Cloud Fundamentals
— AWS Deep Dive Notes

# 1. Go to: https://aws.amazon.com/free
# 2. Click "Create a Free Account"
# 3. Enter email + password → set account name
# 4. Enter contact info (Personal account is fine)
# 5. Enter credit/debit card (required but not charged in free tier)
# 6. Verify identity via SMS
# 7. Choose Support Plan → Basic (Free)
# 8. Sign in to AWS Console

# IMPORTANT — Do these immediately after account creation:
# - Enable MFA on root account
# - Set a billing alarm (Module 14)
# - Never use the root account for daily work
# - Create an IAM user for everything (Module 03)

# ── Console: Create IAM User ──
# IAM → Users → Create User
# → Username: kamran-admin
# → Enable: AWS Management Console access
# → Attach policy: AdministratorAccess (for learning)
# → Download credentials CSV

# ── Enable MFA on root (do this first!) ──
# Top right → Security credentials → MFA → Assign MFA device
# Use Google Authenticator or Authy on your phone

# ── Create Access Keys for CLI ──
# IAM → Users → Your User → Security credentials → Access keys

# ── IAM Policy example (read-only S3) ──
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:ListBucket"],
    "Resource": "*"
  }]
}

# EC2 → Launch Instance
# 1. Name: my-web-server
# 2. AMI: Amazon Linux 2023 (free tier eligible)
# 3. Instance type: t2.micro (free tier)
# 4. Key pair: Create new → download .pem file
# 5. Security Group: Allow SSH (22) from your IP
# 6. Storage: 8 GB gp3 (default)
# 7. Launch!

# Connect via SSH (Linux/Mac)
chmod 400 my-key.pem
ssh -i my-key.pem ec2-user@YOUR-PUBLIC-IP

# Connect via SSH (Windows — use PuTTY or Windows Terminal)
# Convert .pem to .ppk using PuTTYgen first

# Once connected — it's just Linux!
sudo dnf update -y
sudo dnf install nginx -y
sudo systemctl enable --now nginx

# Standard 3-tier VPC layout:

VPC: 10.0.0.0/16  (65,536 addresses)
├── Public Subnet A:  10.0.1.0/24  (AZ-1a)  ← Load Balancer, Bastion
├── Public Subnet B:  10.0.2.0/24  (AZ-1b)  ← Load Balancer (HA)
├── Private Subnet A: 10.0.3.0/24  (AZ-1a)  ← EC2 App Servers
├── Private Subnet B: 10.0.4.0/24  (AZ-1b)  ← EC2 App Servers (HA)
├── DB Subnet A:      10.0.5.0/24  (AZ-1a)  ← RDS Database
└── DB Subnet B:      10.0.6.0/24  (AZ-1b)  ← RDS Standby

# Traffic flow:
# Internet → IGW → Public Subnet → Load Balancer
#                                 → Private Subnet → EC2
#                                                   → DB Subnet → RDS
# Private EC2 → NAT Gateway → Internet (updates only)

# Console: EC2 → Elastic IPs → Allocate Elastic IP
# → Associate → choose your EC2 instance → Associate

# AWS CLI equivalent:
# Allocate an Elastic IP
aws ec2 allocate-address --domain vpc

# Associate it with an instance
aws ec2 associate-address \
  --instance-id i-0abc123def456789 \
  --allocation-id eipalloc-0abc123def456789

# IMPORTANT: Elastic IP is FREE when attached to a running instance
# You get charged if it's allocated but NOT attached — release unused EIPs!

# Console: Route 53 → Hosted Zones → Create Hosted Zone
# → Domain name: devriston.com.pk → Type: Public

# Create an A Record:
# → Record name: @ (or www)
# → Record type: A
# → Value: YOUR-ELASTIC-IP
# → TTL: 300

# Update your domain registrar's nameservers
# Route 53 gives you 4 NS records — paste these into your registrar

# Test DNS propagation:
dig devriston.com.pk
nslookup devriston.com.pk 8.8.8.8

# Step 1: Create Launch Template (what servers to launch)
# EC2 → Launch Templates → Create
# → AMI, instance type, key pair, security group, user data

# Step 2: Create Target Group (group of servers LB sends traffic to)
# EC2 → Target Groups → Create
# → Type: Instances | Protocol: HTTP | Port: 80
# → Health check path: /  (or /health)

# Step 3: Create Application Load Balancer
# EC2 → Load Balancers → Create → Application Load Balancer
# → Internet-facing | Select public subnets in 2+ AZs
# → Listener: HTTP:80 → Forward to target group

# Step 4: Create Auto Scaling Group
# EC2 → Auto Scaling Groups → Create
# → Use your launch template
# → Select private subnets
# → Attach to your load balancer target group
# → Min: 2 | Desired: 2 | Max: 6
# → Scale out when CPU > 70%
# → Scale in when CPU < 30%

# Create a bucket (name must be globally unique)
aws s3 mb s3://devriston-backups-2026

# Upload a file
aws s3 cp backup.tar.gz s3://devriston-backups-2026/

# Upload entire folder
aws s3 sync /var/backups/ s3://devriston-backups-2026/daily/

# Download from S3
aws s3 cp s3://devriston-backups-2026/backup.tar.gz .

# List bucket contents
aws s3 ls s3://devriston-backups-2026/

# Delete a file
aws s3 rm s3://devriston-backups-2026/old-backup.tar.gz

# Enable versioning (keeps all versions of every file)
aws s3api put-bucket-versioning \
  --bucket devriston-backups-2026 \
  --versioning-configuration Status=Enabled

# Host a static website on S3
aws s3 website s3://my-site/ \
  --index-document index.html \
  --error-document 404.html

# Console: RDS → Create Database
# → Standard Create
# → Engine: MySQL 8.0
# → Template: Free tier (for learning)
# → DB instance ID: myapp-db
# → Master username: admin
# → Master password: (strong password)
# → Instance: db.t3.micro (free tier)
# → VPC: your custom VPC
# → Subnet group: private subnets
# → Public access: NO (always)
# → VPC security group: allow port 3306 from app servers only

# Connect from EC2 inside the same VPC:
mysql -h myapp-db.xxxxxxxx.us-east-1.rds.amazonaws.com \
      -u admin -p

# Create a manual snapshot:
aws rds create-db-snapshot \
  --db-instance-identifier myapp-db \
  --db-snapshot-identifier myapp-db-snap-20260627

# Create an EBS Snapshot
aws ec2 create-snapshot \
  --volume-id vol-0abc123def456789 \
  --description "Web server disk backup 2026-06-27"

# Create an AMI from a running EC2
aws ec2 create-image \
  --instance-id i-0abc123def456789 \
  --name "web-server-v1-2026-06-27" \
  --description "Web server before deployment"

# Launch a new EC2 from your AMI
aws ec2 run-instances \
  --image-id ami-0your-ami-id \
  --instance-type t2.micro \
  --key-name my-key \
  --security-group-ids sg-0abc123

# List your snapshots
aws ec2 describe-snapshots --owner-ids self

# List your AMIs
aws ec2 describe-images --owners self

# Create a CPU alarm — email when CPU > 80% for 5 minutes

# Step 1: Create SNS topic (for email notifications)
aws sns create-topic --name DevOps-Alerts

# Step 2: Subscribe your email
aws sns subscribe \
  --topic-arn arn:aws:sns:us-east-1:123456789:DevOps-Alerts \
  --protocol email \
  --notification-endpoint kamran@devriston.com.pk

# Step 3: Create the CloudWatch alarm
aws cloudwatch put-metric-alarm \
  --alarm-name "High-CPU-web-server" \
  --metric-name CPUUtilization \
  --namespace AWS/EC2 \
  --dimensions Name=InstanceId,Value=i-0abc123def456789 \
  --period 300 \
  --evaluation-periods 1 \
  --threshold 80 \
  --comparison-operator GreaterThanThreshold \
  --statistic Average \
  --alarm-actions arn:aws:sns:us-east-1:123456789:DevOps-Alerts

# Install CloudWatch Agent on EC2 (for memory/disk metrics)
sudo dnf install amazon-cloudwatch-agent -y
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-config-wizard

# Install on Linux
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

# Install on Windows
# Download: https://awscli.amazonaws.com/AWSCLIV2.msi

# Configure with your IAM access keys
aws configure
# AWS Access Key ID: AKIAIOSFODNN7EXAMPLE
# AWS Secret Access Key: wJalrXUtnFEMI/K7MDENG
# Default region: ap-south-1
# Default output format: json

# Verify it works
aws sts get-caller-identity

# Common CLI commands
aws ec2 describe-instances                          # list all EC2
aws ec2 start-instances --instance-ids i-0abc123    # start EC2
aws ec2 stop-instances --instance-ids i-0abc123     # stop EC2
aws s3 ls                                           # list all buckets
aws iam list-users                                  # list IAM users
aws rds describe-db-instances                       # list databases

# Use profiles for multiple accounts
aws configure --profile production
aws s3 ls --profile production

# Example Lambda: Stop EC2 instances every night at 11pm

import boto3

def lambda_handler(event, context):
    ec2 = boto3.client('ec2', region_name='ap-south-1')

    # Find all running instances tagged Environment=dev
    response = ec2.describe_instances(
        Filters=[
            {'Name': 'tag:Environment', 'Values': ['dev']},
            {'Name': 'instance-state-name', 'Values': ['running']}
        ]
    )

    instance_ids = []
    for reservation in response['Reservations']:
        for instance in reservation['Instances']:
            instance_ids.append(instance['InstanceId'])

    if instance_ids:
        ec2.stop_instances(InstanceIds=instance_ids)
        print(f"Stopped: {instance_ids}")

    return {'stopped': instance_ids}

# Deploy this function:
# Lambda → Create Function → Author from scratch
# Runtime: Python 3.12
# Execution role: IAM role with EC2 stop permissions
# Add trigger: EventBridge (cron) → cron(0 18 * * ? *) = 11pm PKT

# Console: Billing → Budgets → Create Budget
# → Budget type: Cost budget
# → Amount: $10 (alert before you're surprised)
# → Alert threshold: 80% of budget ($8)
# → Email: your email

# CLI: Create billing alarm via CloudWatch
aws cloudwatch put-metric-alarm \
  --alarm-name "Billing-Alert-10USD" \
  --metric-name EstimatedCharges \
  --namespace AWS/Billing \
  --dimensions Name=Currency,Value=USD \
  --period 86400 \
  --evaluation-periods 1 \
  --threshold 10 \
  --comparison-operator GreaterThanThreshold \
  --statistic Maximum \
  --alarm-actions arn:aws:sns:us-east-1:123456:DevOps-Alerts \
  --region us-east-1

# Cost Explorer — check your spending
# Billing → Cost Explorer → View by service
# Filter by last 7 days to catch unexpected charges fast

# Clean up after labs (in order):
# 1. Terminate EC2 instances
# 2. Delete Load Balancers
# 3. Delete NAT Gateways
# 4. Release Elastic IPs
# 5. Delete RDS instances (take snapshot first)
# 6. Delete VPC