishga tushadi.

Afzallik:

avtomatik scale;
foydalanish bo‘yicha billing;
kam operatsion boshqaruv.

Cheklov:

execution limit;
cold start;
state;
runtime;
observability.

Monitoring

Cloud monitoring metric, log, event va alarm yig‘adi.

Kuzatiladi:

infrastructure;
application;
security;
billing;
audit.

Resource tag va account metadata telemetry’ni guruhlashga yordam beradi.

Audit

Control plane API chaqiriqlari audit logga yoziladi.

Kim qaysi resource’ni yaratdi, o‘zgartirdi yoki o‘chirdi, tekshiriladi.

Audit log alohida himoyalangan account va storage’da saqlanishi mumkin.

Retention compliance talabiga mos bo‘ladi.

Encryption

Storage va database at-rest encryptionni qo‘llashi mumkin.

Key management service orqali provider-managed yoki customer-managed key ishlatiladi.

TLS transportni himoya qiladi.

Key policy noto‘g‘ri bo‘lsa administrator ham data’ga kira olmasligi mumkin.

Infrastructure as Code

Resource console orqali qo‘lda emas, template yoki code orqali yaratiladi.

Afzallik:

version control;
review;
reproducibility;
rollback;
drift detection;
environment consistency.

Secret template ichiga yozilmaydi.

Billing

Narx modeli service’ga bog‘liq:

vaqt;
request;
storage;
IOPS;
data transfer;
provisioned capacity;
reservation.

Kichik resurslar va loglar yig‘ilib katta xarajat berishi mumkin.

Budget, tag va cost allocation ishlatiladi.

Shared responsibility

Provider fizik data center, hardware va ayrim managed qatlamlarni himoya qiladi.

Mijoz:

identity;
data;
network rule;
application;
encryption choice;
patch darajasi;
configuration

uchun javobgar bo‘lishi mumkin.

Service modeliga qarab chegara o‘zgaradi.

Multi-account architecture

Production va developmentni bitta accountda aralashtirmaslik isolationni yaxshilaydi.

Central log, security va networking account bo‘lishi mumkin.

Cross-account role temporary access beradi.

Service control policy maksimal ruxsat chegarasini belgilaydi.

Tagging

Resource tag owner, environment, cost center va data classificationni ko‘rsatadi. Policy majburiy tag bo‘lmasa deploymentni rad etishi mumkin. Tag security boundary emas, lekin automation va billing uchun muhim metadata.

Quota va limit

Ko‘p service region yoki account bo‘yicha quota’ga ega. Katta scale yoki disaster recovery oldidan limit oshiriladi. Emergency paytida quota request kutish availability rejasini buzishi mumkin.

Bog‘liq tushunchalar

Amazon Web Services, AWS, Cloud computing, IAM, Availability Zone, Virtual network, Object storage, Compute instance, Serverless, Managed database, Infrastructure as Code