DEV Community: Naami Ahmed

AWS Architecture Unlocked: Follow a Request Through a VPC

Naami Ahmed — Mon, 05 Oct 2026 07:50:47 +0000

Understanding VPCs, subnets, route tables, Internet Gateway, NAT Gateway, Security Groups, NACLs, IAM, and S3 through one real-world request.

What actually happens when a user opens an application running on AWS?

You have probably seen diagrams like this:

User → Load Balancer → EC2 → RDS

It looks simple.

But then the questions start:

How does the request enter the AWS network?
Why is the Load Balancer in a public subnet?
Why is the application server in a private subnet?
How does a private EC2 instance access the internet?
What exactly does the NAT Gateway do?
What is the difference between an Internet Gateway and a NAT Gateway?
Where do Route Tables fit into all of this?
If Security Groups protect resources, what does a Network ACL protect?
How does the application access S3?
Does IAM provide the network connection to S3?
What actually happens to a packet as it travels through the architecture?

Learning AWS services individually is one thing.

Understanding how those services work together is another.

That is what this article is about.

Rather than explaining AWS networking as a collection of definitions, let's follow a request through a realistic AWS architecture and understand what happens at each step.

1. The Big Picture

Let's imagine that we are running a simple web application on AWS.

Our architecture contains:

Amazon Route 53
Amazon VPC
Two Availability Zones
Public subnets
Private application subnets
Private database subnets
Internet Gateway
NAT Gateway
Application Load Balancer
EC2 application servers
Amazon RDS
Amazon S3
VPC Endpoint
Route Tables
Security Groups
Network ACLs
IAM

At a high level:

                         INTERNET
                            │
                            ▼
                       Route 53
                            │
                            ▼
                 Application Load Balancer
                            │
                ┌───────────┴───────────┐
                │                       │
          Application A           Application B
                │                       │
                └───────────┬───────────┘
                            │
                           RDS
                            │
                           S3

But there is much more happening underneath.

Let's open this architecture step by step.

2. First: What Is a VPC?

An Amazon VPC, or Virtual Private Cloud, is your logical network environment inside AWS.

Think about a company office.

The office has:

different rooms
entrances
internal areas
security controls
different routes between areas

A VPC gives you a similar networking boundary in AWS.

Inside a VPC, you can create:

Subnets
Route Tables
Security Groups
Network ACLs
Internet Gateways
NAT Gateways
VPC Endpoints

A VPC spans the Availability Zones in an AWS Region, and you can create subnets in those Availability Zones.

For example:

AWS Region
│
└── VPC
    │
    ├── Availability Zone A
    │
    └── Availability Zone B

The VPC is therefore the main networking boundary for our application.

3. Why Do We Use Multiple Availability Zones?

Before discussing public and private subnets, there is another important concept: Availability Zones.

An AWS Region contains multiple Availability Zones.

Instead of putting our entire application into one Availability Zone, we can distribute resources across multiple Availability Zones.

For example:

                    VPC
                     │
          ┌──────────┴──────────┐
          │                     │
       AZ - A                 AZ - B
          │                     │
     Application A        Application B

Why?

Because if one Availability Zone experiences a problem, resources in another Availability Zone can continue serving traffic.

This is one of the basic ideas behind high availability.

For our example, we'll use two Availability Zones.

4. Public Subnet vs Private Subnet

This is one of the most important concepts to understand.

We can divide our VPC into different subnets.

For example:

VPC
│
├── Availability Zone A
│   ├── Public Subnet
│   ├── Private Application Subnet
│   └── Private Database Subnet
│
└── Availability Zone B
    ├── Public Subnet
    ├── Private Application Subnet
    └── Private Database Subnet

But what actually makes a subnet "public"?

It is not simply a label saying Public Subnet.

The important factor is routing.

A subnet can be considered public when its route table contains a route to an Internet Gateway. For IPv4 internet traffic, that commonly looks like:

Destination       Target

0.0.0.0/0         Internet Gateway

AWS documentation describes adding this route to a subnet's route table to provide internet access through an Internet Gateway.

So:

Public subnet = subnet whose routing allows internet connectivity through an Internet Gateway, with appropriately addressed resources and security controls.

A private subnet does not have a direct route to an Internet Gateway for internet-bound traffic.

5. What Does a Route Table Actually Do?

This is where many beginners become confused.

A Route Table is basically a traffic decision table.

It answers:

"Where should this traffic go?"

For example:

Destination       Target

10.0.0.0/16       local
0.0.0.0/0         igw-xxxx

The first route says:

Traffic destined for the VPC's own CIDR stays inside the VPC.

The second says:

Traffic destined for anywhere else should use the Internet Gateway.

AWS describes a route table as a set of rules that determines where traffic from a subnet or gateway is directed.

Think of a route table like a road-sign system.

If the destination is:

10.0.0.0/16

take the local road.

If the destination is:

0.0.0.0/0

take the configured default route.

6. How Does Internet Traffic Enter the VPC?

Now let's follow a real request.

Imagine a user opens:

https://myapp.com

The simplified flow is:

User
  │
  ▼
Internet
  │
  ▼
Route 53
  │
  ▼
Application Load Balancer
  │
  ▼
Private Application Server

But how does the request actually enter the VPC?

That's where the Internet Gateway comes in.

7. Internet Gateway — The VPC's Connection to the Internet

An Internet Gateway, or IGW, is attached to the VPC.

It provides connectivity between the VPC and the internet when the appropriate routing and addressing are configured.

A simplified view:

Internet
   │
   ▼
Internet Gateway
   │
   ▼
VPC

For a public subnet, the route table may contain:

0.0.0.0/0 → Internet Gateway

The Internet Gateway itself is not placed inside the subnet.

It is attached to the VPC.

This is an important detail because architecture diagrams often make this confusing.

8. Application Load Balancer in the Public Subnets

Now let's introduce an Application Load Balancer.

Our architecture looks like:

                    Internet
                       │
                       ▼
               Internet Gateway
                       │
             ┌─────────┴─────────┐
             │                   │
       Public Subnet A     Public Subnet B
             │                   │
             └─────────┬─────────┘
                       │
                       ▼
               Application
               Load Balancer

The ALB can receive requests from users and distribute them to healthy application targets.

Our application servers don't need to be directly exposed to the internet.

Instead:

Internet
   ↓
ALB
   ↓
Private Application Server

This gives us a cleaner security boundary.

9. Why Put the Application Servers in Private Subnets?

Suppose we have two EC2 application servers:

Private Application Subnet A
        │
        └── EC2 App Server A

Private Application Subnet B
        │
        └── EC2 App Server B

These servers do not need public IP addresses for users to access the application.

Users communicate with the ALB.

The ALB communicates with the application servers.

So:

Internet
   ↓
ALB
   ↓
Private EC2

This reduces the direct exposure of the application servers.

This is a common pattern in multi-tier AWS architectures.

10. Security Groups: Resource-Level Protection

Now we need security.

Security Groups act as a virtual firewall associated with resources such as network interfaces.

For our application, we could create three Security Groups:

ALB Security Group
Application Security Group
Database Security Group

For example:

ALB Security Group

Inbound:
HTTPS 443
Source: Internet

Application Security Group

Inbound:
Application port
Source: ALB Security Group

Database Security Group

Inbound:
PostgreSQL 5432
Source: Application Security Group

This creates a chain:

Internet
   │
   │ HTTPS 443
   ▼
ALB
   │
   │ Application traffic
   ▼
EC2
   │
   │ PostgreSQL 5432
   ▼
RDS

Notice something important.

We don't say:

"Allow the entire internet to access RDS on port 5432."

Instead, we restrict database access to the application tier.

This is the principle of least privilege applied to network access.

11. Security Groups Are Stateful

Security Groups are stateful.

If an allowed inbound connection is established, the response traffic is automatically allowed back without requiring a separate outbound rule for that response.

Security Groups also support allow rules rather than explicit deny rules.

This is different from Network ACLs.

12. Network ACLs — Subnet-Level Protection

A Network Access Control List, or NACL, works at the subnet level.

Think about it this way:

             VPC
              │
        ┌─────┴─────┐
        │           │
      Subnet      Subnet
        │           │
       NACL        NACL

A Security Group protects resources.

A NACL controls traffic at the subnet boundary.

The basic comparison is:

Feature	Security Group	Network ACL
Scope	Resource / network interface	Subnet
Stateful	Yes	No
Allow rules	Yes	Yes
Deny rules	No	Yes
Main purpose	Resource-level traffic control	Subnet-level traffic control

Because NACLs are stateless, you need to think about both directions of traffic.

13. Now the Interesting Question: How Does a Private EC2 Reach the Internet?

Our application server is private.

It has no public IP address.

But suppose the application needs to:

call an external API
download a package
access an external service
retrieve some internet-hosted resource

How does it access the internet?

The answer is:

NAT Gateway.

14. NAT Gateway — Private to Internet

We put a NAT Gateway in a public subnet.

The architecture becomes:

Private EC2
     │
     ▼
Private Route Table
     │
     ▼
NAT Gateway
     │
     ▼
Internet Gateway
     │
     ▼
Internet

The private subnet route table can contain:

Destination       Target

0.0.0.0/0         NAT Gateway

AWS documents this pattern: a NAT device can allow resources in private subnets to initiate connections to the internet while those resources cannot receive unsolicited inbound connection requests from the internet. AWS recommends NAT Gateway as the managed NAT option for this use case.

The important concept is:

Private resources can initiate outbound internet connections through NAT without requiring direct inbound internet connectivity.

15. Internet Gateway vs NAT Gateway

This is a common interview question.

Internet Gateway

Think:

VPC ↔ Internet

It provides the VPC's connection to the internet when routing and addressing permit it.

NAT Gateway

Think:

Private Subnet → Internet

It allows private resources to make outbound connections without requiring them to have public IP addresses.

So:

PUBLIC:

EC2 / ALB
   ↓
Route Table
   ↓
Internet Gateway
   ↓
Internet

And:

PRIVATE:

EC2
   ↓
Route Table
   ↓
NAT Gateway
   ↓
Internet Gateway
   ↓
Internet

16. Important: NAT Gateway Does Not Make a Private Subnet Public

This is a common misunderstanding.

Some beginners think:

"If my private EC2 uses NAT Gateway, then it becomes public."

No.

The EC2 remains without a public IP address.

The NAT Gateway performs the network address translation for outbound traffic.

The return traffic is translated back to the private resource.

So the architecture remains:

Internet
   X
   │
   │ No direct unsolicited inbound connection
   │
NAT Gateway
   │
Private EC2

17. Why Do We Need Multiple NAT Gateways?

For a highly available architecture, we generally avoid depending on one NAT Gateway in only one Availability Zone.

For example:

                VPC

        AZ-A              AZ-B
         │                  │
    Public Subnet       Public Subnet
         │                  │
    NAT Gateway A       NAT Gateway B
         │                  │
    Private App A       Private App B

This avoids making one NAT Gateway a single point of failure for both Availability Zones.

There is also a cost consideration because NAT Gateways are billed resources.

For a learning architecture, you can show two NAT Gateways and explain that real architectures must balance availability, complexity, and cost.

18. What About the Database?

Our application needs a database.

Let's use Amazon RDS.

We can place RDS in private database subnets:

Private Application Subnet
        │
        ▼
Application Server
        │
        │ TCP 5432
        ▼
Private Database Subnet
        │
        ▼
       RDS

The RDS database does not need to be directly accessible from the internet.

The database Security Group can allow PostgreSQL traffic only from the application Security Group.

This gives us:

Internet
   │
   X
   │
   └── No direct access to RDS

Application
   │
   ▼
RDS

This is a very important production-style security pattern.

19. Now Let's Talk About S3

Amazon S3 is different from EC2 and RDS.

You don't create an S3 bucket inside your VPC.

S3 is an AWS managed service.

So we shouldn't draw it as:

VPC
└── S3

as if S3 were a subnet resource.

Instead:

              VPC
               │
          Application
               │
               ▼
              S3

But now we have two separate questions:

Question 1:

Is the application allowed to access the S3 bucket?

That's an authorization question.

Question 2:

How does the network traffic reach S3?

That's a networking question.

These are different concepts.

20. IAM Controls Authorization

Suppose our EC2 application needs to download an object from S3.

We can attach an IAM Role to the EC2 instance.

That role can contain permissions such as:

s3:GetObject

for a specific bucket or path.

So:

EC2
 │
 ▼
IAM Role
 │
 ▼
Permission to access S3

IAM answers:

"Is this identity allowed to perform this AWS action?"

IAM does not create the network path to S3.

That distinction is extremely important.

21. VPC Endpoint: Private Connectivity to S3

Now let's look at the networking side.

For Amazon S3, we can use a Gateway VPC Endpoint.

The traffic can be:

Private EC2
     │
     ▼
Route Table
     │
     ▼
S3 VPC Endpoint
     │
     ▼
Amazon S3

This allows access to S3 without requiring an Internet Gateway or NAT Gateway for that S3 traffic. AWS also documents that gateway endpoints can be associated with route tables and that they can be used for private access to S3.

For example, our private route table could conceptually contain:

10.0.0.0/16       local
S3 prefix list    S3 VPC Endpoint
0.0.0.0/0         NAT Gateway

The more-specific S3 route can send S3 traffic to the endpoint, while other internet-bound traffic can continue through the NAT Gateway. AWS documents this routing pattern as well.

22. IAM vs VPC Endpoint

This is worth remembering.

                 Application
                    │
          ┌─────────┴─────────┐
          │                   │
       IAM Role          VPC Endpoint
          │                   │
          ▼                   ▼
   Authorization          Network Path
          │                   │
          └─────────┬─────────┘
                    ▼
                   S3

In simple words:

IAM says:

"You are allowed to do this."

VPC Endpoint says:

"This is the private network path to the AWS service."

These two concepts work together, but they are not the same thing.

23. Let's Follow the Complete User Request

Now let's put everything together.

Imagine a user opens:

https://myapp.com

Step 1 — DNS

The user's request needs to find where the application is hosted.

Route 53 provides DNS functionality.

User
 ↓
Route 53

Step 2 — Internet

The request travels through the internet toward our AWS application.

User
 ↓
Internet

Step 3 — Internet Gateway

The traffic enters the VPC through the Internet Gateway according to the configured routing.

Internet
 ↓
Internet Gateway

Step 4 — Load Balancer

The Application Load Balancer receives the request.

Internet Gateway
 ↓
Application Load Balancer

Step 5 — Application Server

The ALB forwards the request to a healthy application server in a private subnet.

ALB
 ↓
Private EC2

Step 6 — Database

If the application needs data:

EC2
 ↓
RDS

The database Security Group controls whether the application is allowed to connect.

Step 7 — S3

If the application needs an image or file:

EC2
 ↓
VPC Endpoint
 ↓
S3

IAM permissions determine whether the application is authorized to access the required S3 object.

24. What If the Application Calls an External API?

Now imagine the application needs to call:

https://api.example.com

The application is still in a private subnet.

The traffic follows:

Private EC2
     ↓
Private Route Table
     ↓
NAT Gateway
     ↓
Internet Gateway
     ↓
Internet
     ↓
External API

This is one of the most useful traffic flows to understand when working with AWS.

25. The Architecture at a Glance

Now we can understand the complete architecture:

                              INTERNET
                                 │
                                 ▼
                             Route 53
                                 │
                                 ▼
                         Internet Gateway
                                 │
                   ┌─────────────┴─────────────┐
                   │                           │
              Public Subnet A            Public Subnet B
                   │                           │
                   └─────────────┬─────────────┘
                                 │
                        Application LB
                                 │
                 ┌───────────────┴───────────────┐
                 │                               │
          Private App Subnet A            Private App Subnet B
                 │                               │
              EC2 App A                       EC2 App B
                 │                               │
                 ├──────────────┐  ┌─────────────┤
                 │              │  │             │
                 ▼              │  │             ▼
                RDS             │  │            S3
                 │              │  │             ▲
                 │              │  │             │
                 │              └──┴──── VPC Endpoint
                 │
                 │
          Private outbound traffic
                 │
                 ▼
             NAT Gateway
                 │
                 ▼
          Internet Gateway
                 │
                 ▼
              INTERNET

26. One Simple Mental Model

If you forget everything else from this article, remember these questions.

VPC

Where is my network?

Subnet

Where inside the network is my resource?

Route Table

Where should the traffic go?

Internet Gateway

How does my VPC communicate with the internet?

NAT Gateway

How can private resources initiate outbound internet connections?

Security Group

Which traffic is allowed to reach this resource?

Network ACL

Which traffic is allowed or denied at the subnet boundary?

IAM

Is this identity allowed to perform this AWS action?

VPC Endpoint

Can my VPC privately reach a supported AWS service?

Once you understand these questions, AWS networking becomes much less confusing.

27. The Most Important Lesson

AWS architecture is not about memorizing hundreds of services.

It is about understanding relationships.

A real application is not:

EC2
RDS
S3
VPC

as four independent services.

It is:

User
  ↓
DNS
  ↓
Internet
  ↓
VPC
  ↓
Load Balancer
  ↓
Application
  ↓
Database

while security and networking operate around those components:

                IAM
                 │
                 ▼
Application ──── RDS
    │
    ├── Security Groups
    │
    ├── Route Tables
    │
    ├── NACLs
    │
    └── VPC Endpoint ─── S3

When you start thinking in terms of traffic flow, trust boundaries, routing, and authorization, AWS architecture becomes much easier to reason about.

28. Final Takeaway

You don't need to memorize every AWS service to start understanding cloud architecture.

Start with one question:

"Where does the request come from, where does it go, and what controls it along the way?"

From that one question, many AWS concepts become connected:

Request
   │
   ▼
DNS
   │
   ▼
Internet
   │
   ▼
Internet Gateway
   │
   ▼
Public Subnet
   │
   ▼
Load Balancer
   │
   ▼
Private Subnet
   │
   ▼
Application
   │
   ├──────────► RDS
   │
   ├──────────► S3 through VPC Endpoint
   │
   └──────────► Internet through NAT Gateway

And around that traffic flow:

Route Tables
Security Groups
Network ACLs
IAM

work together to control where traffic goes, what traffic is allowed, and what an identity is permitted to do.

That is the AWS architecture mental model I wish I had when I first started learning cloud.

What I Would Add to the Architecture Next

This article intentionally focuses on the networking foundation.

Once this mental model is clear, you can extend the architecture with:

AWS WAF
CloudFront
Auto Scaling
ECS/EKS
Lambda
SQS
EventBridge
CloudWatch
AWS Secrets Manager
AWS KMS
CI/CD
Terraform
Multi-region architecture

But don't put everything into the first diagram.

A good architecture diagram should explain a system, not display every AWS service you know.

A Final Note

This article is based on my current understanding of AWS networking and architecture as a Cloud/DevOps engineer.

I'm still learning, and that's exactly why I wanted to explain these concepts from the perspective of someone who is learning how individual AWS services connect to form a complete system.

If this helped you understand AWS architecture a little better, feel free to share it with someone who is learning AWS.

Happy building! ☁️

Getting Started with Kiro as a DevOps Engineer

Naami Ahmed — Sun, 10 May 2026 13:27:09 +0000

Artificial Intelligence is rapidly changing modern software engineering. Today, developers are no longer using AI only for code completion. Instead, AI tools are becoming engineering assistants that help with planning, debugging, architecture, automation, and project workflows.

Recently, I started exploring Kiro, an AI-powered development environment focused on structured and agentic software engineering workflows. As someone interested in Cloud and DevOps engineering, I wanted to understand how Kiro could help with real-world development tasks such as CI/CD, deployment automation, cloud infrastructure, and production-style workflows.

In this article, I’ll share my first experience with Kiro, what I explored, and why I think tools like this are becoming important for modern developers.

What is Kiro?

Kiro is an AI-powered IDE and engineering assistant designed to support developers throughout the software development lifecycle.

Unlike traditional AI coding assistants that mainly focus on autocomplete or generating small code snippets, Kiro focuses on a more structured engineering workflow.

Kiro can help developers with:

Requirement understanding
Project planning
Code generation
Architecture guidance
Workflow organization
Deployment-related tasks
Debugging support
Multi-step development assistance
Engineering documentation
Automation ideas

This makes Kiro feel more like a development partner instead of only an autocomplete tool.

Why I Started Exploring Kiro

As a DevOps and cloud-focused engineer, I usually work with technologies and workflows such as:

AWS services
Docker containers
GitHub Actions
Linux environments
CI/CD pipelines
Nginx reverse proxy configurations
Deployment automation
Full-stack application deployments

Modern DevOps projects are not only about writing code. They also involve:

Infrastructure setup
Deployment planning
Automation workflows
Monitoring
Debugging
System architecture decisions

Because of this, I wanted to explore whether Kiro could support engineering workflows beyond basic code generation.

My Current Development Setup

For my experiments with Kiro, I used the following environment:

Development Tools
Kiro IDE
VS Code
GitHub
Docker Desktop
Linux terminal environment
Cloud & DevOps Tools
AWS EC2
AWS IAM
AWS Lambda
Docker containers
GitHub Actions
Nginx
Languages & Frameworks
React
Node.js
JavaScript
Bash scripting

This setup helped me test Kiro in realistic cloud and deployment-related scenarios.

My First Use Cases with Kiro

After setting up Kiro, I started experimenting with several common DevOps and cloud engineering tasks.

1. Dockerfile Generation

I tested Kiro by asking it to generate Docker configurations for frontend and backend applications.

It helped with:

Dockerfile structure
Base image suggestions
Dependency installation
Port exposure
Container optimization ideas

This was useful because containerization is one of the most common workflows in DevOps projects.

2. CI/CD Workflow Assistance

I also experimented with GitHub Actions workflow generation.

Kiro helped generate ideas for:

Build pipelines
Docker image creation
Deployment steps
Environment variable handling
Automated workflows

This was interesting because CI/CD pipelines can become complex when projects scale.

3. Deployment Workflow Planning

I tested Kiro with deployment-related prompts such as:

Deploying applications to AWS EC2
Nginx reverse proxy setup
Docker-based deployment architecture
Multi-service deployment flow ideas

Instead of only generating commands, Kiro tried to provide more structured workflow guidance.

4. Debugging Support

I also experimented with debugging scenarios.

Examples included:

Docker issues
Deployment errors
Configuration mistakes
CI/CD workflow problems

Kiro helped identify possible causes and suggested improvements step by step.

What I Like About Kiro

After spending some time exploring Kiro, a few things stood out to me.

Engineering-Focused Workflow

One of the biggest differences I noticed is that Kiro focuses on engineering workflows instead of only code completion.

This is important because real-world software projects involve:

planning
architecture
deployment
debugging
automation
documentation

not just writing code.

Structured Development Assistance

Kiro tries to guide development in a more organized way.

For example:

understanding project goals
breaking tasks into steps
suggesting workflow improvements
helping organize implementations

This feels closer to real software engineering practices.

Useful for DevOps Learning

As someone learning and working with DevOps workflows, I found Kiro useful for:

deployment planning
automation ideas
Docker workflows
CI/CD generation
infrastructure thinking

AI-assisted workflows can help learners understand engineering processes faster.

Multi-Step Workflow Thinking

Another interesting part is that Kiro does not only focus on a single prompt-response cycle.

Instead, it attempts to support:

continuous workflows
project context
implementation planning
iterative improvements

This feels more practical for larger projects.

Challenges and Learning Curve

Since I recently started exploring Kiro, I’m still learning how to fully utilize its capabilities.

Some challenges I noticed include:

Learning effective prompting
Understanding workflow patterns
Verifying generated outputs
Adapting AI suggestions to real projects
Integrating AI assistance into existing workflows

Like all AI tools, developer knowledge is still important. AI-generated solutions should always be reviewed and validated before production use.

How I Plan to Use Kiro Next

I’m planning to continue exploring Kiro with more practical DevOps and cloud engineering projects.

Some areas I want to test further include:

AWS deployment workflows
Infrastructure automation
CI/CD optimization
Docker orchestration
Monitoring workflows
Cloud-native applications
AI-assisted architecture planning

I also hope to create more technical content and share my learning journey with the developer community.

Final Thoughts

My journey with Kiro is still at an early stage, but my first experience has been positive so far.

What makes Kiro interesting to me is its focus on structured engineering workflows rather than simple code autocomplete.

For cloud engineers, DevOps learners, and full-stack developers, tools like Kiro may become very useful for:

improving productivity
understanding workflows
automating repetitive tasks
organizing projects
accelerating learning

As AI-assisted engineering continues to evolve, it will be exciting to see how tools like Kiro shape the future of software development.

AWS Student Community Day Sri Lanka 2026 - Event Recap

Naami Ahmed — Thu, 30 Apr 2026 17:29:37 +0000

AWS Student Community Day is a one day, student led conference, organized by AWS Cloud Clubs for the community. It is a great way to bringing an AWS conference into your university.

AWS Student Community Day Sri Lanka 2026 was co-organized by AWS Cloud Club at University of Kelaniya and AWS Cloud Club at ITUM. The event had 14 speakers and over 200 student attendees. It was a full day of community building and learning for the students.

I created this article based on how we prepared to host this event.

The approach I took was first I made an organizing committee of student enthusiast who would like to work towards this event. The first OC meeting was taken 45 days before the planned event day.

Web page

This is one of the first things you are going to need. It's up to you whether you create your own or use some template. We used a template from AWS Community Day China and asked lovable to generate a similar one. Then we customized it to our needs.

Registation

We used to local ticketing platform called MyTickets to track registrations and generate QR codes for attendees.

Call for speakers and sponsors

We used two google forms, one for speakers and the other for sponsors to call for them. We attached the sponsorship prospectus in the form calling for sponsors.

Based on my past experience hosting events, I learnt that each member in a team needs to know their responsibilities clearly. To ensure this, I created a document laying out the responsibilities that each role would have before I called in for applications for the OC. In this way every team member was aware of their responsibilities.

We took meetings each week and made a plan for the following week.

Free or paid

The community day organizers are always dealing with this one... and there is no right or wrong way. Both have pros and cons.

Paid Event - Even symbolic price can reduce the no-shows (ratio between registered and the ones that actually showed-up) and increase the budget you get. But there is a chance you have to pay taxes, as you are creating the profit.

Free Event - Prepare yourself for a no-shows... 😬 It's frustrating, but it is what is is.

We decided to go with paid.

All being said, organizing AWS Student Community Day was a lot of fun, but also lots of hard work went into it. It took us 3 months of work, from idea that we are doing that, to the actual event.

If you are still thinking if to do it or not - by all means we say Yes, go for it! 😉

How to Prevent Unnecessary Charges on AWS: Free Billing Alerts for Beginners

Naami Ahmed — Fri, 14 Nov 2025 15:15:34 +0000

Introduction

AWS is one of the most popular cloud platforms, but beginners often get surprised by unexpected charges. Luckily, AWS provides free tools to monitor your spending and prevent unnecessary costs. In this article, we will guide you step by step to set up free billing alerts, understand usage limits, and stay safe while learning AWS.

Target Audience: Beginners who want to avoid surprises in their AWS billing.

Step 1: Enable AWS Billing Alerts (Free)

Before creating alerts, you must enable billing alerts in your account. This allows AWS to track your usage and send notifications if you approach your free tier or budget limits.

Steps:

Log in to AWS Management Console.
Go to Billing & Cost Management → Billing Preferences.

Tick:

Receive Free Tier Usage Alerts – This sends alerts when you are nearing the free tier limits, so you can avoid accidental charges.

Click Save to activate this alert.

Step 2: Create an AWS Budget Alert (Free)

The AWS Budget feature allows you to define a spending limit and get email notifications when your usage reaches specific thresholds. This gives beginners more control and peace of mind while learning.

Steps:

Go to Billing → Budgets → Create Budget.
Choose Cost Budget and set your monthly limit (for example, $2 USD). This is the maximum you are willing to spend in a month.
Add alert thresholds to receive notifications at 50%, 80%, and 100% of your budget. Each alert warns you before reaching the full limit.
Add your email address for notifications and click Save.

Tip: Always use email notifications, as SMS alerts may incur small charges.

Step 3: Enable Cost Explorer (Optional, Free)

AWS Cost Explorer helps you visualize your spending over time. By tracking daily usage and costs, you can better understand which services may contribute to charges and make adjustments before they become an issue.

Steps:

Go to Billing → Cost Explorer.
Click Enable to activate the tool. Once enabled, you can view your usage in graphs and tables.

Safe to use (Free):

IAM (users & permissions) – Manage access without creating cost.

Billing dashboard & CloudWatch billing alerts – Free tools to monitor your usage.

AWS Budgets & Cost Explorer – Tools to track spending and visualize data for free.

Additional Tips to Stay Safe

Regularly check Free Tier usage: Even small services can exceed limits if forgotten. Monitoring usage helps avoid surprises.
Use tags to track resources: Tags make it easy to identify and manage resources, especially if you try multiple services at once.
Delete resources you are not using: Unused resources, like instances or storage, can lead to unexpected charges.
Monitor daily billing with Cost Explorer: Keeping an eye on daily costs helps you react before reaching your budget.
Set low budgets initially: Beginners can start with $1–$2 per month to test alerts and get familiar with AWS billing.

Conclusion

Setting up AWS billing alerts is simple, free, and essential for beginners. By combining budget alerts, free tier alerts, and monitoring tools, you can confidently explore AWS without worrying about unexpected charges. Adding screenshots and visuals in your article or video will make these steps even clearer and more engaging for beginners.

🎮 Building a Mini Tic-Tac-Toe Game Using Amazon Q Developer and Python

Naami Ahmed — Mon, 10 Nov 2025 14:51:56 +0000

Introduction

Artificial Intelligence (AI) is becoming more accessible for developers to integrate into their projects. Amazon Q Developer is a powerful AI coding assistant from AWS that helps developers generate, debug, and improve code directly inside their IDE.

In this article, I’ll walk you through a practical example: creating a mini Tic-Tac-Toe game in Python using Amazon Q Developer. This will give you hands-on experience with AI-assisted coding while exploring how AWS’s developer tools work.

🧠 What is Amazon Q Developer?

Amazon Q Developer is an AI-powered coding assistant integrated into IDEs like VS Code.
It helps developers by:

Generating or explaining code.
Suggesting fixes or optimizations.
Improving documentation and refactoring logic.

It’s part of AWS’s effort to make development more intelligent and cloud-ready.
You can also use Amazon Q Business (for enterprise workflows) or Q Developer (for coding).

Free Usage: The Developer (Free) tier gives you full AI assistance inside VS Code without any extra cost — perfect for personal learning or experiments.

⚙️ Step 1: Environment Setup

Install Python 3.10+ on your computer.
Install VS Code.
Add the Amazon Q Developer extension in VS Code.
Sign in using your AWS Builder ID.
Create a project folder:

TicTacToe-Q

Create a file named:

main.py

💻 Step 2: Writing a Simple Tic-Tac-Toe Game

Start with a simple console-based Python version (If you want, you can start the code generation using Amazon Q):

import tkinter as tk
import random

# --- Basic Setup ---
root = tk.Tk()
root.title("Tic Tac Toe - Amazon Q AI")
root.configure(bg='#2c3e50')
root.geometry('400x500')

# Game variables
board = [""] * 9
player = "X"
game_active = True

# --- AI Functions ---
def ai_move():
    # Try to win
    for i in range(9):
        if board[i] == "":
            board[i] = "O"
            if check_winner() == "O":
                return i
            board[i] = ""

    # Block player from winning
    for i in range(9):
        if board[i] == "":
            board[i] = "X"
            if check_winner() == "X":
                board[i] = ""
                return i
            board[i] = ""

    # Take center if available
    if board[4] == "":
        return 4

    # Take corners
    corners = [0, 2, 6, 8]
    available_corners = [i for i in corners if board[i] == ""]
    if available_corners:
        return random.choice(available_corners)

    # Take any available spot
    available = [i for i in range(9) if board[i] == ""]
    return random.choice(available) if available else None

# --- Functions ---
def check_winner():
    wins = [(0,1,2),(3,4,5),(6,7,8),(0,3,6),(1,4,7),(2,5,8),(0,4,8),(2,4,6)]
    for a,b,c in wins:
        if board[a] == board[b] == board[c] != "":
            return board[a]
    if "" not in board:
        return "Draw"
    return None

def show_winner_overlay(winner):
    if winner == "Draw":
        winner_overlay.config(text="🤝 It's a Draw!", fg='#95a5a6')
    else:
        symbol = "🎉" if winner == "X" else "🤖"
        player_name = "You" if winner == "X" else "AI"
        color = '#e74c3c' if winner == 'X' else '#f39c12'
        winner_overlay.config(text=f"{symbol} {player_name} ({winner}) Wins!", fg=color)
    winner_overlay.place(relx=0.5, rely=0.4, anchor='center')
    restart_overlay_btn.place(relx=0.5, rely=0.55, anchor='center')
    reset_button.grid_remove()

def reset_game():
    global board, player, game_active
    board = [""] * 9
    player = "X"
    game_active = True
    winner_overlay.place_forget()
    restart_overlay_btn.place_forget()
    reset_button.grid(row=5, column=0, columnspan=3, pady=15)
    for btn in buttons:
        btn.config(text="", bg='#34495e', fg='white')
    status_label.config(text="Your Turn (X)", fg='#3498db')

def update_button_color(btn, symbol):
    if symbol == "X":
        btn.config(fg='#e74c3c', bg='#ecf0f1')
    else:
        btn.config(fg='#f39c12', bg='#ecf0f1')

def click_button(i):
    global player, game_active
    if board[i] == "" and game_active and player == "X":
        board[i] = player
        buttons[i].config(text=player)
        update_button_color(buttons[i], player)

        winner = check_winner()
        if winner:
            game_active = False
            show_winner_overlay(winner)
            return

        # AI turn
        player = "O"
        status_label.config(text="AI is thinking...", fg='#f39c12')
        root.after(500, ai_turn)

def ai_turn():
    global player, game_active
    if game_active:
        move = ai_move()
        if move is not None:
            board[move] = "O"
            buttons[move].config(text="O")
            update_button_color(buttons[move], "O")

            winner = check_winner()
            if winner:
                game_active = False
                show_winner_overlay(winner)
                return

            player = "X"
            status_label.config(text="Your Turn (X)", fg='#3498db')

# --- Create UI ---
title_label = tk.Label(root, text="🎮 Tic Tac Toe AI", font=("Arial", 18, "bold"), 
                      bg='#2c3e50', fg='#ecf0f1')
title_label.grid(row=0, column=0, columnspan=3, pady=10)

buttons = []
for i in range(9):
    btn = tk.Button(root, text="", width=6, height=3, font=("Arial", 24, "bold"),
                    bg='#34495e', fg='white', relief='raised', bd=3,
                    command=lambda i=i: click_button(i))
    btn.grid(row=i//3+1, column=i%3, padx=5, pady=5)
    buttons.append(btn)

status_label = tk.Label(root, text="Your Turn (X)", font=("Arial", 16), 
                       bg='#2c3e50', fg='#3498db')
status_label.grid(row=4, column=0, columnspan=3, pady=10)

reset_button = tk.Button(root, text="🔄 New Game", font=("Arial", 12, "bold"),
                        bg='#27ae60', fg='white', relief='raised', bd=2,
                        command=reset_game)
reset_button.grid(row=5, column=0, columnspan=3, pady=15)

# Winner overlay (hidden initially)
winner_overlay = tk.Label(root, text="", font=("Arial", 20, "bold"),
                         bg='#2c3e50', relief='solid', bd=2, padx=20, pady=10)

# Restart button for winner overlay (hidden initially)
restart_overlay_btn = tk.Button(root, text="🔄 Play Again", font=("Arial", 12, "bold"),
                               bg='#e67e22', fg='white', relief='raised', bd=2,
                               command=reset_game)

root.mainloop()

Run this code (click Run ▶️ at the top or press F5) once to make sure it works fine.

💻 Step 4: Installing Amazon Q in VS Code

Before starting your project, you need the Amazon Q Developer extension in VS Code:

Open VS Code.
Go to the Extensions panel (click the square icon on the left sidebar or press Ctrl + Shift + X). 3.In the search bar, type:

Amazon Q Developer

Click Install on the extension.
After installation, sign in using your AWS Builder ID (or create one if you don’t have it). 6.You’ll now see the Amazon Q panel on the side of VS Code. This is where you can:

Chat with Amazon Q.
Generate or improve code.
Ask for explanations of your Python scripts.

✅ Now your VS Code is ready to use Amazon Q for interactive AI coding.

🤖 Step 4: Using Amazon Q to Improve the Game

Now that your base version works, let’s make it more advanced using Amazon Q.

Inside VS Code:
Open Amazon Q Chat (Ctrl + Shift + P → Amazon Q: Chat).
Ask questions like:

“Convert this Tic-Tac-Toe game to GUI using Tkinter.”
“Add AI logic so the computer can play automatically.”
“Refactor this into object-oriented Python code.”

Amazon Q will generate improved snippets or even a full new version of your code.
You can directly replace or merge suggestions.

🚀 Conclusion

Amazon Q Developer is a promising tool from AWS that brings AI into your coding workflow.
While it may seem a little complex to set up, it offers great educational value — especially for those who plan to grow their skills in the AWS ecosystem.

Starting with a small project like Tic-Tac-Toe is a fun and practical way to understand how AI-assisted coding can help you improve your logic, refactor code, and experiment confidently.

Keep exploring — and maybe your next project could integrate AWS Lambda or DynamoDB with your game! ☁️🎮

Thank You for Reading 🙌🙌🙌

[Boost]

Naami Ahmed — Thu, 02 Oct 2025 02:34:28 +0000

Become an AWS Cloud Club Captain – Sri Lanka 2025

Naami Ahmed ・ Oct 1

#webdev #programming #productivity #beginners

Become an AWS Cloud Club Captain – Sri Lanka 2025

Naami Ahmed — Wed, 01 Oct 2025 13:33:53 +0000

Cloud is shaping the future of technology, and students around the world are stepping up to lead this change. The AWS Cloud Club Captain program is an initiative by Amazon Web Services that empowers students to build and grow their own tech communities. As a Captain, you don’t just learn cloud — you share knowledge, organize events, and become the face of AWS on your campus.

For students in Sri Lanka, this is a chance to stand out as a leader in the growing cloud ecosystem and open doors to new opportunities.

📅 Application Deadline

The application deadline has been extended to October 6th, 2025. If you are passionate about technology, leadership, and community building, now is the best time to apply.

Who Can Apply?

To be eligible for the program, you must be:

A university or institute student who is currently enrolled.
Someone who will graduate after October 2026.
Interested in leadership, community building, and cloud technologies.

The program is designed for students who want to go beyond personal learning and create a bigger impact by supporting peers and driving cloud adoption on campus.

Why Become a Cloud Club Captain?

Being a Captain is more than just a title. It’s an opportunity to grow your technical and leadership skills while connecting with a global network of students and professionals.

Some of the key benefits include:

AWS Certification Vouchers: Captains receive exam vouchers to pursue industry-recognized AWS certifications.
AWS Credits: Hands-on learning is supported through credits to explore AWS services.
Recognition Badges: Captains can earn Bronze, Silver, Gold, and Platinum badges as they progress and achieve milestones.
Networking Opportunities: Gain access to AWS experts, professionals, and other captains worldwide.
Leadership Development: From organizing workshops to leading hackathons, you will build skills that strengthen both your resume and confidence.

The value of this program is not just in the resources, but in the real-world leadership experience and the strong community connections you build along the way.

Application Process

The application is designed to help AWS understand your passion, leadership potential, and vision. It consists of three main parts:

Written Application
You will be asked to answer questions about your background, leadership journey, and ideas for growing a student cloud community. This is your chance to share your story and vision.
Video Submission
A short (2–3 minute) video introducing yourself and explaining why you want to become a Cloud Club Captain. Keep it natural, authentic, and enthusiastic.
Faculty Support Letter
A recommendation letter from a faculty member is required to confirm your suitability and support your application.

After preparing these, you can submit them directly through the AWS Cloud Club Captain application portal.

Why This Matters for Sri Lanka

Sri Lanka’s tech landscape is growing rapidly, and cloud skills are in high demand. Programs like AWS Cloud Clubs give students the platform to gain skills, share knowledge, and contribute to the country’s future workforce.

Captains play a vital role in this ecosystem — bringing together students, organizing events, and creating opportunities that go beyond the classroom. By stepping into this role, you are not only helping yourself, but also shaping the next generation of cloud leaders in Sri Lanka.

Final Thoughts

If you’re a student graduating after October 2026, this is your opportunity to take the lead and make an impact. The AWS Cloud Club Captain program combines learning, leadership, and community in one platform.

📅 Deadline: October 6th, 2025
📹 Watch my application video here: https://youtu.be/VbGNlV9Mqog?si=Zfgv627rbSNIq6qy
🔗 Apply here: https://pulse.aws/application/TAWKU3CJ?p=0

Let’s build the future of cloud in Sri Lanka, together. 🚀

How to Host a Static Website on AWS S3 — Complete Step-by-Step Guide

Naami Ahmed — Tue, 01 Jul 2025 13:30:58 +0000

Hosting a website no longer requires a complex server setup or expensive infrastructure. If you’re looking for a quick, reliable, and low-cost way to publish your HTML/CSS/JavaScript site, then Amazon S3 is your best friend. In this article, I’ll guide you through the complete process of hosting a static website on AWS S3, and we’ll also include a live demo at each key step to make things easy to follow.

** What is Amazon S3?**
Amazon Simple Storage Service (S3) is a highly scalable object storage service offered by AWS. It allows you to store and retrieve any amount of data from anywhere on the internet. From backups and application data to static websites and image hosting, S3 is a powerful tool used by developers and businesses worldwide.

With built-in redundancy, versioning, encryption, and fine-grained access control, S3 is more than just a file storage system — it’s an enterprise-level solution. For this article, we’ll focus on one of its most practical features: hosting static websites.

🌍** Why Use S3 to Host a Website?**
There are many reasons why S3 is perfect for hosting static sites:

No server management: You don’t need to worry about Apache, Nginx, or scaling.
Highly reliable and durable: 99.999999999% durability ensures your files are safe.
Cheap or even free (with the AWS Free Tier).
Fast performance, especially when combined with AWS CloudFront (CDN).
Perfect for portfolios, landing pages, resumes, and documentation websites.

🛠️ Prerequisites
Before you begin, make sure you have the following:

A working AWS account (the free tier is sufficient).
A static website ready to upload. This could be your personal portfolio or a sample HTML/CSS project.
IAM (Identity and Access Management) user credentials — avoid using the root account for safety.
🧭 Overview: 5 Key Steps to Host a Website on S3
Here’s what we’ll be doing in this tutorial:

Create an S3 bucket
Upload the website files
Enable public access
Set a bucket policy
Enable static website hosting Let’s dive in.

📦 Step 1: Create an S3 Bucket
After logging in to your AWS Management Console, search for S3 using the top search bar. Click on the S3 service and then click the “Create bucket” button.

You’ll be prompted to enter a unique bucket name (bucket names must be globally unique). Choose your preferred AWS region (like Asia Pacific — Mumbai) and leave most settings at their default.

Click Create bucket, and you’re done! You’ve just created a cloud storage container that will hold your website files.

📁 Step 2: Upload Website Files
Next, open your newly created bucket and click on the “Upload” button. You’ll need to upload your static website files — typically index.html, along with folders for CSS, images, and JavaScript.

It’s important to keep your folder structure consistent so your site behaves the same after upload. Start by uploading the root-level files (like index.html), then add folders like /css, /img, or /js.

Once all files and folders are selected, click Upload and wait until the upload succeeds.

🔓 Step 3: Enable Public Access
By default, all files and buckets in S3 are private. To allow users to access your website, you must enable public access to the bucket.

To do this, go to the Permissions tab of your bucket. Click Edit under “Block public access,” uncheck “Block all public access,” and then confirm your change. AWS may prompt you to type a confirmation statement to avoid accidental misconfiguration.

Once this is saved, your bucket is now publicly accessible — but we still need to set permissions for each file. That’s where the next step comes in.

📝 Step 4: Set a Bucket Policy
Now let’s configure a bucket policy — a JSON-based configuration that defines who can access your bucket and what actions they can perform.

In the Permissions tab, scroll down to Bucket policy, click Edit, and paste this policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::your-bucket-name/*"
    }
  ]
}

Make sure to replace "your-bucket-name" with your actual bucket name. This policy gives the public read-only access to all files in your bucket — exactly what we need for a static website.

Save the policy to apply the settings.

🌐 Step 5: Enable Static Website Hosting
Now for the final touch — let’s tell AWS to serve this bucket as a website.

Go to the Properties tab of your bucket and scroll down to find Static website hosting. Click Edit, then enable the setting.

You’ll need to provide the name of your entry file, usually index.html. You can leave the error document field empty or add error.html if your site has one.

Click Save changes, and AWS will generate a public URL for your website in the format:

ttp://your-bucket-name.s3-website.region.amazonaws.com/
Open this link in your browser — and voila! Your website is live and accessible to the world.

🏁 Final Result
At this point, you’ve completed all the essential steps to host a website on Amazon S3:

You created a secure bucket
Uploaded all required files
Set public access and policies
Enabled static website hosting
Received a live link to your project
You can now share this link with clients, friends, or on your resume. And next time someone asks how to host a simple website, you’ll be ready!

💡 Pro Tips (Optional but Helpful)
Use IAM roles instead of root access for better security and monitoring.
Enable versioning on your bucket to track changes and recover deleted files.
Connect a custom domain via Route 53, and add CloudFront for global speed boost.
If needed, create CI/CD pipelines to auto-upload files using GitHub Actions or AWS CLI.

⚠️ What Happens to Your AWS RDS Instances After Account Suspension? Author: Naami Ahmed

Naami Ahmed — Fri, 27 Jun 2025 04:38:29 +0000

Have you ever wondered what happens to your AWS resources if your account gets suspended—especially your RDS databases?

Recently, I encountered a situation where an AWS account was suspended due to billing issues. After reactivation, some services were still there—like EC2 and VPC—but surprisingly, the RDS database instances were missing. This led me to investigate why RDS behaves differently from other services during suspension.

In this blog post, I’ll explain what I learned, how RDS is treated differently, and what you can do to protect your data.

🔍 AWS Account Suspension: What Actually Happens?
When AWS suspends your account—usually because of unpaid bills—it restricts your access to most services. However, not all resources behave the same way.

Let’s break it down:

✅ EC2 and VPC Resources

EC2 instances are stopped, not terminated.
VPC configurations (like subnets, route tables, security groups) remain intact.
After reactivating the account, EC2 instances can be restarted manually—or automatically if configured.

So far, so good.

⚠️ RDS Resources (The Catch)

Amazon RDS (Relational Database Service) behaves differently from EC2. Here’s what I found:
RDS is fully managed, meaning AWS handles the infrastructure, maintenance, and operations.
During account suspension, AWS may automatically delete RDS instances, typically within 3–7 days of the suspension.
There’s no fixed public retention policy from AWS for RDS after suspension.
AWS might delete these instances earlier to free up storage and reduce management cost, since databases require persistent storage and monitoring.

This behavior can lead to permanent data loss if you’re not prepared.

💾 Can You Recover the Deleted RDS Database?
Yes—but only if you had backups. There are two ways this could save you:

Automated Backups: If you enabled automated backups, AWS retains daily backups for a defined retention period (usually 7–35 days).
Manual Snapshots: If you manually created DB snapshots, you can restore from them any time.

When you restore from a backup or snapshot, a new RDS instance is created, and that means:

➡️ The database endpoint (URL) changes.
➡️ All connected apps must be updated with the new endpoint.

If you don’t have any backups or snapshots? Unfortunately, there’s no way to recover the data.

🔐 Best Practices to Avoid RDS Surprises
To stay safe and avoid losing your databases, follow these tips:

1. Enable Automated Backups
Make sure every RDS instance has automated backups turned on with a suitable retention period.

2. Take Regular Manual Snapshots
Automated backups can disappear after account issues. Snapshots are manual and can be kept longer—even after deletion of the instance.

**3. Use CloudWatch Billing Alerts
**Set up AWS Billing alerts to get notified when your usage charges increase or when you’re at risk of suspension.

**4. Keep a Recovery Checklist
**When recovering from account suspension or restoring a DB:

Confirm that backups exist.
Note the new endpoint.
Update connection strings in your applications.

5. Document Your Incident Recovery Plan
Have a disaster recovery plan ready—especially if your app depends heavily on RDS. A simple document can save hours of troubleshooting.

Nginx Configuration on AWS EC2 Deployment

Naami Ahmed — Sun, 13 Apr 2025 15:42:56 +0000

This guide explains how to configure an EC2 instance, install Nginx, and set up auto deployment using GitHub Actions for a UAT environment.

✅ 1. Create EC2 Instance
Steps:

Login to AWS Console → Go to EC2 Dashboard.
Launch Instance → Choose Amazon Linux 2 as your OS.
Configure basic settings like name, instance type, and network settings.
Create/Use Key Pair → This key will be used later for SSH connection.

In the Security Group, allow:

Port 22 (SSH): For connecting remotely to EC2.
Port 80 (HTTP): For regular web traffic.
Port 443 (HTTPS): For secure (SSL) web traffic.

📌 Explanation:
Security groups act like a firewall. Opening ports allows your instance to communicate with the internet properly.

🔐 2. Connect to EC2 via SSH
Windows Users (PowerShell using OpenSSH):

ssh -i "path/to/your-key.pem" ec2-user@<your-ec2-public-ip>

📌 Explanation:
This command connects your local computer to the EC2 instance using the .pem key. You need this to log in securely.

⚙️ 3. Install and Configure Nginx
For Amazon Linux 2:

sudo yum update -y
sudo amazon-linux-extras enable nginx1
sudo yum install nginx -y

For Ubuntu:

sudo apt update && sudo apt install nginx -y

Start Nginx:

sudo systemctl start nginx
sudo systemctl enable nginx

🧪 Check Nginx:
Open a browser and visit http://<your-ec2-public-ip> – You should see the default Nginx welcome page.

📌 Explanation:
Nginx is a web server used to serve your frontend app. We’re installing and starting it here.

🛠️ 4. Configure Nginx to Serve Your App
Create New Config File:

sudo nano /etc/nginx/conf.d/app-proxy.conf

Sample Config (Generic):

server {
    listen 80;
    server_name your-subdomain.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name your-subdomain.example.com;
    root /usr/share/nginx/html/your-app-folder;
    index index.html;

    location / {
        try_files $uri /index.html;
    }

    error_page 404 /404.html;

    ssl_certificate /etc/letsencrypt/live/your-domain/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your-domain/privkey.pem;
}

📌 Explanation:

First block: Redirects HTTP to HTTPS.
Second block: Serves the app using SSL (HTTPS).
root: The directory where your built frontend app files are copied.
try_files $uri /index.html: This is for frontend routing support (like React or Angular apps).
SSL certs are from Let's Encrypt (set up using Certbot separately).

Test and Restart Nginx:

sudo nginx -t
sudo systemctl restart nginx

🚀 5. Auto Deployment Using GitHub Actions

Steps:

In your GitHub repo, create folder: .github/workflows/
Inside it, add a file: deploy-uat.yml
GitHub Actions Example:

name: Deploy Frontend App to EC2 with Nginx

on:
  push:
    branches:
      - deploy

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v3
        with:
          node-version: 20

      - name: Install Dependencies
        run: npm ci --legacy-peer-deps

      - name: Build App
        env:
          CI: false
        run: |
          npm run build
          ls -l build/

      - name: Archive Build Folder
        run: tar -czf build.tar.gz -C build .

      - name: Deploy to EC2
        run: |
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > my-key
          chmod 600 my-key
          scp -i my-key -o StrictHostKeyChecking=no build.tar.gz ec2-user@<EC2_PUBLIC_IP>:/usr/share/nginx/html/your-app-folder/

      - name: Extract Build on EC2
        run: |
          ssh -i my-key -o StrictHostKeyChecking=no ec2-user@<EC2_PUBLIC_IP> << EOF
            cd /usr/share/nginx/html/your-app-folder/
            if [ -f build.tar.gz ]; then
              tar -xzf build.tar.gz
              rm build.tar.gz
              echo "Deployment successful!"
            else
              echo "Error: build.tar.gz not found!"
              exit 1
            fi
          EOF

📌 Explanation:

Trigger: Runs when you push to the deploy branch.
Build: Installs dependencies and builds the frontend app.
Archive: Compresses the build files.
Upload: Sends the files to the EC2 server using scp.
Extract: Unzips files on EC2 to serve them with Nginx.

🔐 Use GitHub Secrets:
To avoid hardcoding private keys, store them as GitHub repository secrets like SSH_PRIVATE_KEY.

🧪 6. Test Auto Deployment

Make a small change in your frontend code.
Push to deploy branch.
Check GitHub → Actions tab to monitor the workflow.
Visit your subdomain or EC2 public IP to confirm the changes are live.

Automating AWS RDS Management Using IAM, Lambda, CloudWatch, and EventBridge

Naami Ahmed — Sun, 09 Mar 2025 08:30:29 +0000

Introduction

In cloud computing, cost and resource optimization are critical for efficient infrastructure management. AWS provides various services that help automate database management, enhance security, and ensure high availability. This article explores how to automate Amazon RDS instance management using AWS IAM, Lambda, CloudWatch, and EventBridge. We will walk through a common scenario, benefits, and implementation steps.

Common Scenario: Managing RDS Instance Availability

Many organizations use Amazon RDS for databases, but keeping instances running 24/7 can be costly. To optimize costs, businesses prefer running their RDS instances only during business hours. This scenario requires:

Starting RDS at 6 AM IST (before business hours begin).
Stopping RDS at 6 PM IST (after business hours end).
Automating the process to avoid manual intervention.
Monitoring performance and logs to track execution and troubleshoot issues.

Workflow

1. IAM (Identity and Access Management)IAM is used to define permissions for the Lambda function to start and stop RDS instances securely.

2. Lambda (Serverless Compute Function)AWS Lambda helps execute the function that starts and stops RDS instances based on a predefined schedule.

3. CloudWatch (Monitoring and Logging)CloudWatch is used to capture logs, monitor execution, and track failures.

4. EventBridge (Automated Scheduling)Amazon EventBridge (formerly CloudWatch Events) triggers the Lambda function based on a cron schedule, ensuring automation.

Workflow: Automating RDS Start and Stop

Create an IAM Role for Lambda with permissions to start and stop RDS instances.
Write a Lambda Function to check the time and perform the necessary action (start/stop RDS).
Set Up EventBridge Rules to schedule the function execution (6 AM IST & 6 PM IST).
Monitor Execution Logs using CloudWatch to ensure proper functioning.

Step-by-Step Implementation

Step 1: Create an IAM Role for Lambda

1. Go to the AWS IAM Console.
2. Create a new role with the following policies
3. AmazonRDSFullAccess (or custom policy with StartDBInstance & StopDBInstance permissions).
4. AWSLambdaBasicExecutionRole (for CloudWatch logging)
5. Attach this role to the Lambda function.

Step 2: Write the Lambda Function
This function will:

Fetch the current time in IST.
Determine if it’s a weekday and within working hours.
Start or stop the RDS instance accordingly

import boto3
import datetime
from dateutil import tz
import logging
import os
# Configure logging
logging.basicConfig(level=logging.INFO)
# AWS RDS Client
region = os.getenv("AWS_REGION", "us-east-1")  # Default to 'us-east-1' if not set
rds = boto3.client('rds', region_name=region)
# Configurable Tags (Default: Empty Dict)
REQUIRED_TAGS = {
    os.getenv("TAG_KEY", "Environment"): os.getenv("TAG_VALUE", "Production")
}
# Configurable Timezone (Default: UTC)
TIMEZONE = tz.gettz(os.getenv("TIMEZONE", "UTC"))
def get_tagged_rds_instances():
    """Fetches RDS instances with required tags."""
    try:
        instances = rds.describe_db_instances()['DBInstances']
        tagged_instances = []
for db in instances:
            tags = rds.list_tags_for_resource(ResourceName=db['DBInstanceArn'])['TagList']
            tag_dict = {tag['Key']: tag['Value'] for tag in tags}
# Check if all required tags match
            if all(REQUIRED_TAGS[key] == tag_dict.get(key, "") for key in REQUIRED_TAGS):
                tagged_instances.append(db['DBInstanceIdentifier'])
return tagged_instances
    except Exception as e:
        logging.error(f"Error fetching RDS instances: {str(e)}")
        return []
def lambda_handler(event, context):
    """Lambda function to start/stop RDS based on time and day."""
    now = datetime.datetime.now(tz=TIMEZONE)
    current_hour = now.hour
    current_day = now.weekday()
tagged_rds_instances = get_tagged_rds_instances()
for db_identifier in tagged_rds_instances:
        if 0 <= current_day <= 4:  # Weekdays (Monday-Friday)
            if 6 <= current_hour < 18:
                logging.info(f"Starting RDS {db_identifier}...")
                rds.start_db_instance(DBInstanceIdentifier=db_identifier)
            else:
                logging.info(f"Stopping RDS {db_identifier}...")
                rds.stop_db_instance(DBInstanceIdentifier=db_identifier)
        else:  # Weekends (Saturday-Sunday)
            logging.info(f"Stopping RDS {db_identifier} for the weekend...")
            rds.stop_db_instance(DBInstanceIdentifier=db_identifier)
return "Lambda execution completed."

Step 3: Configure EventBridge Rules

Go to Amazon EventBridge.
Create two rules:
Start RDS at 6 AM IST: cron(30 0 * * ? *) (UTC → 6:30 AM IST)
Stop RDS at 6 PM IST: cron(30 12 * * ? *) (UTC → 6:30 PM IST)
Set the target as the Lambda function.

Step 4: Monitor Execution Using CloudWatch

Go to CloudWatch Logs.
Navigate to the log group for your Lambda function.
Check execution details, errors, or any unexpected behaviors.

Benefits of This Approach
✅ Cost Optimization — RDS instances run only when needed, reducing AWS costs.
✅ Automation — Eliminates manual intervention and improves efficiency.
✅ Security & Access Control — IAM roles restrict unnecessary access.
✅ Monitoring & Logging — CloudWatch ensures visibility into function execution.
✅ Scalability — Easily extend this setup for multiple RDS instances.

Conclusion
Automating Amazon RDS using IAM, Lambda, CloudWatch, and EventBridge is a powerful way to optimize cloud resources efficiently. By implementing this workflow, businesses can reduce costs, improve reliability, and maintain secure access control.

This setup can be further enhanced by integrating SNS notifications for alerts or using AWS Systems Manager for more complex automation tasks.

AWS EC2 (Elastic Compute Cloud)

Naami Ahmed — Sun, 05 Jan 2025 04:37:33 +0000

Introduction
Amazon EC2 (Elastic Compute Cloud) is a web service that provides resizable compute capacity in the cloud. It is designed to make web-scale cloud computing easier for developers by offering scalable, flexible, and cost-effective compute resources.

Overview of Amazon EC2
Elastic Compute Capacity: EC2 allows you to scale your compute capacity up or down based on your needs.
Instances: Virtual servers for running applications. Instances can be launched in multiple regions and availability zones to ensure high availability.
Instance Types: EC2 offers a variety of instance types optimized for different purposes, such as general-purpose, compute-optimized, memory-optimized, storage-optimized, and GPU instances.
Pricing Models:

On-Demand Instances: Pay for compute capacity by the hour or second with no long-term commitments.
Reserved Instances: Purchase instances for a significant discount compared to On-Demand pricing.
Spot Instances: Bid on spare EC2 capacity and run instances for even lower costs.
Savings Plans: Flexible pricing model offering lower prices on EC2 usage in exchange for a commitment to a consistent amount of usage (measured in $/hour) for a 1- or 3-year term.

Key Features of Amazon EC2
Scalability: EC2 allows you to automatically scale your infrastructure up or down based on demand using Auto Scaling.
Flexibility: Choose from a wide range of instance types to fit different use cases, ensuring optimal performance for your applications.
Reliability: EC2 instances are hosted in multiple locations worldwide, providing high availability and fault tolerance.
Security: EC2 integrates with AWS Identity and Access Management (IAM) to provide robust security features such as security groups, key pairs, and IAM roles.
Networking: Options include Virtual Private Cloud (VPC) for isolated networks, Elastic IP addresses for static IPs, and Elastic Load Balancing for distributing traffic across instances.

Use Cases for Amazon EC2
Web Hosting: Run scalable and reliable web applications with the ability to handle varying levels of traffic.
Big Data: Process and analyze large datasets using EC2 instances optimized for high performance.
Development and Testing: Quickly create and scale environments for development and testing purposes.
Machine Learning: Train and deploy machine learning models on powerful GPU instances.
Gaming: Host gaming servers with low latency and high availability.

Benefits of Amazon EC2
Cost-Effective: Only pay for the compute capacity you actually use, with options to save costs through Reserved Instances and Spot Instances.
High Performance: Choose from a variety of instance types optimized for specific workloads to ensure optimal performance.
Global Reach: Deploy instances in multiple regions worldwide, bringing your applications closer to your users.
Secure: Built-in security features and compliance certifications ensure your data and applications are protected.

Conclusion
Amazon EC2 provides scalable, flexible, and cost-effective compute capacity in the cloud. By leveraging its features and following best practices, you can effectively manage and optimize your cloud infrastructure, ensuring high performance and security for your applications.