kodekloud-engineer/aws-11-20.md

## Task 11

An instance named xfusion-ec2 and an elastic network interface named xfusion-eni already exists in us-east-1 region.
Attach the xfusion-eni network interface to the xfusion-ec2 instance.
Make sure status is attached before submitting the task.

```bash
# Instance ID from Name tag
IID=$(aws ec2 describe-instances \
  --filters "Name=tag:Name,Values=xfusion-ec2" "Name=instance-state-name,Values=pending,running,stopping,stopped" \
  --region us-east-1 \
  --query 'Reservations[0].Instances[0].InstanceId' \
  --output text)

# ENI ID from Name tag
ENI_ID=$(aws ec2 describe-network-interfaces \
  --filters "Name=tag:Name,Values=xfusion-eni" \
  --region us-east-1 \
  --query 'NetworkInterfaces[0].NetworkInterfaceId' \
  --output text)

# Attach at device index 1 (0 is taken by the primary ENI)
aws ec2 attach-network-interface \
  --network-interface-id "$ENI_ID" \
  --instance-id "$IID" \
  --device-index 1 \
  --region us-east-1


# validate
aws ec2 describe-network-interfaces \
  --network-interface-ids "$ENI_ID" \
  --region us-east-1 \
  --query 'NetworkInterfaces[0].Attachment.Status'
```


## Task 12

An instance named datacenter-ec2 and a volume named datacenter-volume already exists in us-east-1 region. Attach the datacenter-volume volume to the datacenter-ec2 instance, make sure to set the device name to /dev/sdb while attaching the volume.

```bash
# Instance ID from Name tag
IID=$(aws ec2 describe-instances \
  --filters "Name=tag:Name,Values=datacenter-ec2" "Name=instance-state-name,Values=pending,running,stopping,stopped" \
  --region us-east-1 \
  --query 'Reservations[0].Instances[0].InstanceId' \
  --output text)

# Volume ID from Name tag
VOL_ID=$(aws ec2 describe-volumes \
  --filters "Name=tag:Name,Values=datacenter-volume" \
  --region us-east-1 \
  --query 'Volumes[0].VolumeId' \
  --output text)

# Attach at /dev/sdb
aws ec2 attach-volume \
  --volume-id "$VOL_ID" \
  --instance-id "$IID" \
  --device /dev/sdb \
  --region us-east-1

# waiter
aws ec2 wait volume-in-use --volume-id "$VOL_ID" --region us-east-1

# validate
aws ec2 describe-volumes \
  --volume-ids "$VOL_ID" \
  --region us-east-1 \
  --query 'Volumes[0].{State:State,Device:Attachments[0].Device,Instance:Attachments[0].InstanceId,AttachState:Attachments[0].State}'
```

## Task 13

For this task, create an AMI from an existing EC2 instance named nautilus-ec2 with the following requirement:
Name of the AMI should be nautilus-ec2-ami, make sure AMI is in available state.

```bash
# Instance ID from Name tag
IID=$(aws ec2 describe-instances \
  --filters "Name=tag:Name,Values=nautilus-ec2" "Name=instance-state-name,Values=pending,running,stopping,stopped" \
  --region us-east-1 \
  --query 'Reservations[0].Instances[0].InstanceId' \
  --output text)

# Create the AMI
AMI_ID=$(aws ec2 create-image \
  --instance-id "$IID" \
  --name nautilus-ec2-ami \
  --region us-east-1 \
  --query 'ImageId' \
  --output text)

echo "AMI: $AMI_ID"

# waiter
aws ec2 wait image-available --image-ids "$AMI_ID" --region us-east-1

# verify
aws ec2 describe-images \
  --image-ids "$AMI_ID" \
  --region us-east-1 \
  --query 'Images[0].{Name:Name,State:State,Id:ImageId}'
```

## Task 14

1) Delete the ec2 instance named datacenter-ec2 present in us-east-1 region.
2) Before submitting your task, make sure instance is in terminated state.

```bash
# Instance ID from Name tag
IID=$(aws ec2 describe-instances \
  --filters "Name=tag:Name,Values=datacenter-ec2" "Name=instance-state-name,Values=pending,running,stopping,stopped" \
  --region us-east-1 \
  --query 'Reservations[0].Instances[0].InstanceId' \
  --output text)

# Clear termination protection if it's set (harmless if it wasn't)
aws ec2 modify-instance-attribute \
  --instance-id "$IID" \
  --no-disable-api-termination \
  --region us-east-1

# Terminate
aws ec2 terminate-instances --instance-ids "$IID" --region us-east-1

# Block until fully terminated
aws ec2 wait instance-terminated --instance-ids "$IID" --region us-east-1

# Verify
aws ec2 describe-instances \
  --instance-ids "$IID" \
  --region us-east-1 \
  --query 'Reservations[0].Instances[0].State.Name'
```

## Task 15

Create a snapshot of an existing volume named nautilus-vol in us-east-1 region.

1) The name of the snapshot must be nautilus-vol-ss.
2) The description must be nautilus Snapshot.
3) Make sure the snapshot status is completed before submitting the task.


```bash
# Volume ID from Name tag
VOL_ID=$(aws ec2 describe-volumes \
  --filters "Name=tag:Name,Values=nautilus-vol" \
  --region us-east-1 \
  --query 'Volumes[0].VolumeId' \
  --output text)

# Create snapshot: description as field, name as tag
SNAP_ID=$(aws ec2 create-snapshot \
  --volume-id "$VOL_ID" \
  --description "nautilus Snapshot" \
  --region us-east-1 \
  --tag-specifications 'ResourceType=snapshot,Tags=[{Key=Name,Value=nautilus-vol-ss}]' \
  --query 'SnapshotId' \
  --output text)

echo "Snapshot: $SNAP_ID"

# Verify
aws ec2 describe-snapshots \
  --snapshot-ids "$SNAP_ID" \
  --region us-east-1 \
  --query 'Snapshots[0].{Id:SnapshotId,State:State,Desc:Description,Name:Tags[?Key==`Name`]|[0].Value}'
```

## Task 16

create an IAM user named iamuser_anita.


```bash
aws iam create-user --user-name iamuser_anita

# Validate
aws iam get-user --user-name iamuser_anita \
  --query 'User.{Name:UserName,Arn:Arn,Created:CreateDate}'
```

## Task 17

Create an IAM group named iamgroup_ravi.

```bash
aws iam create-group --group-name iamgroup_ravi

# Verify
aws iam get-group --group-name iamgroup_ravi \
  --query 'Group.{Name:GroupName,Arn:Arn,Created:CreateDate}'
```

## Task 18

Create an IAM policy named iampolicy_anita in us-east-1 region, it must allow read-only access to the EC2 console, i.e this policy must allow users to view all instances, AMIs, and snapshots in the Amazon EC2 console.

```bash
cat > /tmp/iampolicy_anita.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:Describe*",
      "Resource": "*"
    }
  ]
}
EOF

aws iam create-policy \
  --policy-name iampolicy_anita \
  --policy-document file:///tmp/iampolicy_anita.json


# Verify
aws iam list-policies \
  --scope Local \
  --query 'Policies[?PolicyName==`iampolicy_anita`].{Name:PolicyName,Arn:Arn,Attachments:AttachmentCount}' \
  --output table
```

## Task 19

An IAM user named iamuser_kirsty and a policy named iampolicy_kirsty already exist. Attach the IAM policy iampolicy_kirsty to the IAM user iamuser_kirsty.

```bash
# Resolve the policy ARN by name
POLICY_ARN=$(aws iam list-policies \
  --scope Local \
  --query 'Policies[?PolicyName==`iampolicy_kirsty`].Arn' \
  --output text)

# Attach it to the user
aws iam attach-user-policy \
  --user-name iamuser_kirsty \
  --policy-arn "$POLICY_ARN"

# Verify
aws iam list-attached-user-policies \
  --user-name iamuser_kirsty \
  --query 'AttachedPolicies[].{Name:PolicyName,Arn:PolicyArn}' \
  --output table
```

## Task 20

Create an IAM role as below:

1) IAM role name must be iamrole_john.
2) Entity type must be AWS Service and use case must be EC2.
3) Attach a policy named iampolicy_john.

```bash
# 1. Trust policy: allow the EC2 service to assume this role
cat > /tmp/trust-ec2.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "Service": "ec2.amazonaws.com" },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

# 2. Create the role with that trust policy
aws iam create-role \
  --role-name iamrole_john \
  --assume-role-policy-document file:///tmp/trust-ec2.json

# 3. Resolve the policy ARN, then attach
POLICY_ARN=$(aws iam list-policies \
  --scope Local \
  --query 'Policies[?PolicyName==`iampolicy_john`].Arn' \
  --output text)

aws iam attach-role-policy \
  --role-name iamrole_john \
  --policy-arn "$POLICY_ARN"
```