AWS practitioner & SysOps essentials Cheat Sheet by datamansam

Instance / Ephemeral Storage

Attached to the physical host running an instance

preferable to instance storage in nearly all usage scenarios

Once you have created a snapshot, you can then create additional EBS volumes that will be identical copies of the source snapshot. You could, for example, create a snapshot containing your database backups

EBS +ve:

EBS volumes is clearly preferable except in a few cases, such as when you need fast temporary storage for data that can be safely dis‐ carded.

Different combin­ations of CPU, memory, network bandwidth and even custom hard‐ ware differ­entiate AWS instance types.

Compute Optimized Instances

Good for high-p­erf­ormance applic­ation servers, gaming servers, and web applic­ations.

Accele­rated Computing Instances

Boost data processing for graphics applic­ations and streaming.

- Large file systems

- Online transa­ction systems

On-Demand

Short-­term, irregular workloads that cannot be interr­upted

Reserved Instances

Billing discount applied to the use of On-Demand Instances in your account for a 1-year or 3-year term

Dedicated Hosts

physical servers with Amazon EC2 instance capacity that is fully dedicated to your use.

On-demand:

Allocated by the hour and requiring no upfront commit­tment

Spot:

Requires no upfront committ‐ ment, and their pricing fluctuates according to the supply and demand of compute capacity.

# Describe all of your own images in the US East region

aws ec2 descri­be-­images --owners self --region us-east-1

# Basic invocation to create instances

aws ec2 run-in­sta­nce­s--­ima­ge-id ami-6d­060707

1. Launch

a) Select a template with basic configs

2. Connect

Users by loging in and accessing the computer desktop

a) Install software

c) Copy and organise files

launching an instance with the default networking config­uration will give you an instance with a public IP address

To more sophis­itcated cofig

Amazon offers more-a­dvanced solu‐ tions that can, for example, give you a secure VPN connection from your datacenter to a Virtual Private Cloud (VPC) within EC2.

You can create sub‐ nets and gateways, configure routing, select IP address ranges and define its security perimeter

Routing requires:

Payload or contents

IP addresses:

IPv4 notation -

Usually binary IP are c

EC2:

Allows customers to rent computing resources by the hour in the form of virtual machines (known as instances) that run a wide range of operating systems.

Standard

Burstable perfor­mance

A stack

A collection of AWS resources that you can manage as a single unit. I

Creating Stacks:

aws cloudf­orm­ation create­-stack --temp­lat­e-body file:/­/ex­amp­le-­sta­ck.json \ --stac­k-name exampl­e-stack

$ aws cloudf­orm­ation descri­be-­sta­ck-­res­ources --stac­k-name exampl­e-stack \ --output text

Update the running stack with aws cloudf­orm­ation update­-stack

Ensuring local copy of a stack matches the running version:

use diff to:

compare the local and remote versions

The ability to run systems to deliver business value at the lowest price point

Monitor usage and cost

Establish policies and procedures to monitor and approp­riately allocate

Evaluate cost when you select services:

Applic­ation level:

Amazon RDS and Amazon DynamoDB

Meet costs targets when selecting resources

Think type, Size and Number

Cost Explorer:

View and track your usage in detail

Auto Scaling:

Match supply and demand

Identity and Access Management (IAM) is the name given to the suite of features that let you manage who and what can access AWS APIs using your account.

Amazon Resource Names / ARM:

A globally unique identifier that references AWS objects

A permis­sion:

a combin­ation of two items: an action and one or more resources.

Create a set of access creden­tials that are authorized to perform only the specific actions required by the script:

One can use the comman­d-line tools to create a user and attach a new policy to it, using the iam-us­erc­reate and iam￾ userad­dpolicy commands

The -k option says that we want to create a new access key and secret for this use. These get printed to stdout. The first item is the access key ID, and the second is the secret access key. Store these somewhere safe, as we will need them later.

The -e and -r arguments state that we are creating an Allow policy that applies to all resources (the asterisk after the -r option). Finally, we specify a list of actions that will be allowed, each preceded by an -a flag. You can specify as many permis­sions as you need.

The Resource attribute of an IAM policy lets you control exactly which resources an action can be performed on. In the previous example, the policy granted the user per‐ missions to delete any EBS snapshot owned by this account. What if you want a more granular policy that applies only to a subset of resources?

An IAM policy that allows users to perform any action on S3 buckets, with the exception of the one containing your backups. We do this by creating a policy containing two statem­ents. The first grants the user all S3-related permis­sions, allowing them to be performed on any resource. The second statement denies all S3-related permis­sions, but only on the protected buckets

Next, create the policy using the comman­d-line tools or Management Console. If using the Management Console, you can create the policy as follows: 1. Navigate to IAM Users. 2. Select an existing User or Group. 3. Click Attach User/Group Policy. 4. Select Custom Policy. 5. Paste the text into the Policy Document box

Conditions can be used to create dynamic IAM policies that behave differ­ently, depending on one or more factors. The attributes of the request (such as the ARN of the requesting user or the source IP address) can be used in Boolean expres­sions to control whether a request should be allowed or denied.

Limita­tions of IAM policies

Whenever you refer to EC2 permis­sions in a policy, the resource will be *, which means it will apply to every instance owned by your AWS account.

The user can be assigned one or more IAM policies, which specify the actions the user is allowed to perform.

IAM is a global AWS service, meaning it is not tied to any particular region. An IAM user will be able to access APIs in any region