Ravindra BagaleCourses & study guides मराठी

Ravi Sir's Cards › DevOps

Chapter 40: Terraform Real AWS Labs VPC EC2 nginx S3 and IAM Role: Cards

मराठी cards · Open the chapter

Revision cards

Lab part 1: VPC, public subnets, internet gateway. A web server needs a network first. The default VPC is shared and messy; your own VPC is clean and repeatable.
Revision card 1 of 5: Lab part 1: VPC, public subnets, internet gateway · Download PNG · Open card page

Lesson: 40.1 Lab part 1 — VPC, public subnets, internet gateway and routes

Lab part 2: security group for the web server. A new server with no firewall rules either blocks everything or, with bad rules, opens SSH to the world.
Revision card 2 of 5: Lab part 2: security group for the web server · Download PNG · Open card page

Lesson: 40.2 Lab part 2 — security group for the web server

Lab part 3: EC2 with nginx from user_data. You want a working web page with no manual login on the server.
Revision card 3 of 5: Lab part 3: EC2 with nginx from user_data · Download PNG · Open card page

Lesson: 40.3 Lab part 3 — EC2 with nginx from user_data

Lab part 4: IAM role and instance profile. The server needs AWS access, and keys stored on it would be a risk.
Revision card 4 of 5: Lab part 4: IAM role and instance profile · Download PNG · Open card page

Lesson: 40.4 Lab part 4 — IAM role and instance profile

Lab part 5: a private S3 bucket, then destroy. Labs left running cost money, and a forgotten public bucket is a risk.
Revision card 5 of 5: Lab part 5: a private S3 bucket, then destroy · Download PNG · Open card page

Lesson: 40.5 Lab part 5 — a private S3 bucket, then destroy everything

Interview cards

What makes a subnet public in AWS? A subnet is public when its route table has a route 0.0.0.0/0 → internet gateway. Servers also need a public IP to be reached.
Interview card 1 of 5: What makes a subnet public in AWS? · Download PNG · Open card page

Lesson: 40.1 Lab part 1 — VPC, public subnets, internet gateway and routes

Why allow SSH only from your own IP? Port 22 open to 0.0.0.0/0 is scanned by bots within minutes. Allowing only your IP/32 means one address can even try to log in.
Interview card 2 of 5: Why allow SSH only from your own IP? · Download PNG · Open card page

Lesson: 40.2 Lab part 2 — security group for the web server

The web server is up but the page does not load. How do you debug user_data? Check in order: security group allows 80, the route to the internet gateway, the public IP, then on the server /var/log/cloud-init-output.log and systemctl status nginx.
Interview card 3 of 5: The web server is up but the page does not load. How do you debug user_data? · Download PNG · Open card page

Lesson: 40.3 Lab part 3 — EC2 with nginx from user_data

What is least privilege, and how do you apply it to an EC2 role? Least privilege means giving only the actions and resources a job needs. For a server reading one bucket: s3:GetObject on arn:aws:s3:::bucket/* only.
Interview card 4 of 5: What is least privilege, and how do you apply it to an EC2 role? · Download PNG · Open card page

Lesson: 40.4 Lab part 4 — IAM role and instance profile

Why does destroy fail on an S3 bucket, and what is force_destroy? AWS will not delete a bucket that still has objects. force_destroy = true lets Terraform empty the bucket first, then delete it.
Interview card 5 of 5: Why does destroy fail on an S3 bucket, and what is force_destroy? · Download PNG · Open card page

Lesson: 40.5 Lab part 5 — a private S3 bucket, then destroy everything

Comparison cards

Route table vs security group. Route table: says where network traffic from a subnet goes (internet gateway, NAT, local).Security group: a firewall that says which traffic a server accepts.
Comparison card 1 of 3: Route table vs security group · Download PNG · Open card page

Lesson: Chapter 40: Terraform Real AWS Labs VPC EC2 nginx S3 and IAM Role

Public IP vs Elastic IP. Public IP: given to a server at start, changes after stop and start.Elastic IP: a fixed public IP you keep and attach to a server or NAT gateway.
Comparison card 2 of 3: Public IP vs Elastic IP · Download PNG · Open card page

Lesson: Chapter 40: Terraform Real AWS Labs VPC EC2 nginx S3 and IAM Role

force_destroy vs prevent_destroy. force_destroy: an S3 setting that lets Terraform delete a bucket with files in it.prevent_destroy: a lifecycle setting that blocks any destroy.
Comparison card 3 of 3: force_destroy vs prevent_destroy · Download PNG · Open card page

Lesson: Chapter 40: Terraform Real AWS Labs VPC EC2 nginx S3 and IAM Role