Role and Salary Range (USD/year)

Cloud Support Engineer = $50k–$90k

Associate Cloud Engineer = $60k–$100k

Cloud Engineer = $80k–$140k

Senior Cloud Engineer = $120k–$180k

Cloud Architect = $140k–$250k+

Solutions Architect = $130k–$240k+

DevOps Engineer = $90k–$170k

Senior DevOps Engineer = $130k–$220k

Platform Engineer = $110k–$190k

Site Reliability Engineer (SRE) = $120k–$220k

Cloud Security Engineer = $120k–$220k

Cloud Security Architect = $160,000–$300,000+

Data Engineer = $100,000–$180,000

MLOps Engineer = $130,000–$250,000+

Kubernetes Engineer = $120,000–$220,000

Nigeria Market (Approximate Annual Salary)

Cloud Support Engineer = ₦3M–₦8M

Junior Cloud Engineer = ₦4M–₦10M

Cloud Engineer = ₦8M–₦20M

Senior Cloud Engineer = ₦15M–₦40M+

DevOps Engineer = ₦10M–₦30M+

Cloud Architect = ₦20M–₦60M+

Cloud Security Engineer = ₦12M–₦40M+

Certifications That Increase Earning Potential

AWS

• AWS Certified Cloud Practitioner

• AWS Certified Solutions Architect – Associate

• AWS Certified DevOps Engineer – Professional

Azure

• Microsoft Certified; Azure Fundamentals (AZ-900)

• Azure Administrator Associate (AZ-104)

GCP

• Associate Cloud Engineer

• Professional Cloud Architect

Highest-Paying Cloud Paths

1. Cloud Security Architect

2. Cloud Architect

3. Solutions Architect

4. Site Reliability Engineer (SRE)

5. MLOps Engineer

6. Principal Cloud Engineer

7. Platform Architect

For Flutter Developers

Because you already have experience with Flutter and software development, a strong path could be:

Flutter Developer

     ↓

AWS Cloud Practitioner

     ↓

AWS Solutions Architect Associate

     ↓

Cloud Engineer

     ↓

DevOps Engineer

     ↓

Cloud Architect

On-Demand: Available 24/7.

CIDR block: Classless inter-domain routing.

Pay-Load: is the original data, while meta-data is the data that contains informations about the payload.

Pay-as-you-go: Paying for what you used only.

SQL: Structural Query data, Excel-like data.

NoSQL: No relational Database.

POP: Point of Presence

Underlay: Is the physical network of a Datacenter.

Overlay: Is the virtual network. It rely on the underlay.

IDP: Identity provider.

ASN: Automous system numbers. Related to IP address.

SRE (Site Reliability Engineering): is a discipline that applies software engineering principles to infrastructure and operations to create highly reliable, scalable systems.

IANA (Internet Assigned Numbers Authority): are the once incharge of assigning IP addresses

NACLs: Network...

LTS: Long time support

Ingress (Inbound): This is the incoming traffic

Egress (Outbound): This is outgoing traffic.

Introduction to AWS: AWS(Amazon Web Services) is the most comprehensive and broadly adopted cloud platform. It provides over 200 fully featured services from data centers globally.
Some, benefits of AWS:

• Scalability: scaling resourses up and down based on client need. There are Vertical Scalability( Up and down) and horizontal scalabilty (out and in).

• Cost Efficiency: Pay only for what is being used.

• Speed and Agility: You can upgrade, downgrade, launch and deploy resources in seconds not in weeks.

• Security: It is secured by professional that might be very costly for individual companies.

• Global Reach: Available resourses globally.

AWS Cloud services and Offering: These services are grouped based on their functionality:

• Compute:
  >EC2( Elastic compute cloud - virtual Server): Full control over OS, instance types (CPU/memory/storage), networking, and storage (EBS). Supports auto-scaling, load balancing, and reserved/spot pricing.

>Lambda( Serverless): Event-driven, automatic scaling, pay only for execution time (milliseconds). Supports many languages (Node.js, Python, Java, etc.).

>ECS (Elastic container services - Container): Two modes — EC2 (you manage instances) or Fargate (serverless). Integrates with load balancers, auto-scaling, and service discovery.

>EKS (Elastic Kubernetes container services - Containers): Fully managed Kubernetes control plane. Supports Fargate (serverless) or EC2 nodes. Standard Kubernetes tooling (kubectl, Helm).

• Storage:
  >S3(Simple storage service - Object):Websites, backups, media, big data, data lakes, static content. For general-purpose, frequently accessed objects.

>EBS(Elastic Block storage - Block): Boot volumes, databases (e.g., RDS, self-managed DBs), enterprise apps needing low-latency file systems. High-performance, low-latency for running applications/EC2.

>Glacier(Archival):  Compliance archives, media archives, backups, rarely accessed data.

• Database:
  >RDS(Relational DB): AWS managed relational (SQL) databases. Supports engines like MySQL, PostgreSQL, MariaDB, Oracle, SQL Server.

>DynamoDB(NoSQL): Fully managed NoSQL key-value and document database. Serverless: no servers to manage, automatic scaling to any workload.

>Aurora( Managed DB): AWS’s high-performance relational database engine. Fully compatible with MySQL and PostgreSQL. Runs inside RDS but is significantly faster

• Networking & Content delivery:
  >VPC (Virtual Network)
  >Route 53 (DNS)
  >CloudFront (CDN)

• Security, Identity & Compliance:
  >IAM (Access Management)
  >KMS (Key management)
  >GuardDuty (Threat Detection)

• Management & Governance:
  >CloudWatch (Monitoring)
  >CloudTrail (Audit Logs)
  >Config (Resource Tracking)

• Analytics:
  >Athena (Query Data)
  >Redshift (Data Warehouse)
  >QuickSight (BI & Reporting)

• Artificial intelligence & Machine learning:
  >SageMaker (ML Platform)
  >Rekognition (Image Analysis)
  >Comprehend (NLP)

• Application Integration:
  >SQS (Message Queue)
  >SNS (Notification)
  >EventBridge (Events)

• Migration & Transfer:
  >AWS migration Hub
  >Snow Family (Data transfer)
  >Application Discovery Service

AWS Region and Zones: AWS region is a geographical location where AWS has multiple Data center. The closer the region to your user the better the performance and compliance. AWS Availability Zone (Subset of region) is a physical location where AWS have data center.

AWS Edge Network (CDN): It is a global content delivery network(CDN) that delivers to users with low latency, high transfer speed and improved security.

Cloud Model Offering: Private Cloud, Public Cloud, Hybrid Cloud(Private and Public) and Multi Cloud( service from multiple cloud providers - Aws+GCP+Azure).

Shared Responsibility Model: Know what your part and AWS know their. Security is not solely forAWS, your have your role also.

AWS Cloud Cost and Pricing:

• Pay as you go( On Demand): You pay for only what you used. It is more expensive but easy to implement.

• Scale Up/Down (Reserved instance): You pay for what you will need and use Auto-Scalar (minimum and maximum policy, Health check-work with gauge) to scale up/down as demand increases.

• Savings Plans: Renting VM earlier/ when it is cheaper, which might not be when you want to use it.

• Spot Instances: Using idol AWS server. It charges less than 90% of On-Demand but when needed by AWS, the datas there will be erased without AWS notifying you. Used for training or services with frequent changing data.

• AWS pricing Calculator: This helps you know the cost of AWS resources before applying for it.

Creating AWS Account for Individual: Click for guideline Create AWS Account.

IAM Users, Groups and Roles: Access management tool.

IAM Policies: (inline vs managed): Access management policies.

AWS Organization Hierarchy: In an enterprise setting, you rarely have just one AWS account. You use AWS Organizations to link multiple distinct AWS accounts together under a single master Management Account (for consolidated billing and central security control). 

AWS Identity Center: 

In AWS, we have 2 types of account; Root Account, IAM user account and Federated user account.

1. Root Account: The Root Account is the identity that is created when you first open an AWS account. It is tied directly to the email address used to sign up.

• Permissions: It has ultimate, unrestricted access to all resources and billing data in the account. These permissions cannot be limited or locked down.

• Best Practice: Do not use it for daily tasks. Lock it down with Multi-Factor Authentication (MFA), store the credentials securely, and only use it for specific tasks that strictly require it (like closing the account or changing support plans).

2. IAM User Account: An IAM (Identity and Access Management) User is an identity created inside your AWS account for a specific person or application.

• Permissions: It starts with zero privileges by default. You must explicitly grant permissions using IAM policies (e.g., allowing access to only one specific S3 bucket).

• Credentials: Can have password access to the AWS Management Console and/or Access Keys for command-line/API access.

• Best Practice: Create unique IAM users for individual team members (if not using federation) and follow the principle of least privilege.

3. Federated User Account: A Federated User is an identity that does not natively exist inside AWS. Instead, users log in using an external identity provider (IdP)—such as Okta, Microsoft Entra ID (Active Directory), or Google Workspace—and are granted temporary access to AWS.

• How it works: When a user logs in via your company's portal, the external provider authenticates them. AWS then trusts that provider and grants the user a temporary, short-lived session via an IAM Role.

• Best Practice: This is the recommended approach for enterprises. It eliminates the need to create and manage separate IAM users and passwords for every employee.

AWS IAM Core Components

• IAM User: A permanent identity created inside AWS representing a specific person or application (e.g., john_developer or Engr_Nnamdi). It has a permanent name and static credentials (password or access keys).

• User Group: A collection of IAM users. You are advised to instead of assigning permissions to individuals, you put users into a group (e.g., Intern-devops, DevTeam or Admins) to manage them collectively.

• IAM Policy: A JSON(has virtual option) document that formally defines what actions are allowed or denied, and to which resources (e.g., "Allow downloading files from S3 Bucket A"). AWS have Managed policies and Custom Policies (specific permission you select to ensure limited access AWS managed polices).

• IAM Role: An identity with permissions, but without permanent credentials or a specific owner. It is designed to be "assumed" temporarily by anyone who needs it—like an EC2 server running code, an AWS service, or a user from another account.

• Identity Provider (IdP): An external service outside of AWS (like Google Workspace, Okta, or Microsoft Entra ID) that manages your organization's user logins. AWS trusts this provider to verify who a user is before letting them into AWS.

Set-Up IAM: You can give users permission from users or user group but here, i will use the best practice; assign users to group and give the group permissions. With this approach, i will have different department with their permission and role in my AWS account. 

• From the img1 below,  Click on User groups, which will take you to img2 below.

• img2 will show list of all the groups you have created and an option to create new one, because i have only one group(intern-devops) currently, i will click on it, which will take me to img3.

• img3 is inside my intern-devops group. Here, i will see list of my users under User, Permissions the users in this group can access under Permissions, and also options to edit(remove or add) permissions and users.

• You can do research (AWS documentation or Ai) on the best permissions to give each group and also user access advisor to know how often they user that permissions.

AWS Organization:

AWS IAM Identity Center (Formerly AWS Single Sign-On):

AWS IAM Identity Center is not the same as IAM (Identity and Access Management).

Think of it this way:

• IAM = Manages identities (IAM Users, Groups, Roles, Policies) inside one AWS account.

• IAM Identity Center = Manages human users across one or many AWS accounts from one central location using Single Sign-On (SSO). It is AWS's recommended way for employees and administrators to access AWS.

What is IAM Identity Center?

IAM Identity Center is a service that allows users to sign in once (Single Sign-On), access multiple AWS accounts, access AWS applications, access third-party applications (Salesforce, Microsoft 365, etc.), and use existing corporate identities (Microsoft Entra ID, Okta, Active Directory) instead of creating separate IAM users in every AWS account.

Why AWS Created IAM Identity Center

Imagine a company with 500 employees and 50 AWS accounts, without Identity Center, each employee needs an IAM User in every account. Eg; 

• AWS Account A:  John, Mary, and David.

• AWS Account B:  John, Mary, and David.

• AWS Account C:  John, Mary, and David.

That becomes extremely difficult to manage. So instead u should create;

IAM Identity Center:  John, Mary, and David to manage 

AWS Account A

AWS Account B

AWS Account C

Now users exist once, and permissions are assigned centrally.

Main Components:

IAM Identity Center consists of several key components.

• Identity Source: This is where users are stored. You have three choices.
  
  Option 1 (Default): Identity Center Directory. Here AWS stores users.
  Example: John, Mary, & David and AWS manages them.
  
  Option 2: Microsoft Active Directory. Eg:
  Company AD John, Mary, & David. AWS simply trusts Active Directory.
  
  Option 3: External Identity Provider. Such as; Okta, Microsoft Entra ID (Azure AD), Ping Identity, & JumpCloud. AWS doesn't store passwords. The external provider authenticates the user. (Amazon Web Services, Inc.).

• Users: Human users. Eg; John, Mary, Alice, & Bob. These are workforce identities.

• Groups: Instead of assigning permissions one by one. Eg;
  Developers (John, David, & Mike).
  Admins (Mary, Alice, & Mike).

• Permission Sets: This is one of the most important concepts. A Permission Set is not an IAM Policy. It is a template that Identity Center uses to automatically create IAM Roles in AWS accounts. Eg;
  - AdministratorAccess
  - DeveloperAccess
  - ReadOnlyAccess

AWS Access Portal: Users don't log directly into the AWS console, instead they visit https://your-company.awsapps.com/start. After login they see;
- Production Account
- Development Account
- Testing Account
Click one and AWS automatically signs them into that account.

Relationship Between IAM Identity Center and Federated Users: This is one of the most common AWS certification topics.

What is a Federated User?

A federated user is a user whose identity is managed outside AWS. Eg;
- Company Active Directory
- Okta
- Microsoft Entra ID
- Google Workspace

The user logs into the company identity provider, and AWS trusts that authentication instead of storing a separate password.

So What is the Relationship?

Identity Center is the service that manages federated access. 

Identity Provider
        ▼
IAM Identity Center
        ▼
Permission Set
        ▼
IAM Role
        ▼
AWS Account

The flow is:

1. User authenticates with the Identity Provider.

2. Identity Center verifies the authentication.

3. Identity Center maps the user or group to a Permission Set.

4. Identity Center automatically assumes an IAM role.

5. AWS issues temporary credentials.

6. User accesses AWS.

Authentication vs Authorization

Authentication answers: Who are you?

(Identity Provider verifies the password.)

Authorization answers: What are you allowed to do?

(Permission Sets and IAM Roles determine permissions.)

How to Create IAM Identity Center
Step 1
Sign in to the AWS Management Console.

Step 2
Open IAM Identity Center

Step 3
Click Enable

AWS creates:

• Identity Center

• Identity Store

• AWS Access Portal

Step 4
Choose your Identity Source. Options:

• Identity Center Directory

• Active Directory

• External Identity Provider (For learning AWS, select: Identity Center Directory)

Step 5
Create a User. Example
Username: john
Email: john@example.com
First Name: John
Last Name: Doe
AWS emails the user to set a password.

Step 6
Create a Group. Example
Developers ( add John, David, & Mike).

Step 7
Create a Permission Set. Example:
AdministratorAccess, or ReadOnlyAccess, or a custom AWS also allows custom permission sets using IAM policies.

Step 8
Assign the Permission Set. Choose:
AWS Account
↓
Development Account
↓
Group
↓
Developers
↓
Permission Set
↓
DeveloperAccess
Identity Center automatically creates the IAM role in that account.

How Users Use IAM Identity Center
John receives: https://company.awsapps.com/start. He logs in and sees: Development, Production, & Testing. When he clicks on Development, AWS opens the console.
Behind the scenes:
John
↓
Authentication
↓
Permission Set
↓
IAM Role
↓
Temporary Credentials
↓
AWS Console

CLI Access
Users can also access AWS from the AWS CLI.

Run:
aws configure sso

Provide: SSO Start URL, AWS Region, Account, and Role.

Login: aws sso login

Now AWS CLI receives temporary credentials automatically, without storing long-term access keys. (AWS Documentation)

Benefits of IAM Identity Center

• Centralized user management

• Single Sign-On (SSO)

• Multi-account access

• Supports external identity providers

• Uses temporary credentials instead of permanent access keys

• Easier permission management with Permission Sets

• Integrates with AWS Organizations

• Can also provide SSO access to many AWS-managed and third-party applications. (Amazon Web Services, Inc.)

IAM Identity Center vs Federated User

IAM Identity Center

Federated User

AWS service

Type of user

Provides Single Sign-On

Authenticates using an external identity provider

Creates and manages Permission Sets

Receives permissions through IAM roles

Can manage users itself or trust an external identity provider

Usually comes from Active Directory, Okta, Microsoft Entra ID, etc.

Issues temporary AWS access through assumed roles

Uses temporary AWS credentials, not long-term IAM user credentials

Interview Example

Imagine a company uses Microsoft Entra ID for employee logins:

• Alice logs into her company laptop with her Entra ID account.

• She opens the AWS access portal.

• IAM Identity Center trusts Microsoft Entra ID and authenticates Alice.

• Alice belongs to the Developers group.

• The Developers group has the DeveloperAccess permission set for the Development AWS account.

• IAM Identity Center automatically assumes the corresponding IAM role in that account and gives Alice temporary AWS credentials.

• Alice can work in the Development account without ever having an IAM user or permanent AWS access keys. (AWS Documentation)

For the AWS Certified Cloud Practitioner (CLF-C02) and AWS Solutions Architect Associate (SAA-C03) exams, remember this key principle: AWS recommends IAM Identity Center for human workforce users, while IAM roles are the preferred mechanism for workloads and services. IAM Identity Center uses those roles behind the scenes to grant secure, temporary access. (AWS Documentation)

Amazon Web Services Elastic Compute Cloud (EC2) is a cloud service that allows you to create and run virtual computers on the internet instead of buying and maintaining your own physical servers.

Think of it like renting a computer in Amazon's data center. You decide:

• The operating system (Windows, Ubuntu, Amazon Linux, etc.)

• The CPU and RAM

• The amount of storage

• The network settings

• How long you need it

You pay only for what you use (depending on the pricing model).

What is an EC2 Instance?

An EC2 Instance is simply a virtual machine (VM).

Instance CPU RAM Purpose

t3.micro    2 vCPU 1 GB Learning, testing

t3.small 2 vCPU 2 GB Small websites

m7i.large 2 vCPU 8 GB Business applications

Components of EC2

1. AMI (Amazon Machine Image)

AMI contains:

• Operating system

• Software

• Configuration

Examples:

• Ubuntu 24.04

• Windows Server 2025

• Amazon Linux

• Red Hat Enterprise Linux

Launching an instance from an AMI is like installing Windows from an image.

2. Instance Type

This determines the "power" of your virtual machine.

Examples:

• t-series → Low-cost general purpose

• m-series → Balanced CPU and memory

• c-series → Compute optimized

• r-series → Memory optimized

• g-series → GPU for AI and graphics

3. EBS (Elastic Block Store)
EBS provides persistent storage. AWS provides EBS volumes. It stores:

• Files

• Applications

• Databases

• Operating system

Even if you stop your instance, your EBS volume can persist (depending on configuration).

4. Security Groups
Think of these as the firewall for your EC2 instance. You decide which traffic is allowed. Example:
Port       Service

22 SSH (Linux remote login)

80 HTTP

443 HTTPS

3389 Remote Desktop (Windows)

5. Key Pair

For Linux instances, AWS creates or uses an SSH key pair. You download a private key (.pem) when launching the instance.  You use it to securely connect: ssh -i mykey.pem ubuntu@public-ip. Without the private key, you generally cannot SSH into the instance.

6. Elastic IP

Normally, when an EC2 instance stops and starts, its public IP address may change.
An Elastic IP is a static public IP address that remains yours until you release it.
This is useful for:

• Websites

• APIs

• Production servers

Common Uses of EC2

EC2 can be used for many workloads, including:

• Hosting websites

• Running web applications

• Database servers

• Game servers

• Development and testing environments

• AI/ML workloads (GPU instances)

• File servers

• Email servers

• VPN servers

• CI/CD build servers

• Microservices

• Container hosts

• Enterprise applications

EC2 Workflow

Choose an AMI
        ▼
Choose Instance Type
        ▼
Configure Network
        ▼
Add Storage (EBS)
        ▼
Configure Security Group
        ▼
Launch Instance
        ▼
Connect using SSH or RDP
        ▼
Install your application

EC2 Pricing Models

AWS offers several ways to pay:
Pricing Model Best For

On-Demand Short-term or unpredictable workloads

Reserved Instances Long-term workloads (1–3 years)

Savings Plans Flexible long-term cost savings

Spot Instances Fault-tolerant workloads at steep discounts

Dedicated Hosts Regulatory or licensing requirements

Below is a complete end-to-end guide to creating a Windows EC2 instance in AWS.

Internet > VPC (Internet Gateway > Route Table > Public Subnet) > EC2 Instance ( Security Group, key [RDP or SSH], MobaXterm). Logs generated by the VPC can be stored in an Amazon S3 Bucket using the VPC flow log.

Step 1: Create a VPC (Virtual Private Cloud): A VPC is your own private network inside AWS. Every EC2 instance runs inside a VPC. Without a VPC, AWS would not know where to place your resources.

• Log into AWS Console.

• Search VPC.

• Click Create VPC.

• Choose VPC only.

• Name your VPC (companies-vpc, etc.)

• Set your private IPv4 CIDR (10.0.0.0/16, 198.62.0.0/16, etc)

• Under IPv6, select None

• Set Tenancy to Default

Click Create VPC.

Step 2: Create a Public Subnet: A subnet (Switch not Hub) divides your VPC into smaller networks. The EC2 instance must live inside a subnet. For internet access, the subnet must be public.

• Under VPC left panel, click on Subnets, then on Create Subnet.

• Choose a VPC that the subnet will be under.

• Name your Subnet (companies-subnet, etc).

• Choose availability zone (us-east-1a)

• Under IPv4 CIDR assign (10.0.1.0/24, or ...).

• Then click on Create.

Step 3: Enable Auto Assign Public IP: Without a public IP, nobody on the Internet can reach your EC2 instance (Windows, Linux, or any OS server).

• Go to Subnet, then Actions, select Edit subnet settings and enable Auto-assign Public IPv4 cilck on Save.

Step 4: Create an Internet Gateway (IGW): An Internet Gateway allows traffic between your VPC and the public Internet. Without it, the EC2 instance cannot access the Internet or receive connections.

• Under VPC left panel, click on Internet Gateways, then Create internet gateway.

• Name your internet gateway (companies-igw, ...)

• Then Click on Create.

• Now, back to your internet gateways page, select the one you created and Attach to VPC created earlier.

Step 5: Create a Route Table: A Route Table tells AWS where network traffic should go.

Without a route table, the subnet does not know how to reach the Internet.

• Under VPC left panel, click on Route Tables, and then on Create Route Table

• Name your route table (companies-rt, etc)

• Select the VPC for it and then click on Create.

Step 6: Add Internet Route: This tells AWS "Send all Internet traffic to the Internet Gateway."

• Select the Route Table created above.

• In the bottom panel, select Routes and then Edit routes.

• Click on add route, input in Destination: 0.0.0.0/0 and in Target: Internet Gateway.

• select the internet gateway you created earlier and then save.

Step 7: Associate Route Table with Public Subnet: Even if the route table exists, the subnet won't use it until you associate them.

• Select the Route Table created above again.

• In the bottom panel, select Subnet associtions and then Click Edit Subnet Associations under Explicit Subnet Associations.

• Select the subnet you create earlier and save.

Step 8: Create a Security Group: A Security Group is the firewall for your EC2 instance. It controls which traffic is allowed in and out.

• Go to EC2, then select Security Groups.

• Click on Create security group

• Name your security group (companies-dev-sg, companies-admin-sg, etc.)

• Select the VPC created earlier

• Under Inbound Rules, set
  - RDP(3389) for Windows and SSH for Linux,Debian,Ubuntu, etc, then My-IP Address.
  - HTTP(80) and then Anywhere (0.0.0.0/0) (if hosting a website).
  - HTTPS(443) and then Anywhere (0.0.0.0/0) (if hosting a secure website).

• Under Outbound rules, Leave default; Allow All

Step 9: Create an RSA Key Pair: AWS uses a key pair to securely access your instance. For Windows, the private key is used to decrypt the Administrator password.

• Go to EC2 left panel, then Key Pairs and Create key pair.

• Name your key companies-key1

• Type: RSA

• Format: .pem

• Then download to a secured location. Store it safely. You cannot download it again.

Step 10: Launch Windows EC2 Instance: The EC2 instance is the virtual Windows server where your applications and services will run. 

• Under EC2, select Instance in the left panel and then click on Launch Instance.

• Name your instance (company-server, etc.).

• AMI: Microsoft Windows Server 2022 Base.

• Instance Type: t3.micro (Free Tier eligible in supported accounts)

• Key Pair: The key pair created above.

• VPC: The VPC above

• Subnet: The subnet above

• Auto Assign Public IP: Enabled

• Security Group: The Security group above.

Click Launch Instance.

Step 11: Wait for Instance Status Checks: AWS performs health checks to ensure the virtual machine and underlying hardware are functioning correctly. So wait until you see, Running and 2/2 Status Checks Passed.

Step 12: Retrieve the Windows Administrator Password(For Windows only): Windows instances generate a random Administrator password. AWS encrypts it with your public key, and you decrypt it using your private .pem file.

• Go to: EC2, then Instances

• Select your EC2 instance and click on Actions, select Security, then Get Windows Password.

• Upload: The private key pair you downloaded earlier.

• Click Decrypt Password.

• Copy the:
  - Username: Administrator
  - Password: The generated password

Step 13: Install MobaXterm: MobaXterm is a client that supports both SSH (Linux) and RDP (Windows). It provides a convenient way to connect to remote servers from Windows. Download and install MobaXterm on your local computer.

Step 14: Connect Using MobaXterm: 

• Open MobaXterm.

• Click: Session
  - Choose: RDP if it is Windows EC2 instance
  - Choose: SSH for Linux, Ubuntu, Suse, Debian

• Enter: Remote Host, EC2 Public IPv4 Address
  - Username: Administrator and click OK, when the server Open, Windows will ask for the password created earlier.
  - Username: ubuntu, then click on advance SSH and upload the private key pair created earlier.

Step 15: Create an S3 Bucket: An Amazon S3 bucket provides durable object storage. It is commonly used to store: VPC Flow Logs, EC2 backups, Application files, Static website assets, Installation packages, Log archives, etc.

• Open Amazon S3.

• Click Create bucket.

• Enter a globally unique bucket name (for example, my-ec2-logs-12345).

• Choose the same AWS Region as your EC2 instance.

• Leave Block Public Access enabled unless you have a specific need to make objects public.

• Click Create bucket.

Step 16: Enable VPC Flow Logs: VPC Flow Logs record information about network traffic entering and leaving network interfaces in your VPC. They are valuable for: Troubleshooting connectivity issues, Monitoring network activity, Detecting suspicious traffic, Security investigations, Compliance and auditing, etc.

• Go to VPC.

• Select Your VPC.

• Open the Flow Logs tab in the bottom panel.

• Click Create flow log.

• Configure:
  - Filter: All
  - Destination: Amazon S3
  - Select the S3 bucket you created
  - Create or select an IAM role if prompted.
  - Click Create flow log.

AWS will begin delivering network traffic logs to your S3 bucket.

EC2 is ideal when you need full control over a server, unlike serverless services such as AWS Lambda.

Introduction: 

A Virtual Private Cloud (VPC) is a logically isolated virtual network in AWS where you launch and manage your cloud resources, such as virtual servers, databases, load balancers, and applications.
Think of a VPC as your own private data center inside AWS. Even though your resources run on AWS's shared infrastructure, your VPC is isolated from other AWS customers unless you explicitly allow communication.
VM (EC2 or Laptop) >> Subnet (Switch) >> Router(Route table) >> Internet gateway >> Internet.

What Does a VPC Do?

• Network Isolation:
  Your resources are separated from everyone else's resources. For example:
  Customer A: has VPC A, EC2, and Database
  Customer B: VPC B, EC2, and Lambda
  Customer C: VPC C, ECS, and RDS
  Eachof these VPCs are isolated.

• IP Address Management:
  Every VPC has its own private IP address range. Eg;10.0.0.0/16

• Security: A VPC controls,
  Which servers can access the Internet
  Which servers remain private
  Which ports are open
  Which IP addresses are allowed

• Communication: Resources inside the same VPC can communicate. Example:
  Web Server(10.0.1.10) and Database (10.0.2.15) can communicate inside the AWS network.

• Internet Access: You decide whether resources,
  Have Internet access
  Are private
  Can only communicate internally.
  
  

Components of a VPC:

A VPC consists of several networking components; CIDR Block, Subnets, Route Tables, Internet Gateway, NAT Gateway, Security Groups, Network ACLs, Elastic IP, and EC2 Instances

Let's explain each one.

• CIDR Block: CIDR block defines the IP address range available in your VPC. AWS allows private IP ranges such as:

10.0.0.0/16
172.16.0.0/16
192.168.0.0/16

• Subnets:
  A subnet (Switch) is a smaller network inside the VPC. Example:
  For VPC (10.0.0.0/16)
  ├── Public Subnet(10.0.1.0/24)
  │
  ├── Private Subnet(10.0.2.0/24)
  │
  └── Database Subnet(10.0.3.0/24)
  Each subnet belongs to one Availability Zone. Eg, Public Subnet(US-East-1a), and Private Subnet(US-East-1b).

Public Subnet can access the Internet. Used for
Web servers
Load balancers
Bastion hosts
Private Subnet No direct Internet access. Used for
Databases
Internal APIs
Backend services

• Route Table: A route table tells traffic where to go. It stays between the internet gateway and the subnet(s).

• Internet Gateway (IGW): The Internet Gateway connects a VPC to the public Internet.

• NAT Gateway: A NAT Gateway allows private instances to access the Internet without allowing inbound Internet connections. Eg; Private EC2 >>NAT Gateway>>Internet.

• Security Groups: Security Groups act as virtual firewalls for individual resources. Eg, Web Server allow: 80, 443, and 22. Everything else is blocked unless allowed.

• Network ACL (NACL): A Network ACL provides firewall rules at the subnet level. Unlike Security Groups, NACLs can both allow and explicitly deny traffic.

How to Create a VPC in AWS

You can create a VPC using the AWS Management Console.

Step 1

Sign in to the AWS Console.

Step 2

Search for VPC.

Step 3

Open the VPC Dashboard.

Step 4

Click Create VPC.

Step 5

Choose one of the options:

• VPC only (create networking resources manually)

• VPC and more (AWS automatically creates subnets, route tables, Internet Gateway, and more)

For beginners, VPC and more is usually the easiest choice.

Step 6

Configure the VPC.

Example:

Name

MyFirstVPC

IPv4 CIDR

10.0.0.0/16

Step 7

If using VPC and more, specify:

• Number of Availability Zones (AZs)

• Number of public subnets

• Number of private subnets

• Whether to create a NAT Gateway

• Whether to create VPC endpoints (optional)

Step 8

Review the settings and click Create VPC.

AWS creates the VPC and the selected networking resources.

Creating a VPC Using the AWS CLI

You can also create a VPC from the command line:

aws ec2 create-vpc \

   --cidr-block 10.0.0.0/16

Example output:

{

 "Vpc": {

   "VpcId": "vpc-0123456789abcdef0",

   "State": "pending",

   "CidrBlock": "10.0.0.0/16"

 }

}

After creating the VPC, you would typically create subnets, attach an Internet Gateway, configure route tables, and launch resources into the appropriate subnets.

Best Practices

• Use private subnets for databases and backend services.

• Place public-facing resources (such as load balancers) in public subnets.

• Spread resources across multiple Availability Zones for high availability.

• Apply the principle of least privilege with Security Groups and Network ACLs.

• Plan your CIDR block carefully to allow for future growth.

 
Creating VPC
VPC flow log

Question: 

Hosting a secure website with AWS.

1. Create Network in AWS: 

• Create VPC,

• Create a subnet for the VPC,

• Explicit Subnet-associates, 

• Create Internet-gateway, select and attach it to the VPC,

• Create a route table; route-rule configuration, 

• Create a Security-group; security-group rule (ingress rules).

• Create S3-bucket.

• Create VPC-flow-log: for foot print of all those that access the VPC. Use the S3 bucket above to store the data here.
  
  

2. Create EC2 Instance with public ip (t2-medium, 2cpu, 4gram). You will need to create/add ssh-key. You can increase storage to 20gib, Attach the VPC, subnet and security-group to EC2. Also, ensure auto assigning of iP addresses. Then click create instance.
   
   

3. Create a dns record with the ip address of the EC2
   Buy a Domain name for the company (A record for IPv4 and AAAA record for IPv6)
   Point the DNS to the public ip address of EC2 instance
   Check the propagation with dnschecker.org.
   
   

4. Download a website template and costumize it.
   Download from themewagon,or themeforest.
   
   

5. Use Mobaxterm to upload file to EC2 instance.
   Allow HTTP and HTTPS
   Go to AWS Console EC2 Security Groups Inbound & Outbound Rules and add
   HTTP, HTTPS, and SSH.
   Set their source to 0.0.0.0/0 each
   Then
   Open MobaXterm
   Click Session and select SSH
   Enter: Remote Host (Your EC2 Public IP) and Specify Username (ubuntu)
   Click Advanced SSH Settings and select/check Use private key, then select your downloaded key (your-key.pem)
   Click OK
   
   

6. Install Nginx (Web services engine)
   Update Ubuntu
   Run:
   sudo apt update
   sudo apt upgrade -y
   Install Nginx
   sudo apt install nginx -y
   to verify that nginx have been insalled (systemctl status nginx)
   Check if it is running (sudo systemctl status nginx), you will see "Active: active (running)"
   If not (sudo systemctl start nginx)
   Enable it (sudo systemctl enable nginx) 
   sudo systemctl stop nginx
   sudo systemctl disable nginx
   sudo systemctl restart nginx
   Test Nginx
   Visit (http://YOUR_PUBLIC_IP) using any browser
   Upload your website
   Suppose your website folder is C:\Users\mine\Desktop\website
   Inside MobaXterm Left panel drag every files&folders inside the ...\website folder into /home/ubuntu/
   Now your website is on the server.
   Move website to Nginx folder
   The default website folder is /var/www/html
   Delete default files (sudo rm -rf /var/www/html/*)
   Copy your website (sudo cp -r ~/website/* /var/www/html/)
   Or
   If your files & folders are directly inside /home/ubuntu: then use (sudo cp -r ~/* /var/www/html/)
   Give permissions
   sudo chown -R www-data:www-data /var/www/html
   Then
   sudo chmod -R 755 /var/www/html
   Restart Nginx
   sudo systemctl restart nginx
   check the ip address or server url on a browser.
   
   

7. Verify the Domain propagation
   www.dnschecker.org
   enter the server domain name and check if ip address has propergated
   
   

8. Configure your domain
   Since you've already pointed your domain to the EC2 public IP, verify the DNS records:
   A, @, and EC2 Public IP
   also
   A, www, and EC2 Public IP
   Wait for DNS propagation if you made recent changes (this can take anywhere from a few minutes to several hours) then check (http://yourdomain.com) on your web browser.
   Enable HTTPS (recommended)
   Install certbot and configure Https with letencrypt, or and other certificate.
   sudo apt install certbot
   sudo apt install certbot python3-certbot-nginx -y
   Follow the prompts: Enter email, Accept Terms, Choose your domain, and Redirect HTTP to HTTPS? YES
   Then visit (https://yourdomain.com)
   You now have a secure site.
   
   

9. Other useful Linux commands
   pwd # Current directory
   ls # List files
   ls -la # Detailed listing
   cd foldername # Change directory
   cd .. # Go up one directory
   mkdir test # Create directory
   rm file.txt # Delete file
   rm -rf folder # Delete folder recursively
   cp file1 file2 # Copy file
   cp -r folder1 folder2   # Copy folder
   mv old new # Move or rename
   cat file.txt # View file
   nano file.txt # Edit file
   
   

10. Request for certificate on domain_name.online
    sudo certbot --nginx -d domain_name.online
    sudo systemctl start nginx
    if nginx fails, we restart the entire system.
    if your ip change cos of stop and restart of vm.
    update your dns record with the new ip address.
    
    

11. Test your application.
    
    

12. Penetration Testing
    online pentesting
    https://pentest-tools.com/
    
    

13. Prepare your Documentation.
    
    

14. Post Link.