Introduction to the AWS Command Line Interface (CLI)

AWS provides various options to encrypt your data on S3.

There are 2 types of encryption:

• Client side: Client encrypts locally using tool/software of their choices
• Server Side encryption: Choose from available choices in AWS

In this video, our focus will be Server Side Encryption(SSE) since Client side is open to your preference/choices/requirement.

Server Side has 3  types of encryption as well:

• SSE-S3: One click encryption
• SSE-KMS: Using KMS
• SSE-C: Not available in console. Customer provides the keys

Encrypt a file using SSE S3:

$ aws s3 cp abcd.txt s3://kms-test11 --sse

Reference Article: https://aws.amazon.com/premiumsupport/knowledge-center/s3-multipart-upload-cli/

We will need 2 accounts for this lesson. Account A will provide access to Account B on one of A’s bucket.

On Account A — Create a new Bucket:

Add some items into the bucket.

Enter this policy text in one the bucket policy of the Account A. Change the Account ID and bucket Name:

{

“Version”: “2012-10-17”,

“Statement”: [

{

“Sid”: “Example permissions”,

“Effect”: “Allow”,

“Principal”: {

“AWS”: “arn:aws:iam::771452637355:root”

},

“Action”: “s3:*”,

“Resource”: [

“arn:aws:s3:::my-buicketsdsdsd”,

“arn:aws:s3:::my-buicketsdsdsd/*”

]

}

]

}

** if you remove the second line from the resource section, then you cannot copy the files inside the bucket and only list the bucket. With the second line you get access to every object inside the bucket.

From Account B’s access credentials use AWS CLI and enter this command:

$ aws s3 ls bucketname

You should be able to list the bucket and copy content from another account.

 Now try adding this to the bucket policy and get finer controls:

{

“Version”: “2012-10-17”,

“Statement”: [

{

“Sid”: “Example permissions”,

“Effect”: “Allow”,

“Principal”: {

“AWS”: “arn:aws:iam::771452637355:root”

},

“Action”: “s3:*”,

“Resource”: [

“arn:aws:s3:::my-buicketsdsdsd”,

“arn:aws:s3:::my-buicketsdsdsd/*”

]

},

{

“Sid”: “Deny permission”,

“Effect”: “Deny”,

“Principal”: {

“AWS”: “arn:aws:iam::771452637355:root”

},

“Action”: “s3:GetObject”,

“Resource”: “arn:aws:s3:::my-buicketsdsdsd/*”

}

]

}

CLI Reference: https://docs.aws.amazon.com/cli/latest/reference/s3/presign.html

Github repo link :https://github.com/ravsau/AWS-CLI-Commands

In this lesson, our aim is to create an Amazon Machine Image commonly referred to as an AMI  that we can use to launch instances in the future.

So far, we’ve been mostly using the Amazon Linux AMI. Now we can create our own AMI’s.

 AMI essentially saves the configurations of a server when the image is created so If I create an image of my web server, I can launch other web servers and have a web server running immediately after they launch.

This means that we don’t have to install a web server every time we provision a new web server. In today’s example, we will only install a web server, but you can create an AMI with any software installed, and use that to launch an EC2 instance.

Step 1: We will use the user data to launch an EC2 instance. We will be using a file that has a bootstrap script containing the commands to launch and start a web server. We will pass that file with the run-instances command.

Launch an EC2 Instance and save the instance ID into an environment variable

instance_id=$(aws ec2 run-instances --i --instance-type t2.micro --key-name MyKeyPair1 --user-data file://userdata.txt  --query 'Instances[*].[InstanceId]' --output text )

Step 2: Check the user data worked and the web server is running by typing the web server IP on a browser and verifying you see “Hello World”

Step 3: Create an image from that instance ID and save the image id to a variable image_id

image_id=$(aws ec2 create-image --instance-id $instance_id --name "My server" --description "An AMI for my webserver" --query ImageId --output text)

step 4: use that image to launch an instance

aws ec2 run-instances --image-id $image_id --instance-type t2.micro --key-name MyKeyPair1   --query 'Instances[*].[InstanceId]' --output text

i-03c84ceb5391371b6

Step 5: verify the web server is running by typing  the IP address on a browser

Thanks, and see you in the next lesson.

In this lesson I will briefly explain how Cloudformation works.

AWS CloudFormation gives developers and systems administrators an easy way to create and manage a collection of related AWS resources, provisioning and updating them in an orderly and predictable fashion

You can create your own templates to describe the AWS resources, and any associated dependencies or runtime parameters, required to run your application. 

A stack is created through a template and we can update a stack or delete a stack all at once.

CloudFormation is available at no additional charge, and you pay only for the AWS resources needed to run your applications.

Cloudformation is a very useful tool to have.

You can find all the commands and files in the link below:
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/mon-scripts.html?refid=ha_a131L000005Cti5QAC

By default, we cannot monitor Memory metrics on EC2 Instances. But, by using a custom metric we can. In this video, I walk through the process of setting up custom metrics.  This is one of the possible questions asked in the AWS assoiciate developer/architect/sysops exam as well.