AWS

AWS Cloud Services

Overview

Amazon Web Services (AWS) provides a comprehensive cloud platform including compute, storage, database, analytics, networking, deployment, and machine learning services.

Core Services

EC2 (Elastic Compute Cloud)

Launch Instance

import boto3

ec2 = boto3.client('ec2', region_name='us-west-2')

# Launch instance
response = ec2.run_instances(
    ImageId='ami-0c55b159cbfafe1f0',  # Amazon Linux 2
    InstanceType='t2.micro',
    MinCount=1,
    MaxCount=1,
    KeyName='my-key-pair',
    SecurityGroupIds=['sg-1234567890abcdef0'],
    SubnetId='subnet-12345678',
    UserData='''
        #!/bin/bash
        yum update -y
        yum install -y docker
        service docker start
    ''',
    TagSpecifications=[
        {
            'ResourceType': 'instance',
            'Tags': [
                {'Key': 'Name', 'Value': 'MyInstance'},
                {'Key': 'Environment', 'Value': 'Dev'}
            ]
        }
    ]
)

instance_id = response['Instances'][0]['InstanceId']
print(f"Launched instance: {instance_id}")

Manage Instances

# Describe instances
response = ec2.describe_instances(InstanceIds=[instance_id])

# Stop instance
ec2.stop_instances(InstanceIds=[instance_id])

# Terminate instance
ec2.terminate_instances(InstanceIds=[instance_id])

# Create AMI from instance
ec2.create_image(
    InstanceId=instance_id,
    Name='my-custom-ami',
    Description='My custom AMI'
)

S3 (Simple Storage Service)

Upload/Download

s3 = boto3.client('s3')

# Upload file
s3.upload_file(
    'local_file.txt',
    'my-bucket',
    'remote_file.txt',
    ExtraArgs={'ContentType': 'text/plain'}
)

# Download file
s3.download_file('my-bucket', 'remote_file.txt', 'local_file.txt')

# List objects
response = s3.list_objects_v2(Bucket='my-bucket')
for obj in response.get('Contents', []):
    print(obj['Key'])

Presigned URLs

# Generate presigned URL (valid for 1 hour)
url = s3.generate_presigned_url(
    'get_object',
    Params={'Bucket': 'my-bucket', 'Key': 'file.txt'},
    ExpiresIn=3600
)

Lambda (Serverless Functions)

Create Function

lambda_client = boto3.client('lambda')

# Create function
response = lambda_client.create_function(
    FunctionName='my-function',
    Runtime='python3.11',
    Role='arn:aws:iam::123456789012:role/lambda-role',
    Handler='lambda_function.lambda_handler',
    Code={
        'ZipFile': b'''
def lambda_handler(event, context):
    return {
        'statusCode': 200,
        'body': 'Hello from Lambda!'
    }
        '''
    },
    Timeout=30,
    MemorySize=256,
)

# Invoke function
response = lambda_client.invoke(
    FunctionName='my-function',
    InvocationType='RequestResponse',
    Payload=json.dumps({'key': 'value'})
)

result = json.load(response['Payload'])
print(result)

Deploy from S3

lambda_client.update_function_code(
    FunctionName='my-function',
    S3Bucket='my-bucket',
    S3Key='lambda-deployment.zip'
)

IAM (Identity and Access Management)

Create Role

iam = boto3.client('iam')

# Create role
iam.create_role(
    RoleName='lambda-role',
    AssumeRolePolicyDocument=json.dumps({
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": {"Service": "lambda.amazonaws.com"},
                "Action": "sts:AssumeRole"
            }
        ]
    })
)

# Attach policy
iam.attach_role_policy(
    RoleName='lambda-role',
    PolicyArn='arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
)

SageMaker (ML Model Training & Deployment)

Training Job

sagemaker = boto3.client('sagemaker')

# Create training job
sagemaker.create_training_job(
    TrainingJobName='my-training-job',
    AlgorithmSpecification={
        'TrainingImage': '763104351884.dkr.ecr.us-west-2.amazonaws.com/pytorch-training:2.1.0-cpu-py310',
        'TrainingInputMode': 'File'
    },
    InputDataConfig=[
        {
            'ChannelName': 'training',
            'DataSource': {
                'S3DataSource': {
                    'S3DataType': 'S3Prefix',
                    'S3Uri': 's3://my-bucket/training-data/',
                    'S3DataDistributionType': 'FullyReplicated'
                }
            }
        }
    ],
    OutputDataConfig={
        'S3OutputPath': 's3://my-bucket/output/'
    },
    ResourceConfig={
        'InstanceType': 'ml.m5.xlarge',
        'InstanceCount': 1,
        'VolumeSizeInGB': 10
    },
    StoppingCondition={
        'MaxRuntimeInSeconds': 86400,
        'MaxWaitTimeInSeconds': 86400
    },
    RoleArn='arn:aws:iam::123456789012:role/SageMakerRole'
)

Deploy Model

# Create model
sagemaker.create_model(
    ModelName='my-model',
    PrimaryContainer={
        'Image': '763104351884.dkr.ecr.us-west-2.amazonaws.com/pytorch-inference:2.1.0-cpu',
        'ModelDataUrl': 's3://my-bucket/output/model.tar.gz'
    },
    ExecutionRoleArn='arn:aws:iam::123456789012:role/SageMakerRole'
)

# Create endpoint config
sagemaker.create_endpoint_config(
    EndpointConfigName='my-endpoint-config',
    ProductionVariants=[{
        'VariantName': 'AllTraffic',
        'ModelName': 'my-model',
        'InitialInstanceCount': 1,
        'InstanceType': 'ml.t2.medium'
    }]
)

# Create endpoint
sagemaker.create_endpoint(
    EndpointName='my-endpoint',
    EndpointConfigName='my-endpoint-config'
)

RDS (Relational Database Service)

Create Database

rds = boto3.client('rds')

# Create DB instance
rds.create_db_instance(
    DBInstanceIdentifier='my-database',
    DBInstanceClass='db.t3.micro',
    Engine='postgres',
    MasterUsername='admin',
    MasterUserPassword='password123',
    AllocatedStorage=20,
    VpcSecurityGroupIds=['sg-1234567890abcdef0'],
    DBSubnetGroupName='my-db-subnet-group'
)

ECS (Elastic Container Service)

Task Definition

ecs = boto3.client('ecs')

# Register task definition
ecs.register_task_definition(
    family='my-task',
    containerDefinitions=[
        {
            'name': 'my-app',
            'image': 'my-app:latest',
            'memory': 512,
            'cpu': 256,
            'essential': True,
            'portMappings': [
                {'containerPort': 8000, 'protocol': 'tcp'}
            ],
            'logConfiguration': {
                'logDriver': 'awslogs',
                'options': {
                    'awslogs-group': '/ecs/my-task',
                    'awslogs-region': 'us-west-2',
                    'awslogs-stream-prefix': 'ecs'
                }
            }
        }
    ]
)

Run Task

ecs.run_task(
    cluster='my-cluster',
    taskDefinition='my-task',
    launchType='FARGATE',
    networkConfiguration={
        'awsvpcConfiguration': {
            'subnets': ['subnet-12345678'],
            'securityGroups': ['sg-1234567890abcdef0'],
            'assignPublicIp': 'ENABLED'
        }
    }
)

Infrastructure as Code

CloudFormation Template

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Sample CloudFormation template'

Parameters:
  Environment:
    Type: String
    Default: dev
    AllowedValues:
      - dev
      - prod

Resources:
  MyBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub '${Environment}-my-bucket'

  MyFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub '${Environment}-my-function'
      Runtime: python3.11
      Handler: index.handler
      Code:
        ZipFile: |
          def handler(event, context):
            return {'statusCode': 200}
      Role: !GetAtt MyFunctionRole.Arn

  MyFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

Terraform Configuration

# S3 Bucket
resource "aws_s3_bucket" "my_bucket" {
  bucket = "my-unique-bucket-name"

  tags = {
    Environment = "dev"
  }
}

# Lambda Function
resource "aws_lambda_function" "my_function" {
  function_name = "my-function"
  runtime       = "python3.11"
  handler       = "index.handler"
  role          = aws_iam_role.lambda_role.arn

  filename      = "lambda_function.zip"

  source_code_hash = filebase64sha256("lambda_function.zip")
}

# IAM Role
resource "aws_iam_role" "lambda_role" {
  name = "lambda-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "lambda.amazonaws.com"
        }
      }
    ]
  })
}

# Attach policy
resource "aws_iam_role_policy_attachment" "lambda_basic" {
  role       = aws_iam_role.lambda_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

Monitoring & Logging

CloudWatch Logs

logs = boto3.client('logs')

# Create log group
logs.create_log_group(logGroupName='/aws/lambda/my-function')

# Put log event
logs.put_log_events(
    logGroupName='/aws/lambda/my-function',
    logStreamName='stream-name',
    logEvents=[
        {'timestamp': int(time.time() * 1000), 'message': 'Log message'}
    ]
)

CloudWatch Metrics

cloudwatch = boto3.client('cloudwatch')

# Put metric data
cloudwatch.put_metric_data(
    Namespace='MyApp',
    MetricData=[
        {
            'MetricName': 'RequestCount',
            'Value': 1,
            'Unit': 'Count',
            'Dimensions': [
                {'Name': 'Environment', 'Value': 'dev'}
            ]
        }
    ]
)

Security Best Practices

1. IAM Security

• Follow principle of least privilege
• Use IAM roles instead of access keys
• Rotate credentials regularly
• Enable MFA for root account

2. Network Security

• Use security groups and NACLs
• Enable VPC Flow Logs
• Use private subnets for databases
• Implement bastion hosts

3. Data Security

• Enable S3 bucket encryption
• Use KMS for encryption
• Enable S3 bucket policies
• Enable CloudTrail for audit

4. Cost Optimization

• Use reserved instances for steady workloads
• Use spot instances for fault-tolerant workloads
• Enable S3 lifecycle policies
• Monitor costs with Cost Explorer

Common Patterns

Serverless API

• API Gateway → Lambda → DynamoDB

ML Pipeline

• SageMaker for training
• S3 for model storage
• Lambda for inference
• API Gateway for endpoints

Web Application

• EC2/ECS for compute
• RDS for database
• S3 + CloudFront for static assets
• Route 53 for DNS

Integration

• Docker: Containerize applications
• Kubernetes: EKS for orchestration
• CI/CD: CodePipeline, CodeBuild
• Monitoring: CloudWatch, X-Ray