In Part-1 we created IAM users with long-term credentials, and in Part-2 we switched into a member account with something called OrganizationAccountAccessRole. That "switch" is the single most important mechanism in AWS security - assuming an IAM role - and this Part-3 is all about it. A role is an identity …

In Part-15 jhooq.com started pointing at the Application Load Balancer - over plain HTTP. Browsers mark that "Not secure", search engines rank it lower, and nobody should log in over it. The fix on AWS costs nothing: AWS Certificate Manager (ACM) issues publicly trusted TLS certificates for free, validates …

In Part-2 we built a multi-account setup by hand - an organization, OUs, SCPs, a log-archive account, IAM Identity Center - and I ended with "or let Control Tower do it". This Part-24 is that. AWS Control Tower orchestrates Organizations, Service Catalog, IAM Identity Center, CloudTrail and Config to build a …

One EC2 instance (Part-4) is a lab. A real application needs at least two instances in two Availability Zones, something to replace an instance when it dies, and something to add instances when traffic spikes and remove them when it drops. That something is Amazon EC2 Auto Scaling, and in this Part-10 we build it from …

In Part-4 we clicked through the launch wizard once. In Part-10 we needed the same configuration for every instance an Auto Scaling group creates, and the answer was a launch template - we created one quickly and moved on. This post is the deep dive it deserves, because the launch template is the thing that turns …

Every EC2 instance in this series so far was On-Demand - you pay the list price per second and nobody takes it away. Spot Instances are the same hardware, the same AMIs, the same launch templates, for up to 90 % less - with one condition: Amazon EC2 can take the instance back with two minutes notice when it needs the …

This is Part-1 of my AWS step-by-step series, and it starts where every AWS account should start - with IAM (Identity and Access Management). You have just created an AWS account, you are logged in as the root user, and the very first thing to do is to stop using it. In this post we are going to create an IAM user, …

Everything up to now ran on EC2 instances that you launch, patch, scale and pay for while idle. AWS Lambda removes the server: you upload a function, AWS runs it when something invokes it, scales it from zero to thousands of parallel executions, and bills you per millisecond. This Part-17 covers the three features …

We created a NAT Gateway in Part-5 in one step and moved on. It deserves its own part, because the NAT Gateway is the component every private subnet depends on, it is the first surprise on most AWS bills, and the three most common "my instance cannot reach the internet" tickets all end at it. This Part-14 …

In Part-10 we used an Application Load Balancer, and for a web application that is the right default. But every so often the requirements say "the customer needs a fixed IP to allow-list", "it is not HTTP, it is MQTT on port 8883", "we need a million connections per second", or "we …