<p>AWS Identity and Access Management (IAM) uses <strong class="">policies</strong> to define permissions for users, groups, and roles. These policies are crucial for controlling access to AWS resources securely and efficiently.</p><h2>​What is an AWS Policy?<br></h2><p>​An <strong class="">AWS policy</strong> is a JSON document that explicitly lists permissions. Each policy contains one or more statements, where each statement grants or denies permission to perform specific actions on specified resources under certain conditions.</p><h2>Types of AWS Policies<br></h2><ol><li style="background-color: transparent"><p><strong class="">Identity-based policies</strong>:<br>These are attached to IAM users, groups, or roles. They define what actions those identities can perform on which resources.<br>Example: Allowing a user to read objects from a specific S3 bucket.</p></li><li style="background-color: transparent"><p><strong class="">Resource-based policies</strong>:<br>These are attached directly to AWS resources (such as S3 buckets, SQS queues, or SNS topics). They specify who (which users, accounts, or roles) can access the resource and what actions they can perform.<br>Example: Allowing another AWS account to write to your S3 bucket.</p></li><li style="background-color: transparent"><p><strong class="">Permissions boundaries</strong>:<br>These are advanced policies that set the maximum permissions an IAM entity (user or role) can have. They act as a boundary, ensuring that even if a user is granted broader permissions elsewhere, they cannot exceed the boundary.</p></li><li style="background-color: transparent"><p><strong class="">Service control policies (SCPs)</strong>:<br>Used with AWS Organizations, SCPs set permission guardrails for accounts or organizational units (OUs). They do not grant permissions but restrict the maximum available permissions.</p></li><li style="background-color: transparent"><p><strong class="">Session policies</strong>:<br>These are passed when you assume a role or federate a user session. They provide temporary, additional restrictions for the session.</p></li></ol><h2>Utility of AWS Policies in IAM​</h2><ul><li style="background-color: transparent"><p><strong class="">Fine-grained access control</strong>:<br>Policies allow you to specify exactly who can do what, on which resources, and under what conditions. This minimizes the risk of unauthorized access.</p></li><li style="background-color: transparent"><p><strong class="">Separation of duties</strong>:<br>By assigning different policies to different users, groups, or roles, you can enforce the principle of least privilege, ensuring users have only the permissions they need.</p></li><li style="background-color: transparent"><p><strong class="">Scalability and manageability</strong>:<br>Policies can be reused and attached to multiple identities or resources, making it easier to manage permissions as your AWS environment grows.</p></li><li style="background-color: transparent"><p><strong class="">Audit and compliance</strong>:<br>Policies provide a clear, auditable record of who has access to what, which is essential for compliance and security reviews.</p></li></ul><p><br></p><h4>Example Policy</h4><p>Here is a simple example of an identity-based policy that allows listing all S3 buckets:</p><pre>​​<span style="color: #cccccc">{</span><br><span style="color: #569cd6">"Version"</span><span style="color: #cccccc">: </span><span style="color: #ce9178">"2012-10-17"</span><span style="color: #cccccc">,</span><br><span style="color: #569cd6">"Statement"</span><span style="color: #cccccc">: [</span><br><span style="color: #cccccc">    {</span><br><span style="color: #569cd6">"Effect"</span><span style="color: #cccccc">: </span><span style="color: #ce9178">"Allow"</span><span style="color: #cccccc">,</span><br><span style="color: #569cd6">"Action"</span><span style="color: #cccccc">: </span><span style="color: #ce9178">"s3:ListAllMyBuckets"</span><span style="color: #cccccc">,</span><br><span style="color: #569cd6">"Resource"</span><span style="color: #cccccc">: </span><span style="color: #ce9178">"*"</span><br><span style="color: #cccccc">    }</span><br><span style="color: #cccccc">  ]</span><br><span style="color: #cccccc">}</span><br></pre><blockquote><p>​AWS policies are the foundation of access management in AWS. They provide the flexibility and control needed to secure your cloud resources, enforce organizational security standards, and support compliance requirements. Properly designed policies are essential for a secure and well-governed AWS environment.<br></p></blockquote><p>​<br></p>

AWS Policies and Their Utility in IAM

Home

<p>Cloud computing is a technology that delivers computing services—such as servers, storage, databases, networking, software, and analytics—over the internet (“the cloud”). Instead of owning and maintaining physical hardware and software, users can access these resources on-demand from cloud providers, paying only for what they use. This approach offers flexibility, scalability, and cost savings, making it popular for businesses and individuals alike.</p><div class="se-component se-image-container __se__float-none" style="width: 100%"><figure style="width: 100%;"><img src="https://www.api.cstechie.com/upload/editor-image/Types_of_Java_I_O_Streams_-_visual_selection_(1)_1752865259934.png" alt="Cloud Computing Features" data-rotate="" data-proportion="true" data-size="100%," data-align="none" data-percentage="100," data-file-name="Types of Java I_O Streams - visual selection (1).png" data-file-size="77689" data-origin="," style="width: 100%;"></figure></div><h2><strong class="">Key Features of Cloud Computing:</strong></h2><ul><li style="background-color: transparent"><strong class="">On-Demand Self-Service:</strong> Users can provision computing resources automatically, without human intervention from the service provider.</li><li style="background-color: transparent"><strong class="">Broad Network Access:</strong> Services are available over the network and accessed through standard devices like laptops, smartphones, and tablets.</li><li style="background-color: transparent"><strong class="">Resource Pooling:</strong> Cloud providers use multi-tenant models to serve multiple customers with dynamically assigned resources.</li><li style="background-color: transparent"><strong class="">Rapid Elasticity:</strong> Resources can be scaled up or down quickly based on demand, providing flexibility and efficiency.</li><li style="background-color: transparent"><strong class="">Measured Service:</strong> Usage is monitored, controlled, and reported, so users pay only for what they consume.</li><li style="background-color: transparent"><strong class="">Reliability and Availability:</strong> Cloud services are designed for high availability and disaster recovery, ensuring continuous access.</li><li style="background-color: transparent"><strong class="">Security:</strong> Leading cloud providers offer robust security features, including data encryption, identity management, and compliance certifications.</li></ul><blockquote><p>​​​Cloud computing supports various service models such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS), enabling users to choose the right level of control and management for their needs.<br></p></blockquote>

Cloud Computing Introduction

<p>The AWS Shared Responsibility Model is a fundamental concept that outlines the security responsibilities between Amazon Web Services (AWS) and its customers. It clarifies what AWS is responsible for and what the customer is responsible for when using AWS cloud services. This model helps ensure that security is properly managed and understood by both parties.<br></p><h2>"Security <em>of</em> the Cloud" - AWS Responsibility​<br></h2><p>​AWS is responsible for the security <em>of</em> the cloud. This means AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud. This infrastructure includes the hardware, software, networking, and facilities that run AWS Cloud services.</p><p><br></p><p>AWS's responsibilities include:</p><ul><li style="background-color: transparent"><strong class="">Physical Security:</strong> Protecting the global infrastructure, including data centers, hardware, and networking components.</li><li style="background-color: transparent"><strong class="">Network Security:</strong> Securing the network infrastructure, including firewalls, routing, and network access control.</li><li style="background-color: transparent"><strong class="">Compute:</strong> Securing the underlying compute infrastructure (e.g., EC2 instances, Lambda functions).</li><li style="background-color: transparent"><strong class="">Storage:</strong> Securing the underlying storage infrastructure (e.g., S3, EBS, RDS).</li><li style="background-color: transparent"><strong class="">Database:</strong> Securing the underlying database infrastructure.</li><li style="background-color: transparent"><strong class="">Regions, Availability Zones, and Edge Locations:</strong> Ensuring the security and resilience of these foundational components.</li></ul><h2>"Security <em>in</em> the Cloud" - Customer Responsibility​<br></h2><p>​The customer is responsible for security <em>in</em> the cloud. This means customers are responsible for securing their data, applications, and configurations within the AWS environment. The customer's responsibilities vary depending on the cloud service model they are using (IaaS, PaaS, or SaaS).</p><p><strong class="">Customer responsibilities generally include:</strong></p><ul><li style="background-color: transparent"><strong class="">Data:</strong> Managing and securing their data, including encryption, access control, and data integrity.</li><li style="background-color: transparent"><strong class="">Operating Systems:</strong> Configuring and patching guest operating systems (for IaaS services like EC2).</li><li style="background-color: transparent"><strong class="">Applications:</strong> Securing their applications, including application code, dependencies, and configurations.</li><li style="background-color: transparent"><strong class="">Network Configuration:</strong> Configuring network security groups, NACLs, and routing tables.</li><li style="background-color: transparent"><strong class="">Identity and Access Management (IAM):</strong> Managing user access, permissions, and credentials (e.g., IAM users, groups, roles, policies).</li><li style="background-color: transparent"><strong class="">Client-Side Data Encryption:</strong> Encrypting data before it's sent to AWS.</li><li style="background-color: transparent"><strong class="">Server-Side Encryption (File System and Data):</strong> Configuring encryption for data at rest and in transit.</li><li style="background-color: transparent"><strong class="">Security Awareness and Training:</strong> Ensuring their employees are aware of security best practices.</li></ul><p><br></p><div class="se-component se-image-container __se__float-none" style="width: 100%"><figure style="width: 100%;"><img src="https://www.api.cstechie.com/upload/editor-image/shared-reponsibility_1753862842045.jpeg" alt="Shared Responsibility Model" data-rotate="" data-proportion="true" data-size="100%," data-align="none" data-percentage="100," data-file-name="shared-reponsibility.jpeg" data-file-size="128735" data-origin="," style="width: 100%;"></figure></div><h3><strong class=""><br></strong></h3><h3><strong class="">Shared Responsibility Model In IAM</strong></h3><table class="se-table-layout-fixed"><thead><tr><th><div>AWS</div></th><th><div>User</div></th></tr></thead><tbody><tr><td><div>Global Network Security (Infrastructure)</div></td><td><div>Users, Groups, Roles, Policies management ad monitoring.</div></td></tr><tr><td><div>Configuration and Vulnerability analysis.</div></td><td><div>Enable MFA on all accounts.</div></td></tr><tr><td><div>Complience Validation.</div></td><td><div>Rotate all the keys.</div></td></tr><tr><td><div>-</div></td><td><div>Use IAM tools to apply approperiate permission.</div></td></tr><tr><td><div>-</div></td><td><div>Analyze acees patterns &amp; review permission.</div></td></tr></tbody></table><p><strong class=""><br></strong></p><h3><strong class=""><br></strong></h3><h3><strong class="">Varying Responsibilities by Service Model:</strong></h3><p>The shared responsibility model shifts depending on the service model:</p><ul><li style="background-color: transparent"><strong class="">Infrastructure as a Service (IaaS) - e.g., Amazon EC2:</strong><ul><li style="background-color: transparent"><strong class="">AWS:</strong> Responsible for the underlying infrastructure (physical security, virtualization layer).</li><li style="background-color: transparent"><strong class="">Customer:</strong> Responsible for the operating system, applications, network configuration, and data.</li></ul></li><li style="background-color: transparent"><strong class="">Platform as a Service (PaaS) - e.g., Amazon RDS, AWS Lambda:</strong><ul><li style="background-color: transparent"><strong class="">AWS:</strong> Manages the underlying infrastructure, operating system, and database software.</li><li style="background-color: transparent"><strong class="">Customer:</strong> Responsible for their application code, data, and IAM configurations.</li></ul></li><li style="background-color: transparent"><strong class="">Software as a Service (SaaS) - e.g., Amazon S3, Amazon DynamoDB:</strong><ul><li style="background-color: transparent"><strong class="">AWS:</strong> Manages almost all aspects, including infrastructure, operating system, and application.</li><li style="background-color: transparent"><strong class="">Customer:</strong> Primarily responsible for their data, access management (IAM), and client-side encryption.</li></ul></li></ul><p><br></p><h3><strong class="">Why is the Shared Responsibility Model Important?</strong></h3><ul><li style="background-color: transparent"><strong class="">Clarity:</strong> It clearly defines the security boundaries, helping customers understand their role in securing their cloud environment.</li><li style="background-color: transparent"><strong class="">Risk Management:</strong> It allows both AWS and the customer to focus on their respective areas of responsibility, leading to better overall security.</li><li style="background-color: transparent"><strong class="">Compliance:</strong> Understanding the model is crucial for meeting compliance requirements (e.g., HIPAA, GDPR, PCI DSS), as it helps identify which party is responsible for specific controls.</li></ul><p><br></p>

AWS shared Responsibility Model

<p>AWS Identity and Access Management (IAM) is a core service in Amazon Web Services that enables you to securely control access to AWS resources. IAM allows you to manage users, groups, roles, and permissions, ensuring that only authorized individuals and systems can access specific resources in your AWS environment. One of the key features of IAM is the ability to organize users into groups, making permission management more efficient and scalable.<br></p><h2>What is AWS IAM?<br></h2><p>AWS IAM is a web service that helps you manage access to AWS services and resources securely. With IAM, we can create and manage AWS users and groups, and use permissions to allow or deny their access to AWS resources. IAM is integrated with most AWS services and is provided at no additional cost.</p><p>IAM operates on the principle of least privilege, meaning users and services should only have the permissions necessary to perform their tasks—nothing more. This approach minimizes security risks and helps organizations maintain tight control over their cloud environments.</p><h2>IAM Users<br></h2><p>An IAM user is an entity that you create in AWS to represent a person or application that interacts with AWS resources. Each user has a unique name and credentials, such as a password or access keys, which are used to sign in and make requests to AWS services.</p><p>IAM users are ideal for individuals who need their own credentials to access the AWS Management Console, AWS CLI, or AWS API. You can assign permissions directly to users, but as the number of users grows, managing individual permissions can become complex and error-prone.</p><p><br></p><h2>IAM Groups<br></h2><p>IAM groups are collections of IAM users. Groups make it easier to manage permissions for multiple users at once. Instead of assigning permissions to each user individually, we can assign permissions to a group, and all users in that group inherit those permissions.</p><p>For example, we might create groups such as "<strong>Developers</strong>," "<strong>Admins</strong>," and "<strong>ReadOnlyUsers</strong>," each with different levels of access. When a new developer joins our team, we simply add them to the "Developers" group, and they automatically receive the appropriate permissions.</p><div class="se-component se-image-container __se__float-center"><figure><img src="https://www.api.cstechie.com/upload/editor-image/AWS_IAM_Groups_Diagram_1753704509269.png" alt="IAM Diagram with Groups and policies" data-rotate="" data-proportion="true" data-size="," data-align="center" data-percentage="auto,auto" data-file-name="AWS IAM Groups Diagram.png" data-file-size="19655" data-origin="," style=""></figure></div><h3><strong class="">Key Points about IAM Groups:</strong></h3><ul><li style="background-color: transparent">A user can belong to multiple groups.</li><li style="background-color: transparent">Groups cannot be nested (a group cannot contain another group).</li><li style="background-color: transparent">Permissions assigned to a group are automatically applied to all its members.</li><li style="background-color: transparent">You can change group membership or permissions at any time, and changes take effect immediately.</li></ul><h3><br></h3><h3>Managing Permissions with Policies<br></h3><p>Permissions in IAM are managed using policies, which are JSON documents that define what actions are allowed or denied for specific AWS resources. we can attach policies to users, groups, or roles to grant the necessary permissions.</p><p>By attaching policies to groups, we simplify permission management. For example, we can attach an S3 read-only policy to a "ReadOnlyUsers" group, ensuring all members can only view S3 buckets and objects, but not modify them.</p><blockquote><p>In AWS we apply <strong>Least Privilege Principle , Don't give more permission than user need</strong><br></p></blockquote><h3>1. S3 Read-Only Policy<br></h3><pre>​  <span style="color: #cccccc">{</span><br><span style="color: #9cdcfe">"Version"</span><span style="color: #cccccc">: </span><span style="color: #ce9178">"2012-10-17"</span><span style="color: #cccccc">,</span><br><span style="color: #9cdcfe">"Statement"</span><span style="color: #cccccc">: [</span><br><span style="color: #cccccc">    {</span><br><span style="color: #9cdcfe">"Effect"</span><span style="color: #cccccc">: </span><span style="color: #ce9178">"Allow"</span><span style="color: #cccccc">,</span><br><span style="color: #9cdcfe">"Action"</span><span style="color: #cccccc">: [</span><br><span style="color: #ce9178">"s3:GetObject"</span><span style="color: #cccccc">,</span><br><span style="color: #ce9178">"s3:GetObjectVersion"</span><span style="color: #cccccc">,</span><br><span style="color: #ce9178">"s3:ListBucket"</span><br><span style="color: #cccccc">      ],</span><br><span style="color: #9cdcfe">"Resource"</span><span style="color: #cccccc">: [</span><br><span style="color: #ce9178">"arn:aws:s3:::my-bucket"</span><span style="color: #cccccc">,</span><br><span style="color: #ce9178">"arn:aws:s3:::my-bucket/*"</span><br><span style="color: #cccccc">      ]</span><br><span style="color: #cccccc">    }</span><br><span style="color: #cccccc">  ]</span><br><span style="color: #cccccc">}</span><br></pre><h3><br></h3><h3>2. EC2 Developer Policy<br></h3><pre><span style="color: #cccccc">{</span><br><span style="color: #9cdcfe">"Version"</span><span style="color: #cccccc">: </span><span style="color: #ce9178">"2012-10-17"</span><span style="color: #cccccc">,</span><br><span style="color: #9cdcfe">"Statement"</span><span style="color: #cccccc">: [</span><br><span style="color: #cccccc">    {</span><br><span style="color: #9cdcfe">"Effect"</span><span style="color: #cccccc">: </span><span style="color: #ce9178">"Allow"</span><span style="color: #cccccc">,</span><br><span style="color: #9cdcfe">"Action"</span><span style="color: #cccccc">: [</span><br><span style="color: #ce9178">"ec2:DescribeInstances"</span><span style="color: #cccccc">,</span><br><span style="color: #ce9178">"ec2:DescribeImages"</span><span style="color: #cccccc">,</span><br><span style="color: #ce9178">"ec2:DescribeKeyPairs"</span><span style="color: #cccccc">,</span><br><span style="color: #ce9178">"ec2:DescribeSecurityGroups"</span><span style="color: #cccccc">,</span><br><span style="color: #ce9178">"ec2:RunInstances"</span><span style="color: #cccccc">,</span><br><span style="color: #ce9178">"ec2:StopInstances"</span><span style="color: #cccccc">,</span><br><span style="color: #ce9178">"ec2:StartInstances"</span><span style="color: #cccccc">,</span><br><span style="color: #ce9178">"ec2:TerminateInstances"</span><br><span style="color: #cccccc">      ],</span><br><span style="color: #9cdcfe">"Resource"</span><span style="color: #cccccc">: </span><span style="color: #ce9178">"*"</span><span style="color: #cccccc">,</span><br><span style="color: #9cdcfe">"Condition"</span><span style="color: #cccccc">: {</span><br><span style="color: #9cdcfe">"StringEquals"</span><span style="color: #cccccc">: {</span><br><span style="color: #9cdcfe">"ec2:InstanceType"</span><span style="color: #cccccc">: [</span><span style="color: #ce9178">"t2.micro"</span><span style="color: #cccccc">, </span><span style="color: #ce9178">"t2.small"</span><span style="color: #cccccc">]</span><br><span style="color: #cccccc">        }</span><br><span style="color: #cccccc">      }</span><br><span style="color: #cccccc">    }</span><br><span style="color: #cccccc">  ]</span><br><span style="color: #cccccc">}</span><br>​<br><br></pre><h3><br></h3><h3>3. Admin Policy (Full Access)<br></h3><pre><span style="color: #cccccc">{</span><br><span style="color: #9cdcfe">"Version"</span><span style="color: #cccccc">: </span><span style="color: #ce9178">"2012-10-17"</span><span style="color: #cccccc">,</span><br><span style="color: #9cdcfe">"Statement"</span><span style="color: #cccccc">: [</span><br><span style="color: #cccccc">    {</span><br><span style="color: #9cdcfe">"Effect"</span><span style="color: #cccccc">: </span><span style="color: #ce9178">"Allow"</span><span style="color: #cccccc">,</span><br><span style="color: #9cdcfe">"Action"</span><span style="color: #cccccc">: </span><span style="color: #ce9178">"*"</span><span style="color: #cccccc">,</span><br><span style="color: #9cdcfe">"Resource"</span><span style="color: #cccccc">: </span><span style="color: #ce9178">"*"</span><br><span style="color: #cccccc">    }</span><br><span style="color: #cccccc">  ]</span><br><span style="color: #cccccc">}</span><br>​<br><br></pre><h3><br></h3><h3>Best Practices for Using IAM and Groups</h3><ul><li style="background-color: transparent"><strong class="">Use Groups for Permission Management:</strong> Assign permissions to groups rather than individual users to simplify administration.</li><li style="background-color: transparent"><strong class="">Follow the Principle of Least Privilege:</strong> Grant only the permissions users need to perform their tasks.</li><li style="background-color: transparent"><strong class="">Regularly Review Group Memberships and Policies:</strong> Ensure users have appropriate access and remove unnecessary permissions.</li><li style="background-color: transparent"><strong class="">Enable Multi-Factor Authentication (MFA):</strong> Add an extra layer of security for users, especially those with elevated privileges.</li><li style="background-color: transparent"><strong class="">Monitor IAM Activity:</strong> Use AWS CloudTrail and IAM Access Analyzer to track and audit IAM actions.</li></ul><p><br></p><h3>Summary<br></h3><blockquote><ul><li>IAM : Identity Access Management (Global Service).<br></li><li>By Default Root Account is Created should not shared or used.</li><li>Users are those who works in our organization and can be grouped.</li><li>Groups only contains Users not other groups.</li><li>It is not mandatory to wrap user to group, User can be part of 0 group or Multiple groups</li></ul></blockquote>

AWS IAM Groups and Policies

<p>To create a <strong class="">group</strong> and a <strong class="">user</strong> in AWS, you typically use the AWS Management Console, AWS CLI, or Infrastructure as Code tools like CloudFormation or Terraform. Here’s a quick guide for the most common methods:</p><h2>​Using AWS Management Console<br></h2><h3>​1. <strong class="">Create a Group</strong></h3><ul><li style="background-color: transparent">Sign in to the <a href="https://console.aws.amazon.com/" target="_blank" rel="noopener noreferrer">AWS Management Console</a>.</li><li style="background-color: transparent">Go to <strong class="">IAM</strong> (Identity and Access Management).</li><li style="background-color: transparent">In the left navigation pane, click <strong class="">User groups</strong>.</li><li style="background-color: transparent">Click <strong class="">Create group</strong>.</li><li style="background-color: transparent">Enter a <strong class="">Group name</strong>.</li><li style="background-color: transparent">(Optional) Attach policies to set permissions for the group.</li><li style="background-color: transparent">Click <strong class="">Create User group</strong>.</li></ul><div class="se-component se-image-container __se__float-none" style="width: 100%"><figure style="width: 100%;"><img src="https://www.api.cstechie.com/upload/editor-image/iam-dashboard_1754200230492.png" alt="IAM Dashboard" data-rotate="" data-proportion="true" data-size="100%,236px" data-align="none" data-file-name="iam-dashboard.png" data-file-size="179742" data-origin="," style="width: 100%; height: 236px;"></figure></div><h3><br></h3><h3>as per Above image we can clearly see no group is existing.</h3><p>Next Step to click on User Groups link available in left side menu.<br></p><p>Next Page will appear where user can click on "Create Group" button to create the group with desired policies.</p><div class="se-component se-image-container __se__float-none" style="width: 100%"><figure style="width: 100%;"><img src="https://www.api.cstechie.com/upload/editor-image/group-create_1754200522775.png" alt="Group creation page3" data-rotate="" data-proportion="true" data-size="100%," data-align="none" data-percentage="100," data-file-name="group-create.png" data-file-size="184907" data-origin="," style="width: 100%;"></figure></div><h3><br></h3><h3>After Submit the "Create User Group " group will be successfully created.&nbsp;</h3><p>Next Page looks like below:<br></p><div class="se-component se-image-container __se__float-none" style="width: 100%"><figure style="width: 100%;"><img src="https://www.api.cstechie.com/upload/editor-image/group-create-success_1754200677579.png" alt="Group Success Page" data-rotate="" data-proportion="true" data-size="100%," data-align="none" data-percentage="100," data-file-name="group-create-success.png" data-file-size="54511" data-origin="," style="width: 100%;"></figure></div><h3>After Successful creation of Group. Below is the new IAM dashboard.</h3><div class="se-component se-image-container __se__float-none" style="width: 100%"><figure style="width: 100%;"><img src="https://www.api.cstechie.com/upload/editor-image/new-iam-dashboard_1754201761903.png" alt="IAM Dashboard" data-rotate="" data-proportion="true" data-size="100%," data-align="none" data-percentage="100," data-file-name="new-iam-dashboard.png" data-file-size="129255" data-origin="," style="width: 100%;"></figure></div><p><br></p><h3>2.<strong class="">Create a User</strong></h3><ul><li style="background-color: transparent">In the IAM dashboard, click <strong class="">Users</strong> in the left pane.</li><li style="background-color: transparent">Click <strong class="">Add users</strong>.</li><li style="background-color: transparent">Enter a <strong class="">User name</strong>.</li><li style="background-color: transparent">Select the type of access (Programmatic access, AWS Management Console access, or both).</li><li style="background-color: transparent">Click <strong class="">Next: Permissions</strong>.</li><li style="background-color: transparent">Add the user to the group you created earlier (or assign permissions directly).</li><li style="background-color: transparent">Complete the steps and click <strong class="">Create user</strong>.</li></ul><h3>Find The screenshot for all steps during User creation.</h3><h3>Available Users</h3><div class="se-component se-image-container __se__float-none" style="width: 100%"><figure style="width: 100%;"><p><img src="https://www.api.cstechie.com/upload/editor-image/user_create_dashboard_1754327858208.png" alt="Create User Dashboard" data-rotate="" data-proportion="true" data-size="100%," data-align="none" data-percentage="100," data-file-name="user_create_dashboard.png" data-file-size="126328" data-origin="," style="width: 100%;"></p></figure></div><blockquote><h3>Note: As per above screenshot, we can see, region will be global during User or Group creation.<br></h3></blockquote><h3>After Clicking on Create User button next Page will be&nbsp;</h3><div class="se-component se-image-container __se__float-none" style="width: 100%"><figure style="width: 100%;"><img src="https://www.api.cstechie.com/upload/editor-image/create_user_1_1754328243901.png" alt="First Phase of Creating User in AWS" data-rotate="" data-proportion="true" data-size="100%," data-align="none" data-percentage="100," data-file-name="create_user_1.png" data-file-size="117878" data-origin="," style="width: 100%;"></figure></div><p><strong>&gt;&gt; Next&nbsp;</strong></p><div class="se-component se-image-container __se__float-none" style="width: 100%"><figure style="width: 100%;"><img src="https://www.api.cstechie.com/upload/editor-image/create_user_2_1754328305162.png" alt="Create User Phase 2" data-rotate="" data-proportion="true" data-size="100%," data-align="none" data-percentage="100," data-file-name="create_user_2.png" data-file-size="113737" data-origin="," style="width: 100%;"></figure></div><p>&nbsp;&gt;&gt; Next</p><div class="se-component se-image-container __se__float-none" style="width: 100%"><figure style="width: 100%;"><img src="https://www.api.cstechie.com/upload/editor-image/create_user_3_1754328339225.png" alt="Create User Phase 3" data-rotate="" data-proportion="true" data-size="100%," data-align="none" data-percentage="100," data-file-name="create_user_3.png" data-file-size="96752" data-origin="," style="width: 100%;"></figure></div><p><br></p><p>&gt;&gt; Create User</p><div class="se-component se-image-container __se__float-none" style="width: 100%"><figure style="width: 100%;"><img src="https://www.api.cstechie.com/upload/editor-image/create_user_success_1754328393118.png" alt="User created Successfully" data-rotate="" data-proportion="true" data-size="100%," data-align="none" data-percentage="100," data-file-name="create_user_success.png" data-file-size="85120" data-origin="," style="width: 100%;"></figure></div><h3>Using AWS CLI<br></h3><h3>​1. <strong class="">Create a Group</strong></h3><h3>​aws iam create-group --group-name MyGroup<br></h3><h3>2. <strong class="">Create a User</strong></h3><h3>​aws iam create-user --user-name MyUser<br></h3><h3>3. <strong class="">Add User to Group</strong></h3><h3>​aws iam add-user-to-group --user-name MyUser --group-name MyGroup<br></h3><h3>4. <strong class="">Attach Policy to Group (Optional)</strong></h3><h3>​aws iam attach-group-policy --group-name MyGroup --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess<br></h3><h3>Using CloudFormation (YAML Example)<br></h3><h3><span style="color: #569cd6">Resources</span><span style="color: #cccccc">:</span><br><span style="color: #569cd6"> MyGroup</span><span style="color: #cccccc">:</span><br><span style="color: #569cd6">  Type</span><span style="color: #cccccc">: </span><span style="color: #ce9178">AWS::IAM::Group</span><br><span style="color: #569cd6"> Properties</span><span style="color: #cccccc">:</span><br><span style="color: #569cd6">  GroupName</span><span style="color: #cccccc">: </span><span style="color: #ce9178">MyGroup<br><br></span><br><span style="color: #569cd6"> MyUser</span><span style="color: #cccccc">:</span><br><span style="color: #569cd6">  Type</span><span style="color: #cccccc">: </span><span style="color: #ce9178">AWS::IAM::User</span><br><span style="color: #569cd6">  Properties</span><span style="color: #cccccc">:</span><br><span style="color: #569cd6">   UserName</span><span style="color: #cccccc">: </span><span style="color: #ce9178">MyUser</span><br><span style="color: #569cd6">   Groups</span><span style="color: #cccccc">:</span><br><span style="color: #cccccc">        - </span><span style="color: #808080">!</span><span style="color: #569cd6">Ref</span><span style="color: #ce9178">MyGroup</span><br><br></h3>

Create Group and User in AWS

<h2>Password Pilicy&nbsp;</h2><p>AWS Identity and Access Management (IAM) allows us to set a custom password policy for your IAM users. If user doesn't set a custom policy, AWS enforces a <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#id_credentials_passwords_account-policy-default" target="_blank" rel="noopener noreferrer"><span style="color: rgb(0, 85, 255)">default passwor​d policy</span></a>.</p><p>The default AWS password policy requires:</p><ul><li style="background-color: transparent">A minimum password length of 8 characters and a maximum of 128 characters.</li><li style="background-color: transparent">At least three of the following character types: uppercase letters, lowercase letters, numbers, and non-alphanumeric characters (e.g., <code>! @ # $ % ^ &amp; * ( ) _ + - = [ ] { } | '</code>).</li><li style="background-color: transparent">The password must not be identical to your AWS account name or email address.</li><li style="background-color: transparent">Passwords never expire.</li></ul><p>User can customize this policy to include additional requirements such as a different minimum length, specific character types, password expiration, and preventing password reuse. For more details on setting a custom policy, refer to the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html" target="_blank" rel="noopener noreferrer"><span style="color: rgb(0, 85, 255)">AWS documentation</span></a>.</p><h2>Multi Factor Authentication (MFA)</h2><p>Multi-Factor Authentication (MFA) in AWS is a security feature that requires users to present two or more forms of authentication before they can access AWS resources. This adds an extra layer of protection beyond just a username and password.</p><h3>In AWS, MFA typically involves:</h3><ol><li style="background-color: transparent"><strong class="">Something you know:</strong> Your password.</li><li style="background-color: transparent"><strong class="">Something you Own:</strong> A physical or virtual MFA device that generates a time-based one-time password (TOTP).</li></ol><p>When MFA is enabled, users must enter their password and a code from their MFA device to sign in or perform certain sensitive operations.</p><h3><strong class="">Types of MFA devices supported by AWS:</strong></h3><ul><li style="background-color: transparent"><strong class="">Virtual MFA devices:</strong> Applications such as Google Authenticator or Authy installed on smartphones or tablets.</li><li style="background-color: transparent"><strong class="">Hardware MFA devices:</strong> Physical devices that generate TOTP codes, such as key fobs.</li><li style="background-color: transparent"><strong class="">U2F security keys:</strong> Devices that support the Universal 2nd Factor (U2F) standard, such as YubiKey.</li></ul><h3><strong class="">Use cases for MFA in AWS:</strong></h3><ul><li style="background-color: transparent">Securing the AWS Management Console login for IAM users and the root account.</li><li style="background-color: transparent">Protecting sensitive API operations (for example, deleting resources or changing account settings).</li><li style="background-color: transparent">Enforcing MFA for privileged users or roles.</li></ul><h3><strong class="">Enabling MFA:</strong></h3><p>User can enable MFA for the AWS root user and for individual IAM users. AWS strongly recommends enabling MFA, especially for the root account, to reduce the risk of unauthorized access.</p><p>For detailed steps on enabling and managing MFA in AWS, refer to the official <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html" target="_blank" rel="noopener noreferrer">AWS documentation</a>.</p><p><br></p>

Password Policy And MFA In AWS

<p>There are three primary options to access an AWS account:</p><h3>1. AWS Management Console</h3><p>This is a web-based user interface that allows users to interact with AWS services visually. Users log in using a username and password, and optionally an MFA code.</p><blockquote><p>This can be protected by Password + MFA<br></p></blockquote><p><strong class="">Example:</strong><br>An IAM user named "alice" logs in at <a href="https://console.aws.amazon.com" target="_blank" rel="noopener noreferrer"><span style="color: rgb(0, 85, 255)">https://console.aws.amazon.com</span></a> using her username, password, and an MFA code to manage EC2 instances and S3 buckets.</p><p><br></p><h3>2. AWS Command Line Interface (CLI)</h3><p>The AWS CLI is a tool that allows users to interact with AWS services from a terminal or command prompt using commands. Users authenticate using access keys (an access key ID and a secret access key).</p><div class="se-component se-image-container __se__float-none" style="width: 100%"><figure style="width: 100%;"><img src="https://www.api.cstechie.com/upload/editor-image/accesskeylastuseddetail-fake_1754534932244.png" alt="Access Key Specimen" data-rotate="" data-proportion="true" data-size="100%," data-align="none" data-percentage="100," data-file-name="accesskeylastuseddetail-fake.png" data-file-size="91102" data-origin="," origin-size="600,310" style="width: 100%;"></figure></div><blockquote><p>​<span style="color: rgb(153, 153, 153);background-color: rgb(255, 248, 220)">Protected by Access Key</span>​<br></p></blockquote><p><strong class="">Example:</strong><br>A developer configures the AWS CLI with their access keys and runs the following command to list all S3 buckets:</p><pre>aws s3 ls  <br></pre><p><br></p><h3>3. AWS Software Development Kits (SDKs) and APIs</h3><p>AWS provides SDKs for various programming languages (such as Python, Java, and Node.js) that allow developers to programmatically interact with AWS services. Authentication is done using access keys or IAM roles.</p><blockquote><p>Protected by Access Key<br></p></blockquote><p><strong class="">Example:</strong><br>A Python application uses the AWS SDK for Python (Boto3) to upload a file to an S3 bucket:</p><pre>​​<span style="color: #c586c0">import</span><span style="color: #cccccc"> boto3</span><br><span style="color: #cccccc">s3 </span><span style="color: #d4d4d4">=</span><span style="color: #cccccc"> boto3.client(</span><span style="color: #ce9178">'s3'</span><span style="color: #cccccc">)</span><br><span style="color: #cccccc">s3.upload_file(</span><span style="color: #ce9178">'localfile.txt'</span><span style="color: #cccccc">, </span><span style="color: #ce9178">'my-bucket'</span><span style="color: #cccccc">, </span><span style="color: #ce9178">'remotefile.txt'</span><span style="color: #cccccc">)</span><br></pre><p><br></p><p>These three options—Management Console, CLI, and SDKs/APIs—cover the main ways users and applications can access and manage AWS resources.<br></p>

Way To Access AWS Accounts

<p>​<strong class="">AWS CloudShell</strong> is a browser-based, pre-configured shell environment provided by AWS. It allows you to securely manage, explore, and interact with your AWS resources directly from your web browser, without needing to install or configure any local tools.</p><p><span style="font-size: 19px">Key Features of AWS CloudShell</span></p><ul><li style="background-color: transparent"><strong class="">Pre-installed Tools:</strong> CloudShell comes with the AWS CLI, AWS SDKs, and other common tools (such as Python, Node.js, Git, and more) already installed.</li><li style="background-color: transparent"><strong class="">Persistent Storage:</strong> Each user gets 1 GB of persistent storage in their home directory, which is retained across sessions.</li><li style="background-color: transparent"><strong class="">Secure Access:</strong> CloudShell automatically uses the credentials of the user who is signed in to the AWS Management Console, ensuring secure and seamless access to AWS resources.</li><li style="background-color: transparent"><strong class="">No Local Setup Required:</strong> You do not need to install or configure the AWS CLI or SDKs on your local machine.</li><li style="background-color: transparent"><strong class="">Region Support:</strong> CloudShell is available in multiple AWS regions, and the environment is region-specific.</li></ul><h3><br></h3><h3>Example Usage</h3><p>Suppose you want to list all S3 buckets in your account. You can open AWS CloudShell from the AWS Management Console and run:</p><pre>aws s3 ls </pre><p>Or, you can clone a Git repository, write scripts, and interact with AWS services directly from the browser.</p><p><br></p><h3>How to Access AWS CloudShell</h3><ol><li style="background-color: transparent">Sign in to the <a href="https://console.aws.amazon.com/" target="_blank" rel="noopener noreferrer"><span style="color: rgb(0, 85, 255)">AWS Management Console</span></a>.</li><li style="background-color: transparent">Click the <strong class="">CloudShell</strong> icon (usually found in the top navigation bar).</li><li style="background-color: transparent">A new shell session will open in your browser, ready to use.</li></ol><p><br></p><h3>Use Cases</h3><ul><li style="background-color: transparent">Running AWS CLI commands without local setup.</li><li style="background-color: transparent">Managing AWS resources interactively.</li><li style="background-color: transparent">Writing and testing scripts for automation.</li><li style="background-color: transparent">Troubleshooting and debugging AWS environments.</li></ul>

AWS CloudShell

<p>​<strong class="">IAM roles</strong> in AWS are a fundamental security feature that allow you to delegate access to AWS resources without sharing long-term credentials (such as passwords or access keys). Unlike IAM users, roles are not associated with a specific person or service by default. Instead, they can be assumed by trusted entities, such as IAM users, AWS services, or external identities.​</p><h3>Key Characteristics of IAM Roles</h3><ul><li style="background-color: transparent"><strong class="">Temporary Credentials:</strong> When a role is assumed, AWS provides temporary security credentials with the permissions defined in the role’s policies.</li><li style="background-color: transparent"><strong class="">No Long-Term Credentials:</strong> Roles do not have passwords or access keys attached to them by default.</li><li style="background-color: transparent"><strong class="">Assumable by Trusted Entities:</strong> Roles can be assumed by IAM users, AWS services (like EC2, Lambda), or external users (via identity federation or cross-account access).</li><li style="background-color: transparent"><strong class="">Fine-Grained Permissions:</strong> Permissions are defined using IAM policies attached to the role, specifying what actions are allowed and on which resources.</li></ul><h3><br></h3><h3>Common Use Cases</h3><ul><li style="background-color: transparent"><strong class="">EC2 Instance Roles:</strong> Assign a role to an EC2 instance to allow it to access other AWS services (e.g., S3, DynamoDB) securely, without embedding credentials in the application code.</li><li style="background-color: transparent"><strong class="">Cross-Account Access:</strong> Allow users or services in one AWS account to access resources in another account by assuming a role.</li><li style="background-color: transparent"><strong class="">AWS Service Access:</strong> Grant AWS services (such as Lambda functions or ECS tasks) permissions to interact with other AWS resources.</li><li style="background-color: transparent"><strong class="">Federated Access:</strong> Allow external identities (such as corporate users authenticated via SAML or OIDC) to assume roles and access AWS resources.</li></ul><h3><br></h3><h3>Example</h3><p>Suppose you want an EC2 instance to read objects from an S3 bucket. You would:</p><ol><li style="background-color: transparent">Create an IAM role with a policy that allows <code>s3:GetObject</code> on the desired bucket.</li><li style="background-color: transparent">Attach the role to the EC2 instance.</li><li style="background-color: transparent">The application running on the instance can now access the S3 bucket using the temporary credentials provided by the role.&nbsp;</li></ol><p><br></p><h3>Further Reading</h3><p>For more details, refer to the official <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html" target="_blank" rel="noopener noreferrer"><span style="color: rgb(0, 85, 255)">AWS IAM roles documentation</span></a>. If you need an example policy or guidance on creating and using roles, please specify your requirement.</p>

IAM Roles in AWS

<p><span style="font-size: 20px">Below are the possible questions and their answer that might ask in upcomming AWS certification exam like AWS Cloud Practitioner (CLF-02),&nbsp;AWS AI Practitioner etc.</span></p><p>​<br></p><h4>1. Which AWS service is used to manage users and their permissions in AWS?</h4><p>A) Amazon EC2<br>B) AWS Identity and Access Management (IAM)<br>C) Amazon S3<br>D) AWS CloudTrail<br><strong class="">Answer:</strong> B</p><hr><h4>2. What is the main benefit of using IAM groups?</h4><p>A) To monitor user activity<br>B) To assign permissions to multiple users at once<br>C) To encrypt user passwords<br>D) To create temporary users<br><strong class="">Answer:</strong> B</p><hr><h4>3. What is an IAM policy?</h4><p>A) A document that defines permissions for actions on AWS resources<br>B) A list of users in an AWS account<br>C) A monitoring tool for AWS resources<br>D) A billing report for AWS usage<br><strong class="">Answer:</strong> A</p><hr><h4>4. What happens if a user is not explicitly granted permission to access an AWS resource?</h4><p>A) The user has full access by default<br>B) The user is denied access by default<br>C) The user can request access through the AWS Management Console<br>D) The user can access the resource only during business hours<br><strong class="">Answer:</strong> B</p><hr><h4>5. Which of the following is a best practice for managing IAM user permissions?</h4><p>A) Assign permissions directly to each user<br>B) Use IAM groups to assign permissions<br>C) Give all users administrator access<br>D) Share user credentials among team members<br><strong class="">Answer:</strong> B</p><hr><h4>6. Which IAM entity can you attach a policy to?</h4><p>A) Only users<br>B) Users, groups, and roles<br>C) Only groups<br>D) Only roles<br><strong class="">Answer:</strong> B</p><hr><h4>7. What is the effect of an explicit "Deny" in an IAM policy?</h4><p>A) It overrides any "Allow" permissions<br>B) It is ignored if there is an "Allow"<br>C) It only applies to root users<br>D) It is only valid for S3 buckets<br><strong class="">Answer:</strong> A</p><hr><h4>8. Which type of policy would you use to grant cross-account access to an S3 bucket?</h4><p>A) Identity-based policy<br>B) Resource-based policy<br>C) Permissions boundary<br>D) Service control policy<br><strong class="">Answer:</strong> B</p><hr><h4>9. What is the default maximum number of IAM users per AWS account?</h4><p>A) 10<br>B) 50<br>C) 100<br>D) 5000<br><strong class="">Answer:</strong> C</p><hr><h4>10. Which of the following is NOT a valid IAM policy type?</h4><p>A) Identity-based policy<br>B) Resource-based policy<br>C) Network-based policy<br>D) Permissions boundary<br><strong class="">Answer:</strong> C</p><hr><h4>11. What is the purpose of a permissions boundary in IAM?</h4><p>A) To define the maximum permissions an IAM entity can have<br>B) To encrypt IAM user credentials<br>C) To monitor IAM activity<br>D) To create temporary users<br><strong class="">Answer:</strong> A</p><hr><h4>12. How can you assign the same set of permissions to multiple IAM users efficiently?</h4><p>A) Attach the policy to each user individually<br>B) Add users to an IAM group and attach the policy to the group<br>C) Use a resource-based policy<br>D) Use a service control policy<br><strong class="">Answer:</strong> B</p><hr><h4>13. Which policy element specifies the AWS service action in a policy statement?</h4><p>A) Effect<br>B) Action<br>C) Resource<br>D) Condition<br><strong class="">Answer:</strong> B</p><hr><h4>14. What is the default behavior if a user has no policies attached?</h4><p>A) The user has full access<br>B) The user has no access<br>C) The user can only access S3<br>D) The user can only access IAM<br><strong class="">Answer:</strong> B</p><hr><h4>15. Which of the following is a recommended security best practice for IAM users?</h4><p>A) Use the root account for daily tasks<br>B) Enable multi-factor authentication (MFA)<br>C) Share passwords among users<br>D) Disable CloudTrail logging<br><strong class="">Answer:</strong> B</p><hr><h4>16. What is the purpose of an IAM role?</h4><p>A) To provide temporary access to AWS resources<br>B) To monitor AWS billing<br>C) To encrypt S3 buckets<br>D) To create EC2 instances<br><strong class="">Answer:</strong> A</p><hr><h4>17. Which AWS service can be used to centrally manage multiple AWS accounts and apply policies across them?</h4><p>A) AWS CloudFormation<br>B) AWS Organizations<br>C) Amazon S3<br>D) AWS Lambda<br><strong class="">Answer:</strong> B</p><hr><h4>18. What is the recommended way to provide an application running on an EC2 instance with permissions to access other AWS services?</h4><p>A) Store AWS credentials in the application code<br>B) Assign an IAM role to the EC2 instance<br>C) Use the root account credentials<br>D) Share user credentials<br><strong class="">Answer:</strong> B</p><hr><h4>19. Which of the following actions can be controlled by an IAM policy?</h4><p>A) Starting and stopping EC2 instances<br>B) Accessing objects in S3 buckets<br>C) Creating and deleting DynamoDB tables<br>D) All of the above<br><strong class="">Answer:</strong> D</p><hr><h4>20. What is the AWS root user?</h4><p>A) A user with no permissions<br>B) The first account created when you sign up for AWS, with full access to all resources<br>C) A user created by IAM<br>D) A user with read-only access<br><strong class="">Answer:</strong> B</p>

Possible Certification Questions on IAM Service

<p>AWS Budgets is a cost governance service that lets you set custom budgets for cost, usage, Reserved Instances (RIs), and Savings Plans, then notifies you when actual or forecasted amounts exceed defined thresholds. You can scope budgets to the whole account or narrow them by service, linked account (in AWS Organizations), tags, Cost Categories, region, and more. Notifications can go to email or Amazon SNS (which you can connect to Slack via AWS Chatbot).<br></p><p><br></p><h2>How to set up AWS Budgets (Console)<br></h2><ol><li style="background-color: transparent">Open the Billing and Cost Management console and go to Budgets, then Create budget.</li><li style="background-color: transparent">Choose a budget type (Cost), select time period (Monthly), set start date, and enter your budget amount and currency.</li><li style="background-color: transparent">Add filters if needed, for example Service = Amazon S3, or Tag = Environment:Prod.</li><li style="background-color: transparent">Add alerts, such as 80% for Actual and 100% for Forecasted, and choose recipients (email or SNS topic).</li><li style="background-color: transparent">Name the budget and create it. Repeat for other teams, services, or accounts as needed.</li></ol><h2><br></h2><h2>How to set up using AWS CLI<br></h2><p>Below is a minimal example that creates a monthly cost budget filtered by a tag and two notifications (80% actual, 100% forecasted):<br></p><pre><span style="color: rgb(204, 204, 204)">ACCOUNT_ID=123456789012</span><br><span style="color: rgb(204, 204, 204)">aws budgets create-budget \</span><br><span style="color: rgb(204, 204, 204)">--account-id "$ACCOUNT_ID" \</span><br><span style="color: rgb(204, 204, 204)">--budget '{</span><br><span style="color: rgb(204, 204, 204)">"BudgetName": "monthly-prod-cost",</span><br><span style="color: rgb(204, 204, 204)">"BudgetLimit": { "Amount": "5000", "Unit": "USD" },</span><br><span style="color: rgb(204, 204, 204)">"CostFilters": { "TagKeyValue": ["Environment$Prod"] },</span><br><span style="color: rgb(204, 204, 204)">"CostTypes": {</span><br><span style="color: rgb(204, 204, 204)">"IncludeTax": true,</span><br><span style="color: rgb(204, 204, 204)">"IncludeSubscription": true,</span><br><span style="color: rgb(204, 204, 204)">"UseAmortized": true,</span><br><span style="color: rgb(204, 204, 204)">"UseBlended": false</span><br><span style="color: rgb(204, 204, 204)">},</span><br><span style="color: rgb(204, 204, 204)">"TimeUnit": "MONTHLY",</span><br><span style="color: rgb(204, 204, 204)">"BudgetType": "COST"</span><br><span style="color: rgb(204, 204, 204)">}'</span><br><span style="color: rgb(204, 204, 204)">aws budgets create-notification \</span><br><span style="color: rgb(204, 204, 204)">--account-id "$ACCOUNT_ID" \</span><br><span style="color: rgb(204, 204, 204)">--budget-name "monthly-prod-cost" \</span><br><span style="color: rgb(204, 204, 204)">--notification '{</span><br><span style="color: rgb(204, 204, 204)">"NotificationType": "ACTUAL",</span><br><span style="color: rgb(204, 204, 204)">"ComparisonOperator": "GREATER_THAN",</span><br><span style="color: rgb(204, 204, 204)">"Threshold": 80.0,</span><br><span style="color: rgb(204, 204, 204)">"ThresholdType": "PERCENTAGE"</span><br><span style="color: rgb(204, 204, 204)">}' \</span><br><span style="color: rgb(204, 204, 204)">--subscribers '[</span><br><span style="color: rgb(204, 204, 204)">{ "SubscriptionType": "EMAIL", "Address": "finance@example.com" },</span><br><span style="color: rgb(204, 204, 204)">{ "SubscriptionType": "EMAIL", "Address": "ops@example.com" }</span><br><span style="color: rgb(204, 204, 204)">]'</span><br><span style="color: rgb(204, 204, 204)">aws budgets create-notification \</span><br><span style="color: rgb(204, 204, 204)">--account-id "$ACCOUNT_ID" \</span><br><span style="color: rgb(204, 204, 204)">--budget-name "monthly-prod-cost" \</span><br><span style="color: rgb(204, 204, 204)">--notification '{</span><br><span style="color: rgb(204, 204, 204)">"NotificationType": "FORECASTED",</span><br><span style="color: rgb(204, 204, 204)">"ComparisonOperator": "GREATER_THAN",</span><br><span style="color: rgb(204, 204, 204)">"Threshold": 100.0,</span><br><span style="color: rgb(204, 204, 204)">"ThresholdType": "PERCENTAGE"</span><br><span style="color: rgb(204, 204, 204)">}' \</span><br><span style="color: rgb(204, 204, 204)">--subscribers '[</span><br><span style="color: rgb(204, 204, 204)">{ "SubscriptionType": "EMAIL", "Address": "oncall@example.com" }</span><br><span style="color: rgb(204, 204, 204)">]'</span><br>​​<br><br></pre><h2><br></h2><h2>How to set up using CloudFormation<br></h2><pre><span style="color: #cccccc">AWSTemplateFormatVersion: '2010-09-09'</span><br><span style="color: #cccccc">Resources:</span><br><span style="color: #cccccc">  MonthlyProdCostBudget:</span><br><span style="color: #cccccc">    Type: AWS::Budgets::Budget</span><br><span style="color: #cccccc">    Properties:</span><br><span style="color: #cccccc">      Budget:</span><br><span style="color: #cccccc">        BudgetName: monthly-prod-cost</span><br><span style="color: #cccccc">        BudgetType: COST</span><br><span style="color: #cccccc">        TimeUnit: MONTHLY</span><br><span style="color: #cccccc">        BudgetLimit:</span><br><span style="color: #cccccc">          Amount: 5000</span><br><span style="color: #cccccc">          Unit: USD</span><br><span style="color: #cccccc">        CostFilters:</span><br><span style="color: #cccccc">          TagKeyValue:</span><br><span style="color: #cccccc">            - Environment$Prod</span><br><span style="color: #cccccc">        CostTypes:</span><br><span style="color: #cccccc">          IncludeTax: true</span><br><span style="color: #cccccc">          IncludeSubscription: true</span><br><span style="color: #cccccc">          UseAmortized: true</span><br><span style="color: #cccccc">          UseBlended: false</span><br><span style="color: #cccccc">      NotificationsWithSubscribers:</span><br><span style="color: #cccccc">        - Notification:</span><br><span style="color: #cccccc">            NotificationType: ACTUAL</span><br><span style="color: #cccccc">            ComparisonOperator: GREATER_THAN</span><br><span style="color: #cccccc">            Threshold: 80</span><br><span style="color: #cccccc">            ThresholdType: PERCENTAGE</span><br><span style="color: #cccccc">          Subscribers:</span><br><span style="color: #cccccc">            - SubscriptionType: EMAIL</span><br><span style="color: #cccccc">              Address: finance@example.com</span><br><span style="color: #cccccc">            - SubscriptionType: EMAIL</span><br><span style="color: #cccccc">              Address: ops@example.com</span><br><span style="color: #cccccc">        - Notification:</span><br><span style="color: #cccccc">            NotificationType: FORECASTED</span><br><span style="color: #cccccc">            ComparisonOperator: GREATER_THAN</span><br><span style="color: #cccccc">            Threshold: 100</span><br><span style="color: #cccccc">            ThresholdType: PERCENTAGE</span><br><span style="color: #cccccc">          Subscribers:</span><br><span style="color: #cccccc">            - SubscriptionType: EMAIL</span><br><span style="color: #cccccc">              Address: oncall@example.com</span><br>​<br></pre>

AWS Budgets and their Setup

<p>Amazon Elastic Compute Cloud (EC2) provides virtual servers—called instances—that you can launch, configure, and scale on demand. You choose an image to boot from, a hardware profile, storage, and networking, then deploy applications with full OS-level control.<br></p><h2>Core concepts</h2><p>An Amazon Machine Image (AMI) is the boot template that defines the operating system and optional software. AMIs are region-specific and can be copied across regions. Instance types define virtual hardware (vCPU, memory, storage, network). Families include general purpose, compute optimized, memory optimized, storage optimized, and accelerated computing. Newer “g” types use AWS Graviton (ARM) CPUs for strong price-performance if your software supports arm64.</p><p>EC2 runs inside a Virtual Private Cloud (VPC). You place instances in subnets within specific Availability Zones. Public subnets route to an Internet Gateway, while private subnets do not; use a NAT Gateway for private instances that need outbound internet. Each instance has a primary private IP; you can assign a public IP in public subnets. Elastic IPs are static public IPs you control at the account and region level.</p><p>Security Groups are stateful firewalls attached to network interfaces. They allow inbound rules and automatically allow return traffic. Network ACLs are stateless filters applied at the subnet level and support explicit deny and allow.</p><div class="se-component se-image-container __se__float-none" style="width: 100%"><figure style="width: 100%;"><img src="https://www.api.cstechie.com/upload/editor-image/AWS_EC2_Core_Diagram_-_Clear_1755146336638.png" alt="EC2 Diagram" data-rotate="" data-proportion="true" data-size="100%," data-align="none" data-percentage="100," data-file-name="AWS EC2 Core Diagram - Clear.png" data-file-size="85259" data-origin="," style="width: 100%;"></figure></div><h2>Storage</h2><p>Elastic Block Store (EBS) is network-attached block storage that persists independently of the instance lifecycle. Common volume types are gp3 (general purpose), io1/io2 (provisioned IOPS), and st1/sc1 (HDD, throughput-oriented). Snapshots are incremental, region-bound copies of volumes; you can copy snapshots across regions and create AMIs from them.</p><p>Instance store is physically attached, very fast ephemeral storage. It is ideal for caches, buffers, and temporary data. Data on instance store is lost when you stop or terminate the instance; it survives only reboots.</p><p>For shared files, pair EC2 with EFS (managed NFS for Linux) or FSx families (e.g., Lustre, Windows File Server).</p><p><br></p><h2>Access and identity</h2><p>You connect to Linux via SSH and to Windows typically via RDP. Key pairs generate the credentials for initial access; you cannot retrieve a lost private key. Prefer using AWS Systems Manager Session Manager to access instances without opening inbound SSH/RDP, provided the SSM agent and IAM role are configured.</p><p>Attach IAM roles to instances to grant temporary credentials for AWS APIs. Applications obtain these credentials via the Instance Metadata Service; IMDSv2 (session-based) is recommended for security.</p><h2>Lifecycle and operations<br></h2><p>The typical lifecycle is pending, running, stopping or stopped (EBS-backed only), and terminated. Stopping preserves EBS volumes; terminating deletes the instance and, by default, the root volume unless you disable delete-on-termination. Hibernate writes RAM to the encrypted root EBS volume and resumes faster than a cold start on supported types and sizes.</p><p>To resize, stop the instance, change the instance type, and start it again (ensure the AZ has capacity and that the new type is compatible). You can attach/detach additional EBS volumes at runtime. For backups, create EBS snapshots or bake a new AMI. To move across AZs or VPCs, create an AMI or snapshot and relaunch in the target location.</p><p><br></p><h2>Availability and scaling<br></h2><p>Use multiple AZs for high availability. Place instances behind a load balancer: Application Load Balancer for HTTP/HTTPS with path/host-based routing, Network Load Balancer for ultra-low latency TCP/UDP and static IPs. Auto Scaling groups (ASGs) manage fleets: define a launch template, desired/min/max capacity, health checks, and scaling policies. Target tracking policies are the most common and adjust capacity to keep a metric (for example, CPU at 50%) at a target value.</p><p>Placement groups influence how instances are arranged: cluster (low-latency within one AZ for HPC), spread (max seven per AZ to isolate critical instances), and partition (isolate across partitions for large distributed systems like Hadoop).</p><p><br></p><h2>Pricing models</h2><p>On-Demand instances offer maximum flexibility. Savings Plans and Reserved Instances reduce cost with a usage or capacity commitment. Spot Instances are heavily discounted but can be interrupted with two minutes’ notice; use them for fault-tolerant, stateless, or batch workloads. Dedicated Hosts/Instances provide hardware isolation for compliance and licensing needs.</p><h2>Monitoring and logging</h2><p>CloudWatch provides default metrics (for example, CPU). Enable detailed monitoring for one-minute granularity, and install the CloudWatch Agent to collect memory and disk metrics. Send OS and application logs to CloudWatch Logs. VPC Flow Logs record network metadata for troubleshooting.</p>

Amazon EC2 basics

<p>Let’s walk through how to create an <strong class="">Amazon EC2 instance</strong> step by step, hands-on style. I’ll use the AWS Management Console (web UI) since that’s the most common way for beginners, and mention CLI alternatives as well.</p><p><br></p><h3>Step 1: Sign in to AWS Console</h3><ol><li style="background-color: transparent">Go to <a href="https://console.aws.amazon.com/" target="_blank" rel="noopener noreferrer">AWS Console</a>.</li><li style="background-color: transparent">In the search bar, type <strong class="">EC2</strong> and open the EC2 service dashboard.</li></ol><p><br></p><h3>Step 2: Launch an Instance</h3><ol><li style="background-color: transparent">Click <strong class="">Launch instance</strong>.</li><li style="background-color: transparent">Enter an <strong class="">Instance name</strong> (e.g., <strong>MyFirstEC2</strong>).</li></ol><p><br></p><h3>Step 3: Choose an Amazon Machine Image (AMI)</h3><ol><li style="background-color: transparent">Select the OS template. For example:<ul><li style="background-color: transparent"><strong class="">Amazon Linux 2 (Free tier eligible)</strong> if you want a Linux environment.</li><li style="background-color: transparent">Or <strong class="">Ubuntu 22.04 LTS</strong> if you prefer Ubuntu.&nbsp;</li></ul></li></ol><p><br></p><h3>Step 4: Choose Instance Type</h3><ol><li style="background-color: transparent">Select <strong class="">t2.micro</strong> (Free tier eligible).</li><li style="background-color: transparent">If you need more CPU/RAM later, you can choose larger instances.&nbsp;</li></ol><p><br></p><h3>Step 5: Configure Key Pair (Authentication)</h3><ol><li style="background-color: transparent">Under <strong class="">Key pair (login)</strong>:<ul><li style="background-color: transparent">If you don’t have one, create a new key pair (choose <code>.pem</code> for SSH).</li><li style="background-color: transparent">Download the key file and keep it safe (you’ll need it to connect).</li><li style="background-color: transparent">If you already have one, select it.&nbsp;</li></ul></li></ol><p><br></p><h3>Step 6: Network Settings (Security rules)</h3><ol><li style="background-color: transparent">By default, AWS provides a security group.</li><li style="background-color: transparent">Ensure you allow <strong class="">SSH (port 22)</strong> to connect from your IP.</li><li style="background-color: transparent">If you plan to host a web app:<ul><li style="background-color: transparent">Allow <strong class="">HTTP (port 80)</strong></li><li style="background-color: transparent">Optionally <strong class="">HTTPS (port 443)&nbsp;</strong></li></ul></li></ol><p><br></p><h3>Step 7: Configure Storage</h3><ol><li style="background-color: transparent">By default, you might get <strong class="">8 GiB EBS storage</strong>.</li><li style="background-color: transparent">You can increase it if required.&nbsp;</li></ol><p><br></p><h3>Step 8: Launch Instance</h3><ol><li style="background-color: transparent">Click <strong class="">Launch instance</strong>.</li><li style="background-color: transparent">AWS will start provisioning. Within a couple of minutes, it will be running.&nbsp;</li></ol><p><br></p><h3>Step 9: Connect to Your Instance</h3><p>From <strong class="">Instances → Select your instance → Connect</strong>.<br>Options:</p><ul><li style="background-color: transparent"><strong class="">Using Browser SSH (no setup needed):</strong><ul><li style="background-color: transparent">Click "Connect" → "EC2 Instance Connect".&nbsp;</li></ul></li><li style="background-color: transparent">Using terminal SSH (with .pem key):<br></li></ul><pre>chmod 400 MyKeyPair.pem<br>ssh -i MyKeyPair.pem ec2-user@&lt;Public-IP&gt;<br></pre><blockquote><p>​For Ubuntu AMIs, use ubuntu@&lt;Public-IP&gt; instead of ec2-user.<br></p></blockquote><p>​</p><h3>Step 10: Test</h3><p>Once connected, we can run:</p><pre>sudo yum update -y   # Amazon Linux<br># or<br>sudo apt update &amp;&amp; sudo apt upgrade -y  # Ubuntu<br></pre><p>Installing Apache Server command</p><pre>​​sudo yum install -y httpd    # Amazon Linux<br>sudo systemctl start httpd<br></pre><p>We can install Apache server and add static web page through User Data setup.</p><p>User just need to add command in the user data filed during Instance creation.</p><p>Here’s a <strong class="">User data script</strong> example for Amazon Linux 2:</p><pre><span style="color: #6a9955">#!/bin/bash</span><br><span style="color: #6a9955"># Update system</span><br><span style="color: #dcdcaa">yum </span><span style="color: #ce9178">update </span><span style="color: #569cd6">-y</span><br><span style="color: #6a9955"># Install Apache HTTP server</span><br><span style="color: #dcdcaa">yum </span><span style="color: #ce9178">install </span><span style="color: #569cd6">-y </span><span style="color: #ce9178">httpd</span><br><span style="color: #6a9955"># Start Apache service</span><br><span style="color: #dcdcaa">systemctl </span><span style="color: #ce9178">start </span><span style="color: #ce9178">httpd</span><br><span style="color: #dcdcaa">systemctl </span><span style="color: #ce9178">enable </span><span style="color: #ce9178">httpd</span><br><span style="color: #6a9955"># Create a custom index.html</span><br><span style="color: #dcdcaa">echo</span><span style="color: #ce9178">"&lt;html&gt;&lt;h1&gt;Welcome to My EC2 Apache Server!&lt;/h1&gt;&lt;/html&gt;"</span><span style="color: #d4d4d4">&gt;</span><span style="color: #ce9178">/var/www/html/index.html</span><br>​<br></pre><p><br></p><p><br></p><p><br></p><p><br></p>

EC2 Instance Hands On

<p>An AWS Security Group is a <strong class="">virtual firewall</strong> that controls inbound and outbound traffic for our EC2 instances. When we launch an EC2 instance, we associate one or more security groups with it. These security groups act at the instance level, not the subnet level, meaning they filter traffic for individual instances.</p><p>Think of it like this: if your EC2 instance is a house, the security group is the bouncer at the door, deciding who gets in and who gets out based on rules you define.</p><div class="se-component se-image-container __se__float-none" style="width: 100%"><figure style="width: 100%;"><img src="https://www.api.cstechie.com/upload/editor-image/aws-sg-new_1755460247592.png" alt="Security Group in AWs" data-rotate="" data-proportion="true" data-size="100%," data-align="none" data-percentage="100," data-file-name="aws-sg-new.png" data-file-size="47574" data-origin="," style="width: 100%;"></figure></div><p><br></p><h2>Key Points of Security Groups</h2><ol><li style="background-color: transparent"><strong class="">Instance-Level Firewall:</strong> Security groups operate at the instance level, not the subnet level. Each instance can have multiple security groups, and a security group can be associated with multiple instances.</li><li style="background-color: transparent"><strong class="">Stateful:</strong> Security groups are stateful. This means that if we allow inbound traffic on a specific port, the outbound return traffic for that connection is automatically allowed, even if there isn't an explicit outbound rule for it. For example, if we allow inbound SSH, the SSH response traffic going back to our client is automatically permitted.</li><li style="background-color: transparent"><strong class="">Allow Rules Only:</strong> Security groups only support "allow" rules. We cannot create "deny" rules. If traffic doesn't explicitly match an allow rule, it is implicitly denied.</li><li style="background-color: transparent"><strong class="">Default Deny:</strong> All inbound traffic is implicitly denied by default, and all outbound traffic is implicitly allowed by default. We must explicitly add rules to allow inbound traffic.</li><li style="background-color: transparent"><strong class="">Referencing Other Security Groups:</strong>&nbsp;We can reference other security groups in our rules. This is very useful for allowing traffic between instances that share a common function (e.g., allowing web servers to talk to database servers).</li><li style="background-color: transparent"><strong class="">Changes are Immediate:</strong> Any changes we make to a security group are applied immediately to all instances associated with that security group.</li><li style="background-color: transparent"><strong>Region Based:</strong> Security Group is Region based means based on region and avalability zone Security Group works.</li></ol><h2><br></h2><h2>Ways to Create a Security Group and Their Utility<br></h2><p>We&nbsp;can create security groups using the AWS Management Console, AWS CLI, or AWS SDKs/CloudFormation.<br></p><h3>Using the AWS Management Console (Web UI)<br></h3><p><strong class="">Steps:</strong></p><ol><li style="background-color: transparent"><strong class="">Navigate to EC2 Dashboard:</strong> Sign in to the AWS Management Console and go to the EC2 dashboard.</li><li style="background-color: transparent"><strong class="">Go to Security Groups:</strong> In the left navigation pane, under "Network &amp; Security," click on <strong class="">Security Groups</strong>.</li><li style="background-color: transparent"><strong class="">Create Security Group:</strong> Click the <strong class="">Create security group</strong> button.</li><li style="background-color: transparent"><strong class="">Basic Details:</strong><ul><li style="background-color: transparent"><strong class="">Security group name:</strong> Give it a descriptive name (e.g., <code>web-server-sg</code>, <code>ssh-access-sg</code>).</li><li style="background-color: transparent"><strong class="">Description:</strong> Provide a brief explanation of its purpose.</li><li style="background-color: transparent"><strong class="">VPC:</strong> Select the Virtual Private Cloud (VPC) where your instances will reside.</li></ul></li><li style="background-color: transparent"><strong class="">Inbound Rules:</strong><ul><li style="background-color: transparent">Click <strong class="">Add rule</strong>.</li><li style="background-color: transparent"><strong class="">Type:</strong> Choose the type of traffic (e.g., <code>SSH</code>, <code>HTTP</code>, <code>Custom TCP</code>).</li><li style="background-color: transparent"><strong class="">Port range:</strong> Specify the port (e.g., <code>22</code> for SSH, <code>80</code> for HTTP).</li><li style="background-color: transparent"><strong class="">Source:</strong> Define where the traffic can come from:<ul><li style="background-color: transparent"><code>My IP</code>: Your current public IP address (good for SSH).</li><li style="background-color: transparent"><code>Anywhere-IPv4</code>: <code>0.0.0.0/0</code> (allows traffic from anywhere on the internet – use with caution for sensitive ports).</li><li style="background-color: transparent"><code>Custom</code>: Specify a CIDR block (e.g., <code>192.168.1.0/24</code>) or another security group ID.</li></ul></li><li style="background-color: transparent"><strong class="">Description (optional):</strong> Add a note for the rule.</li></ul></li><li style="background-color: transparent"><strong class="">Outbound Rules:</strong><ul><li style="background-color: transparent">By default, all outbound traffic (<code>0.0.0.0/0</code>) is allowed.</li><li style="background-color: transparent">You can restrict this if needed (e.g., only allow outbound traffic to a specific database).</li></ul></li><li style="background-color: transparent"><strong class="">Create Security Group:</strong> Click the <strong class="">Create security group</strong> button.&nbsp;</li></ol><p><br></p><h3><strong class="">Utility:</strong></h3><ul><li style="background-color: transparent"><strong class="">Ease of Use:</strong> Ideal for beginners or when you need to quickly set up rules.</li><li style="background-color: transparent"><strong class="">Visual Management:</strong> Provides a clear overview of all rules.</li><li style="background-color: transparent"><strong class="">Interactive:</strong> Easy to add, modify, or remove rules on the fly.</li></ul><p><br></p>

Security Group In AWS

<p><span style="font-size: 19px">Common Ports and Their Utility in AWS</span></p><ol><li style="background-color: transparent"><strong class="">Port 22 (SSH - Secure Shell)</strong><ul><li style="background-color: transparent"><strong class="">Utility:</strong> This is the primary port for securely connecting to your Linux EC2 instances. It allows you to execute commands, transfer files, and manage your server remotely.</li><li style="background-color: transparent"><strong class="">Security Note:</strong> For production environments, it's highly recommended to restrict SSH access to specific IP addresses (e.g., your office IP, a jump box IP) rather than <code>0.0.0.0/0</code> (anywhere).</li></ul></li><li style="background-color: transparent"><strong class="">Port 80 (HTTP - Hypertext Transfer Protocol)</strong><ul><li style="background-color: transparent"><strong class="">Utility:</strong> Used for unencrypted web traffic. If you're hosting a website or web application, this port needs to be open for users to access it via a web browser.</li><li style="background-color: transparent"><strong class="">Security Note:</strong> While still common, it's best practice to use HTTPS (Port 443) for all web traffic to ensure data encryption.</li></ul></li><li style="background-color: transparent"><strong class="">Port 443 (HTTPS - Hypertext Transfer Protocol Secure)</strong><ul><li style="background-color: transparent"><strong class="">Utility:</strong> Used for encrypted web traffic. This is the standard for secure communication over the internet, essential for e-commerce, login pages, and any site handling sensitive data. It uses SSL/TLS for encryption.</li><li style="background-color: transparent"><strong class="">Security Note:</strong> Always prioritize HTTPS over HTTP for public-facing web applications.</li></ul></li><li style="background-color: transparent"><strong class="">Port 3389 (RDP - Remote Desktop Protocol)</strong><ul><li style="background-color: transparent"><strong class="">Utility:</strong> This port is used to connect to Windows EC2 instances via Remote Desktop. It provides a graphical interface for managing your Windows server.</li><li style="background-color: transparent"><strong class="">Security Note:</strong> Similar to SSH, restrict RDP access to specific trusted IP addresses. Exposing RDP to <code>0.0.0.0/0</code> is a significant security risk.</li></ul></li><li style="background-color: transparent"><strong class="">Port 21 (FTP - File Transfer Protocol)</strong><ul><li style="background-color: transparent"><strong class="">Utility:</strong> Used for transferring files between a client and a server.</li><li style="background-color: transparent"><strong class="">Security Note:</strong> FTP is unencrypted and generally considered insecure for sensitive data. SFTP (SSH File Transfer Protocol, which uses Port 22) or SCP are more secure alternatives.</li></ul></li><li style="background-color: transparent"><strong class="">Port 20/21 (FTP Data/Control)</strong><ul><li style="background-color: transparent"><strong class="">Utility:</strong> FTP uses two ports: 21 for control commands and 20 for data transfer in active mode.</li><li style="background-color: transparent"><strong class="">Security Note:</strong> Due to the complexity of FTP and its security vulnerabilities, it's often avoided in modern cloud architectures in favor of SFTP or cloud storage solutions like S3.</li></ul></li><li style="background-color: transparent"><strong class="">Port 25 (SMTP - Simple Mail Transfer Protocol)</strong><ul><li style="background-color: transparent"><strong class="">Utility:</strong> Used for sending email. If your EC2 instance needs to send outbound emails directly (e.g., for notifications), this port might be used.</li><li style="background-color: transparent"><strong class="">Security Note:</strong> AWS often restricts outbound traffic on Port 25 by default to prevent spam. You might need to request an unblock from AWS support. Using AWS SES (Simple Email Service) is generally a better and more scalable approach for sending emails from EC2.</li></ul></li><li style="background-color: transparent"><strong class="">Port 53 (DNS - Domain Name System)</strong><ul><li style="background-color: transparent"><strong class="">Utility:</strong> Used for DNS queries. Your instances need to communicate on this port to resolve domain names to IP addresses.</li><li style="background-color: transparent"><strong class="">Security Note:</strong> Typically, this port is allowed for outbound traffic to AWS's internal DNS resolvers or public DNS servers. Inbound DNS is usually only needed if your EC2 instance is acting as a DNS server itself.</li></ul></li><li style="background-color: transparent"><strong class="">Port 1433 (MS SQL Server)</strong><ul><li style="background-color: transparent"><strong class="">Utility:</strong> The default port for Microsoft SQL Server. If you have an MS SQL database running on an EC2 instance, this port needs to be open for clients (applications, other EC2 instances) to connect to it.</li><li style="background-color: transparent"><strong class="">Security Note:</strong> Restrict access to only the necessary application servers or specific IP ranges. Ideally, use AWS RDS for managed databases.</li></ul></li><li style="background-color: transparent"><strong class="">Port 3306 (MySQL/Aurora)</strong><ul><li style="background-color: transparent"><strong class="">Utility:</strong> The default port for MySQL and Amazon Aurora databases. Similar to MS SQL, this port is needed for applications to connect to a MySQL database running on an EC2 instance.</li><li style="background-color: transparent"><strong class="">Security Note:</strong> Restrict access to only the necessary application servers or specific IP ranges. AWS RDS is the preferred service for managed MySQL/Aurora databases.</li></ul></li><li style="background-color: transparent"><strong class="">Port 5432 (PostgreSQL)</strong><ul><li style="background-color: transparent"><strong class="">Utility:</strong> The default port for PostgreSQL databases.</li><li style="background-color: transparent"><strong class="">Security Note:</strong> Restrict access to only the necessary application servers or specific IP ranges. AWS RDS is the preferred service for managed PostgreSQL databases.</li></ul></li><li style="background-color: transparent"><strong class="">Port 27017 (MongoDB)</strong><ul><li style="background-color: transparent"><strong class="">Utility:</strong> The default port for MongoDB.</li><li style="background-color: transparent"><strong class="">Security Note:</strong> If running MongoDB on EC2, restrict access to only the necessary application servers. Consider AWS DocumentDB for a managed MongoDB-compatible service.</li></ul></li><li style="background-color: transparent"><strong class="">Port 8080 (HTTP Alternate)</strong><ul><li style="background-color: transparent"><strong class="">Utility:</strong> Often used for web servers or application servers (like Tomcat, Jenkins) that serve HTTP traffic on a non-standard port.</li><li style="background-color: transparent"><strong class="">Security Note:</strong> Treat this like Port 80/443 regarding access restrictions.</li></ul></li><li style="background-color: transparent"><strong class="">Ephemeral Ports (1024-65535)</strong><ul><li style="background-color: transparent"><strong class="">Utility:</strong> These are dynamic ports used by clients when initiating connections to servers. When your EC2 instance initiates an outbound connection (e.g., connecting to an external API, downloading updates), the source port will be an ephemeral port.</li><li style="background-color: transparent"><strong class="">Security Note:</strong> While you typically don't explicitly open these for inbound traffic (unless it's a specific application), outbound rules often allow traffic to these ranges. Security groups are stateful, so return traffic on these ports is automatically allowed if the outbound connection was initiated from the instance.</li></ul></li></ol><p><br></p><blockquote><p>​When configuring security groups, always adhere to the principle of <strong class="">least privilege</strong>: only open the ports and allow traffic from the sources that are absolutely necessary for your application to function. This significantly reduces your attack surface.​<br></p></blockquote>

Common AWS ports and their uses in security groups

<p>EC2 instances come in <strong class="">different families (types)</strong>, each optimized for a specific use case. Choosing the right instance type is crucial for performance, scalability, and cost optimization in AWS.</p><h2><strong class="">Types of EC2 Instances and Their Utilities</strong></h2><h4>1. <strong class="">General Purpose Instances</strong></h4><ul><li style="background-color: transparent"><strong class="">Examples:</strong><code>t2</code>, <code>t3</code>, <code>t4g</code>, <code>m5</code>, <code>m6i</code>, <code>m7g</code></li><li style="background-color: transparent"><strong class="">Utility:</strong> Balanced compute, memory, and networking resources. Ideal for applications with moderate resource requirements.</li><li style="background-color: transparent"><strong class="">Use Cases:</strong><ul><li style="background-color: transparent">Web servers</li><li style="background-color: transparent">Small &amp; mid-size databases</li><li style="background-color: transparent">Development/testing environments</li></ul></li></ul><hr><h4>2. <strong class="">Compute Optimized Instances</strong></h4><ul><li style="background-color: transparent"><strong class="">Examples:</strong><code>c5</code>, <code>c6i</code>, <code>c7g</code></li><li style="background-color: transparent"><strong class="">Utility:</strong> High-performance processors optimized for compute-heavy workloads.</li><li style="background-color: transparent"><strong class="">Use Cases:</strong><ul><li style="background-color: transparent">High-performance web servers</li><li style="background-color: transparent">Scientific modeling</li><li style="background-color: transparent">Batch processing</li><li style="background-color: transparent">Gaming servers</li></ul></li></ul><hr><h4>3. <strong class="">Memory Optimized Instances</strong></h4><ul><li style="background-color: transparent"><strong class="">Examples:</strong><code>r5</code>, <code>r6g</code>, <code>x1</code>, <code>x2idn</code>, <code>z1d</code></li><li style="background-color: transparent"><strong class="">Utility:</strong> Provide large memory size relative to vCPU for memory-intensive applications.</li><li style="background-color: transparent"><strong class="">Use Cases:</strong><ul><li style="background-color: transparent">Real-time big data analytics</li><li style="background-color: transparent">High-performance databases (SQL, NoSQL, in-memory)</li><li style="background-color: transparent">In-memory caches (Redis, Memcached, SAP HANA)</li></ul></li></ul><hr><h4>4. <strong class="">Storage Optimized Instances</strong></h4><ul><li style="background-color: transparent"><strong class="">Examples:</strong><code>i3</code>, <code>i4i</code>, <code>d2</code>, <code>h1</code>, <code>im4gn</code></li><li style="background-color: transparent"><strong class="">Utility:</strong> High, sequential read/write access to large data sets, optimized for storage throughput or IOPS.</li><li style="background-color: transparent"><strong class="">Use Cases:</strong><ul><li style="background-color: transparent">NoSQL databases (MongoDB, Cassandra)</li><li style="background-color: transparent">Data warehousing</li><li style="background-color: transparent">Hadoop and distributed file systems</li><li style="background-color: transparent">Large-scale OLAP systems</li></ul></li></ul><hr><h4>5. <strong class="">Accelerated Computing Instances (GPU/FPGA)</strong></h4><ul><li style="background-color: transparent"><strong class="">Examples:</strong><code>p3</code>, <code>p4d</code>, <code>g5</code>, <code>g6</code>, <code>f1</code></li><li style="background-color: transparent"><strong class="">Utility:</strong> Specialized hardware accelerators like GPUs or FPGAs for parallel computation and graphics-intensive workloads.</li><li style="background-color: transparent"><strong class="">Use Cases:</strong><ul><li style="background-color: transparent">Machine Learning (training/inference)</li><li style="background-color: transparent">High-Performance Computing (HPC)</li><li style="background-color: transparent">Video rendering &amp; 3D graphics</li><li style="background-color: transparent">Genomic analysis</li><li style="background-color: transparent">Real-time simulations</li></ul></li></ul><h3>Key Takeaways<br></h3><blockquote><ol><li style="background-color: transparent"><strong class="">General Purpose:</strong> Best for balanced workloads (web apps, dev).</li><li style="background-color: transparent"><strong class="">Compute Optimized:</strong> Best for CPU-intensive workloads (batch processing, game servers).</li><li style="background-color: transparent"><strong class="">Memory Optimized:</strong> Best for memory-heavy workloads (databases, big data).</li><li style="background-color: transparent"><strong class="">Storage Optimized:</strong> Best for high storage throughput workloads (NoSQL, analytics).</li><li style="background-color: transparent"><strong class="">Accelerated Computing:</strong> Best for GPU/FPGA workloads (AI/ML, HPC).</li></ol></blockquote><h3><br></h3><h2>EC2 Purchasing Options<br></h2><h4>1. <strong class="">On‑Demand Instances</strong></h4><ul><li style="background-color: transparent"><strong class="">What it is:</strong> Pay by the second (Linux) or by the hour (Windows/others) with no long‑term commitments.</li><li style="background-color: transparent"><strong class="">Utility:</strong> Full flexibility — launch or terminate instances anytime.</li><li style="background-color: transparent"><strong class="">Best For:</strong><ul><li style="background-color: transparent">Short‑term, unpredictable workloads</li><li style="background-color: transparent">Development, testing, or proof‑of‑concept projects</li><li style="background-color: transparent">When application usage patterns are unclear</li></ul></li></ul><hr><h4>2. <strong class="">Reserved Instances (RIs)</strong></h4><ul><li style="background-color: transparent"><strong class="">What it is:</strong> Commitment to a specific instance type and region for <strong class="">1 or 3 years</strong>, with significant discounts (up to 72%) compared to On‑Demand.</li><li style="background-color: transparent"><strong class="">Types of RIs:</strong><ul><li style="background-color: transparent"><em>Standard Reserved Instances</em>: Cheapest, fixed configuration.</li><li style="background-color: transparent"><em>Convertible RIs</em>: Flexibility to change instance families, OS, or tenancy during term. Lower discount than Standard RIs.</li></ul></li><li style="background-color: transparent"><strong class="">Payment Options:</strong> All Upfront, Partial Upfront, or No Upfront (monthly payments).</li><li style="background-color: transparent"><strong class="">Best For:</strong><ul><li style="background-color: transparent">Steady‑state workloads (always running applications)</li><li style="background-color: transparent">Core business systems (databases, ERP, large web apps)</li></ul></li></ul><hr><h4>3. <strong class="">Savings Plans</strong></h4><ul><li style="background-color: transparent"><strong class="">What it is:</strong> Flexible alternative to Reserved Instances. Commit to a certain spend per hour (e.g., $10/hour) for 1 or 3 years. Applies automatically to any instance usage.</li><li style="background-color: transparent"><strong class="">Types:</strong><ul><li style="background-color: transparent"><em>Compute Savings Plan</em>: Applies to any EC2 instance in any region, even AWS Fargate and Lambda. Very flexible.</li><li style="background-color: transparent"><em>EC2 Instance Savings Plan</em>: Applies only to a family within a region (e.g., <code>m5</code> in <code>us-east-1</code>).</li></ul></li><li style="background-color: transparent"><strong class="">Best For:</strong><ul><li style="background-color: transparent">Customers wanting RI‑like savings without being locked to a specific instance type/region.</li></ul></li></ul><hr><h4>4. <strong class="">Spot Instances</strong></h4><ul><li style="background-color: transparent"><strong class="">What it is:</strong> Unused EC2 capacity offered at up to <strong class="">90% discount</strong> compared to On‑Demand. Instances can be terminated by AWS anytime with 2‑minute notice.</li><li style="background-color: transparent"><strong class="">Utility:</strong> Extremely cost‑efficient for fault-tolerant, flexible workloads.</li><li style="background-color: transparent"><strong class="">Best For:</strong><ul><li style="background-color: transparent">Big data and analytics</li><li style="background-color: transparent">Containerized workloads</li><li style="background-color: transparent">CI/CD pipelines</li><li style="background-color: transparent">Batch processing, rendering, simulations</li></ul></li><li style="background-color: transparent"><strong class="">Not Good For:</strong><ul><li style="background-color: transparent">Critical applications that can’t tolerate interruptions</li></ul></li></ul><hr><h4>5. <strong class="">Dedicated Hosts</strong></h4><ul><li style="background-color: transparent"><strong class="">What it is:</strong> Entire physical EC2 server dedicated to you. Provides visibility and control over hardware.</li><li style="background-color: transparent"><strong class="">Utility:</strong> Best for software licensing (e.g., Oracle, SQL Server) or compliance requirements requiring dedicated hardware.</li><li style="background-color: transparent"><strong class="">Best For:</strong><ul><li style="background-color: transparent">BYOL (Bring Your Own License) compliance</li><li style="background-color: transparent">Workloads requiring physical isolation</li></ul></li></ul><hr><h4>6. <strong class="">Dedicated Instances</strong></h4><ul><li style="background-color: transparent"><strong class="">What it is:</strong> Instances running on physical hardware dedicated to a single customer, but <strong class="">not single‑tenant</strong> per server. You don’t control placement.</li><li style="background-color: transparent"><strong class="">Utility:</strong> Provides hardware isolation for compliance needs but with less cost than Dedicated Hosts.</li></ul><hr><h4>7. <strong class="">Capacity Reservations</strong></h4><ul><li style="background-color: transparent"><strong class="">What it is:</strong> Reserve capacity in a specific Availability Zone for increased reliability. You pay On‑Demand rates (unless combined with RI or Savings Plans).</li><li style="background-color: transparent"><strong class="">Utility:</strong> Guarantees you will always have available EC2 capacity in a particular AZ.</li><li style="background-color: transparent"><strong class="">Best For:</strong><ul><li style="background-color: transparent">Mission‑critical workloads that require guaranteed capacity during spikes</li><li style="background-color: transparent">Disaster recovery scenarios</li></ul></li></ul><p><br></p><h2>Quick Comparison among all EC2 Purchasing Options<br></h2><table class="se-table-layout-fixed"><thead><tr><th><div>Option</div></th><th><div>Commitment<br></div></th><th><div>Savings vs On‑Demand<br></div></th><th><div>Flexibility<br></div></th><th><div>Best For<br></div></th></tr></thead><tbody><tr><td><div>On‑Demand<br></div></td><td><div>None</div></td><td><div>None</div></td><td><div>Highest<br></div></td><td><div>Unpredictable workloads<br></div></td></tr><tr><td><div>Reserved Instances<br></div></td><td><div>1 or 3 years<br></div></td><td><div>Up to 72%<br></div></td><td><div>Low‑Medium<br></div></td><td><div>Steady workloads<br></div></td></tr><tr><td><div>Savings Plans<br></div></td><td><div>1 or 3 years (spend)<br></div></td><td><div>Up to 72%<br></div></td><td><div>Higher than RIs<br></div></td><td><div>Varied/modern workloads<br></div></td></tr><tr><td><div>Spot Instances<br></div></td><td><div>None (can terminate)<br></div></td><td><div>Up to 90%<br></div></td><td><div>High, except interruption<br></div></td><td><div>Fault‑tolerant jobs<br></div></td></tr><tr><td><div>Dedicated Host<br></div></td><td><div>1 or 3 years<br></div></td><td><div>Variable<br></div></td><td><div>Low<br></div></td><td><div>Compliance &amp; licensing<br></div></td></tr><tr><td><div>Dedicated Instance<br></div></td><td><div>None<br></div></td><td><div>Higher cost<br></div></td><td><div>Medium<br></div></td><td><div>Hardware isolation<br></div></td></tr><tr><td><div>Capacity Reservation<br></div></td><td><div>Flexible + optional<br></div></td><td><div>None (unless combined)<br></div></td><td><div>Medium<br></div></td><td><div>Critical workloads<br></div></td></tr></tbody></table><p><br></p><p><br></p><p><br></p>

Types of EC2 instances and their use cases

<h2><strong class="">What is Amazon EBS?</strong></h2><p>Amazon <strong class="">Elastic Block Store (EBS)</strong> is a block storage service designed for use with EC2 instances. Think of it as a <strong class="">virtual hard drive</strong> you can attach to your EC2 server. It provides persistent storage, meaning that your data remains intact even if the EC2 instance stops or terminates (unless you explicitly delete it).</p><p>Unlike ephemeral <em>instance store volumes</em> which are wiped when the instance stops, <strong class="">EBS volumes persist independently of the EC2 lifecycle</strong>.</p><p><br></p><h2><strong class="">Key Features of EBS</strong></h2><ol><li style="background-color: transparent"><strong class="">Persistent Storage</strong> – Data stays even if the instance is stopped.</li><li style="background-color: transparent"><strong class="">Scalable</strong> – Volumes can be resized and adjusted for performance.</li><li style="background-color: transparent"><strong class="">Replicated within an AZ</strong> – Provides durability against hardware failure.</li><li style="background-color: transparent"><strong class="">Snapshots</strong> – You can take point‑in‑time backups stored in Amazon S3.</li><li style="background-color: transparent"><strong class="">Encrypted</strong> – Integrated with KMS for data encryption at rest and in transit.</li><li style="background-color: transparent"><strong class="">Attach/Detach</strong> – Volumes can be attached, detached, or shifted between instances within the same availability zone.</li></ol><h2>Types of Amazon EBS Volumes &amp; Their Use Cases<br></h2><h4>1. <strong class="">General Purpose SSD (gp2 / gp3)</strong></h4><ul><li style="background-color: transparent"><strong class="">Description:</strong> Balanced price/performance.</li><li style="background-color: transparent"><strong class="">Performance:</strong> Baseline IOPS with burst capability (gp2), customizable IOPS &amp; throughput (gp3).</li><li style="background-color: transparent"><strong class="">Use Cases:</strong><ul><li style="background-color: transparent">Boot volumes for EC2</li><li style="background-color: transparent">Development and test environments</li><li style="background-color: transparent">Small to medium databases</li><li style="background-color: transparent">Web applications</li></ul></li></ul><hr><h4>2. <strong class="">Provisioned IOPS SSD (io1 / io2)</strong></h4><ul><li style="background-color: transparent"><strong class="">Description:</strong> Highest performance SSD with guaranteed IOPS. io2 has even higher durability.</li><li style="background-color: transparent"><strong class="">Performance:</strong> Up to millions of IOPS, designed for mission‑critical workloads.</li><li style="background-color: transparent"><strong class="">Use Cases:</strong><ul><li style="background-color: transparent">High‑transaction databases (Oracle, SQL Server, SAP HANA)</li><li style="background-color: transparent">Critical applications requiring consistent I/O performance</li><li style="background-color: transparent">Latency‑sensitive OLTP systems</li></ul></li></ul><hr><h4>3. <strong class="">Throughput Optimized HDD (st1)</strong></h4><ul><li style="background-color: transparent"><strong class="">Description:</strong> Low‑cost HDD optimized for <strong class="">large, sequential</strong> workloads.</li><li style="background-color: transparent"><strong class="">Performance:</strong> High throughput but lower IOPS (not suitable for random access).</li><li style="background-color: transparent"><strong class="">Use Cases:</strong><ul><li style="background-color: transparent">Big data processing (Hadoop, Spark)</li><li style="background-color: transparent">Data warehousing</li><li style="background-color: transparent">Streaming logs</li><li style="background-color: transparent">ETL workloads</li></ul></li></ul><hr><h4>4. <strong class="">Cold HDD (sc1)</strong></h4><ul><li style="background-color: transparent"><strong class="">Description:</strong> Lowest cost per GB, designed for infrequently accessed data.</li><li style="background-color: transparent"><strong class="">Performance:</strong> Lowest IOPS and throughput among EBS types.</li><li style="background-color: transparent"><strong class="">Use Cases:</strong><ul><li style="background-color: transparent">Infrequent data access</li><li style="background-color: transparent">Archival storage within EC2</li><li style="background-color: transparent">Backup repositories</li></ul></li></ul><hr><h4>5. <strong class="">Magnetic (Standard Volumes – Legacy)</strong></h4><ul><li style="background-color: transparent"><strong class="">Description:</strong> Old generation, rarely used now, replaced by other types.</li><li style="background-color: transparent"><strong class="">Use Cases:</strong><ul><li style="background-color: transparent">Only for older workloads that haven’t been migrated.</li></ul></li></ul><hr><h3><strong class="">Common Use Cases of EBS</strong></h3><ul><li style="background-color: transparent">Hosting application data that needs persistence.</li><li style="background-color: transparent">Running relational (MySQL/PostgreSQL) or NoSQL (MongoDB, Cassandra) databases.</li><li style="background-color: transparent">Boot volumes for EC2 machines.</li><li style="background-color: transparent">Creating snapshots for backups and disaster recovery.</li><li style="background-color: transparent">Scalable storage for analytics or big‑data pipelines.</li><li style="background-color: transparent">High IOPS storage for enterprise workloads like SAP or Oracle.</li></ul><p><br></p>

Comments

AWS