Securely accessing cloud resources is a common challenge for many IT professionals. AWS Client VPN is a managed client-based VPN service that enables us to securely access our AWS resources and resources in our on-premises network. With Client VPN, we can access our resources from any location using an OpenVPN-based VPN client.

Architecture

Architecture Diagram: Client VPN Connection

Procedure

Prerequisites

Before we begin, we need to have the following:

• The permissions required to work with Client VPN endpoints.
  Generate an appropriate IAM Role or if you have Administrator Access role that is sufficient.

• The permissions required to import certificates into AWS Certificate Manager.
  We will be using AWS CLI, Consequently Access key and Secret key are required.

• A VPC with at least one subnet and an internet gateway. The route table that's associated with our subnet must have a route to the internet gateway.

Step 1: Choose your endpoint type

AWS Client VPN supports two endpoint types:

• VPC subnet association for single-VPC access, and

• Transit Gateway association for multi-VPC and hybrid network scenarios.
  In this Blog we will configure using VPC-associated endpoints.

Step 2: Generate server and client certificates and keys

We will setup EasyRSA for generating the certificates and use mutual authentication, where Client VPN uses certificates to perform authentication between clients and the Client VPN endpoint.

Install the EasyRSA, from the link below.

https://github.com/OpenVPN/easy-rsa/releases

Download the ZIP file appropriate for your operating system, extract it, navigate to the extracted directory, and open the easyrsa.bat file. These Easy-RSA commands initialize the Public Key Infrastructure (PKI), create a Certificate Authority (CA), and generate the server and client certificates required for mutual TLS authentication.

#easyrsa.bat

# Easy RSA Configuration
	 ./easyrsa init-pki
	 ./easyrsa build-ca nopass
	 ./easyrsa build-server-full server.domain.tld nopass
	 ./easyrsa build-client-full client1.domain.tld nopass

Now, For ease, what we do is create an new folder and copy the certificates and key into that folder and upload those certificates to the AWS ACM.

Open a PowerShell new terminal and go into that EasyRSA directory where we previously ran commands and copy the certificates and key into a VPNDemo Directory.

#POWERSHELL

cd C:\Users\Acer\Downloads\EasyRSA-3.2.6-win64\EasyRSA-3.2.6
mkdir ~/VPNDemo
cp .\pki\ca.crt ~/VPNDemo/
cp .\pki\issued\server.domain.tld.crt ~/VPNDemo/
cp .\pki\private\server.domain.tld.key ~/VPNDemo/
cp .\pki\issued\client1.domain.tld.crt ~/VPNDemo/
cp .\pki\private\client1.domain.tld.key ~/VPNDemo/
cd C:\Users\Acer\VPNDemo\

After Creating client, server keys and certificates along with ca.crt. We will copy it into the new directory VPNDemo and from here we shall import Client and Server Certificates to the AWS ACM.

NOTE: Before importing, Please run aws configure and Enter your Access key and Secret key.

# Import server certificate to aws acm

aws acm import-certificate --certificate fileb://server.domain.tld.crt \     
--private-key fileb://server.domain.tld.key \
--certificate-chain fileb://ca.crt \
--region us-east-2

# Import Client certificate to aws acm

aws acm import-certificate --certificate
fileb://client1.domain.tld.crt \
--private-key fileb://client1.domain.tld.key \
--certificate-chain fileb://ca.crt \
--region us-east-2

• Go to the AWS Management Console, Search for ACM and you shall see the Certificates there.

Step 3: Create a Client VPN endpoint

Before we create a Client VPN endpoint, We need to have a VPC with Private Subnet and we shall associate the endpoint to that private subnet.

Here, I have created a VPC named "demo-vpc". For this blog I shall not cover creating VPC, You can easily create one.

• For creating Client VPN Endpoint, In the AWS Console, go to VPC and click on Create Client VPN Endpoint.

we can set the VPN endpoint Name and Description (both are optional). we will select the "demo-vpc" and the default security group.

we need to specify the Client VPN CIDR range between /12 and /22 and can't overlap with the target network, VPC address range or routes.

for now, we'll use 10.0.0.0/12

under Authentication:

• Select the Server certificate ARN from drop down that we have previously imported.

• use mutual authentication for Authentication options.

• Similarly, Select the Client certificate ARN from drop down that we have previously imported.

• Enable Self-service Portal, under Client Interface

• Select split-tunnel, From the Connection protocol

Step 4: Associate a target network

It’s important to note that once created, the endpoint will remain in the pending-associate state until a target network association is added. This means you’ll need to associate the endpoint with at least one subnet in your VPC before it becomes operational.

Step 5: Add an authorization rule for the VPC

By default, nothing is accessible. we must explicitly allow access.

Authorization rules define what resources out VPN users can access. we can find this under the ‘Authorization Rules’ tab in our Client VPN endpoint settings.

Navigate to Authorization Rules. Add a rule that permits traffic to our VPC CIDR range (e.g., 192.168.0.0/16) and not our Client VPN CIDR range.

Step 6: Configure Route Table

The route table configuration determines where our VPN traffic should be directed.

Step 7: Verify security group requirements

Make sure your resources’ security groups allow inbound traffic from the Client VPN CIDR block.

For example:

• Allow RDP (3389) for Windows instances.

• Allow SSH (22) for Linux instances.

• Allow ICMP if you want to test with ping.

Step 8: Download the Client VPN endpoint configuration file and Configure it.

When all settings are configured and Client VPN state is available, download the client configuration file from the top of the dashboard by clicking on Download client configuration.

Before we use this configuration file, we need to modify it and add the certificate and key of the client.

Open the .ovpn file in a text editor and add the following blocks at the end, replacing the placeholders with the actual certificate and key content form your client cert and key file.

    <cert>
    -----BEGIN CERTIFICATE-----
    [Your client certificate content]
    -----END CERTIFICATE-----
    </cert>

    <key>
    -----BEGIN PRIVATE KEY-----
    [Your client private key content]
    -----END PRIVATE KEY-----
    </key>

Step 9: Connect to the Client VPN endpoint

To connect using the AWS provided client for Windows x64-based or Windows Arm64-based systems:

if you have downloaded yet please download from client VPN Endpoints.

• Open the AWS VPN Client app.

• Choose File, Manage Profiles.

• Choose Add Profile.

• For Display Name, enter a name for the profile.

• For VPN Configuration File, browse to and then select the configuration file that you received from your Client VPN administrator, and choose Add Profile.

I have created an AWS EC2 instance on Private Subnet which has private IP 192.168.128.81 and with security group with ICMP and SSH Protocol allowed.

The instance is reachable from the VPN client and can also access the internet, which is enabled by the split-tunnel configuration that we have implemented.

Once connected, We can also see the Connection that had been created on the Client VPN Endpoint, under the connections tab.

Congratulations!!

This confirms that the VPN connection has been successfully established and that the instance in the private subnet is reachable. You can now securely connect to the server via SSH using the instance’s private IP address.

chmod 400 <path-to/keyfile.pem>
ssh -i <path-to/keyfile.pem> <userName>@<privateIP>

The chmod 400 command ensures that the private key has the required permissions. The SSH username depends on the operating system/AMI used by the EC2 instance for example, ec2-user for Amazon Linux, ubuntu for Ubuntu, and admin for some Debian-based images. Replace with the appropriate username for your instance.

Benefits

• Security : Implements enterprise-grade security with certificate-based authentication

• Flexibility : Connects AWS and on-premises resources

• Scalability : Automatically scales based on you needs

• Managed Service : AWS handles the infrastructure, We just focus on the configuration

NOTE:

If you ever change settings like enabling split-tunnel or adding new routes, Please make sure to re-download the client config file and reconnect otherwise, your local profile might not reflect the new routing.

Conclusion

AWS Client VPN with mutual authentication provides a secure, controlled, and scalable way to access private resources without exposing them to the public internet. With the right configuration, secure remote access becomes simple, reliable, and production-ready.

Migrating physical or virtual machines from on-premises to AWS can feel scary but AWS Application Migration Service (MGN) makes it straightforward by continuously replicating servers to AWS and enabling test launches and cutovers with minimal downtime. Let’s start from planning to post-cutover validation.

Architecture Diagram

Procedure:

Step 1: Configure replication in AWS MGN

• Open the AWS Application Migration Service console.

  

Confirm Replication settings:

• Under settings select the Replication template and click on edit.

• Select the subnet for replication instance and instance type based on your requirement.

• Choose EBS volume type and Encryption method.

  

• Save the template

Now, Select the Lunch template under Settings.

• Edit the template

• Choose the EBS volume type, security group and EBS volume type

• Save the template.

Under Post-launch template

• Select the install the system manager agent and allow exectuting actions on launch servers.

• Also, choose the Deployment option for agent to be installed on.

• save the template.

Step 2: Agent installation

The agent registers the server to your MGN service and starts sending block-level data to replication servers in your AWS account .

Now, Select the Source servers and click on Add server.

• Select the Operating system, replication preferences and

• Provide the AWS Access key ID and Secret Access Key, you can generate form IAM if you haven’t generated it yet.

• Copy the Installer link and paste on the browser of your physical machine, it will download an installer file.

Note: remember you need to download the exe file not .sha512

• Copy the Command below the installer download link and paste on the same directory where your installer is downloaded.

• In the MGN Console you should see the source server appear (with a discovered source ID).

• Wait for the lifecycle to complete

• Wait until replication progress is 100%.

• We can see the specification of physical machine on the server info

• After successful replication, the Lifecycle moves to Ready for testing stage.

• The new ec2 server creation for AWS Migration Service Replication Server is visible.

Step 3: Verifying the Templates

On the AWS Application and Migration Serve on source server

• Go to the launch settings and modify EC2 launch Template

• It will redirect to the EC2 launch template

• Under Key Pair select or create a new key pair

• Under Advanced network configuration Enable Auto-assign public IP

• Select the template and choose Set default version from the Action

• Choose the recent version

• It’s now visible that default version is changed to 3 from 2.

Step 4: Launch the Testing Instance

On the Migration Dashboard

• Select Test and cutover and as Lifecycle is Ready for testing, Lunch test instances.

• Lunch the test instance

• View the events on the launch history on the left sidebar, wait until it’s completed.

• The job logs and Lifecycle for an update.

• As the test instance is launched, now open the RDP port of the instance and you can connect it through the RPD

• Select the test instance and under Security

• Click on security group, edit it and

• Add the RDP port.

• Select the instance and click on connect

• Only copy the public DNS and use the username and password of the On-prem server.

• All the files of on-premises on the ec2 test-instance is replicated, if everything is Perfect, we will start the final cutover.

Step 5: Lunch Final Cutover Instance.

• Go back to AWS Application Migration server and mark ready for cutover.

• If you find something unusual or all your data was not migrated, you can Revert to “Ready for testing“ and ensure sync completed before “Lunch Test Instances”.

• You can see that when you changed to Ready for cutover the Test-Instance is automatically deleted.

  Now for Cutover,

1. Schedule downtime or maintenance window for the application (short maintenance window reduces final delta).

2. In MGN Console, Perform Cutover for selected servers:

   • MGN will perform a final sync (brief pause for consistent state).

   • Launch the target EC2 instance(s) in AWS.

• As the Lifecycle moves to the Ready for cutover,

• From the Test and cutover option, click on “Lunch cutover instance”

• Wait until the cutover is completed. Meanwhile you can see the Jobs and logs from lunch history

• Job logs.

• After the Cutover is completed, as we can see on the Lunch history.

• We can see that the Final instance has been created on the EC2 Instances.

• Now, we need to finalize the cutover after testing the Instance so that we can shutdown the source and Replication server.

• Click on the Finalize cutover from the “Test and Cutover” Option.

• Lifecycle transition from the Cutover in profess to Cutover complete after Finalize.

• After everything is completed next step is mark as archived the source server as it is already disconnected from the service when we finalize the cutover.

• we can see that only one instance is running tha is our final Cutover Production server migrated from the on-premises. Let’s connect it through the RDP

• Copy the public-dns of the server and use the on-premises username and Password.

we have migrated the On-premise server to the AWS using AWS Application Migration Service (MGN).

Final tips and best practices

• Start small: do with a noncritical server to learn the process.

• Document everything: replication settings, custom drivers, any changes to server configurations.

Conclusion

AWS Application Migration Service (MGN) simplifies moving on-prem servers to AWS by providing continuous block-level replication, safe test launches, and an easy cutover path. With good planning and careful testing, we can migrate mission-critical workloads with minimal downtime with predictable results.

Architecture:

Assumptions & prerequisites

1. Network connectivity between AWS and on-prem (VPN / Public IP available).

2. Administrative access to source MySQL and to the AWS account (permissions to create RDS, DMS, IAM, roles, subnets, and security groups).

Step-by-step migration procedure:

Step 1: Assess & plan

Decide migration type: Full load + ongoing replication (CDC) is recommended for production to reduce downtime.

• Configure MySQL for DMS (Binary Logs + Remote Access)

Edit the MySQL configuration file (/etc/mysql/mysql.conf.d/mysqld.cnf on Ubuntu/Debian, or /etc/my.cnf on RHEL/CentOS/Amazon Linux).

bind-address = 0.0.0.0 
# AWS DMS timeout configuration
net_read_timeout=300
net_write_timeout=300
wait_timeout=300

Save and restart MySQL:

 sudo systemctl restart mysql

Step 2: Create a dedicated DMS user and grant privileges

CREATE USER 'dms_user'@'%' IDENTIFIED BY 'StrongPassword!';
GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'dms_user'@'%';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, INDEX ON `abi_db`.* TO 'dms_user'@'%';
GRANT ALL PRIVILEGES ON awsdms_control.* TO 'dms_user'@'%';
FLUSH PRIVILEGES;

Step 3: Create IAM Roles for AWS DMS

Create the following roles in IAM → Roles → Create role → AWS Service → DMS and attach the matching AWS managed policies:

• dms-cloudwatch-logs-role → attach AmazonDMSCloudWatchLogsRole

• dms-vpc-role → attach AmazonDMSVPCManagementRole

• DMSS3AccessRole-maxdms-migration-bucket → attach AmazonS3FullAccess (or custom bucket policy for least privilege)

NOTE: All roles must trust dms.amazonaws.com

Step 4: Create the target: Amazon RDS for MySQL

• In the AWS Console → RDS → Create database. Choose MySQL, pick engine version compatible with your application

  

• Choose instance class, storage, Multi-AZ (recommended for production), and set backups & maintenance.

• Create or use a DB subnet group inside the VPC where your DMS replication instance will run.

• Note the RDS endpoint, username, and password — you’ll use these for the DMS target endpoint.

Step 5: Networking: ensure connectivity

Decide how DMS will reach on-prem:

• Recommended (secure): AWS VPN / Direct Connect.

• Alternative: Open source MySQL port from DMS replication instance public IP range (less secure).
  Make sure:

• Security groups for RDS allow inbound from the replication instance.

• On-prem firewall allows inbound from replication instance or through your VPN.

• If using public endpoints, consider enabling SSL for MySQL connections

Step 6: Create an AWS DMS replication instance

• Search for AWS DMS in the management console, select Replication instances and click on Create replication instance.

• Choose instance class and storage. For large databases or heavy throughput pick a larger instance.

• Place the instance in the same VPC and subnets that can reach both on-prem (via VPN) and the RDS target.

• Wait for the instance to become available.

  

  

  

Step 7: Create source & target endpoints in DMS

Source endpoint (MySQL):

• Engine: MySQL.

• Hostname: your on-prem IP or hostname reachable by the replication instance.

• Port: 3306 (or custom).

• Username/password: the dms_user you created.

• Test the endpoint connection from the replication instance (there’s a “Test endpoint connection” button).

  

  

Similarly,

Target endpoint (RDS MySQL):

• Engine: MySQL.

• Hostname: RDS endpoint.

• Port: 3306.

• Username/password: RDS master user (or another user with sufficient privileges).

• Test the endpoint.

  

  

  

If the endpoint tests fail, check security group rules, network ACLs, and firewall rules.

Step 8: Create and configure the migration task

• Search for DMS in the console, Select Database migration tasks and click on Create task.

  

Choose:

• Replication instance

• Source endpoint

• Target endpoint

• Migration type: Migrate existing data and replicate ongoing changes (Full load + CDC).

• Table mappings: choose to migrate entire schemas or select tables. You can use JSON mapping to include/exclude objects.

Task settings:

• Choose how to handle target table prep (e.g., Do nothing or Drop tables and recreate).

• For large LOBs, select appropriate LOB mode (e.g., Full LOB mode).

• Tune commit rate and parallel load options if needed.

Start the task (choose Start task on create or start after creation).

Step 9: Monitor the migration

In DMS Console:

• Watch task status and replication instance CPU, memory, and disk I/O.

• Check Table statistics for rows loaded per table

Conclusion

Using AWS DMS to migrate on-prem MySQL to Amazon RDS lets you move with minimal downtime when planned and executed carefully.

Monitoring storage utilization is critical to ensure application stability and avoid unexpected outages. In AWS, Amazon EBS does not provide built-in metrics for volume-level disk usage, which makes proactive alerting a challenge. To address this, we can install a CloudWatch agent that publishes custom disk utilization metrics to Amazon CloudWatch, enabling us to configure alarms and receive email notifications when EBS usage reaches critical thresholds. In this blog we will setup an alarm if our EBS Volume usage is 80% and above.

Architecture Diagram:

Procedure:

Step 1: Launch the EC2-Instance

Step 2: Copy the Public-IP address of the Instance.

Step 3: Connect the server using ssh key

ssh -i /path/<Keyfile.pem> ec2-user@<public Ip>
#example:
ssh -i max-demo-key.pem ec2-user@18.207.190.7

Step 4: Install and configure the cloudwatch agent

you can do it manually or configure with with a custom script.

• make a script install.sh and place the following code.

#!/bin/bash

# Update package list
echo "Updating system packages..."
sudo yum update -y || sudo apt-get update -y

# Install CloudWatch Agent
echo "Installing Amazon CloudWatch Agent..."
sudo yum install -y amazon-cloudwatch-agent || sudo apt-get install -y amazon-cloudwatch-agent

# Create CloudWatch Agent Configuration
echo "Creating CloudWatch Agent Configuration for EBS volume monitoring..."
CONFIG_FILE="/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json"

sudo tee $CONFIG_FILE > /dev/null <<EOF
{
    "agent": {
        "metrics_collection_interval": 60,
        "run_as_user": "root"
    },
    "metrics": {
        "metrics_collected": {
            "cpu": {
                "measurement": [
                    "cpu_usage_idle",
                    "cpu_usage_iowait",
                    "cpu_usage_user",
                    "cpu_usage_system"
                ],
                "metrics_collection_interval": 60,
                "totalcpu": false
            },
            "disk": {
                "measurement": [
                    "used_percent",
                    "inodes_free"
                ],
                "metrics_collection_interval": 60,
                "resources": [
                    "*"
                ]
            },
            "diskio": {
                "measurement": [
                    "io_time",
                    "write_bytes",
                    "read_bytes",
                    "writes",
                    "reads"
                ],
                "metrics_collection_interval": 60,
                "resources": [
                    "*"
                ]
            },
            "mem": {
                "measurement": [
                    "mem_used_percent"
                ],
                "metrics_collection_interval": 60
            },
            "netstat": {
                "measurement": [
                    "tcp_established",
                    "tcp_time_wait"
                ],
                "metrics_collection_interval": 60
            },
            "swap": {
                "measurement": [
                    "swap_used_percent"
                ],
                "metrics_collection_interval": 60
            },
            "custom_metrics": {
                "measurement": [
                    "CustomMetricExample"
                ],
                "metrics_collection_interval": 60,
                "resources": [
                    "*"
                ],
                "default": {
                    "CustomMetricExample": 3
                }
            }
        }
    }
}

EOF

Step 5: make the script executable and run the script

chmod +x install.sh
./install.sh

Step 6: Enable and Start CloudWatch Agent

sudo systemctl enable amazon-cloudwatch-agent
sudo systemctl start amazon-cloudwatch-agent
#verify the agent is running, if required restart the agent
sudo systemctl status amazon-cloudwatch-agent --no-pager

Step 7: Create a role for agent to put metric about the resources :

• Search for IAM > Select Policy > Create Policy

CloudWatchAgentPolicy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cloudwatch:PutMetricData",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:GetDashboard",
                "cloudwatch:ListMetrics",
                "cloudwatch:ListDashboards",
                "cloudwatch:PutMetricAlarm",
                "logs:PutLogEvents",
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:DescribeLogStreams",
                "logs:DescribeLogGroups",
                "logs:PutRetentionPolicy"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:DescribeTags",
                "ec2:DescribeVolumes",
                "ec2:DescribeVolumeStatus",
                "ec2:DescribeInstanceStatus",
                "ec2:DescribeRegions"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams",
                "logs:PutLogEvents"
            ],
            "Resource": "*"
        }
    ]
}

• Create Policy.

  Now

• Select Role and Create New Role

• Trusted entity type to Custom trust policy

  

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

• Click on Next

• Select the Permission you have created Recently i.e CloudWatchAgentPolicy

  

• Click on Next

• Enter the Role Name

• Click on Create Role

Step 8: Attach the Role to the Instance

• On the Instances

• Select the Action > choose Security > Click on Modify IAM role

• Choose the CloudWatchAgentInstanceProfile

Step 9: Restart the Agent

sudo systemctl restart amazon-cloudwatch-agent

• view the logs of the agent

sudo journalctl -u amazon-cloudwatch-agent --no-pager -n 50
sudo cat /opt/aws/amazon-cloudwatch-agent/logs/amazon-cloudwatch-agent.log

Step 10: Create a SNS Topic and make Subscription using required email address.

• Click on Create Topic

• 

  Copy the Arn value

Step 11: Command to create a cloudwatch alarm.

• Change the required value also, CloudWatch metric parameter must match the dimensions.

Example: <Private_IP> and <SNS_ARN_Topic>

aws cloudwatch put-metric-alarm \
  --alarm-name "Volume 80% Utilization" \
  --metric-name "disk_used_percent" \
  --namespace "CWAgent" \
  --statistic "Average" \
  --dimensions Name=device,Value=xvda1 Name=fstype,Value=xfs Name=host,Value=ip-<Private-IP>.ec2.internal Name=path,Value=/ \
  --threshold 80 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 1 \
  --period 300 \
  --alarm-actions <SNS_ARN_Topic> \
  --region us-east-1

Or manually set an alarm.

Now,

• Go to the CloudWatch

• Select All Alarms.

• Copy the ARN of the CloudWatch Alarm.

• 

Step 12: Attach the Access policy to the SNS Topic

• CloudWatch need permission to publish the message,

• Click on Edit in SNS Topic

• Under Access Policy replace the policy and change <SNS ARN>

•           {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Principal": {
                    "Service": "cloudwatch.amazonaws.com"
                  },
                  "Action": "SNS:Publish",
                  "Resource": "<SNS ARN>",
                  "Condition": {
                    "ArnLike": {
                      "aws:SourceArn": "CLOUDWATCH ARN"
                    }
                  }
                }
              ]
            }
  

  Step 13: Restart the Agent and check the metric list.

#restart t-status
sudo systemctl restart amazon-cloudwatch-agent
#checking the metric being pushed by the CWAgent
aws cloudwatch list-metrics --namespace "CWAgent" --metric-name "disk_used_percent" --region us-east-1

Step 14: Creating Subscriptions for your SNS Topic

• Go the SNS TOPIC

• Create Subscriptions

• Protocal: Email

• EndPoint: “Enter Your Email address”

• Open your Email and Confirm Subscription

Step 15: Triggering the Event by Manually utilizing the EBS Volume.

• Creating a testfile.img with size of 5GB

sudo fallocate -l 5G /testfile.img
#view  the storage of the system 
df -h

As you can see the disk utilization is 88% on /dev/xvda1 now, we should receive an alarm.

Congratulation!!!

You did a great job. you have now successfully demonstrated monitoring EBS volume using CloudWatch agent and setup an alarm when the threshold met.

Conclusion:

By publishing custom disk utilization metrics to Amazon CloudWatch, we gained visibility into EBS volume usage that wasn’t available by default. This enables timely alerts and proactive storage management, helping prevent performance issues and downtime.

we need to securely transfer sensitive documents to the cloud without manual intervention. A common requirement is to automatically detect file changes, apply client-side encryption, and upload only the modified files on a scheduled basis, such as every midnight. This approach ensures strong data security, reduces unnecessary uploads, and optimizes bandwidth and storage usage. In this Blog we will go through securing our object and moving it to the S3 bucket.

Architecture Diagram

To complete this Project we will be using AWS CLI and Bash-Script for Automation and Cronjob for triggering event every-midnight.

Procedure:

Step 1: Create a bucket and enable versioning

aws s3 mb s3://max-demo-abi7

#enable the versioning of bucket
aws s3api put-bucket-versioning --bucket max-demo-abi7 --versioning-configuration Status=Enabled

• Go to the AWS management console and Search for S3 and also check for versioning enabled by clicking the Properties option.

Step2: Create a file script.sh

This script does the following:

1. Watches a file (file1.txt) for changes.

   If modified

   Encrypts it with GPG.

2. Uploads the encrypted file to an S3 bucket.

3. Updates a timestamp log.

4. If not modified: Skips processing.

5. If the file doesn't exist: Logs that info.

Now, update the variables in the script, also update passphrase

#!/bin/bash

# Set DIRECTORY_PATH ,FILE_NAME and S3_BUCKET variables
DIRECTORY_PATH="/home/abi/Desktop/max-demo/"
cd "$DIRECTORY_PATH" || { echo "Failed to change directory to $DIRECTORY_PATH"; exit 1; }

FILE_NAME="file1.txt"
ENCRYPTED_FILE="${FILE_NAME}.gpg"
S3_BUCKET="s3://max-demo-abi7"
LAST_MODIFIED_FILE="$DIRECTORY_PATH/last_modified.txt"

# Check if the file exists
if [ -f "$FILE_NAME" ]; then
    # Get the current last modified time of the file
    CURRENT_MODIFIED_TIME=$(stat -c %Y "$FILE_NAME")

    # Check last_modified.txt for previous timestamp (or empty)
    if [ -f "$LAST_MODIFIED_FILE" ]; then
        LAST_MODIFIED_TIME=$(cat "$LAST_MODIFIED_FILE")
        # If the file is empty, treat as not previously uploaded
        if [ -z "$LAST_MODIFIED_TIME" ]; then
            LAST_MODIFIED_TIME=0
        fi
    else
        LAST_MODIFIED_TIME=0  # If the file doesn't exist
    fi

    # Compare timestamps to decide if the file was modified
    if [ "$CURRENT_MODIFIED_TIME" -gt "$LAST_MODIFIED_TIME" ]; then
        echo "$(date): File $FILE_NAME has been modified or is new. Encrypting..."

        # Encrypt the file using GPG (symmetric encryption)
        gpg --batch --yes --symmetric --cipher-algo AES256 --passphrase "max@Passw0rd" -o "$ENCRYPTED_FILE" "$FILE_NAME"

        if [ $? -eq 0 ]; then
            echo "$(date): Encryption successful. Uploading to S3..."

            # Upload the encrypted file to S3
            aws s3 cp "$ENCRYPTED_FILE" "$S3_BUCKET/"

            if [ $? -eq 0 ]; then
                echo "$(date): File successfully uploaded to $S3_BUCKET"
                rm -f "$ENCRYPTED_FILE"

                # Update the last modified timestamp
                echo "$CURRENT_MODIFIED_TIME" > "$LAST_MODIFIED_FILE"
            else
                echo "$(date): Upload to S3 failed!"
            fi
        else
            echo "$(date): Encryption failed!"
        fi
    else
        echo "$(date): File $FILE_NAME has not been modified. Skipping encryption and upload."
    fi
else
    echo "$(date): File $FILE_NAME not found in $DIRECTORY_PATH"
fi

Note: following command is used for encrypting the object so the —passphrase “max@Passw0rd“ should be noted for decrypting later.

gpg --batch --yes --symmetric --cipher-algo AES256 --passphrase "max@Passw0rd" -o "$ENCRYPTED_FILE" "$FILE_NAME"

Step3: Make the script.sh executable

sudo chmod +x script.sh

Step4: Set the cronjob for automation at 12:00 AM midnight

#checking the status of cron
systemctl status cron

crontab -e
#paste the below line and change path to script.sh file
00 00 * * * <Path/to/scritp>/script.sh >> <Path/to/log>/logfile.log 2>&1

for testing set the cronjob for min after some minutes to current time.

Example: This will run the cronjob at 1:40 PM everyday

40 13 * * * ~/Desktop/max-demo/script.sh >> ~/Desktop/max-demo/logfile.log 2>&1

• After the Successful execution of the script , you will get your encrypted object with extension .gpg uploaded to bucket

Step5: Reading the File

• Download the file and decrypt using the passphrase that you have set before.

#download the file from s3 to local directory
aws s3 cp s3://max-demo-abi7/file1.txt.gpg .

cat file1.txt.gpg
#decrypting the file using passphrase and output in file1.txt file
gpg --batch --yes --passphrase "max@Passw0rd" -o file1.txt -d file1.txt.gpg

#view the file after decryption
cat file1.txt

• View the encrypted text file using cat command

You can also check the log_files.log and last_modified.txt files by setting cronjob without changing the context of file1.txt.

Congratulations!!!

You have successfully completed this demonstration. Now you will be able to use client-side encryption into your S3-bucket.

Conclusion:

By automating file change detection, client-side encryption, and scheduled uploads, we can ensure our sensitive data is transferred securely and efficiently.

Data migration and disaster recovery are key considerations for building resilient cloud architectures. A common requirement is to migrate data from an local machine to a primary Amazon S3 bucket, while ensuring that the same objects are automatically replicated to a secondary bucket in another AWS region. This setup not only simplifies data migration but also provides high availability, durability, and cross-region redundancy without manual intervention.

Architecture Diagram:

Procedures:

Step1: Login to your AWS Management Console and change the region to us-east-2.

Step2: Create two S3 Bucket in different regions and enable versioning for cross region replication.

• We name the Primary Bucket “abisbucket” in AWS region “us-east-2”

• Secondary Bucket be “abisbucket101” in AWS region “us-west-2”

• Bucket versioning Enable.

• Similary, Create another bucket.

Step3: Creating Replication Rule to the Primary Bucket.

• Select the primary bucket named, here “abisbucket“

• Navigate to the Management tab

• Navigate to Replication rules and

• Click create replication rule.

• Enter the Name for Replication rule. eg: “crr-full-bucket“

• keep the Status Enabled.

• Under the Source bucket, Apply to all objects in the bucket

• From Destination Section, Choose the bucket in this account

• Browse S3 Bucket that you have created as Secondary.

• Under IAM role, Select Create new role or if you have already created an Role Choose existing IAM roles.

• For now we have just created an bucket and doesn’t contains any objects so choose Not to replicate existing objects.

• Click on Submit.

Step4: Checking whether CRR is Successful or Not.

• Upload an file to the Primary Bucket “abisbucket“

• Navigate to the Seconday Bucket “abisbucket101“, You should be able to see the objects uploaded in the primary bucket.

Step5: Setting up Storage Gateway

• In your Management console type Storage Gateway on the search box and click it to open.

• Click on create gateway

• Enter the Gateway name , For now “File Gateway“

• Under Gateway options, Choose Amazon S3 File Gateway.

• Select Amazon EC2 from Platform options.

• Choose Customize your settings from the Launch EC2 instance.

• Click on Launch instance under Set up gateway on Amazon EC2

Step6: Fill out the details to create an instance.

• Enter the name of the instance (you can choose any name),

• for the AMI it is automatically selected for you,

• on the instance type select t2.micro,

• on the key pair you can proceed with vockey or just proceed to create your own,

• on the network settings I would prefer you use a VPC that you have already created and make sure to enable elastic IP address,

• choose the security group associated with the instance,

• if the volume is not enough go ahead and add a new volume so that your data will be able to fit without any disruptions,

• after doing all of this go ahead and review all the settings and if everything is looking good

• launch the instance.

• You will receive a sucess message that your instance has been created successfully.

• Your instance is going to take a few minutes to initialize. Monitor the deployment until the status check to complete.

• Copy the above instance Public IP address.

• On the Gateway Tab on Step2 , Select IP address connection options and Paste the copied instance public ip address.

• Choose Publicly accessible in the Endpoint options.

• After all of this choose next and review and activate settings and choose activate gateway. You will receive a success message as the on below and make sure the status is running.

Step7: Create file Share

• After successfully creating the File Gateway and the status is displaying running the proceed and create file share at the top right hand side. You will happen to see the page below.

• Select the Name of the Gateway you just created

• On the S3 bucket choose the primary bucket that you had already created, then choose customize configuration or you can go right ahead to create file share.

• For the file share protocol, I will use NFS since am using Linux and my instance is also Linux,

• You can see the File share has been created successfully and added to the gateway.

you have successfully created a storage gateway and you are almost there, it should be running just fine.

Now,

We need to mount the file share to Linux instance for migrating the data.

Step8: Connect to on premises instance and migrate the data to S3.

• Create the directory that will be used to synchronize data with your S3 bucket.

ssh -i </path/to/key-file> ec2-user@<ip-addess>
sudo mkdir -p /mnt/nfs/s3

• Then mount the file share on the Linux instance by using the command that you located in the Storage Gateway file shares details screen at the end of the last task.

sudo mount -t nfs -o nolock,hard 10.10.1.98:/abisbucket [MountPath]
#example:
sudo mount -t nfs -o nolock,hard 10.10.1.98:/abisbucket /mnt/nfs/s3*
#view if the bucket is mounted to your instance mountpoint
df-h
#copy the data to the mountpoint
cp -v <file/Path> </mountpoint>
#example
cp -v /media/data/* /mnt/nfs/s3

Step9: Confirming Migrations

Check whether the data have been migrated to the primary S3 bucket and also to the secondary bucket form the primary bucket.

• To verify that your data has been migrated you can go back to the management console and search for S3.

• Select the Primary Bucket “abisbucket“

• you can see the files migrated to the bucket form the instance.

• Now, select the Seconday Bucket “abisbucket101“

• you can see all the objects have been replicated from the Primary Bucket.

Conclusion:

we have successfully migrated data to Amazon S3 by using AWS Storage Gateway in File Gateway mode. Being a hybrid storage solution AWS Storage Gateway is a highly adaptable solution. It can serve a broad range of use cases, from primary backups and disaster recovery to comprehensive data migrations or cloud resources for various workloads.

The service is designed to be highly scalable, highly available, and highly durable.

Task 1: Creating a security group to access EFS file system

The security group that we associate with a mount target must allow inbound access for TCP on port 2049 for Network File System (NFS). This is the security group that we will now create, configure, and attach to your EFS mount targets.

• At the top of the AWS Management Console, in the search box, search for and choose EC2.

• In the navigation pane on the left, choose Security Groups.

• Choose Create security group then configure:

  • Security group name: EFS Mount Target

  • Description: Inbound NFS access from EFS clients

  • Select the VPC

  • Under the Inbound rules section, choose Add rule then configure:

    • Type: NFS

Task 2: Creating an EFS file system

EFS file systems can be mounted to multiple EC2 instances that run in different Availability Zones in the same Region. These instances use mount targets that are created in each Availability Zone to mount the file system

• At the top of the AWS Management Console, in the search box, search for and choose EFS.

• Choose Create file system.

• In the Create file system window, choose Customize.

  • Uncheck Enable Automatic backups.

  • Lifecycle management:

    • for Transition into IA Select None.

  • In the Tags optional section, configure:

    • Key: Name

    • Value: MY First EFS File System

    • Attach the EFS Mount Target security group to each Availability Zone mount target by choosing EFS Mount Target for each Availability Zone.

Task 3: Creating a new directory and mounting the EFS file system

• In your EC2 terminal session, run the following command to install the required utilities:

    sudo su -l ec2-user
    sudo yum install -y amazon-efs-utils
    sudo mkdir efs
  

• At the top of the AWS Management Console, in the search box, search for and choose EFS.

• Choose My First EFS File System.

• In the Amazon EFS Console, on the top right corner of the page, choose Attach to open the Amazon EC2 mount instructions.

• Copy the above NFS client section and paste it in your terminal to mount the EFS with the system.

• df -hT to view the disk usage in the system, you can see the Type nfs4 with <ip address> in the file system.

Task 4: Examining the performance behavior of your new EFS file system

Examining the performance by using Flexible IO

Flexible IO (fio) is a synthetic I/O benchmarking utility for Linux. It is used to benchmark and test Linux I/O subsystems.

sudo fio --name=fio-efs --filesize=10G --filename=./efs/fio-efs-test.img --bs=1M --nrfiles=1 --direct=1 --sync=0 --rw=write --iodepth=200 --ioengine=libaio

Monitoring performance by using Amazon CloudWatch

• At the top of the AWS Management Console, in the search box, search for and choose CloudWatch.

• In the navigation pane on the left, choose All Metrics.

• In the All metrics tab, choose EFS.

• Choose File System Metrics.

• Select the row that has the PermittedThroughput Metric Name.

• Choose the Graphed metrics tab.

• On the Statistics column, select Sum.

• On the Period column, select 1 Minute.

Congratulations!!!

You created an EFS file system, mounted it to an EC2 instance, and ran an I/O benchmark test to examine its performance characteristics.

Jenkins is an open-source automation server that helps automate the software development process. It is used for building, testing, and deploying software. It helps developers catch bugs early and release software faster.

Some of the Benefits are:

• Easy to install and configure

• Platform independent

• Automates integration

• Detects errors early

• Rich plugin ecosystem

• Open source

• Great community support

• Easy distribution

Now, Let's begin the installation processes.

There are several steps to configure Jenkins on an Ubuntu machine:

1. Install Java:

Jenkins requires Java to run, so you'll first need to install OpenJDK. For Ubuntu 20.04 and later, install OpenJDK 11:

sudo apt install openjdk-11-jre

1. Add the Jenkins repository:

It's recommended to install Jenkins from the official Jenkins repository instead of the Ubuntu repository. This ensures you have the latest version.

curl -fsSL https://pkg.jenkins.io/debian-stable/jenkins.io.key | sudo tee \
  /usr/share/keyrings/jenkins-keyring.asc > /dev/null

sudo sh -c 'echo deb [signed-by=/usr/share/keyrings/jenkins-keyring.asc] https://pkg.jenkins.io/debian-stable binary/ > /etc/apt/sources.list.d/jenkins.list'

1. Install Jenkins:

sudo apt update
sudo apt install jenkins

1. Start Jenkins:

sudo systemctl start jenkins

1. Open the firewall to port 8080:

sudo ufw allow 8080

1. Access Jenkins in your browser at http://localhost:8080

2. Get the initial admin password:

sudo cat /var/lib/jenkins/secrets/initialAdminPassword

1. Paste the password, choose plugins, and create your admin user.

2. Start using Jenkins! You can install more plugins, set up jobs, and configure your CI/CD pipelines.

Congratulations!! start your CICD journey.

Let's Begin the Demonstration

Step 1: Go to the AWS management console, search for RDS and click on it.

Step 2: Click on Create database

• Select the Standard create

Step 3: From the Templates, select the Free tier

Step 4: Select MySQL from the Engine options

Step 5: Under the Settings

• Give a name to the database instance identifier

• enter the Master username and Password (Note it down, you need to remember this )

Step 6: From the instance configuration, select Burstable classes

Step 7: Under Storage select general purpose SSD(gp2)

Step 8: From the Connectivity,

• select Don't connect to an EC2 compute resource.

• Select Default VPC, from the Virtual private cloud(VPC)

• In the Public access, select yes

• Under the VPC security group(firewall), you can choose existing or create new. For now, we create a new one and named it as “sec-group” and also selected “us-east-1a" Availability Zone.

Step 9: Under Database authentication

• Choose Password authentication

• unselect, Enable Enhanced monitoring

Step 10: In the Additional configuration

• Give the initial database name. For now say “worlddb” (NOTE the Database Name)

• Unselect under Backup and Encryption

• Unselect Enable auto minor version upgrade, under Maintenance

• Select no preference under Maintenance window

Step 11: Click on Create database

Step 12: You need to have pre-installed SQLTools and SQL Server(mssql)

• below the extensions click on SQLTools

Step 13: From the connections click on Add New Connections icon.

Step 14: Select MySQL

Step 15: From the database under Connectivity and security copy the endpoint address.

Step 16: In the VS code under Connection Settings

• Give a name to the connection let’s say: "justconnecting"

• in the Server Address: Paste the endpoint address.

• Enter the database name, that you have created in the AWS RDS as “initial database” and noted down.

• Enter the database Master username, 

• Click on TEST CONNECTION

• Click on Allow

• Enter the Master Password that you have noted down.

• You should be able to see the Sucessfully connected Messagae. And click on SAVE CONNECTION

• Click on CONNECT NOW

• Now, you should be able to see the connections and Database below CONNECTIONS

• Now click on the New SQL File on the right side on connetions

• Enter the below query

    use worlddb;
    CREATE TABLE student(
        Id int, 
        Name VARCHAR(20)
        );
    INSERT INTO student(Id, Name) 
    VALUES(1, 'Abi'),
    (2, 'Gaurav');
  
    SELECT * FROM student;
  

• Run the query using pressing CTRL+ E+E

CONGRATULATIONS!!!

You have successfully connected the AWS RDS to your Visual Studio Code.

This capability is crucial as it provides a cost-effective solution for resource sharing between multiple VPCs located in the same or different regions eliminating the need for internet gateways. Additionally, by not relying on public IP addresses or internet access VPC peering enhances security measures.

Let's begin the Demonstration.

Step 1: Go to the AWS management console search for VPC, and click on it.

Step 2: Click on Create VPC.

Step 3: From VPC settings

• select VPC only

• Enter the name of VPC. For now, say “my-vpc1"

• Enter IPv4 CIDR 10.0.0.0 /16

• Click on Create VPC

Step 4: From the Dashboard, select Subnets

• click on Create subnet

Step 5: From VPC ID select “my-vpc1" 

• Give a name to the subnet. For now let’s say, “subnet01”

• Select an Availability zone: "us-east-1a"

• Enter the CIDR block say, 10.0.1.0/24

• Click on Create subnet.

Step 6: From the Dashboard, Select Internet gateway

• click on Create Internet gateway

Step 7: In the Internet gateway settings

• give a Name tag, let’s say "internet-gateway"

• click on Create Internet gateway

Step 8: On the top, you can see the “Attach to a VPC” message, Click on it or you can attach it from the Action.

Step 9: We will create another VPC. From the dashboard, Select “Your VPCs”

• Click on Create VPC

• under VPC Settings, Select VPC only

• Enter the IPv4 CIDR block say, 192.0.0.0/16

• Click on Create VPC.

Step 10: From the dashboard select Subnets, click on Create subnet

• under VPC ID select “my-vpc2"

• Give a name to the subnet. For now let’s say, “subnet2”

• select an Availability zone say, "us-east-1a"

• Enter the CIDR block say, 192.0.1.0/24

• Click on Create subnet

Step 11: From the dashboard, select “Peering connections”

• click on Create peering connection

Step 12: In peering connection settings

• give a name to the connection say, “my-connection"

• Select “my-vpc1” In the VPC ID (Requester)

• Select “my-vpc2” in the VPC ID (Accepter)

• click on Create peering connection

step 13: Now you can see Actions in “my-connection"

• Click on it and Accept request

Step 13: From the dashboard, Select "Route tables"

step 15: In the Route table settings

• Give a name say, “routeTable1”

• Select “my-vpc1"

• Click on Create route table

step 16: Select “routeTable1”, from the Route tables.

• Click on Routes

• click on Edit routes

• click on Add route

• under Destination enter 0.0.0.0/16 and select the Internet gateway in Target.

• Similarly, add 192.0.0.0/16 in Destination and select Peering connections

• Click on Save changes

Step 17: Select the Subnet associations

• click on Edit subnet associations

• select the "subnet01"

• click on Save associations.

Step 18: we need to create another route table. so, from the dashboard, Select Route table. Under route table settings

• Give a name to the table say, "routeTable2"

• select the second VPC created, “my-vpc2”

• Click on Create route table

Step 19: Select the routeTable2

• click on Routes

• click on Edit routes

• click on Add route

• enter 10.0.0.0/16 in the Destination and select pairing connections in the target.

• click on Save associations

• click on the Subnet associations

• click on Edit subnet associations

• select the subnet2

• click on Save associations.

Step 20: From the AWS management console, Search EC2 and click on it.

Step 21: Click on Launch instance

Step 22: Give a name to the instance, say "myserver1"

• select the existing key pair or create a new key pair

Step 23: in the network settings, click on Edit

• Select your first VPC, “my-vpc1”

• select the subnet, “subnet01”

• “Enable”, Auto-assign public IP

• Leave the other setting as the default

step 24: Click on launch instance

step 25: We will create another instance named “myserver2”

• select the Key pair (login)

Step 26: In the network settings, click on Edit

• select the second VPC created, “my-vpc2"

• select the subnet, “subnet2”

• Disable, Auto-assign public IP

• Under Firewall(security groups), Select the create security group

• You can give the name of the Security group and Description or leave it as the default

• In the inbound security groups rules

• Under Type select “All traffic” or “All ICMP” and under Source type select “Anywhere”

Step 27: Click on Launch instance

• From the Instance summary of “myserver2”, Copy the Private IPv4 addresses

Step 28: In the Instances, you can see the two servers running

• select the “myserver1”

• Click on Connect, on the right side of the instances.

• Select the EC2 Instance Connect

• Click on Connect.

Step 29: Ping the my-server2 private IP address.

ping <private ip addresses>

Step 30: you should see the following output.

Congratulations!!!

You have completed the Demonstration of VPC Peering.

Logging and monitoring are techniques used to achieve goals. They work together to ensure that system performance meets baselines and security guidelines consistently.

Amazon SNS is a managed messaging service that enables communication.

CloudWatch is a monitoring and observability service. It provides data and insights for monitoring applications responding to performance changes across systems and optimizing resource utilization. CloudWatch collects logs, metrics and events as part of its monitoring data collection process. By using CloudWatch you can have a view of your health and gain visibility into your AWS resources, applications and services running both on AWS and, on premises.

Objectives:

After completing this Demonstration, you will be able to:

• Create an Amazon EC2 instance

• Create an Amazon SNS notification

• Configure a CloudWatch alarm

• Stress test an EC2 instance

• Confirm that an Amazon SNS email was sent

• Create a CloudWatch dashboard

Let's begin the Demonstration:

TASK 1:Create an Amazon EC2 Instance.

Step 1: Go to the management console and Search for Ec2 and click on it.

Step 2: Give a Name to the instance. for now, we name it "Stress Test".

• choose an Amazon Machine Image for now we choose Amazon Linux 2 AMI (HVM). Recommend you choose (Free tier eligible)

Step 3: For the key pair(login) we proceed without a key pair. You could choose an existing or create new key pair.

Step 4: you could leave other settings default and click on Launch instance

TASK 2:Configure Amazon SNS

Step 3: Go to the management console and Search For SNS

Step 4: On the left, under Dashboard choose the Topics, and then choose Create topic.

Step 5: On the Create topic page in the Details section, configure the following options:

• Type: Choose Standard.

• Name: Enter the name. For now, we say "MyCwAlarm"

Step 6: Choose Create topic.

Step 7: On the MyCwAlarm details page, choose the Subscriptions tab, and then choose Create subscription.

Step 8: In the Details section, configure the following options:

• Topic ARN: Leave the default option selected.

• Protocol: From the dropdown list, choose Email.

• Endpoint: Enter a valid email address that you have.

and Click on Create subscription.

• In the Details section, the Status should be Pending confirmation.

• You should have received an AWS Notification - Subscription Confirmation email message at the email address that you provided in the previous step.

• After you click on the Confirm subscription from the mail, In the Details section, the Status should be Confirmed.

Task 3: Create a CloudWatch alarm

Step 9: In the AWS Management Console, enter Cloudwatch in the search bar, and then choose it.

Step 10: In the left navigation pane, choose the Metrics dropdown list, and then choose All metrics.

Step 11: On the Metrics page, choose EC2, and choose Per-Instance Metrics.From this page, you can view all the metrics being logged and the specific EC2 instance for the metrics.

Step 12: Slect the ­check box with CPUUtilization as the Metric name for the Stress Test EC2 instance that we created.

Step 13: In the left navigation pane, choose the Alarms dropdown list, and then choose All alarms.

Step 14: Choose Create alarm.

Step 15: Choose Select metric and click on Next

Step 16: choose EC2, and then choose Per-Instance Metrics.

Step 17: Under the Search bar type CPUUtilization and hit Enter.

Step 18: Select the Stress Test and Click on Select metric.

Step 19: On the Specify metric and conditions page, configure the following options:

Metric

• Metric name: Enter CPUUtilization

• InstanceId: Leave the default option selected.

• Statistic: Select Average

• Period: From the dropdown list, choose 5minute.

Conditions

• Threshold type: Choose Static.

• Whenever CPUUtilization is...: Choose Greater > threshold.

• than... Define the threshold value: Enter 60

and Click on Next.

Notification

• Alarm state trigger: Choose In alarm.

• Select an SNS topic: Choose Select an existing SNS topic.

• Send a notification to...: Choose the text box, and then choose MyCwAlarm.

Name and description

• Alarm name: Enter CPUUtilizationAlarm

• Alarm description - optional: Enter CloudWatch alarm for Stress Test EC2 instance CPUUtilization

After that Choose Next.

Step 20: Review the Preview and create page, and then choose Create alarm.

Task 4: Test the Cloudwatch alarm

Step 21: In the management Console search for EC2 and click on it.

Step 22: Now, under the Instances Click on the Stress Test Instance that we created earlier and Click on Connect on the right side of Instances,

Step 23: From the Connect to instance Choose Session Manager and Click on Connect.

(Note: you can connect from EC2 Instance Connect as the ultimate goal is to increase the Cpu utilization so that we get notified from the Amazon SNS through mail.)

Step 24: To manually increase the CPU load of the EC2 instance, run the following command:

sudo stress --cpu 10 -v --timeout 200s

• the output from the command should look similar to the following.

Step 25: Navigate back to the AWS console where you have the CloudWatch Alarms page open. Then Choose CPUUtilizationAlarm after that Monitor the graph while selecting the refresh button every 1 minute until the alarm status is In alarm.

On the graph, you can see where CPUUtilization has increased above the 60 percent threshold.

Step 26: Go to your email inbox for the email address that you used to configure the Amazon SNS subscription. You should see a new email notification from AWS Notifications like this below.

Task 5: Create a CloudWatch dashboard

Step 27: Go to the CloudWatch in the AWS console and In the left navigation plane, choose Dashboards and Click on Create dashboard.

Step 28: Give a name to the Dashboard for now we say it EC2Dashboard and click on Create dashboard.

Step 29: Under Add widget choose Line and click on Next.

• Choose Metrics and click on Next.

Step 30: Now, Choose EC2 and then Per-instance Metrics.

Step 31: Under the search bar type CPUUtilization and select the Stress Test, and Click on Create widget.

Step 32: Finally, you can see the CPUUtilization of an Instance.

Congratulations!!!

You now have successfully:

• Created an Amazon SNS notification

• Configured a Cloudwatch alarm

• Stress-tested an EC2 instance

• Confirmed that an Amazon SNS email was sent.

• created a CloudWatch dashboard

Prerequisite

• Before proceeding with ACM please make sure you have a domain name.

• you should be able to create an EC2 Instance (if you don't know, you can read my blog click here)

Let's begin the Demonstration

Step 1: You need to create an EC2 instance that contains user data. If you don't know you can read out my blog. For now, we have created an instance named "Demo server".

• copy and paste the public IPv4 address in the browser.

• you can see the website being hosted

• but it's not secure you can see that "connection not secure"

• so, when we try to put the https:// for the secure connection it says unable to connect.

Step 2: On the management console search for Certificate Manager and click on it.

• now select the "Request a certificate" button.

• under the Certificate type choose Request a public certificate and click on Next

Step 3: Under the Domain names give a domain name or sub-domain that you want the users to use for accessing the website and choose the DNS validation,

• leave the Key algorithm as default and click on the Request button.

Step 4: You can see that Domains(1) but the status is Pending and under the right side you can see the "Create records in Route53" Click on it.

• Now select the Domain on the blue checkbox and click on Create records.

• You can see that the Status of the Certificate is Pending Validation wait for a few minutes.

• Now the status of the Certificate is changed to Issued and you can see that the domain status is "Sucess".

Step 5: Now, under the Dashboard of EC2 select the Target Groups.

• click on the Create target group

Step 6: Leave everything as default (choose target type Instance ) and give a target name for now we give it "acm-demo-TG" After that you will see the following window.

• now select the Instance ID on the checkbox and Include it as pending below.

• now Click on the Create target group.

Step 7: From the Dashboard of EC2 click on Load Balancers.

• Choose the Application Load Balancer and Click on Create.

Step 8: Under Basic configuration give a Load balancer name for now say "acm-demo-alb" and leave others default like Scheme: Internet-facing and Ip address type:IPv4

• Under the Network mapping choose different availability zones

• From the Security groups choose the group created while launching the EC2 instance.

• Under the Listeners and routing choose Forward to of Default action and select the Target Group created for now we select the "acm-demo-TG".

• After you save, click on View load balancer.

• As you can see that our load balancers is on provisioning State wait for few minutes

• now you can see it's in Active state

Step 9: Now under the Hosted zone details Click on Create record.

Step 10: Under the Quick create record field give a Record name, select on Alias From Route traffic to select the Alias to Application and Classic Load Balancer and choose the Availability zone same as the Network mapping we selected previously and lastly select the DNS name of our load balancer. and click on Create records.

Step 11: Now copy and paste our domain from Route 53. and paste it on the browser.

• you can see that the site is still insecure

Step 12: From the Dashboard of EC2 > Select the Load balancer > Select the Listeners and click on Add listeners on the right side.

Step 13: Now under the Default actions select Forward to and under Target group select the target group we created earlier, for now, "say acm-demo-TG"

Step 14: Under the Secure Listener settings from Default SSL/TLS certificate Select a certificate.

• After selecting a certificate click on Add.

Step 15: Now paste the domain name in the browser. you can see that it's secure under https but when you enter the domain name with http its renders and it's insecure so we must redirect the http port to https port to make it secure.

• Now to redirect the http port into https port we do the following changes.

• From the Load balancer Select the Listeners and you can see the following two ports.

Step 16: Select the HTTP:80 port and From Action select the Edite listener.

Step 17: Now under Listener details choose the Redirect and enter 443 at Port and Save changes.

• paste the domain name with http

Finally, you have completed the Demostration and you have made your site secure when you even try to open with http it will automatically redirect to https port.

CONGRATULATIONS!!!

Keep Learning...

What are the benefits of using an AWS VPC?

• Reduced downtime and inconvenience

• Reduced risk of data breaches

• Flexibility

• Cost-effective

How do I create an AWS VPC?

Most users prefer to use the AWS Management Console to create a VPC. Here’s how to set up your VPC step-by-step:

Step 1: Go the AWS management console and search for VPC and select it.

Step 2: Click on Create VPC

Step 3: Under the VPC setting select the vpc only, give the name of the VPC and set the IPv4 CIDR for na and click on the Create VPC. For now say Name: demo-vpc IPv4-CIDR: 10.0.0.0/16

Step 4: Now, select the Subnet on the dashboard column.

Step 5: Click on Create subnet and select the VPC created earlier, which is

(demo-vpc)

Step 6: Give the name of the subnet and set the IPv4 CIDR block and click the create subnet.

Step 7: For creating a private subnet give the name and set the CIDR block such that it doesn't overlap and click the Create subnet.

now you can see the available subnet.

Step 8: Now go to the Route tables under the Dashboard.

Step 9: Now Create the route table and Name the table for the public subnet set the name and select the VPC created earlier.

Step 10: For the private subnet again, create the route table give a name and select the VPC created earlier.

Step 11: Select the Internet gateways from the Dashboard and Click on Create Internet gateway in the top right corner.

Step 12: Give a name for the Internet gateway settings, this is created to connect our VPC to the Internet.

Step 13: At the top right corner Click on Attach to a VPC and under Available VPCs select the with the name demo-vpc created earlier and click on Attach internet gateway.

Step 14: From the Dashboard Click on NAT gateways and on the top right corner Select the Create NAT gateway

Step 15: Under the NAT gateway settings, give a Name to the NAT, under Subnet Field Select a Public subnet created earlier and, on Connectivity type select Public

under Elastic IP allocation ID click on the Allocate Elastic IP button. And Create NAT gateway at the end.

Step 16: Go to the Route table and firstly select the public route table we created earlier.

under the Routes click Edit routes button on the right side of Routes.

Select the Add route and under Destination Select 0.0.0.0/0 and under Target select Internet Gateway that we created since we are targeting any traffic that needs to go to the internet to the IGW and Save changes.

now select the Subnet associations next to the Routes and click on the Edit subnet association under Explicit subnet associations and select the public subnet created earlier and Save associations.

Step 17: Go back to the Route tables and select the private route table and click on the Edit routes.

Under the Destination select 0.0.0.0/0 and under Target select NAT Gateway and Save changes.

Click the Subnet associations and under Explicit Subnet associations click on Edit subnet associations.

select the private subnet we created earlier and save associations.

Step 18: Under the search bar search EC2 and click on it.

Step 19: Click on the Launch Instance

we are creating two instances public and private instance.

Step 20: For the first instance give a name to the instance say instance-public

Step 21: Create a key pair for now we named it randomkey

Step 22: Under the Network settings Click on Edit

Select the VPC created earlier and under subnet field select the public subnet.

Enable the Auto-assign public IP

Step 23: Launch the Instance

Step 24: we are creating a private instance for that click on Launch instance

Step 25: Name the instance for now we name it instance-private.

Step 26: You can select the same key pair or you can create a new one. For now we use the same key pair "randomkey"

Step 27: Under the Network settings Click on Edit.

Select the VPC created earlier we have "demo-vpc" , on Subnet select the private-vpc and Enable the Auto-assign public IP

Step 28: You can see the two instances now, select the public Instance which Status is 2/2 check passed. we have "instance-public" and click on Connect.

Copy the Command from the SSH client

Open the Terminal and change directory where your key-pair is

cd Downloads

change the permission of the key-pair.

chmod 400 randomkey.pem

connect to the public-instance

ssh -i "key-pair_name.pem" ec2-user@<Public IP>

you can ping to google to see if there's a connection established.

ping google.com

Connecting Private instance from public instace

you need to note down the Private IPv4 addresses

open the keypair file and copy the text.

• create a file and paste the copied keypair text inside and save and exit.

• change the file permission

    chmod 400 filename.pem
  

connect the instance using private ip address.

•         ssh -i filename.pem ec2-user@<private_ip_address>
  

you can ping to see the Private instance is connected to internet or not .

ping facebook.com

you have done it.

CONGRATULATIONS!!!

© 2023, Amazon Web Services, Inc.

Method 1: Using a Command & Text file to Create multiple Users in Linux.

Step 1: Open the Linux terminal

Step 2: Create .txt file to write the new user's credentials

nano new_users.txt

step 3: Type your desired multiple-user information in syntax below.

user_name:user_password:Uid:Gid:comment:home_dir:def_shell

here, User_name: user name of the new user to be created

user_password: password for the new user

Uid: New user's ID

Gid: New user's group ID

comment: Comment section or User Full Name

home_dir: User's home directory

def_shell: User's default shell

Step 4: change the .txt file's permissions using the following command

sudo chmod 600 new_users.txt

Step 5: Input the password of the currently logged in user.

Step 6: Create desired users by typing the command bleow and press Enter.

sudo newusers new_users.txt

Step 7: Now, check if the desired users are created.

tail /etc/passwd

Method 2: Using Bash Script to Create Multiple Users in Linux.

Step 1: Open the terminal or Press CTRL + ALT + T

Step 2: Create a directory name bin in your home directory

mkdir bin

Step 3: After that , Create a bash Script file inside the bin directory

nano bin/create_users.sh

Step 4: Now, write the following script in the create_users.sh file for creating multiple users in a loop.

#!/bin/bash

read -p "Enter number of Users to create:" num
echo "------------------------------------------------------"
for (( i=1; i<=$num; i=i+1)); do
read -p "Enter Username no.$i: " uname
sudo useradd $uname
read -p "Enter password for user no.$i? [Y/N] " flag
if [[ "$flag" == "Y" || "$flag" == "y" ]]; then
sudo passwd $uname
echo "Successfully created New User: $uname with password."
echo "------------------------------------------------------"
else
echo "Successfully created New User: $uname without password."
echo "------------------------------------------------------"
fi
done

Step 5: To save and Exit from the Script, press CTRL + S and CTRL + X respectively

Step 6: Now, type the following command to permit the current user in your system.

chmod u+rwx bin/create_users.sh

Step 7: Finally restart your system to add the newly created bin directory to the $PATH variable

sudo reboot

Step 8: Now open your terminal or Press CTRL + ALT + T

Step 9: Run the previously written script by typing the file name.

create_users.sh

Step 10: After entering the data, to check if the desired number of users is created.

tail /etc/passwd

Complementary Information: Adding Multiple Users in a Group

Step 1: Open the Terminal

Step 2: Type the following command

• To create a group for now we are creating a group named "Student"

sudo groupadd Student

• To add multiple users type the following command.

sudo gpasswd -M UserA,UserB,UserC Group_Name

Step 3: To Check the Group Members

sudo less /etc/group| grep "Group_Name"
or 
sudo grep Student /etc/group

As you can see that the users are inside the group named Student.

That's all for now, Happy Coding!!!.

It is an object storage service offering industry-leading scalability, data availability, security, and performance. Customers of all sizes and industries can store, manage and distribute data securely and reliably in the cloud.

Let's Demonstrate the live hosting of our website.

Step 1: Go to the AWS Management Console and search s3 and click on it.

Step 2: Click on Create bucket.

Step 3: Name a bucket and it must be globally unique. For now you say "abi-aws-bucket"

Step 4: Under the Object Ownership you can choose ACLs enabled.

Step 5: Unmark Block all public access to ensure that public access to this bucket and mark the acknowledgement.

Step 6: Enable Bucket Versioning to keep multiple variants of an object in the same bucket.

Step 7: Now Select the create bucket.

Step 8: You can see the (1) near bucket that means our bucket has been successfully created.

Step 9: Click on the Object "abi-aws-bucket" of the Name column. you can see the Objects with (0), It means we have no any objects. Now you can add objects from the upload box.

Step 10: Under Permissions select Grant public-read access and tick mark on the acknowledgement.

Step 12: Click on Upload button.

you can see upload succeeded.

Step 13: Select the Properties.

Step 14: under Static website hosting choose Edit button and Enable it. Also, name the home or default page of your website.

Step 15: After that under static website hosting, you can see the link created at the bucket website endpoint.

Copy the link and paste it in the browser.

Finally, You can see that your website is live.

That's Amazing, You have finally hosted your website using Amazon S3 service.

THANK YOU!!

Now let's create EC2 instance and Deploy our static website

(prerequisite: AWS account)

Step 1: Go to AWS Management Console and Search for EC2 instance also, click on it.

Step 2: Click on Launch Instance on the Dashboard.

Step 3: Write a name for the instance (example: MyWebServer). you can also give additional tags.

Step 4: Choose Amazon Linux 2 and Instance type t3.micro,

you can always choose as you want but Recommend you to use Free tier.

Step 5: Select "Create a new pair" and give a name for now say "webSarver".

you have to know where your key pair file is being downloaded.

Step 6: In the Network settings,

• You can Configure the Security Group name and Description as you like but we are leaving it as default for now.

• select the Inbound security groups rules you can see the Add security group rule click on it.

• Add the following Type and Source type.

Step 7: In configure storage

leave it as default for now but you can get upto 30 GiB in the free tier. This will be your root volume also known as 'boot' volume.

Step 8: In configure advance details

add the following codes in the user data field and leave other field as default.

The Script does the following:

• Install an Apache web server (httpd)

• configure the webserver to automatically start on boot

• Activate the Web server

• Create a simple web page

Step 9: Click on Lauch instance

you can see this interface with a sucess.

step 10: Wait for some time the instance is running and the status is initializing. After some time you can see that there is 2/2 checked passed on the status check.

step 11: Now, you can click on the instance Id and copy the Public IPv4 address and paste it in the browser. you would be able to see this result which was written in the user data field inside the h1 tags.

That's all, you have finally hosted a static website on the AWS cloud.

Congratulations guys!!!