Pass Amazon AWS Certified Solutions Architect - Associate SAA-C02 Exam in First Attempt Easily

Introduction - AWS Certified Solutions Architect Associate

1. Creating an AWS Account

So the first thing we're going to do is sign up for AWS. So we'll just go on Google.com and type in a sign up.Just click one of the first links and we'll be on the Create an AWS Account page. Now, as you can see, each other's account includes twelve months of free tier access. I encourage you to visit this link to understand exactly what's in the free tier. So if we look at it, we can see that we have a feature account right away. So there's some stuff that's free for a year and some that's always free. So we can click on "twelve months free" and see exactly which services are free for how long, and "always free" as well to see which ones are always free for AWS. Basically, this free tier allows us to learn AWS without spending a dime. Now, there is a chance that you spend a little bit of money with me. I would suggest you make a budget for this course. I will tell you whenever you might spend money. If you do not want to spend money, just do not do the tutorial with me and watch the video. You'll be fine. But most of the tutorial is going to be done on the free tier. Now for the console, you just sign up. You enter your email address, your password, and an account name. Now, after doing this, you'll have to provide contact information. So you may have a professional or a personal account. You can just choose that. If you go personal, you need to put your phone number, your region, your address, your city, and so on. When you're there, you have to enter your credit card number, its expiration date, and your holder name. Just remember that this is just in case your usage exceeds the AWS free tier limit. And so, if that's the case, you will be billed. But otherwise, you just put in your credit card number, and if you remain within the free tier, you're not going to pay a cent. So just add that to this. You need to provide a valid phone number because you will get a phone number. Next, you choose a plan for support. We're going to go with a basic plan because it's free. And finally, you're free to sign in to your account.

2. AWS Budget Setup

Okay, so just before we start this course, I want to get started and create an AWS budget. This is to keep track of if you exceed the free tier. And if that's the case, you'll receive an email alert, which will help you avoid overspending. So for this, go on your account and click on my billing dashboard. and you are getting into the billing dashboard. You can see your current spend, zero to date, which is great. But on the left-hand side, under cost management, there are budgets. And this is where we're going to create our first AWS budget. For this, click on Create a Budget, and we're going to choose a cost budget. Next we click on "Set Your Budget." And here, I'm just going to call it budget learning. AWS. It's going to be a monthly budget and a recurring one, and we can set up a fixed amount. So you need to say how much money you will need to spend every month to learn AWS. A good amount to get started is $10. And ten will basically ensure that you don't go over $10 in any month, which is a good way to get started. However, if you don't want to spend any money and want to be aware that as soon as anything is spent, that means anything, you exceed the free tier, you can enter 0.1. And that means that as soon as you spend $0.01, AWS will send you an email. Okay, so this is good enough. I'll say $0.01 just in case. And click on "Configure Alerts." Okay, now you have alerts that you can send. Do you want to send the alerts based on the actual cost or the forecasted cost? So here I'll just say the actual cost. And you can set a threshold. For example, when you reach 80% of your budget amount. So I'll say 100% of the budget amount, and then you send the email you want to have to notify, so [email protected]. And when you're done with this, you click on Confirm Budget. Here you can review your costs. So again, remember that we're not going to spend any money on this course, but there's a chance that if you do something wrong, you will spend money. Remember that the certification does cost you a little bit of money. So, just in case, I recommend you set aside at least $10. You shouldn't spend $10, but maybe you will if you want to learn it properly. And so, in this case, just a budget amount of $0.1. The budget looks good. Everything looks perfect. And I'll just go ahead and click on "Create." And here we go. My first budget has been created. And now if I go over this one sense, I will receive an email from AWS, and I can take action. For example, if I look at my bills, I will be able to see for that one month where that dollar is coming from and where my spend is coming from, which will allow you to drill down into the source and the root cause of your spend. So that's it. We're now ready to learn. AWS. Let's get started.

Hide

AWS Fundamentals: IAM & EC2

1. AWS Regions and AZs

So let's get started with AWS. but we have to start with AWS regions. So AWS is a global cloud provider, and therefore it has many data centres all around the world. These are called regions. And so all these regions around the world can be seen on this map at the bottom of my screen. The blue dots are the regions that exist today, and the orange ones are the ones that are coming soon. So the regions are each a set of datacenters, and we'll see how they are structured in a second. As a result, there is a naming convention for the regions, which is usually US East 1, EUs 3, etc. And when you go into the AWS console, as you'll see in a second, you can see the name of each of the regions alongside the region code. The region code is just a way for us to identify the region quickly, and it corresponds to a geographical location for that region. Northern Virginia is so far east. E.U. Three, for example, is going to be Paris. Okay, so next, what is in the region? The region is a cluster of data centers, and we'll see how they're clustered in a second. And most of the AWS services we're going to use in this course are going to be region scoped.

So that means you can use a service in a specific region, and if you use the same service in another region, you will not have your data replicated or synchronized. So we'd have to recreate your infrastructure in different regions, and that makes sense. Okay. So now let's talk about AWS availability zones. So each region can have many availability zones, and I also refer to them as a "Z" for availability zones. Typically, three AZ will be assigned to each region. Sometimes you will see two, and sometimes you will see six. So here's an example for the region APSoutheast Two, which represents the Sydney region: Then we're going to have three AZ. The first one is AP southeast to AA. The second one is from AP southeast to B. And finally, the third one is AP Southeast to C. The regions, as seen here, end with a number, the AZ, or availability zones, and the letter A-B-C-D-E-F. Okay, so what is an AZ? Each AZ has one or more discrete data centers. Consider a large number of computers in a large room; this is a data center, and each data centre will have written power networking and connectivity. But all these AC, or availability zones, are separate from each other, and that's why they're isolated from disasters. As a result, the azapi to A is distinct and geographically separated from the two B and two C. Okay, but even though they're geographically separated and isolated from disasters, they're still linked via high-bandwidth, ultra-low latency networking. So we have connectivity between all the availability zones. So that's the basis of how AWS works. Now let's go into the console to see how that translates. So here I am in my AWS management console, and if you click on the top right corner, then we can see all the regions available to us. Right now, as we can see, there are tonnes of them.

Some are in North America, some are in Africa, some are in Asia-Pacific, some are in Canada, some are in Europe, some are in the Middle East, and some are in South America. So, for the remainder of this course, it's best if you choose a region close to you because you'll have lower latency access to AWS and a smoother experience. So if I'm in Europe, I want to choose a European region. if you're in America, maybe an American region, and so on. So as we can see, each region has a name. For example, Singapore is not only an Asia-Pacific country but also a code-named AP Southeast country. And so if I click on a different region, then I switch regions automatically. So as you can see, because I'm trying to connect to Singapore and I'm far away from Singapore, it takes a bit of time for me to load. But if I connect to Frankfurt, it's close to me, so it can be faster. Now, if I go to a service, for example, EC 2, the EC 2 service is what's called a regional service. And as such, I will be in the Frankfurt region, okay? And if I switch regions, I will have a different EC-2 service that's specific to that region. But if I go to IAM, so I type IAM in here, as we can see for IAM, what will happen is that IAM is a global service, and as such, there is no region selection that's required, and everything I do in IAM is going to be linked only for the global AWS space. Okay, great. So finally, I want to show you the global infrastructure space. So Amazon.com is about global infrastructure, and what we get out of here is a description of how AWS works, which I think is important to understand before you get started using AWS.

So right now, at this time of recording, there are 23 launch regions and four announced regions, so it's going to go and get even bigger over time. And if we scroll up and down, we see the map of all these regions. And if I hop over a region, I get the number "AZ." So for this course, it's good if you pick a region that has at least three availability zones, okay? If it has two, then please use another one. So if you're in Africa, you can use Cape Town. If you're in South America, you can use Sao Paulo and so on. Okay, then the other thing I want to show you is the regions in AZ. So here you get a list of the maps and the AZ so we can see all the regions and the number of AZ in North America in one table. So this is very helpful. And then finally, I want to show you a regional table. So the regional table is saying which services are offered in which region. And so some services are going to be offered in only one or maybe two regions, while other services are going to be available in all regions. So, if you're in a region but the service isn't available, go back to this table and see which region has it. For example, we're not going to go over App Stream, but take an example. If you're in Ohio, you see that App Stream is not available, so you will not have access to App Stream. So you will switch to another region, for example, Northern Virginia, and you will get access to Amazon Appstore 2.0. So, if a service is unavailable, this will come in handy during the course. Well, that's it for this lecture. So just pick a region in the console that makes sense for you, and we're going to go get started with AWS. I will see you at the next lecture.

2. IAM Introduction

Okay, so we're getting into, first of all, the IAM Service in AWS. IAM stands for Identity and Access Management. And as you can expect from the name, that basically means users. So the whole of your area's security is going to be in I m.There are going to be users, groups, and roles. You have to remember this, and you surely will remember them by the end of this course. The root account is the account with which you create Edwin's account, and you should only use it once and never use it again or share it with anyone else because your root account is the account and user with the most power. The users then must be created with proper permissions, and we'll see how to do this in the lab. and Im is going to be at the centre of AWS. Every AWS service will benefit from I for security. Now we'll have policies within Im, and these policies will be written in JSON. Jason stands for JavaScript Object Notation, and it's basically a way to write data.

So if you don't know anything about Jason, I strongly recommend just going online for a quick tutorial on Google to get started with Jason. Because they've just assumed that as a developer, you probably know what that is. So how do we visualise IAM at a high level? Well, we have the users, and the users are usually going to be a physical person like you or me. We are physical people. So I'll get an account in I am, and you will undoubtedly get an account in I am. That account should not be the root account. Now, users can be grouped together, and the group is whatever you want it to be, but usually it's by functions, for example, admin or devops, or by teams, such as engineering, design, or anything you want. Overall, groups—and you should know this—contain users. OK? So this way you can apply permissions to groups, and users will inherit these permissions. Finally, we have Roles and roles are only intended for use within AWS resources and services. Okay? So roles are what we're going to give to machines. So this is a strong distinction to make. Users will refer to a physical person, whereas roles will refer to a machine. Now overall, as I said, policies are JSON documents, and they will define what each of these building blocks, users, groups, and roles can and cannot do. We'll learn how to write policies, don't worry, and we'll apply all these things at length during this course.

Now I, as you should know, have a global view. When you create a user, a group, or a role in your AWS account, it will be across all the regions, and that kind of makes sense. As I said, the policies are in JSON. You can enable multifactor authentication for your root account and for your users. and that's strongly recommended. Now, IAM comes with managed policies. So basically, you don't need to rewrite the whole policy. You can reuse something that Amazon assembled for you for ease of management. And we'll see in great depth and length how to create IAM policies. Right now, we'll just take it easy and do a soft introduction. Something you'll hear me say over and over andover in this course is that it's best togive users or roles the minimal amount of permissionsthey need to perform their job. And that's called the least privileged principle. And so you absolutely want to make sure that you don't overpower any single person in your organisation or any single application or server. And you will hear me say this so many times. For large corporations, you now use something called "I am Federation." We will not use it in this course because we're not a big enterprise, we're just users. But basically, if a big enterprise has their own repository of users, such as Active Directory, they can integrate this with IAM. In this way, the users of a big enterprise can log into AWS using their company credentials. This uses something called the SAML standard. And Microsoft Active Directory, for example, is one of these big users of the SAML Standard. So it's just something you need to know about for the exam. But we will not practise this.

So just a quick brain dump, and I'm going to feel like I'm your father right now, but I have to say it once because my conscience needs to be clear. Each physical person has one im user. You do not share an IM user with anyone. Your account is your account and no one else's. One im role per application. Each application has its own lifecycle and its own independence. And so you want one impersonator per application. Nothing shared. Your IM credentials should never be shared again. As I said, your ID and your credentials are your own. You never share them with anyone. Now, never, ever, ever I think I've said it that many times. Write my credentials in code. Ever. Okay, this is extremely bad if you put your credentials in code, because if that code ends up in someone's hands or on GitHub or on the cloud or whatever and someone intercepts them, I promise you someone will mine bitcoin in your account, and you'll end up with a $20,000 bill in one day. And that happened for real. You can Google it. Okay? So never, ever, ever write "I am credentials" in code. Ever. Never use your root account except for initial setup. That's super important because the root account is kind of the key to the kingdom. If you lose it, or if you compromise it, you're done. So your root account is something you should create once, then lock in a safe and never use again. So, as I said, never use the roots. I am credentialed. Now it sounds like someone is trying to scare you. And I am. And it's true. Your address book account can do a lot of things. Okay. and can cost a lot of money if you misuse it or someone misuses it for you. So be cautious about credentials and how you handle them. Apart from that, let's go to the next lecture for the lens and hands-on.

3. IAM Hands On

Okay, so now I am in the AWS console. And that's the main page yousee when you start with AWS. Now, in the AWS services, you can click on services and see all of them. And we will not learn all of them becausethat's probably ages you learn all of them. But what we'll learn is the most important one for the certification exam. And so the first one you get started with is Im. Now you can also look in there and find that I am right here. But as a developer, what I like to do is to be efficient. So anytime I need to find a service, I'll usually type it in the bar. I'll type Im, and I'll give you a link straight to the service. To me, this is a little bit easier. When we begin with Im, we see that it is a global service, as I mentioned, so the users, roles, and everything are credited globally. Now, as you can see, we started with almost nothing in our accounts. We have zero users or groups. We have two roles. But these are roles basically created by AWS for us. and we get a security status that doesn't look good. For now, it says what you need to do to make sure that your AWS account is secure. So this is exactly what we have to do right now. So the first one is deleting your root access key. So the root access key provides access to your account, and you should never use it. So never, ever use them. So basically, we'll have to delete them and throw them away. Now we can activate MFA for multifactor authentication on our Roots accounts. So I want to do this right now. Basically, you click on "manage MFA." And then basically you say, okay,we're accessing the credentials page. We say, "Continue to credentials." And so we can enable MFA and click on "Activate MFA." Then you can choose whether it's virtual or hardware. If it's a virtual one, let me use an application such as Google Authenticator for this.

So I'll let you do it. But basically, you can download Google Authenticator and do this. So what you have to do when you open Google Authenticator is to scan this QR code. So you scan the barcode, and then once the barcode is recognized, it's going to give you two authentication codes. So for me, it's 66249 (8). and this will appear in your app directly. And then you need to wait a little bit until the next code arrives, and then enter that code. So my second code is 32793. And then I activate my MFA and great. The MFA was successfully associated. So basically, now our root account is protected by multifactor authentication. And I'm sure that only I, with my own personal device, can log into AWS. So I felt much better about it. And now we have a green tick. Now we need to create individual IMU users. So, in order to create users, we must first create our first user. So I'll click on Manage Users and add a user, and I'll create my own super user and call it Stefan. Stefan, that's me. And what type of access do I want to give myself? Well, I want to give myself programmatic access, that's for sure, and also the AWS management console access so that I can use a password to sign in to my management console. Now we can choose an auto-generated password or custom password; we'll just keep it auto-generated, and then basically when I first login, it's going to require a password reset. Then I click on Next Permissions, and basically I say whatever I want and stuff. So we can add a user to a group orcopy permission of an existing user or attach policies forme, I'll just attach directly policies just to be quick. And I'll give myself administrator access. Basically, I want to use the account to do my course.

So I'll give myself administrator access, and, basically, if you look at the permission boundary, you can just create it without one, okay, because this is an advanced feature and we don't need it right now. So we click on Next to review, and basically it says, "Okay, here is me that's defined, and the permissions I have are that I have administrator access, which is great, and I also can change my own password, which is great as well," right? So I'll go ahead and click on Create, and all of a sudden my user is created. So basically, I successfully generated a user, and I can view and download the security credentials for that user if I wanted to. So click on "Download CSV," and this is something I'm not showing you and you should not see, okay? But basically it is guaranteed that I have auser and then once that page is gone, Iwon't be able to see it uld not see,So I'll close this page, and now we're good. So we have Stefan as a user, and what I'll do is that I will relog into my page very soon as this user. Now if we go back to the dashboard, we can also have groups, okay? So what we have with groups is that we basically group users together so that we can know their identities and group permissions, saving a bit of time. So I manage a group, create a new group, and for this I'll call the group "Admin," okay? And I'll click on Next Step, give administrator access to that group, click on Next Step, and then create the group. So fairly simply, I create a group called Admin, but you create a group name, whatever, devlog developers, whatever, and create the group.

The group Admin now essentially has its own permissions and administrator access. So what I want to do is add my users to my group. So this is myself. I'll add Stefan to this group, and now we can see that Stefan is part of the administrators, and as such, it will inherit the permission of that group. So what I can do is go back to the users now, go to Stefan, and what I can do directly is detach these permissions because they're attached directly and this is not very manageable. So I can detach this administrator access that was attached through the group. Okay, so now we have a much better setup because my administrative access has been provided for the group. So it all looks great. And then finally, we can apply an IAM password policy. Now, an "im" password policy is basically to guarantee that im users such as myself will create strong passwords and that these passwords will change often because I don't want them to hang around for a year. So if I click on "Password policy," you can see all the requirements that there are, but basically you would need to set a minimum length, allow users to change their own password, and maybe I want to expire passwords after 90 days. Okay, that sounds about right, but you can choose whatever requirement you want. I'll apply the password policy and we should be good. So now all this is green. And as I said, I do not agree to allow anyone to use the root account.

So what we'll do is go to customise and create an account. I'll call it Data Cumulus Courses, and I'll say yes, create. And so, basically, now the Imuser signing link is right here. So this link is what I will use to sign into my AWS console. So I'll open a new tab and navigate to console. And right here I have the item username, which is going to be Stefan, and I need to set the password. And the password is the one that you got from the credentials CSV file. So what I'll do is that, basically, I'm going to my credentials CSV file, which you can't see, copy and paste the password, and sign in. Now that I'm signing, as you can see, I must change my password to continue. So I paste my old password, and I'll just type a new password that I'll generate using my password manager. But you can type whatever you want, just make sure it's secure, and then I will confirm the password change. And now, as you can see on the top right, I am logged in as theimuser Stefan in my account, Cumulus Courses. So once you have imuser, this is basically saying, "Hey, I'm not using the root account anymore. I'm using this user that I created from before, and this is a much better thing to do." So if I go back to IAM, as you can see, everything looks complete, everything looks good, and I'm creative and have all the users and rights that I want. So that's it for the setup. Just remember, it's really important for you to setup a user that has admin access and use that user instead of your root account. So that's about it. and I will see you in the next lecture for some much funnier stuff.

Hide