AWS-Admin-New

[Audio] AWS Administration -Your Best Choice Hand Book For AWS Admin Info : [email protected].

[Audio] AWS Administration -Your Best Choice MODULE#1 -Introduction to Cloud Computing Agenda What is Cloud Computing ? Why we go for Cloud Computing? History and Origins of Cloud Computing Characteristics of Cloud Computing Types of cloud services Software as a Service SaaS Platform as a Service PaaS Infrastructure as a Service IaaS Cloud implementation types Conclusion Info : [email protected].

[Audio] AWS Administration -Your Best Choice What is Cloud Service? Services and Solutions that are delivered and consumed in real time over internet are Cloud Services -When you store your photos online, use webmail or social networking site, you will use "Cloud Computing" Service What is Cloud Computing? Cloud Computing is a delivery model of Computing services over the internet -It enables real time development, development and delivery of broad range of products, services and solutions "Cloud computing is a style of computing where massively scalable IT-related capabilities are provided as a service across the Internet to multiple external customers" Info : [email protected].

[Audio] AWS Administration -Your Best Choice What is Cloud Computing? == Computing and software resources that are delivered on demand, as service.. APPLICATIONS COMPUTER NETWORK SERVICES STORAGE (DATABASE) Info : [email protected].

[Audio] AWS Administration -Your Best Choice Why we go for Cloud Computing? Lower Computing Cost Improved Performance Reduced Software Cost Instant Software Updates Unlimited Storage Capacity Increased Data Reliability Device Independence and the "always on!, anywhere and any place" Free From Maintenance and the "no-need- to-know" Info : [email protected].

[Audio] AWS Administration -Your Best Choice History and Origins of Cloud Computing Launches of Google App Engine/Windows Azure Beta 2008 - Google App / 200 S3 200 Launch of Amazon web 199 The first milestone for Cloud The arrival of 196 Supercomputers/Mainfr Info : [email protected].

[Audio] AWS Administration -Your Best Choice Characteristics of Cloud Computing Info : [email protected].

[Audio] AWS Administration -Your Best Choice Characteristics of Cloud Computing On-demand self-service Ubiquitous network access Resource pooling (advanced virtualization) Rapid elasticity Flexible pricing - Pay per use Info : [email protected].

AWS Administration -Your Best Choice Info : [email protected] Characteristics of Cloud Computing • On-demand self-service • Ubiquitous network access • Resource pooling (advanced virtualization) • Rapid elasticity • Flexible pricing - Pay per use.

[Audio] AWS Administration -Your Best Choice Characteristics of Cloud Computing On-demand self-service Ubiquitous network access Resource pooling (advanced virtualization) Rapid elasticity Flexible pricing - Pay per use Info : [email protected].

[Audio] AWS Administration -Your Best Choice Characteristics of Cloud Computing On-demand self-service Ubiquitous network access Resource pooling (advanced virtualization) Rapid elasticity Flexible pricing - Pay per use Info : [email protected].

[Audio] AWS Administration -Your Best Choice Characteristics of Cloud Computing On-demand self-service Ubiquitous network access Resource pooling (advanced virtualization) Rapid elasticity Flexible pricing - Pay per use Info : [email protected].

[Audio] AWS Administration -Your Best Choice Cloud Service Layers Cloud Service Layers Info : [email protected].

[Audio] AWS Administration -Your Best Choice Cloud Service Layers Cloud Service Model -Comparison Info : [email protected].

[Audio] AWS Administration -Your Best Choice Cloud implementation types Info : [email protected].

[Audio] AWS Administration -Your Best Choice Public Cloud Owned and managed by service provider Made available to the general public or a large industry group Info : [email protected].

[Audio] AWS Administration -Your Best Choice Private Cloud Operated solely for an organization May be managed by the organization or a third party Limits access to enterprise and partner network Retains high degree of control, privacy and security Info : [email protected].

[Audio] AWS Administration -Your Best Choice Hybrid Cloud Composition of two or more clouds (private, community, or public) bound together by standardized or proprietary technology that enables data and application portability Info : [email protected].

[Audio] AWS Administration -Your Best Choice Conclusion Cloud Computing is the fastest growing part of network based computing. It provides tremendous benefits to customers of all sizes: simple users, developers, enterprises and all types of organizations. Info : [email protected].

[Audio] AWS Administration -Your Best Choice Lab Activity Info : [email protected].

[Audio] AWS Administration -Your Best Choice MODULE#2 -Introduction to AWS Agenda What is AWS ? Benefits of using AWS? History and Origins of AWS AWS Components AWS Services AWS Regions AWS Availability Zones AWS Edge Locations AWS Certifications Info : [email protected].

[Audio] AWS Administration -Your Best Choice What is AWS? Amazon Web Services(AWS) are a collection of remote services(Also called as web service) offered by the amazon.com over the internet build and run an application. Amazon Web Services (AWS) - robust, scalable and affordable infrastructure for cloud computing. AWS provide compute, storage and database service quickly provisioning the IT needs Info : [email protected].

[Audio] AWS Administration -Your Best Choice What is AWS ? AWS is a set of cloud computing services AWS is flexibility, availability, and scalability AWS is Elasticity: scale up or scale down as needed, We can get recourses instantly AWS is fully on demand Info : [email protected].

[Audio] AWS Administration -Your Best Choice Benefits of using AWS ? Pay-per use model you are only charged for disk space, CPU time and bandwidth that you use. Instant scalability Your Service automatically scales on AWS stack. Reliable/Redundant Infrequent outages (so far). Data is redundant in the cloud. All services have built-in security Security AWS delivers a scalable cloud-computing platform that provides customers with end- to-end security and end-to-end privacy. Most services accessed via simple REST/SOAP API Libraries are available in all major languages. Minimal learning curve. Info : [email protected].

[Audio] AWS Administration -Your Best Choice Service Level Agreement (SLA) SLA between 99.99 and 100% availability Amazon S3 maintains a durability of 99.99999% Availability Availability Zones exist on isolated fault lines, flood plains, and electrical grids to substantially reduce the chance of simultaneous failure Support AWS provides 24/7 support in the real-time operational status of all services around the globe Info : [email protected].

[Audio] AWS Administration -Your Best Choice History and Origins of AWS Grew out of Amazon's need to rapidly provision and configure machines of standard configurations for its own business. Early 2000s – Both private and shared data centers began using virtualization to perform "server consolidation" 2003 – Internal memo by Chris Pinkham describing an "infrastructure service for the world." 2006 – S3 first deployed in the spring, EC2 in the fall 2008 – Elastic Block Store available. – Amazon EC2 Now Offers Windows Server 2008 Info : [email protected].

[Audio] AWS Administration -Your Best Choice Various Components of AWS Info : [email protected].

[Audio] AWS Administration -Your Best Choice AWS Services Amazon provides the various types of services as below EC2 – Virtual Private Servers Similar to standard VPS's and are called instances Available in a variety of sizes (613MB to 64GB of RAM) All major operating systems supported S3 – Cloud Storage Highly scalable (some companies have PBs of data) Highly available – data is stored in multiple data centers RDS – Relational Database MySQL, SQL and Oracle databases Variety of sizes High availability available for an extra cost Read replication Scheduled backups Route 53 – DNS High availability Works well with other AWS services Fast and secure Pay per zone and million queries Info : [email protected].

[Audio] AWS Administration -Your Best Choice CloudFront – Content Delivery Network Uses a number of global edge locations Fast Pay per GB of data transfer (prices vary on the region) Glacier – Data Archiving Store data for a prolong period of time (years) Very cheap Data retrieval takes a few hours DynamoDB – NoSQL Database High availability Data stored on SSDs for speed Pay for number of read/writes per second ElastiCache – Memcache Cache database results Available in a variety of sizes Pay per hours Info : [email protected].

[Audio] AWS Administration -Your Best Choice AWS Services AWS Regions AWS Regions are completely isolated from each other and are in different parts of the world and AWS Regions is – A collection of data centers (Availability Zones or "AZ" – Each region has a set number of AZs – All AZs in a region connected by high-bandwidth – Cost vary from Region to Region – Default Region in US East Info : [email protected].

[Audio] AWS Administration -Your Best Choice AWS Regions AWS Availability Zones Note: There is an extra region called the AWS GovCloud region, but this can only be used by government agencies Info : [email protected].

[Audio] AWS Administration -Your Best Choice AWS Edge Locations Edge locations are the important part of the AWS infrastructure. There are currently 40 edge locations. They are located in most the major cities around the world and are used by CloudFront (CDN) and route53(DNS) to distribute content nearer to the end user AWS Certifications Info : [email protected].

[Audio] AWS Administration -Your Best Choice Lab activity Info : [email protected].

[Audio] AWS Administration -Your Best Choice MODULE#3 –Elastic Cloud Computing EC2 Agenda Introduction to AWS EC2 Benefits of using AWS EC2? Amazon EC2 use cases AWS EC2 Pricing Model AWS Instance type Amazon Machine Image [AMI] Selecting EC2 instance AWS Regions and Availability zones Launching Amazon EC2 Instance Step by Step Info : [email protected].

[Audio] AWS Administration -Your Best Choice Introduction to Amazon EC2 Amazon EC2, which is also known as Amazon Elastic Compute Cloud, provides resizable computing capacity in the Amazon Web Services (AWS) It is a simple web service interface allows you to obtain and configure capacity with minimal friction. It provides you with complete control of your computing resources and lets you run on Amazon's proven computing environment. EC2 is the core service of AWS cloud platform and launched in 2006 These are the virtual servers, also called as an instances we can use these instances pay per use basis Info : [email protected].

[Audio] AWS Administration -Your Best Choice Benefits of using AWS EC2? p Easier and Faster - Amazon EC2 reduces the time required to obtain and boot new server instances to minutes, allowing you to quickly scale capacity, both u and down, as your computing requirements change. Elastic and Scalable – Quickly add and subtract resources to applications to meet customer demand and manage costs. Avoid provisioning resources up- front for projects with variable consumption rates or short lifetimes. High Availability – Amazon EC2 provides developers the tools to build failure resilient applications and isolate themselves from common failure scenarios. Cost-Effective – Consume only the amount of compute, storage and other IT resources needed. No long-term commitment, minimum spend or up-front investment is required. Info : [email protected].

[Audio] AWS Administration -Your Best Choice EC2 Pricing Model Free Usage Tier On-Demand Instances – Start and stop instances whenever you like, costs are rounded up to the nearest hour. (Worst price) Reserved Instances – Pay up front for one/three years in advance. (Best price) – Unused instances can be sold on a secondary market. Spot Instances – Specify the price you are willing to pay, and instances get started and stopped without any warning as the marked changes. (Kind of like Condor!) – Dedicated Instances - Charge for instance Info : [email protected].

[Audio] AWS Administration -Your Best Choice AWS Instance type Info : [email protected].

[Audio] AWS Administration -Your Best Choice Info : [email protected].

[Audio] AWS Administration -Your Best Choice Amazon Machine Image [AMI] Info : [email protected].

[Audio] AWS Administration -Your Best Choice Launching an Amazon EC2 Instance Step by Step Launching an Amazon EC2 Instance Step by Step Sign up for AWS at http://aws.amazon.com Apply the service credit you received by email. Create and download a Key-Pair, save it in your home directory. Create a VM via the AWS Console Connect to your newly-created VM like this: ssh -i my-aws-keypair.pem ec2-user@ip- address-of-vm Info : [email protected].

[Audio] AWS Administration -Your Best Choice Login to AWS Console Click on EC2 from Compute services from AWS Console Info : [email protected].

[Audio] AWS Administration -Your Best Choice You can see the EC2 dashboard and all EC2 instance Click on running instances to see the existing running instances Running instances Info : [email protected].

[Audio] AWS Administration -Your Best Choice Click on Launch Instance to create New Instance AWS Regions Note: There is an extra region called the AWS GovCloud region, but this can only be used by government agencies Info : [email protected].

[Audio] AWS Administration -Your Best Choice AWS Regions AWS Availability Zones Info : [email protected].

[Audio] AWS Administration -Your Best Choice Select the respective OS Image to install Select the Instance type Info : [email protected].

[Audio] AWS Administration -Your Best Choice Info : [email protected].

[Audio] AWS Administration -Your Best Choice Info : [email protected].

[Audio] AWS Administration -Your Best Choice When NOT to user EC2 ? Physical Access to the system Non supporting Operating system Multicast/Manipulation of L2 Networking Disks attached to multiple VM's You don't want to do system administration Info : [email protected].

[Audio] AWS Administration -Your Best Choice Lab Activity Info : [email protected].

[Audio] AWS Administration -Your Best Choice MODULE#4 –Identity and Access Management[IAM] Agenda Introduction to Identity and Access management (IAM) Understanding IAM console Creating and managing security group Creating and managing users Managing the user passwords and security Key ID Creating and managing roles Understanding and managing policy Understanding multi factor authentication User login process Info : [email protected].

[Audio] AWS Administration -Your Best Choice ➢ What is IAM? IAM stands for Identity and Access Management IAM is a web services that enable you to manage users and group permissions in AWS It is targeted at organizations with multiple users or systems that use AWS products such as Amazon Elastic Compute Cloud, Amazon Relational Database Service, and the AWS Management Console ➢ Why we go for IAM? To avoid a security and logistical headache When you create an AWS account, it has permissions to do anything and everything with all the resources IAM Allows you to limit access as needed and gives you the peace of mind that approved people are accessing the right resources in the desired manner ➢ Why we go for IAM? Info : [email protected].

[Audio] AWS Administration -Your Best Choice IAM will allow us to create multiple users with individual security credentials and permissions, with this IAM, each user is allowed to do only what they need to do ➢ Why we go for IAM? Each user in the AWS account must have a unique set of credentials to access the console Info : [email protected].

[Audio] AWS Administration -Your Best Choice ➢ What is IAM? Different types of users have different set of permissions Administrators need to access all AWS resources Developers need only access on Amazon Elastic Compute Cloud (EC2) Info : [email protected].

[Audio] AWS Administration -Your Best Choice ➢ What is IAM ? We can use IAM to create a unique user for each employee and define their permissions ➢ What is a Group ? A group is a collection of IAM users After you set permissions on a group, those permissions are set to all users in the group Even if we create user, we need to use groups to set permissions. We need to manage access for number if groups instead of managing access for every individual user. Info : [email protected].

[Audio] AWS Administration -Your Best Choice ➢ Creating group Select IAM from AWS console ➢ Creating Group Info : [email protected].

[Audio] AWS Administration -Your Best Choice ➢ Creating Group ➢ Creating Group Info : [email protected].

[Audio] AWS Administration -Your Best Choice ➢ Attach the policy ➢ Review the group Info : [email protected].

[Audio] AWS Administration -Your Best Choice Group created ➢ Changing group name Select group->Group actions->Edit group Info : [email protected].

[Audio] AWS Administration -Your Best Choice ➢ Deleting group Select group->Group actions->Delete group ➢ Adding users to group Select group->Group actions->Add users to Group Info : [email protected].

[Audio] AWS Administration -Your Best Choice ➢ Select users to add group Info : [email protected].

[Audio] AWS Administration -Your Best Choice ➢ Creating user ➢ User key ID Info : [email protected].

[Audio] AWS Administration -Your Best Choice ➢ Deleting user ➢ Managing user password Info : [email protected].

[Audio] AWS Administration -Your Best Choice Info : [email protected].

[Audio] AWS Administration -Your Best Choice ➢ Managing access Keys Info : [email protected].

[Audio] AWS Administration -Your Best Choice Info : [email protected].

[Audio] AWS Administration -Your Best Choice ➢ User default password settings ➢ Understanding roles Info : [email protected].

[Audio] AWS Administration -Your Best Choice ➢ Creating roles ➢ Attaching policy to role Info : [email protected].

[Audio] AWS Administration -Your Best Choice Info : [email protected].

[Audio] AWS Administration -Your Best Choice ➢ Deleting role Info : [email protected].

[Audio] AWS Administration -Your Best Choice ➢ Multi Factor Authentication [MFA] Multi-Factor Authentication, or MFA. MFA provides additional security by requiring users to use a password and an authentication code from an external device MFA is especially recommended for the AWS root accounts and account with administrator permissions since they have access to all your AWS resources ➢ Login process Info : [email protected].

[Audio] AWS Administration -Your Best Choice Lab activity Info : [email protected].

[Audio] AWS Administration -Your Best Choice MODULE5# –Simple Storage Solution[S3] Agenda Understanding Storage in AWS Different types of Storages in AWS What is Amazon S3 Functions and concepts of S3 Advantages and disadvantage of S3 Requirement for S3 Understanding pricing of S3 Creating and managing S3 Buckets Creating and managing Objects in S3 Uploading Objects to S3 Deleting Buckets Deleting objects Info : [email protected].

[Audio] AWS Administration -Your Best Choice Storages available in AWS? Storage is an important role AWS and find the below storages available in AWS and uses Info : [email protected].

[Audio] AWS Administration -Your Best Choice What is AWS S3? Amazon Simple Storage Service (Amazon S3) is storage for the Internet. We can use Amazon S3 to store and retrieve any amount of data at any time, from anywhere on the web. We can accomplish these tasks using the AWS Management Console, which is a simple and intuitive web interface. S3 is designed for Remote data storage Low cost, pay-as-you go No up-front costs High-availability High bandwidth Uses Amazon's own networking infrastructure March 2006: Amazon launched Simple Storage Service (S3) Info : [email protected].

[Audio] AWS Administration -Your Best Choice Info : [email protected].

[Audio] AWS Administration -Your Best Choice Advantages of S3? Info : [email protected].

[Audio] AWS Administration -Your Best Choice Use cases Asset storage and CDN Data storage Static site Backups Mobile storage backend File distribution Info : [email protected].

[Audio] AWS Administration -Your Best Choice What is Bucket? Bucket is a Collection of objects Globally unique id a-z A-Z 0-9 . – Max 100 buckets/user No limit on number of objects Buckets Equivalent of directories Single, common namespace across S3 But bucketNames can include "/", eg mgateway/backups/presentations Objects Equivalent of files Up to 5Gb in size Identified by key (== filename) Info : [email protected].

[Audio] AWS Administration -Your Best Choice Best practices on naming DNS compatible FQDN Allows for vhost watch out for SSL: no dots :-( Objects Blob Don't care about file formats Metadata can be added (like mimetype) Maximum 5 TB/object How to Access AWS S3 storage? Accessible using simple HTTP URLs http://s3.amazonaws.com/bucket/key http://bucket.s3.amazonaws.com/key http://bucket/key where bucket is a DNS CNAME record pointing to s3.amazonaws.com) Info : [email protected].

[Audio] AWS Administration -Your Best Choice Info : [email protected].

[Audio] AWS Administration -Your Best Choice It maintains the versions of Objects stored in S3 and recover in case of data loss S3 Range of Classes S3 Standard class for frequently accessed data Info : [email protected].

[Audio] AWS Administration -Your Best Choice We can also setup auto policy to migrate data from one class to another class like standards to Glacier etc.. Info : [email protected].

[Audio] AWS Administration -Your Best Choice Security in S3 Access Control List Bucket Policy Key Authentication S3 also offer SSL encryption for data upload and download Info : [email protected].

[Audio] AWS Administration -Your Best Choice To sign up for Amazon S3 1. Go to http://aws.amazon.com/s3 and click Sign Up. 2. Follow the on-screen instructions. Once we login to AWS console click on S3 from Storage and content delivery We are in S3 dashboard. We are ready to create a bucket using the AWS Management Console. Every object in Amazon S3 is stored in a bucket. Before we can store data in Amazon S3, We must create a bucket. Note: You are not charged for creating a bucket; you are charged only for storing objects in the bucket and for transferring objects in and out of the bucket. Info : [email protected].

[Audio] AWS Administration -Your Best Choice To create a bucket A bucket is a logical unit of storage in Amazon Web Services (AWS) object storage service, Simple Storage Solution S3. Buckets are used to store objects, which consist of data and metadata that describes the data. 1. Sign into the AWS Management Console and open the Amazon S3 console at https://console.aws.amazon.com/s3. 2. Click Create Bucket. 3. In the Create a Bucket dialog box, in the Bucket Name box, enter a bucket name. The bucket name you choose must be unique across all existing bucket names in Amazon S3. Note: After we create a bucket, we cannot change its name. In addition, the bucket name is visible in the URL that points to the objects stored in the bucket. Ensure that the bucket name we choose is appropriate. 4. In the Region box, select a region. For this exercise, select Oregon from the drop-down list. We can choose a region to optimize latency, minimize costs, or address regulatory requirements. Objects stored in a region never leave that region unless you explicitly transfer them to another region. Info : [email protected].

[Audio] AWS Administration -Your Best Choice 5. Click Create. When Amazon S3 successfully creates your bucket, the console displays your empty bucket in the Buckets panel. Info : [email protected].

[Audio] AWS Administration -Your Best Choice Bucket "suvenit" is created We can create, delete and manage the buckets by action button. Info : [email protected].

[Audio] AWS Administration -Your Best Choice Once we click on Bucket properties, we can see all below properties. Info : [email protected].

[Audio] AWS Administration -Your Best Choice Add an Object to a Bucket. An object can be any kind of file: a text file, a photo, a video and so forth. When you add a file to Amazon S3, you have the option of including metadata with the file and setting permissions to control access to the file. To upload an object 1. In the Amazon S3 console, click the name of bucket that you want to upload an object to and then click Upload. 2. In the Upload - Select Files wizard, if you want to upload an entire folder, you must click Enable Enhanced Uploader to install the necessary Java applet. You only need to do this once per console session. Info : [email protected].

[Audio] AWS Administration -Your Best Choice 3. Click Add Files. A file selection dialog box opens: If you enabled the advanced uploader in step 2, you see a Java dialog box titled Select files and folders to upload, as shown. If not, you see the File Upload dialog box associated with your operating system. Info : [email protected].

[Audio] AWS Administration -Your Best Choice 4. Select the file that you want to upload and then click Open. 5. Click Start Upload. You can watch the progress of the upload from within the Transfer panel. 6. Click on action button to manage an objects 7. Click on properties to see the object properties and url to access. Info : [email protected].

[Audio] AWS Administration -Your Best Choice Click on Details to change the Storage class Click on permission to see and to change permissions. Info : [email protected].

[Audio] AWS Administration -Your Best Choice MODULE6# –Virtual Private Cloud Agenda Understanding Networking(TCP/IP, IP Address etc) Understanding network in AWS Subnet and AWS Communications Internet gateway & Routing tables Security groups and ACL's CloudFront, Route53, VPN's, VPG's and direct connect Load Balancing Auto Scaling Info : [email protected].

[Audio] AWS Administration -Your Best Choice Understanding the TCP/IP model Link Layer : includes device driver and network interface card Network Layer : handles the movement of packets, i.e. Routing Transport Layer : provides a reliable flow of data between two hosts Application Layer: handles the details of the particular application IP Responsible for end to end transmission, Sends data in individual packets, Maximum size of packet is determined by the networks Fragmented if too large Unreliable Packets might be lost, corrupted, duplicated, delivered out of order Info : [email protected].

[Audio] AWS Administration -Your Best Choice IP addresses 4 bytes e.g. 163.1.125.98 Each device normally gets one (or more) In theory there are about 4 billion available Routing How does a device know where to send a packet? All devices need to know what IP addresses are on directly attached networks If the destination is on a local network, send it directly there If the destination address isn't local Most non-router devices just send everything to a single local routerRouters needs to know which network corresponds to each possible IP address Allocation of addresses Controlled centrally by ICANN -Fairly strict rules on further delegation to avoid wastage Have to demonstrate actual need for them Organizations that got in early have bigger allocations than they really need IP packets Source and destination addresses Protocol number 1 = ICMP, 6 = TCP, 17 = UDP Various options e.g. to control fragmentation Time to live (TTL) Prevent routing loops Info : [email protected].

[Audio] AWS Administration -Your Best Choice Field Purpose Vers IP version number Len Length of IP header (4 octet units) TOS Type of Service T. Length Length of entire datagram (octets) Ident. IP datagram ID (for frag/reassembly) Flags Don't/More fragments Frag Off Fragment Offset Field Purpose TTL Time To Live - Max # of hops Protocol Higher level protocol (1=ICMP, 6=TCP, 17=UDP) Checksum Checksum for the IP header Source IA Originator's Internet Address Dest. IA Final Destination Internet Address Options Source route, time stamp, etc. Data... Higher level protocol data Info : [email protected].

[Audio] AWS Administration -Your Best Choice NAT Translation EC2- Classic VS. VPC Networks Info : [email protected].

[Audio] AWS Administration -Your Best Choice Info : [email protected].

[Audio] AWS Administration -Your Best Choice VPC Best Configuration Practices A virtual private cloud (VPC) is a virtual network dedicated to your AWS account. It is logically isolated from other virtual networks in the AWS cloud. We can launch your AWS resources, such as Amazon EC2 instances, into your VPC. We can configure your VPC; we can select its IP address range, create subnets, and configure route tables, network gateways, and security settings. 1. Create VPC Log in to the AWS console. Navigate to Services->VPC->Your VPCs. Click ―Create VPC‖. When you create a VPC, you specify a set of IP addresses in the form of a Classless Inter-Domain Routing (CIDR) block (for example, 10.0.0.0/16). For more information about CIDR notation and what "/16" means, see Classless Inter-Domain Routing. You can assign a single CIDR block to a VPC. The allowed block size is between a /28 netmask and /16 netmask. In other words, the VPC can contain from 16 to 65,536 IP addresses. Info : [email protected].

[Audio] AWS Administration -Your Best Choice You cannot change a VPC's size after creating it. If your VPC is too small for your needs, you'll need to terminate all of the instances in the VPC, delete it, and then create a new, larger VPC. To create your VPC, go to the Create VPC dialog box, specify the following VPC details and then click ―Yes, Create‖. CIDR Block: Specify the CIDR block for your VPC. I prefer 10.0.0.0/16. Tenancy: Default tenancy: This is for running instances on shared hardware and is is free of charge. Dedicated Tenancy: This is for running your instances on single-tenant hardware. A $2 fee applies for each hour in which any dedicated instance is running in a region. 2. Create Subnets In the navigation pane click on ―Subnets‖. Click ―Create Subnet‖. Before we create a subnet, let's understand the best practices for creating them. You should create subnets across multiple availability zones, with each subnet residing within a single zone. Creating subnets in and launching instances across multiple availability zones will ensure a high-availability environment. When creating separate subnets for ELB, EC2 and RDS instances, each tier should have at least 2 subnets across availability zones. Info : [email protected].

[Audio] AWS Administration -Your Best Choice For this example, we created subnets using zones us-east1b and us-east-1d. These subnets are called ―private subnets‖ because the instances we launch are not accessible from the Internet. In other words, these instances don't have a public IP unless you assign an EIP. App Tier: 10.0.1.0/24(zone-b), 10.0.2.0/24(zone-d) ELB: 10.0.51.0/24(zone-b), 10.0.52.0/24(zone-d) Database (RDS): 10.0.11.0/24(zone-b), 10.0.12.0/24(zone-d) Always choose the same availability zones for all tiers. For example, if you choose two zones for high availability and use us-east-1a and us-east1b, then maintain those same 1a and 1b zones for all tiers. This will minimize data transfer charges because data transfers between instances within the same availability zone are free. 3. Create Internet Gateway By default, instances that are launched into a VPC can't communicate with the Internet. However, you can enable Internet access by attaching an Internet gateway to the VPC. Go to Internet Gateways in the navigation pane and click ―Create Internet Gateway‖. Info : [email protected].

[Audio] AWS Administration -Your Best Choice Now attach the gateway to a VPC by right clicking on ―VPC‖ and selecting ―Attach to VPC‖. 4. Create Route Tables A route table contains a set of rules, called routes, that determine where network traffic is directed. Each subnet in your VPC must be associated with a route table that will control that subnet's routing. You can associate multiple subnets with a single route table; however, you can only associate a subnet with one route table. Creating a VPC automatically creates a main route table which, by default, enables the instances in your VPC to communicate with one other. Go to Route Tables in the navigation pane and click on ―Create Route Table‖. Info : [email protected].

[Audio] AWS Administration -Your Best Choice As a best practice create separate route tables for each tier. This will provide more control in maintaining the security of each subnet. Now associate the subnets to the route tables. Click on one route table and go to the Associations tab. Select the subnet and click ―Associate‖. Associate each tier's subnets separately to the dedicated route table. Create 3 new route tables: 1. ELB Route table—Associate 10.0.51.0/24 and 10.0.52.0/24. 2. APP route table—Associate 10.0.1.0/24 and 10.0.2.0/24. 3. RDS route table—Associate 10.0.11.0/24 and 10.0.12.0/24. Do not associate any subnets with the main route table. Now navigate to the main route table to add a route to allow Internet traffic to the VPC. Go to Routes and specify the following values: Info : [email protected].

[Audio] AWS Administration -Your Best Choice Destination: 0.0.0.0/0 Target: Select ―Internet Gateway‖ from the dropdown menu. 5. Create Security Groups This process is similar to creating an SG (Security Group) in classic EC2. Create separate security groups for ELB, APP, DB (RDS) and NAT instances. 1. APP_SG01 2. NAT_SG01 3. ELB_SG01 4. DB_SG01 Allow Inbound rules for ELB, DB and APP to suit your needs. We'll address NAT security group rules later in this post. Info : [email protected].

[Audio] AWS Administration -Your Best Choice 6. Create NAT instance Instances launched into a private subnet in a VPC cannot communicate with the Internet unless you assign a public IP or EIP to the instance. However, assigning a public IP to an instance will allow everyone to initiate inbound Internet traffic. Using a Network Address Translation (NAT) instance in your VPC enables instances in the private subnet to initiate outbound Internet traffic. Create a subnet with netmask 10.0.0.0/24 for NAT instance. [Refer to section #2 of this post]. We call this subnet a ―public subnet‖ and the others ―private subnets‖. While, technically, there is no difference between public or private subnet, for clarity we call publicly accessible instances public subnets. Associate this subnet to the main route table. You can also create separate route tables to associate to the subnet. If you do create a separate route table, don't forget to add a route that will allow Internet traffic into the subnet. [Refer to section #4 of this post]. Now navigate to Services->EC2->Launch Instance In the Launch Wizard select ―Community AMIs‖ and search for ―ami-vpc-nat‖. ― Select the first AMI from the results list to launch the instance into the VPC created in section #1. Choose the subnet 10.0.0.0/24 and then check the ―Assign public IP‖ box. You can also assign an EIP, if needed. On the Configure Security Group page, choose ―Select an existing security group‖ and select the NAT_SG security group that you created earlier. For this example, we created a micro server. Info : [email protected].

[Audio] AWS Administration -Your Best Choice Choose a NAT instance type based on your intended workload. If your application only occasionally needs to connect to the Internet and doesn't require high network bandwidth, then a micro instance will suffice. If your application talks to the Internet continuously and requires better bandwidth, then start with m1.medium instances. You may need to upgrade the NAT instance to m1.large because network I/O varies between instance types. Now, deselect the ―Source/Destination‖ check box, right click on the NAT instance, select ―Change Source/Dest. Check‖, and click on ―Disable‖. The NAT instance must be able to send and receive traffic from sources or destinations other than itself, so you'll need to deselect the ―source/destination‖ check boxes. Now navigate to Security Groups to add rules for inbound traffic. Go to the Inbound tab for NAT_SG01. These rules will allow app servers to talk to the NAT instance on the 80 and 443 ports. 1. Select ―HTTP‖ from the Create a new rule list. In the Source box, specify the IP address range of your private subnet (App server subnets) and then click ―Add Rule‖. Info : [email protected].

[Audio] AWS Administration -Your Best Choice 2. Select ―HTTPS‖ from the Create a new rule list. In the Source box, specify the IP address range of your private subnet, and then click ―Add Rule‖. Click ―Apply Rule Changes‖. Now navigate to Route Tables and select the private subnets 10.0.1.0/24 and 10.0.2.0/24. On the Routes tab, specify 0.0.0.0/0 in the Destination box, specify the instance ID of the NAT instance in the Target box, and then click ―Add‖. If you don't need an additional instance for NAT, you can minimize cost by assigning a public IP to the instance that needs Internet access. That will allow the instance to access the Internet directly. 7. Create App Servers Now go to Services->EC2 ->Launch Instance. On the Configure Instance Details page, from the Network list choose the VPC that you created previously and select your app server subnet (10.0.1.0/24, 10.0.2.0/24) from the Subnet list. Optional: Select the ―Public IP‖ check box to request that your app instance receive a public IP address. This is required when you don't have a NAT instance, but your instance requires Internet access. On the Configure Security Group page, select the option ―Select an existing security group‖ and then select the APP_SG01 security group that you created previously. Click ―Review and Launch‖. Now log in to the server and check to see whether or not you can access the Internet. $ ping google.com You now might ask, ―How can I access from my desktop an instance that was created in a private subnet and has no assigned public IP?‖ The answer is that you can't. To do so, you'll need a bastion box in the public subnet. You can use a NAT instance as a bastion server (also known as a jump box). Info : [email protected].

[Audio] AWS Administration -Your Best Choice Log in to the bastion (NAT) server first. You can access any instance from this server that was created in a private subnet. For more details, see here. 8. Create RDS Navigate to Services->RDS Go to Subnet Groups in the navigation pane and click ―Create DB Subnet Group‖. Select the VPC ID from the drop down menu. Select ―Availability Zone‖ and choose the Subnet IDs of 10.0.11.0/24 and 10.0.12.0/24. Then click ―Add‖ Click ―Yes, Create‖ to create the subnet group. Creating an Options Group and a Parameters Group is similar to doing so in classic EC2. Launch an RDS instance within the subnet group created above. In the Additional Config window, select the VPC and DB Subnet Groups created previously. Info : [email protected].

[Audio] AWS Administration -Your Best Choice To make sure that your RDS instance is launched in subnets 10.0.11.0/24 and 10.0.12.0/24, select the ―mydb- subgroup01‖ subnet group. All other steps for creating an RDS are as usual. 9. Create ELB Now it's time to create the load balancer. The load balancer will be the frontend and will be accessible from the Internet, which means that the ELB will be launched in public subnets 10.0.51.0/24 and 10.0.52.0/24. At this point the two subnets can't access the Internet. To make them public subnets, update the route table that these subnets are associated to. Navigate to Services->VPC->Route Tables Select the ELB route table. On the Routes tab, specify 0.0.0.0/0 in the Destination box, select the Internet gateway in the Target box, and then click ―Add‖. Navigate to Services-> EC2-> Load Balancers Click ―Create Load Balancer‖. In the Launch Wizard, select ―Create LB inside‖ as your VPC ID. Do not select ―Create an internal load balancer‖. Click ―Continue‖ In Add EC2 Instances select the subnets where you want the load balanced instances to be. Select 10.0.51.0/24 and 10.0.52.0/24. Info : [email protected].

[Audio] AWS Administration -Your Best Choice In the next window select ‖Choose from your existing security group‖ and then select the ELB_SG01 security group that you created previously. Click ―Continue‖. In the next window select the App servers. Click ―Continue‖. Review the details and click ―Create‖. Make sure that you've enabled the APP_SG01 inbound ports (80/443) to ELB_SG01 so that the ELB can route traffic to backend app servers. Also make sure that ELB_SG01 HTTP and HTTPS ports are publicly accessible (0.0.0.0/0). Info : [email protected].

[Audio] AWS Administration -Your Best Choice Info : [email protected].