Amazon Web Services (AWS) is a secure cloud services platform, offering compute power, database storage, content delivery and other functionality to help businesses scale and grow. Explore how millions of customers are currently leveraging AWS cloud products and solutions to build sophisticated applications with increased flexibility, scalability and reliability.

Create an AWS account :- First you have to create an AWS account. There are 2 ways to create account.

• Create your own account by yourself.
• Your company have a parent account, who will create an account (IAM) for you and also provide required permission.

Here is the list of some important feature in AWS to work on and all are possible options to work as in Intelehealth requred

• IAM (Identity and Access Management)
• EC2 (Elastic Cloud Computing)
  1. Instances
  2. AMI
  3. EBS (Elastic Block Storage)
  4. Elastic IP
  5. Load Balancer
• S3 (Simple Storage Solution)
• RDS (Relational DataBase Services)
• Cloud Watch
• VPC(Subnet, Route 53, Security Group, Key-pair )

S3 (Simple Storage Solution)

Amazon S3 is object storage built to store and retrieve any amount of data from anywhere – web sites and mobile apps, corporate applications, and data from IoT sensors or devices. It is designed to deliver 99.999999999% durability, and stores data for millions of applications used by market leaders in every industry. S3 provides comprehensive security and compliance capabilities that meet even the most stringent regulatory requirements. It gives customers flexibility in the way they manage data for cost optimization, access control, and compliance. S3 provides query-in-place functionality, allowing you to run powerful analytics directly on your data at rest in S3. And Amazon S3 is the most supported cloud storage service available, with integration from the largest community of third-party solutions, systems integrator partners, and other AWS services. click_here

Benifits: -

• UNMATCHED DURABILITY, AVAILABILITY, & SCALABILITY
• MOST COMPREHENSIVE SECURITY & COMPLIANCE CAPABILITIES
• QUERY IN PLACE
• FLEXIBLE MANAGEMENT
• MOST SUPPORTED BY PARTNERS, VENDORS, & AWS SERVICES
• EASY, FLEXIBLE DATA TRANSFER

Use Cases: -

• BACKUP & RECOVERY
• DATA ARCHIVING
• DATA LAKES & BIG DATA ANALYTICS
• HYBRID CLOUD STORAGE
• CLOUD-NATIVE APPLICATION DATA
• DISASTER RECOVERY

The basic storage units of Amazon S3 are objects which are organized into buckets and identified within each bucket by a unique, user-assigned key. Buckets and objects can be created, listed, and retrieved using either a REST-style HTTP interface or a SOAP interface, but new Amazon S3 features will not be supported for SOAP, Amazon recommends using either the REST API or the AWS SDKs.

Bucket names and keys are chosen so that objects are addressable using HTTP URLs:

• http://s3.amazonaws.com/bucket/key
• http://bucket.s3.amazonaws.com/key
• http://bucket/key

S3 Storage Classes

1. S3 Standard is the default class.
2. S3 Standard Infrequent Access (IA) is used for less frequently accessed data.
3. S3 Reduced Redundancy Storage (RRS) is designed for noncritical, reproducible data at lower levels of redundancy.
4. Amazon Glacier is designed for long-term storage of data that is infrequently accessed and for which retrieval latency of minutes or hours are acceptable.

Pricing

Amazon S3 pricing varies depending on the different S3 storage classes. Prices vary from storage usage, number of requests, and data transfers. At its inception, Amazon charged end users $0.15 per gigabyte-month, with additional charges for bandwidth used in sending and receiving data, and a per-request (get or put) charge.

S3 logs

Amazon S3 allows users to enable or disable logging. If enabled, the logs are stored on Amazon S3 buckets which can then be analyzed. These logs contain useful information such as:

• Date / time of access to requested content
• Protocol used (HTTP, FTP, etc.)
• HTTP Status Code
• Turnaround time
• HTTP Request

S3 API

S3 API allows operations on different components of Amazon S3 solution such as Buckets, Objects, and the Service.

Access Permissions

By default, all Amazon S3 resources—buckets, objects, and related sub resources (for example, lifecycle configuration and website configuration)—are private: only the resource owner, an AWS account that created it, can access the resource. The resource owner can optionally grant access permissions to others by writing an access policy.

Amazon S3 offers access policy options broadly categorized as resource-based policies and user policies. Access policies you attach to your resources (buckets and objects) are referred to as resource-based policies. For example, bucket policies and access control lists (ACLs) are resource-based policies. You can also attach access policies to users in your account. These are called user policies. You may choose to use resource-based policies, user policies, or some combination of these to manage permissions to your Amazon S3 resources. The introductory topics provide general guidelines for managing permissions. click_here

RDS (RELATIONAL DATABASE SERVICE)

Amazon Relational Database Service (or Amazon RDS) is a distributed relational database service by Amazon Web Services (AWS). It is a web service running "in the cloud" designed to simplify the setup, operation, and scaling of a relational database for use in applications. Administration processes like patching the database software, backing up databases and enabling point-in-time recovery are managed automatically. Scaling storage and compute resources can be performed by a single API call as AWS do not offer ssh connection to RDS instances.

Amazon RDS supports for

• MySQL Databases 2009
• Oracle Database 2011
• Microsoft SQL Server 2012
• Postgre SQL 2013
• Amazon Aurora 2014
• Maria DB 2015

Overview of Amazon RDS:-

• When you buy a server, you get CPU, memory, storage, and IOPS, all bundled together. With Amazon RDS, these are split apart so that you can scale them independently. If you need more CPU, less IOPS, or more storage, you can easily allocate them.
• Amazon RDS manages backups, software patching, automatic failure detection, and recovery.
• To deliver a managed service experience, Amazon RDS doesn't provide shell access to DB instances, and it restricts access to certain system procedures and tables that require advanced privileges.
• You can have automated backups performed when you need them, or manually create your own backup snapshot. You can use these backups to restore a database. The Amazon RDS restore process works reliably and efficiently.
• You can get high availability with a primary instance and a synchronous secondary instance that you can fail over to when problems occur. You can also use MySQL, MariaDB, or PostgreSQL Read Replicas to increase read scaling.
• You can use the database products you are already familiar with: MySQL, MariaDB, PostgreSQL, Oracle, Microsoft SQL Server.
• In addition to the security in your database package, you can help control who can access your RDS databases by using AWS Identity and Access Management (IAM) to define users and permissions. You can also help protect your databases by putting them in a virtual private cloud.

DB Instance: -

The basic building block of Amazon RDS is the DB instance. A DB instance is an isolated database environment in the cloud. A DB instance can contain multiple user-created databases, and you can access it by using the same tools and applications that you use with a stand-alone database instance. You can create and modify a DB instance by using the AWS Command Line Interface, the Amazon RDS API, or the AWS Management Console.

Regions and Availability Zone: -

Amazon RDS Multi-Availability Zone (AZ) allows users to automatically provision and maintain a synchronous physical or logical “standby” replica, depending on database engine, in a different Availability Zone (independent infrastructure in a physically separate location). Multi-AZ database instance can be developed at creation time or modified to run as a Multi-AZ deployment later. Multi-AZ deployments aim to provide enhanced availability and data durability for MySQL, MariaDB, Oracle, PostgreSQL and SQL Server instances and are targeted for production environments.

Security: -

security group controls the access to a DB instance. It does so by allowing access to IP address ranges or Amazon EC2 instances that you specify. Amazon RDS uses DB security groups, VPC security groups, and EC2 security groups. In simple terms, a DB security group controls access to a DB instance that is not in a VPC, a VPC security group controls access to a DB instance inside a VPC, and an Amazon EC2 security group controls access to an EC2 instance and can be used with a DB instance.

Performance: - click_here

• RDS Metrics
• Instance Metrics
• Slow query log

Cost management: -

• Instance type
• Instance count
• Auto-Scaling

Cloud Watch

Amazon CloudWatch is a monitoring and management service built for developers, system operators, site reliability engineers (SRE), and IT managers. CloudWatch provides you with data and actionable insights to monitor your applications, understand and respond to system-wide performance changes, optimize resource utilization, and get a unified view of operational health. CloudWatch collects monitoring and operational data in the form of logs, metrics, and events, providing you with a unified view of AWS resources, applications and services that run on AWS, and on-premises servers. You can use CloudWatch to set high resolution alarms, visualize logs and metrics side by side, take automated actions, troubleshoot issues, and discover insights to optimize your applications, and ensure they are running smoothly.

Benifits: -

• ACCESS ALL YOUR DATA FROM A SINGLE PLATFORM
• RICHEST AND DEEPEST INSIGHTS FOR AWS RESOURCES
• VISIBILITY ACROSS YOUR APPLICATIONS, INFRASTRUCTURE, AND SERVICES
• REDUCE MEAN TIME TO RESOLUTION (MTTR) AND IMPROVE TOTAL COST OF OWNERSHIP (TCO)
• DRIVE INSIGHTS TO OPTIMIZE APPLICATIONS AND OPERATIONAL RESOURCES
• PAY AS YOU GO

You can use Amazon CloudWatch Logs to monitor, store, and access your log files from Amazon Elastic Compute Cloud (Amazon EC2) instances, AWS CloudTrail, and other sources.

API: - click_here

• Action
  1. DeleteAlarms
  2. DescribeAlarms, .....
• Data Type
  1. AlarmHistoryItem
  2. Datapoint, .....
• Common Parameter
• Common Error
• Regions & Endpoints

VPC (Virtual Private Cloud)

Amazon Virtual Private Cloud (Amazon VPC) lets you provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. You have complete control over your virtual networking environment, including selection of your own IP address range, creation of subnets, and configuration of route tables and network gateways. You can use both IPv4 and IPv6 in your VPC for secure and easy access to resources and applications. click_here

By launching your instances into a VPC instead of EC2-Classic, you gain the ability to:

• Assign static private IPv4 addresses to your instances that persist across starts and stops
• Optionally associate an IPv6 CIDR block to your VPC and assign IPv6 addresses to your instances
• Assign multiple IP addresses to your instances
• Define network interfaces, and attach one or more network interfaces to your instances
• Change security group membership for your instances while they're running
• Control the outbound traffic from your instances (egress filtering) in addition to controlling the inbound traffic to them (ingress filtering)
• Add an additional layer of access control to your instances in the form of network access control lists (ACL)
• Run your instances on single-tenant hardware

AWS VPC allows users to connect to the Internet, a user's corporate data_center, and other users' VPCs.

Users are able to connect to the Internet by adding an Internet Gateway to their VPC, which assigns the VPC a public IPv4 Address.

Users are able to connect to a data center by setting up a Hardware Virtual Private Network connection between the data center and the VPC. This connection allows the user to "interact with Amazon EC2 instances within a VPC as if they were within [the user's] existing network."

VPC Limits: - Click_here

SUBNET

Subnet is “part of the network”, in other words, part of entire availability zone. Each subnet must reside entirely within one Availability Zone and cannot span zones.

ROUTE 53

Amazon Route 53 is a highly available and scalable Domain Name System (DNS) web service.

SECURITY GROUP

A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC could be assigned to a different set of security groups. If you don't specify a particular group at launch time, the instance is automatically assigned to the default security group for the VPC. Click_Here

• By default, security groups allow all outbound traffic.
• Security group rules are always permissive; you can't create rules that deny access.
• Security groups are stateful — if you send a request from your instance, the response traffic for that request is allowed to flow in regardless of inbound security group rules. For VPC security groups, this also means that responses to allowed inbound traffic are allowed to flow out, regardless of outbound rules.
  1. Protocol
  2. Port Range
  3. ICMP type & code
  4. Source and destination

KEY-PAIR

Amazon EC2 uses public–key cryptography to encrypt and decrypt login information. Public–key cryptography uses a public key to encrypt a piece of data, such as a password, then the recipient uses the private key to decrypt the data. The public and private keys are known as a key pair. Click_Here

SET_UP

Create Instance:-

1. Search for EC2 and open the Instances dashboard page and click on Launch Instance.
2. Choose the AMI(Amazon Machine Image). You can select an AMI provided by AWS, our user community, or the AWS Marketplace; or you can select one of your own AMIs. As per Intelehealth requirement, you can select (ami-04ea996e7a3e7ad6b )
3. Choose the Instance Type, contains (General/Copute, RAM, vCPU). As per Intelehealth requirement, you can select (t2.large, m5.large, m4.large, c5.xlarge, c4.xlarge)
4. Configure Instace detail. You have to look into Network, Subnet, Auto-assign Public_Ip, Shutdown Behavior, Monitoring.
5. Add Address as per your Requirement.
6. Place a Tag for the Instance which help to monitor cost of the Instance.
7. Configure security group. You can create one for this Instance or you can use one group for all Instances.
8. Review the Instance configuration Click on launch button. (NOTE:- Here Launch button will not launch your Instance).
9. Now pop-up will ask for key pair, select one option.
10. click the check box and click on "Launch Instance" (NOTE: - This will launch instance).

IMP:-

• If you are not reserved any instance and launching randomly, this is not conformer that your Instance will be create because AWS will check the availability of the Instance type in that particular AZ.

Reserve Instance: -

To purchase RI, be careful to select Platform , Instance type *, Tenancy, Term, Offering class, Payment option.

After finding best price you have to add that instance to cart. Then you buy the instance. Instance type will be the key point for this.

After Reserve your Instance, This will be reserve Instance type for the specific region and apply to any running Instance with the same type.

If you have an Instance of m4.large and running, then cost will be $0.1 / Hour. After Reserve an Instance of m4.large, Your running Instance will automatically attached to RI and cost will be reduce as per RI cost.

Cross Account Sign in: -

Please follow the link, which will help to create the link to cross account sign In. Click_her

NOTE:- 038132173145 is Amal aws ID.

Step 1: Create a policy in the prod Account (Amal), which contains all the permissions which need to the dev account. For now, we have a policy name 'Intelehealth_policy' with Amal account. ________ But if you want to create a new policy, you have to select the dependent permissions like EC2, S3, RDS, e.t.c.

Step 2: Create a role in the prod Account (Amal), which contains all the roles which need to the dev account. For now, we have a role name 'CrossAccountSignin_Intelehealth' with Amal account. ________ But if you want to create a new role, you have to select 'Another aws account' and you have to provide the dev account ID and respected policy.

Step 3: Now from the dev account, you have to create a policy which allow to access cross account.

{ "Version": "2012-10-17",

"Statement": [ { "Sid": "VisualEditor0",

"Effect": "Allow",

"Action": "*",

"Resource": "arn:aws:iam::038132173145:role/CrossAccountSignin_Intelehealth"

} ]

}

Step 4: Create a user who need the cross account sign in, attach the above policy to the user and some other permission wht you want.

Step 5: Login to the dev user. on the top right, you can see your username. click on it, this will show some drop down list, select 'Switch role' from there.

Step 6: Enter prod account ID (038132173145) and role name (CrossAccountSignin_Intelehealth) and click switch role.

This will show you prod user console. Now you have the respective control of the prod account.