Testing exploration – AWS

AWS Tutorial | Compute | EC2 | Launching and Terminating an Instance

Rahul — Sun, 12 Jul 2020 05:48:32 +0000

What is Amazon EC2?

Amazon Elastic Compute Cloud (Amazon EC2) provides scalable computing capacity in the Amazon Web Services (AWS) cloud.
Using Amazon EC2 eliminates your need to invest in hardware up front, so you can develop and deploy applications faster.
You can use Amazon EC2 to launch as many or as few virtual servers as you need, configure security and networking, and manage storage.
Amazon EC2 enables you to scale up or down to handle changes in requirements or spikes in popularity, reducing your need to forecast traffic.

Features of Amazon EC2

Amazon EC2 provides the following features:

Virtual computing environments, known as instances.
Various configurations of CPU, memory, storage, and networking capacity for your instances, known as instance types.
Preconfigured templates for instances, known as Amazon Machine Images (AMIs)
Multiple physical locations for your resources, such as instances and Amazon EBS volumes, known as Regions and Availability Zones.
Secure login information for instances using key pairs.
Persistent storage volumes for your data using Amazon Elastic Block Store (Amazon EBS), known as Amazon EBS volumes
A firewall that enables you to specify the protocols, ports, and source IP ranges that can reach your instances using security groups
Static IPv4 addresses for dynamic cloud computing, known as Elastic IP addresses
Metadata, known as tags, that you can create and assign to your Amazon EC2 resources

Lets get started with EC2 - Launch an EC2 instance

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. From the console dashboard, choose Launch Instance. Or go to Running Instances and then Launch Instances.

3. The Choose an Amazon Machine Image (AMI)page displays a list of basic configurations, called Amazon Machine Images (AMIs), that serve as templates for your instance. Select an HVM version of Amazon Linux 2. Notice that these AMIs are marked “Free tier eligible.”

4. On the Choose an Instance Type page, you can select the hardware configuration of your instance. Select the micro type, which is selected by default. Notice that this instance type is eligible for the free tier.

5. Choose Review and Launch to let the wizard complete the other configuration settings for you. or move step by step.

6. On the Review Instance Launch page, choose Launch.

7. On the Review Instance Launch page, under Security Groups, you’ll see that the wizard created and selected a security group for you. You can use this security group, or alternatively you can select the security group that you created when getting set up using the following steps:

Choose Edit security groups.
On the Configure Security Group page, ensure that Select an existing security group is selected.
Select your security group from the list of existing security groups, and then choose Review and Launch.

8. When prompted for a key pair, select Choose an existing key pair, then select the key pair that you created when getting set up.

Alternatively, you can create a new key pair. Select Create a new key pair, enter a name for the key pair, and then choose Download Key Pair. This is the only chance for you to save the private key file, so be sure to download it. Save the private key file in a safe place. You’ll need to provide the name of your key pair when you launch an instance and the corresponding private key each time you connect to the instance.

9. A confirmation page lets you know that your instance is launching. Choose View Instances to close the confirmation page and return to the console.

10. On the Instances screen, you can view the status of the launch. It takes a short time for an instance to launch. When you launch an instance, its initial state is pending. After the instance starts, its state changes to running and it receives a public DNS name. (If the Public DNS (IPv4) column is hidden, choose Show/Hide Columns (the gear-shaped icon) in the top right corner of the page and then select Public DNS (IPv4).)

11. It can take a few minutes for the instance to be ready so that you can connect to it. Check that your instance has passed its status checks; you can view this information in the Status Checks

How to Create a key pair before launching an EC2 Instance

Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
In the navigation pane, choose Key Pairs.
Choose Create key pair.
For Name, enter a descriptive name for the key pair. Amazon EC2 associates the public key with the name that you specify as the key name. A key name can include up to 255 ASCII characters. It can’t include leading or trailing spaces.
For File format, choose the format in which to save the private key. To save the private key in a format that can be used with OpenSSH, choose pem. To save the private key in a format that can be used with PuTTY, choose ppk.
Choose Create key pair.

How to Create a security group

Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
From the navigation bar, select a Region for the security group. Security groups are specific to a Region, so you should select the same Region in which you created your key pair.
In the navigation pane, choose Security Groups.
Choose Create security group.
In the Basic detailssection, do the following:
1. Enter a name for the new security group and a description. Use a name that is easy for you to remember, such as your user name, followed by _SG_, plus the Region name. For example, me_SG_uswest2.
2. In the VPClist, select your default VPC for the Region.
In the Inbound rulessection, create the following rules (choose Add rule for each new rule):
- Choose HTTPfrom the Type list, and make sure that Source is set to Anywhere (0.0.0/0).
- Choose HTTPSfrom the Type list, and make sure that Source is set to Anywhere (0.0.0/0).
- Choose SSHfrom the Type In the Source box, choose My IP to automatically populate the field with the public IPv4 address of your local computer. Alternatively, choose Custom and specify the public IPv4 address of your computer or network in CIDR notation. To specify an individual IP address in CIDR notation, add the routing suffix /32, for example, 203.0.113.25/32. If your company allocates addresses from a range, specify the entire range, such as 203.0.113.0/24.

How to Terminate an Instance

In the navigation pane, choose Instances. In the list of instances, select the instance.
Choose Actions, Instance State, Terminate.
Choose Yes, Terminatewhen prompted for confirmation.

Amazon EC2 shuts down and terminates your instance. After your instance is terminated, it remains visible on the console for a short while, and then the entry is deleted.

AWS Tutorial – 3 | Identity Access Management

Rahul — Fri, 22 May 2020 02:14:45 +0000

What is IAM?

AWS Identity and Access Management (IAM) enables you to manage access to AWS services and resources securely. Using IAM, you can create and manage AWS users and groups, and use permissions to allow and deny their access to AWS resources.

Manage users and their level of access to the AWS console.
Set users, permissions and roles.
Create multiple users, each with its own security credentials, controlled and billed to a single AWS account.
Create and manage policies to grant access to AWS services and resources.
Assign and control security credentials to each user.
Create roles for your AWS account
Create and manage IAM groups.

Features of IAM

Centralised control of your AWS account: You can control creation, rotation, and cancellation of each user’s security credentials. You can also control what data in the aws system users can access and how they can access.
Enhanced security: IAM enables security best practices by allowing you to grant unique security credentials to users and groups to specify which AWS service APIs and resources they can access.
Shared Access to your AWS account: Users can share the resources for the collaborative projects.
Granular permissions: It is used to set a permission that user can use a particular service but not other services.
Multifactor Authentication: An AWS provides multifactor authentication as we need to enter the username, password, and security check code to log in to the AWS Management Console.
Provide temporary access for users/devices and services where necessary: If you are using a mobile app and storing the data in AWS account, you can do this only when you are using temporary access.
Integrates with many different aws services: IAM is integrated with many different aws services.
Eventually Consistent: IAM service is eventually consistent as it achieves high availability by replicating the data across multiple servers within the Amazon’s data center around the world.
Free to use: AWS IAM is a feature of AWS account which is offered at no additional charge. You will be charged only when you access other AWS services by using IAM user.

What are IAM users?

An IAM user is an entity that you create in AWS.
The IAM user represents the person or service who uses the IAM user to interact with AWS.
A primary use for IAM users is to give people the ability to sign in to the AWS Management Console for interactive tasks and to make programmatic requests to AWS services using the API or CLI.
A user in AWS consists of a name, a password to sign into the AWS Management Console, and up to two access keys that can be used with the API or CLI.
When you create an IAM user, you grant it permissions by making it a member of a group that has appropriate permission policies attached or by directly attaching policies to the user.

What are IAM Groups?

An IAM group is a collection of IAM users.
Add users to or remove them from a group.
A user can belong to multiple groups.
Groups cannot belong to other groups.
You can use groups to specify permissions for a collection of users, which can make those permissions easier to manage for those users.
For example, you could have a group called Admins and give that group the types of permissions that administrators typically need.
Any user in that group automatically has the permissions that are assigned to the group.

What are IAM Roles?

An IAM role is very similar to a user, in that it is an identity with permission policies that determine what the identity can and cannot do in AWS. However, a role does not have any credentials (password or access keys) associated with it.
Instead of being uniquely associated with one person, a role can be taken by anyone who needs it. An IAM user can assume a role to temporarily take on different permissions for a specific task.

What problems do IAM roles solve?

How many IAM roles can be created?

Through IAM roles, you can delegate access with defined permissions to trusted entities without sharing long-term access keys.
You can use IAM roles to delegate access to IAM users managed within your account, to IAM users under a different AWS account, or to an AWS service such as EC2.

Users can create up to 1,000 IAM roles under one AWS account. For further roles, need to contact Amazon support team through the Limit increase form.

IAM Users, Groups and Role at a glance

IAM User

IAM Group

IAM Role

An IAM user has permanent long-term credentials and is used to directly interact with AWS services.

An IAM group is primarily a management convenience to manage the same set of permissions for a set of IAM users.

An IAM role is an AWS Identity and Access Management entity with permissions to make AWS service requests.
IAM roles cannot make direct requests to AWS services; they are meant to be assumed by authorized entities, such as IAM users, applications, or AWS services such as EC2.

Policies and Permissions

A policy is an object in AWS that, when associated with an identity or resource, defines their permissions.
You manage access in AWS by creating policies and attaching them to IAM identities (users, groups of users, or roles) or AWS resources. A
AWS evaluates these policies when an IAM principal (user or role) makes a request. Permissions in the policies determine whether the request is allowed or denied. Most policies are stored in AWS as JSON documents.

Six Policy Types

IAM policies define permissions for an action regardless of the method that you use to perform the operation.
For example, if a policy allows the GetUser action, then a user with that policy can get user information from the AWS Management Console, the AWS CLI, or the AWS API.
When you create an IAM user, you can choose to allow console or programmatic access.
If console access is allowed, the IAM user can sign in to the console using a user name and password.
Or if programmatic access is allowed, the user can use access keys to work with the CLI or API.

Identity-based policies

Resource-based policies

Permissions boundaries

Attach managed and inline policies to IAM identities (users, groups to which users belong, or roles). Identity-based policies grant permissions to an identity.

Attach inline policies to resources.
The most common examples of resource-based policies are Amazon S3 bucket policies and IAM role trust policies.
Resource-based policies grant permissions to the principal that is specified in the policy.
Principals can be in the same account as the resource or in other accounts.

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.

Organizations SCPs

Access control lists (ACLs)

Session policies

Use an AWS Organizations service control policy (SCP) to define the maximum permissions for account members of an organization or organizational unit (OU).
SCPs limit permissions that identity-based policies or resource-based policies grant to entities (users or roles) within the account, but do not grant permissions.

Use ACLs to control which principals in other accounts can access the resource to which the ACL is attached.
ACLs are similar to resource-based policies, although they are the only policy type that does not use the JSON policy document structure.
ACLs are cross-account permissions policies that grant permissions to the specified principal.
ACLs cannot grant permissions to entities within the same account.

Pass advanced session policies when you use the AWS CLI or AWS API to assume a role or a federated user.
Session policies limit the permissions that the role or user’s identity-based policies grant to the session.
Session policies limit permissions for a created session, but do not grant permissions.

More on Policy and Permission

What is a policy summary?

How do permissions work?

How do I assign permissions using a policy?

What does a policy look like?

If you are using the IAM console and choose a policy, you will see a policy summary.
A policy summary lists the access level, resources, and conditions for each service defined in a policy (see the following screenshot for an example).
The access level (View, Read, Write, or Permissions management) is defined by actions granted for each service in the policy.
You can view the policy in JSON by choosing the JSON button.

Access control policies are attached to users, groups, and roles to assign permissions to AWS resources.
By default, IAM users, groups, and roles have no permissions; users with sufficient permissions must use a policy to grant the desired permissions.

To set permissions, you can create and attach policies using the AWS Management Console, the IAM API, or the AWS CLI.
Users who have been granted the necessary permissions can create policies and assign them to IAM users, groups, and roles.

The following policy grants access to add, update, and delete objects from a specific folder, example_folder, in a specific bucket, example_bucket.

{
“Version”:”2012-10-17″,
“Statement”:[
   {
     “Effect”:”Allow”,
     “Action”:[
   “s3:PutObject”,
   “s3:GetObject”,
   “s3:GetObjectVersion”,
   “s3:DeleteObject”,
   “s3:DeleteObjectVersion”
     ],
“Resource”:”arn:aws:s3:::example_bucket/example_folder/*”
}
]
}

Next--> AWS Databases

AWS Tutorial – 2 |Getting Started with AWS | Free AWS Signup

Rahul — Sat, 16 May 2020 12:15:33 +0000

1. To create an AWS account, open this link https://aws.amazon.com

Note: When you create an AWS account you have 12 months of Free Tier Access. You can read more about this offer at https:aws.amazon.com/free As an example in this account you would have 5Gb of Standard Storage, 750 hours of EC2 and RDS, I million calls of AWS Lambda and many more for 12 months.

2. Select the Type of Account you want create, either Professional or Personal. In this example I’m creating a Personal account.

3. Use a valid credit card Fill in the required Payment Information fields and then click on ‘Secure Submit’

4. Setting up the MFA:

And finally you land up on the Console page.

Next --> AWS Identity Access Management(IAM)

AWS Tutorial – 1 | Cloud Fundamentals | 30,000-Foot view of AWS

Rahul — Sun, 26 Apr 2020 10:49:29 +0000

AWS (Amazon Web Service) is a global market leader in Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) industry, offering a wide range of remote cloud services. In this article,

It’s a cloud computing platform that enables users to access on demand computing services like database storage, virtual cloud server. Amazon’s cloud web hosting platform offers flexible, reliable, scalable, easy-to-use, and cost-effective solutions. This tutorial covers various important topics illustrating how AWS works and how it is beneficial to run your website on Amazon Web Services.

So first let's understand what is Cloud Computing?

If you’re unsure about the Cloud Computing, you are probably among the people already using cloud services, like online banking and social networks, but don’t realize it.

The “cloud” is a set of different types of hardware and software that work collectively to deliver many aspects of computing to the end-user as an online service.

Cloud Computing is the use of hardware and software to deliver a service, usually over the Internet. With cloud computing, users can access files and use applications from any device that can access the Internet.

Cloud computing is also a term referred to storing and accessing data over the internet. In cloud computing, you can access data from a remote server.

One of the most popular example of a Cloud Computing provider is Gmail. Gmail users can access files and applications hosted by Google via the internet from any device.

What are Public, Private and Hybrid Clouds?

Public cloud

Private cloud

Hybrid cloud

· A Public Cloud is based on the standard cloud computing framework which consists of files, applications, storage and services available to the public via the internet. Gmail is an example of a Public Cloud.

· Public clouds are owned and operated by a third-party cloud service providers, which deliver their computing resources, like servers and storage, over the Internet.

· With a public cloud, all hardware, software, and other supporting infrastructure is owned and managed by the cloud provider. You access these services and manage your account using a web browser.

A Private Cloud is comprised of files, applications, storage and services that are implemented and protected within a corporate firewall, under the control of a corporate IT department.
A private cloud refers to cloud computing resources used exclusively by a single business or organization.
A private cloud can be physically located on the company’s on-site data center.
A private cloud is one in which the services and infrastructure are maintained on a private network.
An example of a Private Cloud would be a company that uses Microsoft Exchange because Microsoft Exchange can only be accessed by an authorised user through a secure VPN connection.

Hybrid clouds combine public and private clouds, bound together by technology that allows data and applications to be shared between them.
By allowing data and applications to move between private and public clouds, a hybrid cloud gives your business greater flexibility, more deployment options, and helps optimize your existing infrastructure, security, and compliance.

Three models of cloud service

Infrastructure as a service (IaaS)

Platform as a Service(PaaS)

Software as a service (SaaS)

Infrastructure-as-a-service solutions generally get to the level of ‘bare metal’ — the physical servers, networking components, and device storage necessary to make platforms (and, hence, services) functional.
IaaS is popular with corporate clients, with tradeoffs between speed, cost, and privacy that each vendor balances in different ways.
The most basic category of cloud computing services. With IaaS, you rent IT infrastructure—servers and virtual machines (VMs), storage, networks, operating systems—from a cloud provider on a pay-as-you-go basis

Vendors that offer platform-as-a-service portfolios generally face corporate clients.
PaaS products include virtual servers, operating environments, database environments, and any other middle-ware component that sits between the hardware and the consumer-facing application.
PaaS is designed to make it easier for developers to quickly create web or mobile apps, without worrying about setting up or managing the underlying infrastructure of servers, storage, network, and databases needed for development.

Cloud services using a software-as-a-service model, or SaaS, provide fully functional programs to end users even though the programs may not be resident on their local computers.
Software as a service is a method for delivering software applications over the Internet, on demand and typically on a subscription basis.
With SaaS, cloud providers host and manage the software application and underlying infrastructure, and handle any maintenance, like software upgrades and security patching.
Email providers like Gmail and Outlook.com are SaaS applications, as well as just about any computer program that runs inside a browser.

Now let's see what's AWS?

AWS (Amazon Web Service) is a comprehensive cloud computing platform offered by Amazon that offers flexible, reliable, scalable, easy-to-use and cost-effective cloud computing solutions and enables user to access on-demand computing services like database storage, virtual cloud server, etc.
It works on “pay-as-you-go” model that means – you don’t need to pay upfront for services it offer. You pay for only how much service (mostly bandwidth) you consumed at the end of billing cycle.
The platform is developed with a combination of infrastructure as a service (IaaS), platform as a service (PaaS) and packaged software as a service (SaaS) offerings.

AWS Components

AWS Global Infrastructure

AWS Regions

Availability zone

Edge Locations

AWS Region, is kind of framework, in which we have all the available providers.

An AWS Region is a geographical location with a collection of availability zones mapped to physical data centres in that region. Every region is physically isolated from and independent of every other region in terms of location, power, water supply.

Example:For EC2 instance, Storage, DB – we need a region in which we can build our services). We have 17 Regions at the time of preparing this tutorial.

An availability zone is a facility that can be somewhere in a country or in a city, it’s a logical data center in a region available for use by AWS customers.

Each zone in a region has redundant and separate power, networking and connectivity to reduce the likelihood of two zones failing simultaneously.

An availability zone can be a several data centres, but if they are close together, they are counted as 1 availability zone.

Edge Location are the locations where end user services are provided.

Edge locations are the endpoints for AWS used for caching content.

Edge locations are more than regions. Currently, there are over 150 edge locations.