kodekloud-engineer/aws-1-10.md

Task #1

aws ec2 create-key-pair \
  --key-name devops-kp \
  --key-type rsa \
  --key-format pem \
  --region us-east-1 \
  --query 'KeyMaterial' \
  --output text > devops-kp.pem

chmod 400 devops-kp.pem

Task 2

# 1. Grab the default VPC ID
VPC_ID=$(aws ec2 describe-vpcs \
  --filters "Name=isDefault,Values=true" \
  --region us-east-1 \
  --query 'Vpcs[0].VpcId' \
  --output text)

# 2. Create the SG, capture its ID
SG_ID=$(aws ec2 create-security-group \
  --group-name devops-sg \
  --description "Security group for Nautilus App Servers" \
  --vpc-id "$VPC_ID" \
  --region us-east-1 \
  --query 'GroupId' \
  --output text)

# 3. HTTP ingress
aws ec2 authorize-security-group-ingress \
  --group-id "$SG_ID" \
  --protocol tcp \
  --port 80 \
  --cidr 0.0.0.0/0 \
  --region us-east-1

# 4. SSH ingress
aws ec2 authorize-security-group-ingress \
  --group-id "$SG_ID" \
  --protocol tcp \
  --port 22 \
  --cidr 0.0.0.0/0 \
  --region us-east-1

Task 3

For this task, create one subnet named xfusion-subnet under default VPC.

# Grab default VPC ID
VPC_ID=$(aws ec2 describe-vpcs \
  --filters "Name=isDefault,Values=true" \
  --region us-east-1 \
  --query 'Vpcs[0].VpcId' \
  --output text)

# Create subnet + tag in a single call
aws ec2 create-subnet \
  --vpc-id "$VPC_ID" \
  --cidr-block 172.31.96.0/20 \
  --region us-east-1 \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=xfusion-subnet}]' \
  --query 'Subnet.{Id:SubnetId,Cidr:CidrBlock,AZ:AvailabilityZone}'

# list / describe subnets
aws ec2 describe-subnets \
  --filters "Name=vpc-id,Values=$VPC_ID" \
  --region us-east-1

aws ec2 describe-subnets \
  --filters "Name=vpc-id,Values=$VPC_ID" \
  --region us-east-1 \
  --query 'Subnets[].{Id:SubnetId,Cidr:CidrBlock,AZ:AvailabilityZone,Name:Tags[?Key==`Name`]|[0].Value}' \
  --output table

Task 4

The s3 bucket name is devops-s3-15697, enable versioning for this bucket.

aws s3api put-bucket-versioning \
  --bucket devops-s3-15697 \
  --versioning-configuration Status=Enabled \
  --region us-east-1

Task 5

Create a volume with the following requirements:

• Name of the volume should be nautilus-volume.
• Volume type must be gp3.
• Volume size must be 2 GiB.

aws ec2 create-volume \
  --volume-type gp3 \
  --size 2 \
  --availability-zone us-east-1a \
  --region us-east-1 \
  --tag-specifications 'ResourceType=volume,Tags=[{Key=Name,Value=nautilus-volume}]' \
  --query '{Id:VolumeId,Type:VolumeType,Size:Size,AZ:AvailabilityZone}'

# verify
aws ec2 describe-volumes \
  --filters "Name=tag:Name,Values=nautilus-volume" \
  --region us-east-1 \
  --query 'Volumes[0].{Id:VolumeId,Type:VolumeType,Size:Size,AZ:AvailabilityZone,State:State,Name:Tags[?Key==`Name`]|[0].Value}'  

Task 6

For this task, create an EC2 instance with following requirements:

1. The name of the instance must be xfusion-ec2.
2. You can use the Amazon Linux AMI to launch this instance.
3. The Instance type must be t2.micro.
4. Create a new RSA key pair named xfusion-kp.
5. Attach the default (available by default) security group.

# 1. Create the new RSA key pair
aws ec2 create-key-pair \
  --key-name xfusion-kp \
  --key-type rsa \
  --key-format pem \
  --region us-east-1 \
  --query 'KeyMaterial' \
  --output text > xfusion-kp.pem
chmod 400 xfusion-kp.pem

# 2. Grab the default VPC's default security group ID
DEFAULT_SG=$(aws ec2 describe-security-groups \
  --filters "Name=group-name,Values=default" "Name=vpc-id,Values=$(aws ec2 describe-vpcs --filters Name=isDefault,Values=true --region us-east-1 --query 'Vpcs[0].VpcId' --output text)" \
  --region us-east-1 \
  --query 'SecurityGroups[0].GroupId' \
  --output text)

# 3. Launch the instance
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 \
  --instance-type t2.micro \
  --key-name xfusion-kp \
  --security-group-ids "$DEFAULT_SG" \
  --region us-east-1 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=xfusion-ec2}]' \
  --query 'Instances[0].{Id:InstanceId,AMI:ImageId,Type:InstanceType,State:State.Name}'

# verify
aws ec2 describe-instances \
  --filters "Name=tag:Name,Values=xfusion-ec2" \
  --region us-east-1 \
  --query 'Reservations[0].Instances[0].{Id:InstanceId,Type:InstanceType,State:State.Name,Key:KeyName,SG:SecurityGroups[0].GroupName,AMI:ImageId}'

Task 7

1. Change the instance type from t2.micro to t2.nano for devops-ec2 instance.
2. Make sure the ec2 instance devops-ec2 is in running state after the change.

# 0. Resolve instance ID from the Name tag
IID=$(aws ec2 describe-instances \
  --filters "Name=tag:Name,Values=devops-ec2" "Name=instance-state-name,Values=pending,running,stopping,stopped" \
  --region us-east-1 \
  --query 'Reservations[0].Instances[0].InstanceId' \
  --output text)

# 1. Stop it
aws ec2 stop-instances --instance-ids "$IID" --region us-east-1

# 2. Block until fully stopped (not just 'stopping')
aws ec2 wait instance-stopped --instance-ids "$IID" --region us-east-1

# 3. Change the type
aws ec2 modify-instance-attribute \
  --instance-id "$IID" \
  --instance-type t2.nano \
  --region us-east-1

# 4. Start it back up
aws ec2 start-instances --instance-ids "$IID" --region us-east-1

# 5. Block until running
aws ec2 wait instance-running --instance-ids "$IID" --region us-east-1

# Verify
aws ec2 describe-instances \
  --instance-ids "$IID" \
  --region us-east-1 \
  --query 'Reservations[0].Instances[0].{Type:InstanceType,State:State.Name}'

Task 8

There is an EC2 instance named xfusion-ec2 under us-east-1 region, enable the stop protection for this instance.

IID=$(aws ec2 describe-instances \
  --filters "Name=tag:Name,Values=xfusion-ec2" "Name=instance-state-name,Values=pending,running,stopping,stopped" \
  --region us-east-1 \
  --query 'Reservations[0].Instances[0].InstanceId' \
  --output text)

aws ec2 modify-instance-attribute \
  --instance-id "$IID" \
  --disable-api-stop \
  --region us-east-1

# Verify
aws ec2 describe-instance-attribute \
  --instance-id "$IID" \
  --attribute disableApiStop \
  --region us-east-1 \
  --query 'DisableApiStop.Value'

Task 9

IID=$(aws ec2 describe-instances \
  --filters "Name=tag:Name,Values=devops-ec2" "Name=instance-state-name,Values=pending,running,stopping,stopped" \
  --region us-east-1 \
  --query 'Reservations[0].Instances[0].InstanceId' \
  --output text)

aws ec2 modify-instance-attribute \
  --instance-id "$IID" \
  --disable-api-termination \
  --region us-east-1

# Verify: 
aws ec2 describe-instance-attribute \
  --instance-id "$IID" \
  --attribute disableApiTermination \
  --region us-east-1 \
  --query 'DisableApiTermination.Value'

Task 10

There is an instance named nautilus-ec2 and an elastic-ip named nautilus-ec2-eip in us-east-1 region. Attach the nautilus-ec2-eip elastic-ip to the nautilus-ec2 instance.

# Instance ID from its Name tag
IID=$(aws ec2 describe-instances \
  --filters "Name=tag:Name,Values=nautilus-ec2" "Name=instance-state-name,Values=pending,running,stopping,stopped" \
  --region us-east-1 \
  --query 'Reservations[0].Instances[0].InstanceId' \
  --output text)

# EIP allocation ID from its Name tag
ALLOC_ID=$(aws ec2 describe-addresses \
  --filters "Name=tag:Name,Values=nautilus-ec2-eip" \
  --region us-east-1 \
  --query 'Addresses[0].AllocationId' \
  --output text)

# Associate
aws ec2 associate-address \
  --instance-id "$IID" \
  --allocation-id "$ALLOC_ID" \
  --region us-east-1

# Validate
aws ec2 describe-addresses \
  --filters "Name=tag:Name,Values=nautilus-ec2-eip" \
  --region us-east-1 \
  --query 'Addresses[0].{IP:PublicIp,Instance:InstanceId,Assoc:AssociationId}'