Accessing internet from Private Subnet

To Access internet from Private subnet. We have two methods

a)            By using NAT Gateway

b)          By Using NAT Instance

By Using NAT Instance

1) Launch the NAT Instance using ( AMI to be used : Amazon NAT AMI ) in public Subnet

2) Launch the instance in private subnet

3) Assign EIP to the NAT Instance

4) Disable Source/Destination Check for the instance (Select Instance -> Actions -> Networking -> Uncheck Source/Destination check )

5) Update the IPTables of NAT table like below (i.e) POSTROUTING to MASQUERADE

# iptables -t nat -A POSTROUTING -o eth0 -s <privae subnet>  -j MASQUERADE

Modify the Security Group of NAT instance inbound rule to all or the port from PVT subnet

Modify the Route table of the PVT subnet for 0.0.0.0/0 to point to NAT Instance

cat <<EOF | sudo tee /etc/sysctl.d/custom_nat_tuning.conf

# for large instance types, allow keeping track of more

# connections (requires enough RAM)

net.ipv4.netfilter.ip_conntrack_max=262144

EOF

sudo sysctl -p /etc/sysctl.d/custom_nat_tuning.con

/usr/local/sbin/configure-pat.sh

By Using NAT Gateway

1) Launch the NAT Gateway in public Subnet. 

2) Launch the instance in private subnet

3) Assign EIP to the NAT Gateway

4) Modify the Route table of the PVT subnet for 0.0.0.0/0 to point to NAT Gateway

Displayed error	Reason	Remedial steps
Subnet has insufficient free addresses to create this NAT gateway	The subnet you specified does not have any free private IP addresses. The NAT gateway requires a network interface with a private IP address allocated from the subnet's range.	You can check how many IP addresses are available in your subnet by going to the Subnets page in the Amazon VPC console, and viewing the Available IPs field in the details pane for your subnet. To create free IP addresses in your subnet, you can delete unused network interfaces, or terminate instances that you do not require.
Network vpc-xxxxxxxx has no Internet gateway attached	A NAT gateway must be created in a VPC with an Internet gateway.	Create and attach an Internet gateway to your VPC. For more information, see Attaching an Internet Gateway.
Elastic IP address eipalloc-xxxxxxxxcould not be associated with this NAT gateway	The Elastic IP address that you specified does not exist or could not be found.	Check the allocation ID of the Elastic IP address to ensure that you entered it correctly. Ensure that you have specified an Elastic IP address that's in the same region in which you're creating the NAT gateway.
Elastic IP address eipalloc-xxxxxxxxis already associated	The Elastic IP address that you specified is already associated with another resource, and cannot be associated with the NAT gateway.	You can check which resource is associated with the Elastic IP address by going to the Elastic IPs page in the Amazon VPC console, and viewing the values specified for the instance ID or network interface ID. If you do not require the Elastic IP address for that resource, you can disassociate it. Alternatively, allocate a new Elastic IP address to your account. For more information, see Working with Elastic IP Addresses.
Network interface eni-xxxxxxxx, created and used internally by this NAT gateway is in an invalid state. Please try again.	There was a problem creating or using the network interface for the NAT gateway.	You cannot fix this error. Try creating a NAT gateway again.

Comparison of NAT Instances and NAT Gateways

The following is a high-level summary of the differences between NAT instances and NAT gateways.

Attribute	NAT gateway	NAT instance
Availability	Highly available. NAT gateways in each Availability Zone are implemented with redundancy. Create a NAT gateway in each Availability Zone to ensure zone-independent architecture.	Use a script to manage failover between instances.
Bandwidth	Supports bursts of up to 10Gbps.	Depends on the bandwidth of the instance type.
Maintenance	Managed by AWS.You do not need to perform any maintenance.	Managed by you, for example, by installing software updates or operating system patches on the instance.
Performance	Software is optimized for handling NAT traffic.	A generic Amazon Linux AMI that's configured to perform NAT.
Cost	Charged depending on the number of NAT gateways you use, duration of usage, and amount of data that you send through the NAT gateways.	Charged depending on the number of NAT instances that you use, duration of usage, and instance type and size.
Type and size	Uniform offering; you don’t need to decide on the type or size.	Choose a suitable instance type and size, according to your predicted workload.
Public IP addresses	Choose the Elastic IP address to associate with a NAT gateway at creation.	Use an Elastic IP address or a public IP address with a NAT instance. You can change the public IP address at any time by associating a new Elastic IP address with the instance.
Private IP addresses	Automatically selected from the subnet's IP address range when you create the gateway.	Assign a specific private IP address from the subnet's IP address range when you launch the instance.
Security groups	Cannot be associated with a NAT gateway. You can associate security groups with your resources behind the NAT gateway to control inbound and outbound traffic.	Associate with your NAT instance and the resources behind your NAT instance to control inbound and outbound traffic.
Network ACLs	Use a network ACL to control the traffic to and from the subnet in which your NAT gateway resides.	Use a network ACL to control the traffic to and from the subnet in which your NAT instance resides.
Flow logs	Use flow logs to capture the traffic.	Use flow logs to capture the traffic.
Port forwarding	Not supported.	Manually customize the configuration to support port forwarding.
Bastion servers	Not supported.	Use as a bastion server.
Traffic metrics	Not supported.	View CloudWatch metrics.
Timeout behavior	When a connection times out, a NAT gateway returns an RST packet to any resources behind the NAT gateway that attempt to continue the connection (it does not send a FIN packet).	When a connection times out, a NAT instance sends a FIN packet to resources behind the NAT instance to close the connection.
IP fragmentation	Supports forwarding of IP fragmented packets for the UDP protocol. Does not support fragmentation for the TCP and ICMP protocols. Fragmented packets for these protocols will get dropped.	Supports reassembly of IP fragmented packets for the UDP, TCP, and ICMP protocols.

Scenario Based Questions

1. How to migrate an EC2 from one region to anohter

a) take snapshot of the ec2 by right click and create image option

b) copy the AMI to different region

c) then from the new AMI create an EC2

2) How to change the users secret access key

Secret access key cannot be changed. New key need to be generate and assign the user with policy IAMUserSSHKeys. So that next user can manage his own ssh keys.

3) Allow IAM users to change their own passwords

In IAM account Settings, enable Allow users to change their own password, and then click Apply Password Policy.

4) I accidentally deleted my default VPC in AWS. What to do now?

You can open a support ticket and they will re create it for you.

5) In S3

If there is no Edit in the file in S3 and if you upload another file of same name, it is overwritten if versioning is not enabled. A new version is created if version is maintained.

b) Within the Region data is replicated into multiple availablity zone's.

c) Ownership of the object is not transferable.

d) Version ID is the version id for the object and in combination with the key helps to unique

e) Subresources helps provide additional information for an object

Elastic Load Balancing

ELB - Elastic Load Balancer

It is a managed service by AWS (Scalability and Availablity is managed by AWS). Mainly it used for distributing traffic between instances. Once if the instance is registered with ELB, it performs continuous Health check. Once if it finds the unhealthy instance ELB will stop sending the traffic.

ELB can either be public or private it is based on the subnet where we are launching it. It is highly recommended to use 2 AZ's for high availablity. 

ELB creates instances in the subnet's in backend which we cannot see. Private IP's for ELB will be assigned from the subnet which we have selected for the ELB. ELB will expand based on the traffic. Traffic will be distributed to Availablity zone's in round robin manner.

Note: ELB can be accessed only by DNS CNAME and not by IP.

Cross zone load balancing 

It will be useful if we are using multiple zones and if the number of instances in the zones are not equal. For example, If we have 6 Instances in 2 AZ's and in Zone A 4 instance and Zone B 2 instance. ELB will blindly forward the requests in Round robin manner to Zone A & B which causes the instances in Zone B to handle more load compared to the instances in Zone A. To Over com this we can enable cross zone load balancing option.

If cross Load Balancing is enabled then ELB will take the count of all the instances in all the availablity zone's  and will forward the traffic to instance which has least number of connections.

Pre - Warming

If you expect a sudden increase in your hits. For eg: from 1 to 10,000 hits in particular time then it will take some time for ELB to auto scale in backend. To avoid this get your ELB pre warmed by contacting AWS support. They will configure the load balancer to have the appropriate level of capacity based on the traffic that you expect.  

They also need some more details like Start and End dates, Expected flash traffic, Expected request rate per second and the total size of the typical request/response.

Connection Draining 

If enabled, time you give to the instances to complete the already establieshed connection for the unhealthy instances. But it wont send any new traffic to those unhelathy instance.

Internal load balancer - Load balancer launched in the private network.

If an instance is using ELB that doesnt mean the EC2 can download files from internet.

EBS Voulme and its Snapshot

List of Topics

1) Types of EBS volume
2) What is SSD & HDD
3) Difference between the volumes of EBS
4) What is IOPS/ Provsioned IOPS

5) What is IO Credit and Baseline performance
6) How Throughput Optimized volume (st1) Works
7) What is Baseline and Burstable performance

1) Types of EBS volume

AWS offers following 5 types of volumes, each differs by price performance and some other characteristics. The below listed types are mainly categorized by the two types of Disks first one is SSD and second is HDD.

a) SSD-Genral purpose (gp2)
b) SSD-Provisioned IOPS (io1)
c) HDD-Throughput Optimized (st1)
d) HDD-Cold backed (sc1)
e) Magnetic (Old Generation)

Before proceeding with the types of EBS in Detail will see what is SSD and HDD.

2) What is SSD & HDD

HDD - it will have physical disks and these are mechanical hard drive's. If exposed to elements there may be a data loss. Surface of disk should be free of contaminants. The Head of the disk moves back and front to read the data. HDD - backed volumes are optimized for large streaming workloads where throughput (measured in MiB/s) is a better performance measure than IOPS

SSD - SSD is like a flash Storage. It is too small and light compared to HDD. It has NO moving parts. Life span may be about 2000 years for newer generation and for Older generation is about 72 years if used heavly. Performance is 3 times faster than mechanical hard drive's. And even price is little more compared to HDD. Much reliable compared to HDD. SSD-backed volumes are optimized for transactional workloads involving frequent read/write operations with small I/O size, where the dominant performance attribute is IOPS

Less power 

3) Difference between the volumes of EBS

SSD-Backed Provisioned IOPS (io1) - I/O-intensive, NoSQL and relational databases
SSD-Backed General Purpose (gp2) - Boot volume, low-latency interactive apps, dev & test

HDD-Backed Throughput Optimized (st1) - Big data, data warehouse, log processing

HDD-Backed Cold (sc1) - Colder data requiring fewer scans per day

	General Purpose (gp2)	Provisioned IOPS (io1)	Throughput optimized (st1)	Cold backed (sc1)	Magnetic
Base Disk Type	SSD	SSD	HDD	HDD	Previous generation HDD
Use Cases	Recommended for frequently accessed workloads System boot volumes Virtual desktops Low-latency interactive apps Development and test environments	For Critical business applications that require sustained IOPS performance, or more than 10,000 IOPS or 160 MiB/s of throughput per volume Large database workloads,	Streaming workloads requiring consistent, fast throughput at a low price Big data Data warehouses Log processing Cannot be a boot volume	Throughput-oriented storage for large volumes of data that is infrequently accessed Scenarios where the lowest storage cost is important Cannot be a boot	Recommended for infrequently accessed workloads
Volume Size	1 GiB- 16TiB	4 GiB-16TiB	500 GiB-16TB	500 GiB- 16 TiB	1GiB-1TiB
	10,000	20,000	500	250
	65,000	65,000	65,000	65,000	48,000
Throughput Per instance	1,250 MiB/s	1,250 MiB/s	1,250 MiB/s	1,250 MiB/s	1,250 MiB/s
Performance based on attribute	OPS	OPS	MiB/s	MiB/s	OPS

4) What is IOPS

IOPS means Input/output operations per second, is used to measure performance of Hard disk drives (HDD), solid state drives (SSD), and storage area networks (SAN). IOPS is measured in integer. 

For more understanding of IOPS it can be compared to rpm of a car engine. If a vehicle is in neutral, stating that the engine is capable of spinning at 10,000 rpms in that moment is meaningless. Without taking into account the data block size (or I/O size), read/write activity or I/O stream, IOPS as a stand-alone measurement says little.

IOPS are a unit of measure representing input/output operations per second. The operations are measured in KiB, and the underlying drive technology determines the maximum amount of data that a volume type counts as a single I/O. I/O size is capped at 256 KiB for SSD volumes and 1,024 KiB for HDD volumes because SSD volumes handle small or random I/O much more efficiently than HDD volumes.

When small I/O operations are physically contiguous, Amazon EBS attempts to merge them into a single I/O up to the maximum size. For example, for SSD volumes, a single 1,024 KiB I/O operation counts as 4 operations (1,024÷256=4), while 8 contiguous I/O operations at 32 KiB each count as 1operation (8×32=256). However, 8 random I/O operations at 32 KiB each count as 8 operations. Each I/O operation under 32 KiB counts as 1 operation.

Similarly, for HDD-backed volumes, both a single 1,024 KiB I/O operation and 8 sequential 128 KiB operations would count as one operation. However, 8 random 128 KiB I/O operations would count as 8 operations.

Consequently, when you create an SSD-backed volume supporting 3,000 IOPS (either by provisioning an io1 volume at 3,000 IOPS or by sizing a gp2 volume at 1000 GiB), and you attach it to an EBS-optimized instance that can provide sufficient bandwidth, you can transfer up to 3,000 I/Os of data per second, with throughput determined by I/O size.

For example let’s compare how two workloads accessing the same amount of data require a significantly different amount of IOPS. 

The first workload requires reading ten 750MB files, 7.5GB and it takes 100 seconds for the transfer to occur. This means that the transfer rate is 75MB/s and consumes 10 IOPS, which is well within the capabilities of a single hard disk. The second workload requires reading ten thousand 750KB files, the same amount of data, 7.5GB, but it consumes 10,000 IOPS. Since the typical disk drive can’t generate more than 200 IOPS this request won’t get done in the same 100 seconds.(To Understand transfer of 75 Kg object each 7.5 KG will require less load than transfering 75KG which has 10,000 object.)  This is an example of how different workloads can require significantly different performance, while using the same storage capacity.

5) More About General Purpose volume

The performance of gp2 volumes is tied to volume size, which determines the baseline performance level of the volume and how quickly it accumulates I/O credits; larger volumes have higher baseline performance levels and accumulate I/O credits faster. 

Minimum IOPS - 100
Maximum IOPS - 10,000
Baseline  - 3 1OPS/GiB

Baseline of 3 IOPS per GiB with a minimum of 100 IOPS, burstable to 3000 IOPS. And Maximum IOPS for genral purpose is 10000. Also, IOPS for volume sizes greater than 3333 GiB is 10000 IOPS.

I/O credits represent the available bandwidth that your volume can burst large amounts of I/O when more than the baseline performance is needed. The more credits your volume has for I/O, the more time it can burst beyond its baseline performance.

Each volume receives an initial I/O credit balance of 5.4 million I/O credits, which is enough to sustain the maximum burst performance of 3,000 IOPS for 30 minutes

Volumes larger than 1,000 GiB have a baseline performance that is equal or greater than the maximum burst performance, and their I/O credit balance never changes. The maximum I/O credit balance for a volume is equal to the initial credit balance (5.4 million I/O credits).

Bursting and I/O credits are only relevant to volumes under 1,000 GiB, where burst performance exceeds baseline performance.

The burst duration of a volume is dependent on the size of the volume, the burst IOPS required, and the credit balance when the burst begins. This is shown in the following equation:

                            (Credit balance)

Burst duration  =  ------------------------------------

                   (Burst IOPS) - 3(Volume size in GiB)

Eg: If the credit balance is maximum(5.4 Million) and volume size is 1 GB then the burst duration is

Burst duration = 5400000/3000 - 3*1 = 5400000/2997 = 1801 (in Sec for Minutes 1801/60 = 30), then 30 Minutes is the maximum duration of this burst performance.

Throughput can never exceed 160 MiB/s. The throughput limit for gp2 volumes is 128 MiB/s for volumes less than or equal to 170 GiB and 160 MiB/s for volumes over 170 GiB. When I/O demand drops below the baseline level and unused credits are added to the I/O credit balance, the maximum IOPS performance of the volume will again exceed the baseline. 

6) Provisioned IOPS

Minimum IOPS - 100
Maximum IOPS - 20,000
IOPS max is based on 50:1 Ratio

The throughput limit of io1 volumes is 256 KiB for each IOPS provisioned, up to a maximum of 320 MiB/s (at 1,280 IOPS).

For example, a 100 GiB gp2 volume with an empty credit balance has a baseline performance of 300 IOPS and a throughput limit of 75 MiB/s (300 I/O operations per second * 256 KiB per I/O operation = 75 MiB/s)

6) How Throughput Optimized volume (st1) Works

Subject to throughput and throughput-credit caps, the available throughput of an st1 volume is expressed by the following formula:

(Volume size) x (Credit accumulation rate per TiB) = Throughput

In the above figure in throughput line it is showing Baseline 40 MiB/S  Per TB, as we are creating 500 GB volume the throughput is showing as 20 and 123 is the burstable performance.

For a 1 TiB st1 volume, burst throughput is limited to 250

6) What is Baseline and Busrtable performance

Trying to explain what is baseline performance and burstable performance in laymen way. Baseline performance is something like running a car with normal power and if normal power is not utilized completely, then leftover will be added to nitrous power (which is IO credit bucket) In case if we need more power then we can provision extra power by burning nitrous power till it gets empty (technically using io credit balance at some IOPS rate till the bucket becomes empty) even the nitrous mode will have some max speed like 200 KM/h similarly even provisioned IOPS will be bursted at some maximum IOPS  rate which is 3000 IOPS.

Monitoring the Burst Bucket Balance for gp2, st1, and sc1 Volumes

You can monitor the burst-bucket level for for gp2, st1, and sc1 volumes using the EBS BurstBalance metric available in Amazon CloudWatch. This metric shows the percentage of I/O credits (for gp2) or throughput credits (for st1 and sc1) remaining in the burst bucke

About EBS Snapshot

Snapshots occur asynchronously;

Status of the snapshot is pending until the snapshot is complete (when all of the modified blocks have been transferred to Amazon S3),

you can take a snapshot of a volume while a previous snapshot is in the pending status, having multiple pending snapshots of a volume may result in reduced volume performance until the snapshots complete.

Limit of five pending snapshots for a single gp2, io1, or Magnetic volume, and one pending snapshot for a single st1 or sc1 volume.

Snapshots that are taken from encrypted volumes are automatically encrypted. Volumes that are created from encrypted snapshots are also automatically encrypted.

To create a snapshot for an Amazon EBS volume that serves as a root device, you should stop the instance before taking the snapshot.

About AWS Infrastructure

AWS infrastructure has below main concepts which we will use on our daily activities. So a small description about the key concepts. Please ping your queries in comments field.

Region - Any Geographic location where Amazon has datacenter is know as Region. As of today (05/03/2017) there are 16 regions available. In a region minimum 2 datacenter's will be there.

Availablity Zones - An individual datacenter in the region is known as AZ. AZ's in the region will have seperate Power, cooling fan, etc.. AZ's wont share their resources but between AZ's there will be low latency private network. This Multi AZ will help us to a deploy a services in High Availablity.

Edge Locations  - Points of presence where AWS Content Delivery Network service is present is known as Edge Location. In AWS Cloudfront is the CDN service. As of now there are 60+ Edge locations.

Scope of Services

In AWS there are some services which will be available only to respective AZ/Region. Below are the list of some of the services and its scope. For eg; EBS volume is AZ specific, so if you create a EBS volume in an AZ-A then you can't attach the volume to EC2 in AZ-B.

AZ           - EC2, RDS, EBS volume, Redshift Node, Subnets, EFS

Regional - S3, AMI, Snapshot, Dynamodb, VPC, SQS, SNS, Cloudwatch, Cloudtrial

Global     - IAM, Route 53, Cloudfront Distribution

Service Limit - Number of resources we can provision per service.