Podcast
Questions and Answers
What is the purpose of an InstanceProfile in AWS EC2?
What is the purpose of an InstanceProfile in AWS EC2?
What happens to the IP address of an EC2 instance when it is stopped and started?
What happens to the IP address of an EC2 instance when it is stopped and started?
Which data storage option survives a reboot but does not survive a stop or terminate action in EC2?
Which data storage option survives a reboot but does not survive a stop or terminate action in EC2?
What is required to SSH into an EC2 instance?
What is required to SSH into an EC2 instance?
Signup and view all the answers
What happens to an EBS volume when an EC2 instance is terminated?
What happens to an EBS volume when an EC2 instance is terminated?
Signup and view all the answers
Why are IAM Roles preferred for granting permissions between AWS services?
Why are IAM Roles preferred for granting permissions between AWS services?
Signup and view all the answers
What should you do if you want to allow only 'yourself' in the security group and also permit '18.206.107.24/29'?
What should you do if you want to allow only 'yourself' in the security group and also permit '18.206.107.24/29'?
Signup and view all the answers
What happens to instance store disks when you move an EC2 instance to another EC2 host?
What happens to instance store disks when you move an EC2 instance to another EC2 host?
Signup and view all the answers
What method must you use to connect to an Amazon EC2 instance?
What method must you use to connect to an Amazon EC2 instance?
Signup and view all the answers
What happens if you restrict SSH access on an EC2 instance and do not allow the AWS IP range for EC2 Instance Connect?
What happens if you restrict SSH access on an EC2 instance and do not allow the AWS IP range for EC2 Instance Connect?
Signup and view all the answers
In which format should you provide a shell script when launching an EC2 instance?
In which format should you provide a shell script when launching an EC2 instance?
Signup and view all the answers
What is the fate of terminated instances on AWS?
What is the fate of terminated instances on AWS?
Signup and view all the answers
Study Notes
Instance Roles
- IAM roles are used to grant permissions to AWS services, allowing a service to assume the role and inherit its permissions
- EC2 instance roles are roles that an instance can assume, and anything running on that instance has the permissions granted by the role
- Assuming a role grants temporary credentials to the service, which can be delivered to an EC2 instance using an InstanceProfile
EC2 Instances
- InstanceProfile is a wrapper around the IAM role, allowing permissions to be delivered to an EC2 instance
- Creating an IAM role and attaching a permission policy to the role is necessary for the role to be assumed by an EC2 instance
IP Addresses
- Rebooting an instance keeps the IP address
- Stopping and starting an instance changes the IP address
Storage
- Instance Store: data survives reboot, but does not survive stop, hibernate, or terminate
- EBS Volume: survives stop, restart, and termination; root EBS volume is deleted by default when instance is terminated
SSH
- Requires a one-time download of ssh key pair at instance creation
- Requires a public IP address for the instance
- Requires a Security Group allowing port 22
- Defaults to user
ec2-user - Restricting SSH access may restrict the AWS IP range for EC2 Instance Connect
EC2 Instance Connect
- Originating connections come from an AWS IP range
- Restricting SSH access may restrict the AWS IP range for EC2 Instance Connect
- Solve by allowing
0.0.0.0/0or adding a security group with the EC2 Instance Connect IP range
Scripting
- When launching an EC2 instance, you can pass a shell script or Cloud init directive to User Data using
user_dataarg in Terraform code - Example of a "here" doc assigned to
user_data
Connecting
- Linux: SSH client, EC2 Instance Connect, AWS Systems Manager Session Manager
- Windows: Putty, SSH client, AWS Systems Manager Session Manager, Windows Subsystem for Linux (WSL)
- Amazon EC2 supports ED25519 and 2048-bit SSH-2 RSA keys for Linux instances
Instance Lifecycle
- Deleted, terminated, or released resources cannot be recovered
- Terminated instances will be deleted after a few hours and cannot be manually removed
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Description
Learn about the best way for AWS services to be granted permissions to other AWS services through IAM roles. Discover how EC2 instance roles work and how permissions are granted to anything running on the instance. Explore how temporary credentials are created for whoever assumes the role.
