username

aws_access_key_id

aws_secret_access_key

aws_region

Github_Token

domain

Git_username

Become an AWS pro with insights from a seasoned Amazon engineer. Get hands-on with essential AWS services like DynamoDB, S3, and EC2. No setup, no cleanup, no hassle.

local.tar.gz

NodeHelloWorld

NodePackageChange

NodeGithub

InfrastructureAsCode

ADCodebuildGithub

AutomaticDeployments1

AutomaticDeployments2

LoadBalancing1

Scaling1

Production1

CustomDomain1

Https1

NetworkSecurity1

NodeGithub-copy

AutomaticDeployments1-copy

Production1-copy

CustomDomain1-copy

Https1-copy

NetworkSecurity1-copy

This is not your typical AWS reference course. You won’t find most of the knowledge that's shared here in the AWS docs. The goal here is to help you realize which AWS features you’d be foolish not to use — features that have passed the test of time by being at the backbone of most things on the Internet.

In this course, you'll learn a technique used to help make reliable technical choices without getting paralyzed in the face of so many options. You’ll start by going through the most fundamental services AWS offers such as DynamoDB, S3, EC2. Each section breaks down how it’s used, the pros and cons, why you should (or shouldn't) be using it, and more.

This course was written by a former Amazon engineer with 15 years of experience working on AWS.

The Good Parts of AWS: Cutting Through the Clutter

# Objective
Make our instances inaccessible from the internet.
 

# Steps
- Set up SSM for SSH access.
---

In this section, we're going to make our EC2 instances inaccessible from the internet. The instances will be able to reach the internet using a [NAT gateway](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html), but the network will not allow anything from the internet to reach the instances without going through the load balancer.


> 🔍 Once we make our instances use a NAT gateway to connect to the internet, an additional data transfer charge (currently [$0.045/GB in us-east-1](https://aws.amazon.com/vpc/pricing/)) will apply to all traffic that transits the gateway. This includes traffic to other AWS services.

> **NOTE:** It is very important to note that the prices mentioned above are only for the purpose of understanding cost comparisons. These prices are subject to change anytime by AWS. Therefore, most current prices should be referenced for final business decisions.

To avoid the extra charge, most AWS services can be configured to expose an endpoint that doesn't pass through the internet. This can be done via [Gateway VPC Endpoints](https://docs.aws.amazon.com/vpc/latest/userguide/vpce-gateway.html) or [Interface VPC Endpoints (AWS PrivateLink)](https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html).

# Set up SSM for SSH access

One thing that won't work after we lock down our hosts is EC2 Instance Connect. In order to acquire SSH access to our instances, we'll have to use [AWS Systems Manager Session Manager (SSM)](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html).

Let's start by adding two new managed policies to the IAM role used by our instances.

Network Security: Set up SSM for SSH Access

Before Getting Started

Part 1: The Good Parts

Part 2: The Bootstrap Guide

Host Our Application on EC2 Instance

Infrastructure as Code

Automatic Deployments: Create a CI/CD Pipeline

Load Balancing: Add an Application Load Balancer

Scaling: Add an Auto Scaling Group

Conclusion

Network Security: Set up SSM for SSH Access

Objective

Steps