Part 1. Learn about AWS at once - IAM, EC2, EC2 Instance Storage

· Tech· Cloud
CloudCertification

There are various regions in AWS, and you can specify a location with many services or users. Refer to region table

IAM & AWS CLI

Users, Groups, Policies, Roles, Security, AWS CLI, AWS SDK, Access Key, Audit

IAM

This is a service that creates users and assigns groups. It is used to assign roles by grouping permissions to use an AWS account. This method allows you to automatically assign roles by setting roles as groups and assigning users to the groups. Of course, policies can be granted inline without a group.

  • IAM groups contain users, but do not contain groups. If you log in with Sign in IAM user, you will see IAM User information in the upper right corner.

IAM Policies Structure

In the policy structure, you can check what roles it has in IAM and whether they are valid, etc. Statement does not include Version but includes Effect, Action, Resource, and Principle.

{
“Version”: “2024–10–12”,
“Statement”: {
“Effect”: “Allow”,
“Action”: [
“iam:RemoveUserFromGroup”,
],
“Resource”: [
“arn:aws:iam::609103258633:group/Developers”,
“arn:aws:iam::609103258633:group/Operators”
]
}
}
Dynamic IAM Policy

To change IAM dynamically according to policy, you can set it to ${aws:username}.

{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["s3:GetObject"],
"Resource": ["arn:aws:s3::amzn-s3-demo-bucket/${aws:username}/*"]
}]
}
PassRole

Grants the user permission to run all EC2 instances and to assign specific IAM roles (Get-pics) to EC2 instances (iam:PassRole).

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::account-id:role/Get-pics"
}
]
}

IAM Roles

You can also create roles. You can select roles for services, accounts, etc., and create roles by setting permissions. For example, you can create a 'NewRole' that specifies permissions, such as IAMReadOnlyAccess in a service or EC2.

  • You can take a look at current permission settings and IAM management through Access Provider.

Provides policy for IAM access security

  • IAM Password Policy
  • How to set a password
  • Change policy after 90 days, etc.
  • MFA, Muti Factor Authentication
  • Double locking using a second means other than password login
  • Decide on the MFA method and install it on the device
  • IAM Credential Report

IAM Best Practices

  • Avoid using the root account as much as possible.
  • If you have a colleague to work with, create a User instead of account information to give them access.
  • Use a strong password policy.
  • Utilize [Policy for IAM access security] (# Provides policy for IAM access security).
  • Access keys are not shared with IAM users.

###AWS CLI AWS login methods include using password+MFA, CLI, and SDK.

AWS CLI

When using AWS CLI, an Access Key is automatically issued and used. Be careful to never share this key. It can be used in the same way as aws iam list-users.

AWS CloudShell

There is also an easy way to use AWS CloudShell. It has the feature of being available in some regions.

AWS Shared Responsibility Model

Regarding the responsibility model, AWS takes responsibility for security related to its infrastructure, and individual users take responsibility for security for the services they use. For example, this means managing keys, changing passwords, managing IAM users, etc.

Security Token Service, STS

Create and provide temporary security credentials to your users that allow you to control access to AWS resources. It is temporary, and users can request new security credentials if they have permission. https://sts.amazonaws.com is a global service with a single endpoint.

  • AssumeRole - Assume a role on an account or mutual account
  • AssumeRoleWithSAML - Credentials given when a user temporarily logs in with SAML.
  • AssumeRoleWithWebIdentity - Returns the logged in user role to the identity provider, now used instead of Cognito Identity Pool.
  • GetSessionToken - Obtain token for MFA
  • "aws:MultiFactorAuthPresent" : "true"
  • DecodeAuthorizationMessage - Encrypt message when an AWS API error occurs.

AWS Budget

If you log in as an IAM user with access to Billing and Cost Management, you can view costs and billing details. Even in Free Tier, you can see a breakdown of your current usage and how much you plan to use. If you set a budget, you can receive notifications by email when a certain amount (85%) of the set budget is reached or when the expected amount meets 100% of the budget.

##EC2

EC2 is an infrastructural concept called Elastic Compute Cloud. It includes EC2, the machine itself, EBS that stores data, ELB a load balancer, and ASG, a tool that helps with automatic scaling. EC2 Instance gives you the option to select the following components: -OS -CPU

  • RAM (random-access memory)
  • EBS&EFS, EC2 Instance Store -Firewall rules -Network card
  • Bootstrap script
  • You can write tasks to do when booting.
  • EC2 User Data is used to bootstrap your EC2 instances using a bash script. [EC2 Instance Types](https://aws.amazon.com/ko/ec2/instance-types/?gclid=CjwKCAiAjeW6BhBAEiwAdKltMmF0XWyIU0yT lYy2J4zKGrDdc3mGAOn1oStYkq4FlGb8B5it5_jtIhoCOGkQAvD_BwE&trk=68913a17-4967-41f6-a766-0f2eb338dd0 4&sc_channel=ps&ef_id=CjwKCAiAjeW6BhBAEiwAdKltMmF0XWyIU0yTlYy2J4zKGrDdc3mGAOn1oStYkq4FlGb8B5it5 _jtIhoCOGkQAvD_BwE:G:s&s_kwcid=AL!4422!3!588924203178!p!!g!!aws%20ec2!16390049454!133992835579) and You can find information and comparisons about each type at EC2 Instance Info.

Security Group

A security group refers to a firewall that sets rules for communicating with EC2 Instance. You can specify port, IP range (IPv4, IPv6), protocol (TCP, UDP), and Source (0.0.0.0/0). It is divided into inbound rules for accessing EC2 Instances and outbound rules for accessing other instances from EC2 Instances. If access is not possible due to a security group, a timeout occurs.

  • It is recommended to set up a security group for SSH access.
  • Affected by region and VPC. Types of ports and their protocols commonly used in security groups
  • 22 - SSH
  • 21 - FTP
  • 22 - SFTP
  • 80 - HTTP
  • 443 - HTTPS
  • 3389 - RDP (Windows Login)

Access via SSH

Secure Shell (SSH) is a communications protocol that allows you to log in to another computer on a network, run commands, and transfer files on remote systems.

ssh -i key.pem ec2-user@3.435.33.356
  • When accessing an EC2 instance, IAM User permission is granted to ensure that only necessary information is provided.

Purchasing Options

There are various purchasing options for EC2 Instance.

On-Demand

It is common to be billed as you use it on-demand. However, if you have a plan for how much you will use it (1 or 3 years), you can specify it using Reserved or Saving Plans that charge by the hour.

Spot Instance

If your workload is small, Spot Instance can be used inexpensively. This option takes up empty instances like competitive bidding, but has the disadvantage that it may become unusable by another bidder at any time.

Dedicated Hosts

Dedicated Hosts are where the entire physical server is used by a host. Cost is the same as On-Demand.

  • When database technology deployments require physical core and network socket visibility
  • Ability to observe and monitor interactions on sockets, which are endpoints that perform network communications in a computing system.
  • Detailed control may be difficult in on-demand because it operates in a virtualized environment.

Capacity Reservations

EC2 Capacity Reservations are billed like On-Demand, but they are charged regardless of whether they are in operation or not, so they are suitable for use in a specific region for a short period of time. They can be used in combination with Reserved or Saving Plans.

Billing for IPv4 address

Changes for February 2024

  • All instances are free up to a total of 750hr/month during the free tier period, and charges apply for usage beyond that.
  • In the case of LB, you can have one IPv4 address per region, and free tier is not provided.
  • RDS Database can have one IPv4 address and does not provide a free tier.

Additional notes

  • Many ISPs (Internet Service Providers) do not yet support IPv6.
  • With IPAM, you can manage the IPs used by Amazon.

EC2 Instance Metadata (IMDS)

You can view EC2 Instance Metadata. IMDSv1 can be accessed by connecting to http://169.254.169.254/latest/meta-data, and IMDSv2 can be accessed by obtaining a session token and accessing in the same way as http://169.254.169.254/latest/meta-data/profile.

  • Starting in mid-2024, new Amazon EC2 instance types will only use version 2 of the EC2 Instance Metadata Service (IMDSv2.
TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"`
curl http://169.254.169.254/latest/meta-data/profile -H "X-aws-ec2-metadata-token: $TOKEN"

EC2 Instance Storage

EBS, AMI, EFS

Elastic Block Store (EBS)

EBS volumes are network drives. Used for specific Availability Zones, volumes can be moved using snapshots. Only one instance can be mounted at a time at the CCP level.

  • When EC2 is terminated, use may be discontinued depending on EBS settings. - Delete on Termination
  • Make an Amazon EBS volume available for use on Linux
EBS Snapshots

You can use EBS by restoring it to another AZ through a snapshot. In this case, managing snapshots in Archive has the advantage of being 75% cheaper. Even if a snapshot is deleted, it can be restored from the Recycle Bin. There is also a restore using Fast Snapshot, which costs a lot of money but has the advantage of being able to quickly restore a large snapshot.

EBS Volume Types
  • Unlike gp2, gp3 can be set independently of volume size and IOPS (input/output operations per second).
  • gp2 is a structure in which the size of IOPS naturally increases depending on the volume size. In other words, it is expressed as being directly linked.
EBS Multi-Attach

For io 1 or io 2 volumes, multiple attachments allow you to attach an EBS volume to multiple instances (16 limit) within the same Availability Zone.

Amazon Machine Images (AMIs)

You can use the Public AMI provided by Amazon or create your own. As part of creating the AMI, you can take an EBS snapshot and use the AMI to create instances in other AZs.

  • Creation using My AMIs in Instance Creation > Image Creation (AMI) > Instance Creation

EC2 Instance Store

Network drivers can solve the shortcomings of EBS, which has limited performance. It is used for high performance by improving I/O performance with hardware disks.

Elastic File System (EFS)

This filesystem can be mounted and used by multiple instances and operates across multiple Availability Zones. It's elastic, so it expands and contracts automatically. You can choose throughput, performance, scale, and more.

  • Lifecycle Policy - There is a Tier so it can be set to be moved according to Storage Classes after a certain period of time.
  • You only pay when you use it.
  • Comparison with EBS
  • Except for EBS io 1 or io 2 volumes, unlike EBS, it has the feature of being able to connect to multiple instances.
  • It is more expensive than EBS, but costs can be reduced with the storage layer.

ETC

AWS Limits(Quotas) and Exponential Backoff

-API Rate Limits

  • DescribesInstance API for EC2 limit of 100 calls/sec
  • GetObject on S3 limit of 500 calls/sec
  • Service Quotas
  • On-Demand Standard Instances 1152 vCPUs
  • Exponential Backoff
  • You can configure retries for 5xx errors if a ThrottlingException occurs.
  • Configure it to cause an exponential delay when the same request comes.

Comments

No comments yet. Be the first!

    164 posts in 테크

    1–5 / 164