Course: Amazon Web Services (AWS)

1. VPC (Virtual Private Cloud)

1.1 VPC Fundamentals

A VPC is a logically isolated network in AWS.

Core components:

• CIDR block: IP address range (e.g., 10.0.0.0/16)
• Subnets: Public (with IGW route) and Private (with NAT route)
• Route tables: Control traffic flow
• Internet Gateway (IGW): Public internet access
• NAT Gateway / NAT Instance: Outbound internet for private subnets
• VPC Peering: Connect VPCs directly
• Transit Gateway: Hub-and-spoke VPC connectivity
• VPC Endpoints: Private access to AWS services (S3, DynamoDB)

1.2 Multi-AZ VPC Design

┌──────────────Region───────────────┐
│  ┌────AZ-a────┐  ┌────AZ-b────┐  │
│  │ Public a   │  │ Public b   │  │
│  │ Private a  │  │ Private b  │  │
│  │ Database a │  │ Database b │  │
│  └────────────┘  └────────────┘  │
└──────────────────────────────────┘

1.3 VPC Peering and VPN

# Create VPC peering
aws ec2 create-vpc-peering-connection \
  --vpc-id vpc-xxxxx \
  --peer-vpc-id vpc-yyyyy \
  --peer-region eu-west-2

# Enable DNS resolution
aws ec2 modify-vpc-peering-connection-options \
  --vpc-peering-connection-id pcx-xxxxx \
  --requester-peering-connection-options AllowDnsResolutionFromRemoteVpc=true

2. EC2 (Elastic Compute Cloud)

2.1 Instance Types

2.2 User Data and AMIs

#!/bin/bash
# user-data.sh
apt-get update -y
apt-get install -y nginx
systemctl enable nginx
systemctl start nginx
echo "Hello from $(hostname -f)" > /var/www/html/index.html

2.3 Auto Scaling Group (ASG)

# launch-template.yaml
LaunchTemplate:
  LaunchTemplateName: web-lt
  LaunchTemplateData:
    ImageId: ami-0c55b159cbfafe1f0
    InstanceType: t3.medium
    SecurityGroupIds:
      - sg-xxxxx
    UserData: base64-encoded-user-data
    IamInstanceProfile:
      Arn: arn:aws:iam::account:instance-profile/web-role
  AutoScalingGroup:
    ASGName: web-asg
    MinSize: 2
    MaxSize: 10
    DesiredCapacity: 3
    VPCZoneIdentifier:
      - subnet-xxxxx
      - subnet-yyyyy
    TargetGroupARNs:
      - arn:aws:elasticloadbalancing:region:account:targetgroup/web-tg/xxx

3. EKS (Elastic Kubernetes Service)

3.1 EKS Components

• Control Plane: Managed by AWS (apiserver, etcd)
• Node Groups: Self-managed or managed EC2 instances
• Fargate Profiles: Serverless pods
• EKS Managed Node Groups: AWS manages ASG and updates
• Add-ons: CoreDNS, kube-proxy, VPC CNI, AWS Load Balancer Controller

3.2 Cluster Creation

# Create EKS cluster
eksctl create cluster \
  --name production \
  --region eu-west-1 \
  --version 1.28 \
  --nodegroup-name workers \
  --node-type t3.medium \
  --nodes 3 \
  --nodes-min 3 \
  --nodes-max 10 \
  --managed

# Create Fargate profile
eksctl create fargateprofile \
  --cluster production \
  --name fargate-ops \
  --namespace fargate

3.3 EKS Security

# aws-auth ConfigMap for IAM roles
apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-auth
  namespace: kube-system
data:
  mapRoles: |
    - rolearn: arn:aws:iam::account:role/EKSAdminRole
      username: admin
      groups:
        - system:masters
    - rolearn: arn:aws:iam::account:role/EKSNodeRole
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes

4. RDS (Relational Database Service)

4.1 Aurora

Amazon Aurora is a MySQL/PostgreSQL-compatible database with 5x performance:

• Aurora Serverless v2: Auto-scaling capacity
• Aurora Global Database: Cross-region replication
• Multi-AZ: Synchronous standby replica
• Read Replicas: Up to 15 low-latency reads
• Backtrack: Point-in-time restore without snapshot

# Create Aurora cluster
aws rds create-db-cluster \
  --engine aurora-postgresql \
  --db-cluster-identifier prod-cluster \
  --master-username admin \
  --master-user-password secret \
  --vpc-security-group-ids sg-xxxxx \
  --db-subnet-group-name my-subnet-group

5. Lambda

5.1 Function Configuration

import json
import boto3

def lambda_handler(event, context):
    # Process S3 event
    for record in event['Records']:
        bucket = record['s3']['bucket']['name']
        key = record['s3']['object']['key']
        print(f"Processing s3://{bucket}/{key}")

    return {
        'statusCode': 200,
        'body': json.dumps('Processed successfully')
    }

5.2 Lambda Layers

Lambda layers package dependencies separately:

# Create layer
mkdir python
pip install requests -t python/
zip -r layer.zip python/
aws lambda publish-layer-version \
  --layer-name requests-layer \
  --zip-file fileb://layer.zip \
  --compatible-runtimes python3.9 python3.10

6. S3 (Simple Storage Service)

6.1 Bucket Configuration

# S3 bucket with versioning and lifecycle
Bucket:
  Name: myapp-data
  Versioning:
    Status: Enabled
  LifecycleRules:
    - Id: transition-to-ia
      Status: Enabled
      Transitions:
        - Days: 30
          StorageClass: STANDARD_IA
        - Days: 90
          StorageClass: GLACIER
      Expiration:
        Days: 365
  Encryption:
    SSEAlgorithm: AES256

6.2 S3 Features

• Versioning: Protect against accidental deletion
• Lifecycle policies: Automate storage tiering
• Cross-region replication: Copy data across regions
• Presigned URLs: Time-limited access
• Static website hosting: Host SPAs directly
• Object Lock: Write-once-read-many (WORM)

7. IAM (Identity and Access Management)

7.1 Policies

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::myapp-data",
        "arn:aws:s3:::myapp-data/*"
      ],
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": "s3:DeleteBucket",
      "Resource": "*"
    }
  ]
}

7.2 Trust Policies

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::account:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        }
      }
    }
  ]
}

7.3 Permission Boundaries

Permission boundaries delegate admin rights:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "*",
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": [
        "iam:CreateUser",
        "iam:DeleteUser",
        "iam:AttachRolePolicy"
      ],
      "Resource": "*"
    }
  ]
}

8. CloudWatch

8.1 Logs and Metrics

# Push custom metric
aws cloudwatch put-metric-data \
  --namespace "MyApp" \
  --metric-name "ActiveUsers" \
  --value 42 \
  --dimensions Environment=Production

# Create log subscription (Lambda → Elasticsearch)
aws logs put-subscription-filter \
  --log-group-name /aws/lambda/myfunction \
  --filter-name Destination \
  --filter-pattern "ERROR" \
  --destination-arn arn:aws:lambda:region:account:function:log-processor

8.2 Alarms

# CloudWatch alarm for high CPU
CPUAlarm:
  Type: AWS::CloudWatch::Alarm
  Properties:
    AlarmName: high-cpu
    Namespace: AWS/EC2
    MetricName: CPUUtilization
    Statistic: Average
    Period: 300
    EvaluationPeriods: 2
    Threshold: 80
    ComparisonOperator: GreaterThanThreshold
    AlarmActions:
      - arn:aws:sns:region:account:ops-team

9. Route53

9.1 DNS Records and Routing

# Create hosted zone
aws route53 create-hosted-zone \
  --name example.com \
  --caller-reference 2024-01-01

# Routing policies
aws route53 change-resource-record-sets \
  --hosted-zone-id ZONEID \
  --change-batch '{
    "Changes": [{
      "Action": "UPSERT",
      "ResourceRecordSet": {
        "Name": "app.example.com",
        "Type": "A",
        "SetIdentifier": "primary",
        "Failover": "PRIMARY",
        "AliasTarget": {
          "HostedZoneId": "ALBZONEID",
          "DNSName": "my-alb-region.elb.amazonaws.com"
        },
        "EvaluateTargetHealth": true
      }
    }]
  }'

Routing Policies:

Summary

AWS provides the broadest cloud service portfolio. Key services for DevOps: VPC for networking, EC2/EKS for compute, S3 for storage, RDS for databases, IAM for security, CloudWatch for monitoring, and Route53 for DNS. Understanding these services deeply enables designing resilient, secure, and cost-effective infrastructure.