You've learned for 25 minutes. A short break helps your brain.
Sprint done! Great focus. Stretch for a minute?
Cloud with AWS cheat sheet
The commands you learned, in one place.
Sign in and profiles
aws sts get-caller-identityAsk AWS: who am I?aws sts get-caller-identity --profile my-dev-profileThe same, for one profile.aws sso login --profile my-dev-profileSign in at the front desk with these settings.aws configure ssoSet up a new Identity Center profile, step by step.aws sso logoutSign out and clear the cached badges.aws loginSign in through the browser; the CLI keeps the badges fresh.aws login --profile my-dev-profileSign in to one named profile.aws logoutEnd the session.aws configure list-profilesWhich profiles do I have?aws account enable-region --region-name ap-southeast-5Open the Malaysia mall for this account. No output means it worked.aws account get-region-opt-status --region-name ap-southeast-5Is it ENABLING or ENABLED yet?aws account disable-region --region-name ap-southeast-5Switch it off. Careful: what you built there keeps billing.
Keys and guards (IAM)
aws iam create-role --role-name kedai-web --assume-role-policy-document file://trust.jsonMake the web server's role.aws iam delete-role --role-name kedai-webDelete it when done (detach its policies first).aws iam attach-role-policy --role-name kedai-web --policy-arn arn:aws:iam::111122223333:policy/menu-readerGive the web server's role the menu-reader key.Risk: Carefulaws iam list-attached-role-policies --role-name kedai-webWhich policies does this role hold?Risk: Carefulaws iam detach-role-policy --role-name kedai-web --policy-arn arn:aws:iam::111122223333:policy/menu-readerTake the policy off again.Risk: Carefulaws iam list-access-keys --user-name BobShow Bob's keys.aws iam get-access-key-last-used --access-key-id AKIAIOSFODNN7EXAMPLEWhen did this key last work?aws iam update-access-key --access-key-id AKIAIOSFODNN7EXAMPLE --status Inactive --user-name BobSwitch Bob's old key off, but keep it for now.Risk: Carefulaws iam delete-access-key --access-key-id AKIDPMS9RO4H3FEXAMPLE --user-name BobRemove Bob's old key forever.Risk: Can lose work
Network and servers
aws ec2 create-vpc --cidr-block 10.0.0.0/16A plot with 65,536 private addresses.aws ec2 describe-vpcsList your VPCs, the default one too.aws ec2 create-subnet --vpc-id vpc-081ec835f3EXAMPLE --cidr-block 10.0.0.0/24A /24 row: 251 usable addresses, because AWS keeps 5.aws ec2 describe-subnetsList your rows and their free addresses.aws ec2 create-route --route-table-id rtb-22574640 --destination-cidr-block 0.0.0.0/0 --gateway-id igw-c0a643a9Send every other address to the internet gateway.Risk: Carefulaws ec2 describe-route-tablesRead every row's road signs.Risk: Carefulaws ec2 delete-nat-gateway --nat-gateway-id nat-04ae55e711cec5680Stop the hourly NAT bill.Risk: Carefulaws ec2 describe-nat-gatewaysFind NAT gateways you forgot.Risk: Carefulaws ec2 release-address --allocation-id eipalloc-64d5890aGive back the Elastic IP, so it stops billing.Risk: Carefulaws ec2 authorize-security-group-ingress --group-id sg-1234567890abcdef0 --protocol tcp --port 22 --cidr 203.0.113.0/24SSH only from one office range.Risk: Carefulaws ec2 authorize-security-group-ingress --group-id sg-1234567890abcdef0 --protocol tcp --port 80 --source-group sg-1a2b3c4dPort 80 only from servers in another group.Risk: Carefulaws ec2 create-security-group --group-name MySecurityGroup --description "My security group" --vpc-id vpc-1a2b3c4dMake a new group first. It lets nothing in.Risk: Carefulaws ec2 run-instances --image-id ami-0abcdef1234567890 --instance-type t3.microOne small server from this starting disk.Risk: Carefulaws ec2 describe-instancesList your servers and their states.Risk: Carefulaws ec2 stop-instances --instance-ids i-1234567890abcdef0running → stopping → stopped.Risk: Carefulaws ec2 start-instances --instance-ids i-1234567890abcdef0Start it again.Risk: Carefulaws ec2 terminate-instances --instance-ids i-1234567890abcdef0running → shutting-down → terminated.Risk: Can lose workaws ec2 describe-volumes --filters Name=status,Values=availableFind disks attached to nothing. They still bill.Risk: Can lose workaws elbv2 describe-target-health --target-group-arn arn:aws:elasticloadbalancing:us-west-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067Each target with its state: healthy or not.aws elbv2 delete-load-balancer --load-balancer-arn arn:aws:elasticloadbalancing:us-west-2:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188Delete a test load balancer. It bills every hour.aws cloudfront create-invalidation --distribution-id EDFDVBD6EXAMPLE --paths "/example-path/example-file.jpg"Forget one file everywhere. Status starts as InProgress.
Storage (S3)
aws s3 mb s3://amzn-s3-demo-bucketPrints make_bucket: s3://amzn-s3-demo-bucket.aws s3 lsList your buckets.aws s3 ls s3://amzn-s3-demo-bucketList the files in one bucket.aws s3api get-public-access-block --bucket amzn-s3-demo-bucketRead the four locks.aws s3api put-public-access-block --bucket amzn-s3-demo-bucket --public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"Turn all four locks on.aws s3 rb s3://amzn-s3-demo-bucketRemove an empty bucket.Risk: Can lose workaws s3 rb s3://amzn-s3-demo-bucket --forceDelete every file, then the bucket.Risk: Can lose work
Containers
aws ecr get-login-password --region ap-southeast-5 | docker login --username AWS --password-stdin 111122223333.dkr.ecr.ap-southeast-5.amazonaws.comLog Docker in to your shelf. The password never shows.aws ecr create-repository --repository-name project-a/sample-repoPrints the new shelf's ARN.aws ecr create-repository --repository-name project-a/sample-repo --image-tag-mutability IMMUTABLETags can never be swapped.aws ecr create-repository --repository-name kedai-kancil --image-scanning-configuration scanOnPush=trueScan every image on push.aws ecr delete-repository --repository-name ubuntu --forceDelete the shelf and its images.Risk: Can lose workaws ecs list-tasks --cluster defaultEach running task's ARN.aws ecs stop-task --task 666fdccc2e2d4b6894dd422f4eeee8f8Stop one task. A service starts a new one.aws ecs run-task --cluster kedai --launch-type FARGATE --task-definition kedai-web:1 --network-configuration "awsvpcConfiguration={subnets=[subnet-0e99b93155EXAMPLE],securityGroups=[sg-903004f8],assignPublicIp=ENABLED}"One small task in your row, behind your guard.Risk: Carefulaws ecs delete-service --cluster kedai --service shop --forceClose the shop's counter.Risk: Carefulaws ecs delete-cluster --cluster kedaiThen delete the empty cluster.Risk: Carefulaws ecs deregister-task-definition --task-definition kedai-web:1Retire an old recipe card revision.Risk: Carefulaws eks update-kubeconfig --name my-eks-clusterPrints the updated context and the kubeconfig file.aws eks list-clustersList your EKS clusters. Each one bills by the hour.aws rds stop-db-instance --db-instance-identifier test-instanceStatus becomes stopping, then stopped.Risk: Carefulaws secretsmanager delete-secret --secret-id MyTestSecret --recovery-window-in-days 7Gone in 7 days, unless you restore it.Risk: Carefulaws secretsmanager restore-secret --secret-id MyTestSecretChanged your mind? Bring it back within the window.Risk: Careful
Budgets and clean-up
aws budgets create-budget --account-id 111122223333 --budget file://budget.json --notifications-with-subscribers file://notify.jsonSet the line and who gets the email. No output means it worked.aws budgets describe-budgets --account-id 111122223333List your budgets and what you have spent.