Welcome back to BackSpace Academy! In this lab we're going to be creating a 2
server on ec2 that will be running Nodejs web applications for us and also, 3
we'll be connecting in to that server using a terminal and also using SFTP to 4
upload our application and different versions of the application to this server 5
Now one thing I'd like to say is that if you're going to be doing Nodejs 6
development or any other sort of development on AWS in my honest opinion 7
the best way to do that is by using the AWS Cloud 9 IDE because it's going to 8
have everything set up for you out of the box and it's going to have a great 9
IDE to use that will be fully integrated with all of those AWS services for you 10
but that said, you need to have access to the AWS management console to use 11
AWS Cloud 9 IDE but, if you setup on EC2 like we're going 12
to do in this lab, you can give someone programmatic access only and they'll 13
only be able to access it through the command-line interface or through a 14
software development kit. So that's going to reduce any training that is 15
required on the management console and it's going to reduce any possibility of 16
the developer doing something that they probably shouldn't be doing or 17
didn't mean to do. We'll start off by creating an IAM user with limited privileges that 18
will only allow them to have programmatic access. We'll put them in a 19
group called developers and we're also going to create a role that will allow 20
that EC2 server to access other services within AWS. Then we'll set up a security 21
group specifically for Nodejs then we're going to bootstrap this EC2 22
instance with a bash script. So what will happen is that when this EC2 instance is 23
launched it will automatically run this bash script 24
which will set up the Linux operating system for us and a number of 25
firewall settings. Next we'll look at installing the NodeJS software and the AWS 26
software development kit on this instance. Then we'll look at using the 27
secure file transfer protocol to transfer our application, our Nodejs application 28
onto this Nodejs server and also with other versions of our 29
application as well. Then finally we'll look at creating an Amazon Machine Image 30
of this server so that we can launch other servers like that in the future 31
without having to go through all of this process of installing the software 32
and starting off in the IAM management console, we're going to first off create a user 33
we go to users and add user we'll give this user our name BackSpace-lab-ec2 34
will be fine. We're going to give this user programmatic access only and 35
that means that they can access this server remotely through the AWS 36
command-line interface or through an AWS software development kit. We're not going 37
to give them management console access but that said, if this developer required 38
access to the AWS Cloud 9 IDE then you would also need to have management 39
console access as well but for this lab we're just going to be doing 40
programmatic access only. Click on Next permissions. What we need to do now is 41
that we need to add this user to a group because that is good practice to keep 42
track of your users and to have your user inherit the permissions of that group 43
then add that user to a group we can see here we've got a group for 44
administrators and we don't want to add our user to that group so we're going to 45
create a specific group for our developers. So we click on create group 46
we call this group developers and create group. So now we've created that group 47
for our developers. It doesn't have an attached policy yet, we're going 48
we'll to do that later on and we've added our user to that group automatically 49
click on next tags and we're not going to worry about adding any tags 50
to this user and next review and create that user. Ok, so now that we've created 51
that user very important for this for this user to have programmatic access to 52
this server they need to have credentials and so they need to have 53
this access key ID and this secret access key so we need to download that 54
so we just download that now and save that somewhere safe so once we've got 55
that we can close out of here. Okay so now that we've created that user 56
and we've created a group we need to assign permissions for that user because 57
right now that user can't do anything, they've got no permissions to do anything 58
so the best way to get the the right permissions to start with and 59
then we can work from that and refine those missions is to start off with an 60
AWS managed policy for a specific job function. So I am going to open up a web 61
page here and here we have here we have our AWS manage policies for job functions 62
so they are policies that AWS regularly update and their policies that 63
they the AWS believe that a certain job function should have. So we have policies 64
for administrators, billing, database, data sciences and, we've also got there for a 65
developer power user. So we're going to give this this user or this group of users 66
developer power user policy and, so here we can see it has a link to the AWS 67
managed policy there. So we'll click on that and that will take us to the IAM 68
management console specifically for that policy and, there we can see that it has 69
a number of permissions there. We won't worry about that too much but we can 70
refine that later on if we would like to and it's certainly a very good idea to 71
do that because you want to limit access as much as possible. What we need to do 72
now is we need to associate this policy with our developers group and, then our 73
user will inherit this the permissions assigned within this policy. So we go 74
to policy usage and we're going to attach this policy to an entity. 75
So we're going to search for our developers and developers group. We could also attach 76
this policy to a user but, it's far better to attach the policy 77
to a group and have all of those users inherit the policy of that group. 78
So we select developers and we attach that policy now 79
and there we can see we have our developers there are attached to this policy 80
okay so the next thing that we need to do is that we need to create a 81
role for our ec2 server to access AWS resources. So we go to roles and, create 82
role. It's an AWS service. We're going to be 83
allowing or associating this role to the ec2 server. So it's AWS ec2. We select ec2 here 84
which will allow ec2 instances to call AWS services on our behalf. 85
We click on next for permissions. So we're going to give this server access 86
to Amazon s3. So it might want to create buckets or do whatever. So we're just 87
going to give this server Amazon s3 full access, but that said we could also do an 88
Amazon s3 endpoint a VPC endpoint in our VPC and that would also allow access to 89
s3 and that's probably a better way of doing it, 90
but for now I'm just creating a role here to show you how you can create 91
access permissions for a specific server. So this could be access to ec2. 92
For example if you wanted this ec2 server to be able to create other ec2 servers, 93
you could actually search here for ec2 as well, but we'll just stick now with 94
Amazon s3. Click on next tags and, next review. We'll give this role a name. 95
We'll leave the description as it is and that looks pretty good, 96
and we'll create this role. Ok so now that we've created a user and, we've added 97
that user to a group and, we've assigned permissions to that group for that group 98
of users and, we've also created a role and assigned a policy with permissions 99
to that role and, that role can be associated to our ec2 server, the next 100
thing we need to do is to create a security group that we can associate to 101
this server, that will allow traffic from the wider internet and also allow 102
traffic for secure access for us so that we can run terminal commands remotely to 103
to this ec2 server. So we need to receive on port 80 for HTTP but we also need to 104
receive traffic on port 3000 because NodeJS won't receive traffic on port 80 105
it won't let you do that. So what you need to do is receive it on 106
port 80 and then forwarded over to port 3000 and, further on in the lab we'll 107
look at how we're going to do that using the Linux operating system and, we also 108
need to have access on port 22 for secure shell or SSH and that will allow 109
us to remotely connect into this server and issue commands to this server and 110
also it will allow us to upload files using secure File Transfer Protocol 111
directly to that server. So starting off we need to scroll down to network and 112
security in the ec2 management console. Go to security groups and create a 113
security group and, we'll give this security group a name and a description 114
We're going to leave it with the default VPC and we'll add our inbound rules. 115
The first one is to receive traffic for the wider internet on port 80 for HTTP. 116
We'll scroll down, the type will be HTTP and, there we go port 80 and that 117
will be from anywhere. So all traffic from the wider internet on port 80 will 118
come in. We also need to allow traffic which will be a custom TCP on port 3000 119
and that is to receive traffic for the Nodejs server and that will be from 120
anywhere as well and, the final rule that we need to create is for SSH. So we'll 121
scroll down to SSH which will give us secure shell access remotely to our 122
server. Now normally you would select, and I suggest that you select, my IP. 123
I can't do that here because where I operate from I've set up multiple 124
internet connections through a load balancer and so my IP can be run of 125
three or four different IP addresses. So I have to use anywhere but please if 126
you've got a static IP address make sure that you select my IP it's going to give 127
you much better security. So I'm just going to select anywhere for now and 128
then I'll create that security group and there we go. Ok so now that we've created 129
our security group, we need to associate it with an ec2 instance. So first of all 130
we need to create that ec2 instance. So let's go to instances and Launch 131
instance. We will select the Amazon Linux 2 AMI which is a CentOS ami and we'll 132
set the t2.micro and next for configure instance details. 133
We'll leave it with the default VPC. Make sure that you auto assign a public IP address 134
because without that you're not going to be able to receive traffic or you won't 135
be found on the wider internet. We'll select that IAM role for this ec2 136
server that we created which was backspace - lab - ec2 - s3 and then 137
we're going to scroll down to this area of advanced details. Now that might be 138
minimized like this or if it's not there just click on on the caret here 139
and it will open it up for you. Now what we need to do is that we need to create a bash script, 140
a Linux bash script and what that will do is that that will be invoked when the 141
instance is launched and, it will set up, first of all it will do a update of our 142
Linux operating system a yum update. Then it's 143
going to set up our firewall rules within the Linux operating system and, 144
is going to direct traffic that comes in on port 80 that cannot be received by 145
Nodejs directly and it's going to forward that traffic over to port 3000 where the 146
Nodejs system can actually accept that. Now this 147
is firewall rules that are set up in the Linux operating system and this is one 148
thing to remember, is that yes you have security groups but, you also have other 149
layers of security as well and your Linux firewall rules don't forget about 150
them because if you're using Linux you can also take advantage of 151
those as well, as another layer of security. So we've got that set up, now we 152
just paste that in, and we can see there, we're first off, we're doing a yum update 153
and then we're directing traffic for port 80 redirecting over to port 3000. 154
Click on next and storage. We will leave storage as it is. Add tags, we're going to 155
add a tag and we're just going to add a name tag. Now when you put the name tag 156
make sure that you use a capital N in front of the name otherwise it won't 157
come up correctly, and the values is going to be NodeJS. Next we configure 158
our security group. We select the security group so select an existing 159
security group and which will be down here somewhere, 160
there it is. There's our Nodejs security group. We can see there that 161
has traffic coming in on port 80, port 22 and port 3000. That looks-fine. 162
We will review and launch. Looking good, and launch. So we need to choose an 163
existing key pair. So I've already got a key pair here. If you haven't, create a 164
new one. So just acknowledge that and launch the instances 165
and view instances and, we'll let that chug away for now. Okay so now that we've 166
launched our instance, it doesn't really do anything, it won't receive any, or it 167
won't respond to any traffic coming in. It will receive the traffic but it won't 168
do anything with it because we haven't set up NodeJS, there's no software on there. 169
We don't have the AWS software development kit either. So we can't 170
access anything like s3 without our software development kit. So what we need 171
to do is add those. So the way that we do that is we need to connect into this ec2 172
instance using SSH and, run a secure shell and, run commands to install that. 173
So the way we do that is we select our server and we click on connect and, 174
we'll get this connection string down here and, we're just going to copy that, 175
just copy that and, what we need to do now is go to where we downloaded our PEM file 176
just recently. So when we created this ec2 instance we downloaded a PEM file. 177
So I've got the one here that I downloaded. So we just go in to where it 178
is and provided we've got Git for windows installed on our PC, we just right click 179
on the folder area. You don't right click on the actual file itself 180
because it won't come up just right click on the folder area here on the 181
empty space and just to get bash here and, that will get up a Git screen, 182
a bash screen for us that we can issue commands and the first command 183
that we're going to issue will be to connect to that server. Ok so I'm just 184
going to paste that command in now. So just right-click and select paste and 185
enter yes to accept that fingerprint 186
and there we go. So we now have secured access to that ec2 server. 187
What we need to do now is that we need to run through and install the Nodejs 188
software on our on our server. The first thing we need to do is that we 189
need to install the node version manager and, from there we can use the node 190
version manager to install NodeJS. So first of all do a curl command to bring 191
that into our server and, all this is in the lab notes, just copy and paste it 192
from the lab notes, like I am doing here and that will bring that in and now we 193
just need to invoke the node version manager. So we can run it and just copy 194
and paste over again. 195
Now we can use nvm. Now that it's setup and invoked we can use it to 196
install Nodejs. We just do nvm install node and, again I'm just copying this 197
from the lab notes. 198
Okay so that worked fine. We're just going to check that it actually works by 199
doing node --version. If it's installed it will send us back what the 200
version of NodeJS and there we go. So it's version 13.11 201
of node. So that worked fine NodeJS is installed. The next thing we need to 202
install is the AWS software development kit. We can install it using the 203
node package manager. Now that Nodejs is setup, So we just do npm install AWS - SDK. 204
So again I'll just copy that over from the lab notes make life easier. 205
In NPM install AWS software development kit and that looks fine. 206
We just check that it has installed by doing again AWS - - version. Again I'll just copy 207
and paste it over from the lab notes. There we go. So we've got a the AWS 208
software development kit has been set up there fine okay. So we've installed 209
Nodejs and the AWS software development kit for 210
Nodejs what we need to do now is that we need 211
to upload our application code to our server using secure FTP or SFTP for short. 212
What we're going to do is we're going to use a software called CyberDuck 213
and we're going to connecting using it. The first thing we need to do is 214
we need to grab our public IP address and copy that and then open up CyberDuck. 215
So there's CyberDuck and we need to open a connection and, it's going to be SFTP. 216
It won't be FTP it will be SFTP for SSH File Transfer Protocol and the 217
server will be that public IP address. Port will be 22 and then we're going to 218
choose our private key. So normally this will have none. So what we're going to do 219
is choose our private key now that will be the private key that we saved when we 220
created this to service. So the one that's associated 221
to that. That's not your credentials, the excel worksheet view credentials, this is 222
a PEM file. So we'll choose it and connect now provided that PEM file is 223
correct we should be fine. 224
There we go we've connected in and it's got a listing of our server. So just 225
jumping into an editor. I've got Visual Studio, it can be anything, it can be 226
notepad it could be anything, just to edit this this text. So the thing that we 227
need to change here for you it will be this private IP address. So that won't be 228
the same as yours, so we need to copy that over. Now just remember this is the 229
private IP address, before we copied the public IP address, we need to copy the 230
private IP address. So we'll just scroll down a little bit further and on the 231
left hand side here will be the private IP address and I'll just paste that in. 232
Make sure that we have still got the commas or inverted commas around that and I'm 233
going to save that. Okay so once I've saved that I can now use. Go back into 234
Cyberduck and all I need to do is just grab that file from my file explorer 235
and just drag that across and drop it on to Cyberduck, and that will 236
upload it to our server. So I'm just going to grab it here and drop it on 237
onto on to CyberDuck 238
and you can see there that it's been uploaded. Let's just close out of that 239
now. So what I want to do now is connect back in to the server. So make sure that 240
my connection is still open. So just jumping back in to Git for Windows 241
getting that connection and it's still open, which is good and, what I'm going to 242
do is, I'm going to run that application. So the command to use is node and then 243
the name of the file. So the name of the file is app.js and just going to paste that in. 244
So node and then the name of the file. Okay so we let that worked fine. So we can see 245
here the server is running at that private IP address 3000 and that will be 246
receiving traffic from or it will be receiving traffic that has been 247
redirected from port 80. So if we go into into that public IP address now. 248
I'm just going to copy this public IP address, paste it in here there. We can 249
see we have our application which is hello world from Backspace' Academy. 250
That's great! That all worked ok. It was a little bit of work in uploading 251
that software and installing it, so if someone else wants to come along and we 252
need to create another server for them it would be great if we had an an image 253
of that server we could launch directly from that image. So what we're going to 254
do now is that we're going to create an Amazon Machine Image or an AMI of this 255
server and once we've done that we're going to create or launch another ec2 256
instance using thei image and that way we don't have to install all that 257
software again. So the way we do that is that we go to instances, select our instance , 258
go to actions, go to image and create image. We'll give that image a 259
name and we'll give it a description 260
and then we'll click on create image. Now we'll scroll down and we'll go to AMIs 261
and then we can see our AMI is being created. It's status is currently pending 262
we just wait about five minutes or so. I'll go away and have a cup of 263
coffee and hopefully it will be done by then. 264
Okay it's been about five minutes or so and thanks to the magic of pre-recorded video 265
it's all been done. What we can do now is that we can jump back into or 266
no, we'll stay where we are, sorry we will launch directly from this page here. 267
We can launch an ec2 instance from this AMI. So I just click on launch and will 268
select a t2.micro. So same as before we're going to use the default VPC. 269
Make sure our public IP is enabled for it. We'll select that IAM role so that 270
we can access AWS or the ec2 server can access AWS resources and we'll scroll 271
down here and I am going to paste in here. I'm just going to grab it from the lab notes. 272
Okay so we'll paste in our Linux firewall settings or Linux firewall bash 273
script and, next add storage and, add tags. We'll put in a tag there. We'll call this 274
NodeJS. 275
We'll select that same security group 276
and, review and launch and launch. We'll use that same key pair and launch 277
instances. 278
We'll let that chug away and what we'll do in the meantime is we'll get 279
rid of the old one here so we don't get too confused. 280
So actions terminate and we'll give the other one a bit of time to do it stuff 281
until it gets a a status other than pending for us. Okay thanks to the magic 282
of pre-recorded video our instance is up and running. What we need to do now is 283
that we need to change our application because it's set up for the old instance. 284
So what we need to do. I'll just get it up here. So we can see here that the host 285
name which is the private IP address is now set to the private IP address of the 286
old instance. We need to change it to the new instance. So we need to go back 287
into our ec2 management console and we'll select the private IP address. 288
I'm just going to copy that over and we'll paste that in there 289
and we'll save that again. 290
and what we'll do is we'll get Cyberduck up again and we'll and we'll drag and 291
drop that over after we've connected to cyberduck. So get Cyberduck up now and, 292
we'll need to disconnect from the old server and, we'll open a new connection 293
and, what we need to do is we need to make sure it's still SFTP. That's fine. 294
We need to get the new public IP address. So this is again it's for the old server 295
that we've already deleted or terminated, so we need to get the new one for this one . 296
So just copying that public IP this time, not private IP, and we'll paste that 297
in there now. Again it's ec2user again and the same PEM file as well. 298
That should connect in. 299
Okay we logged in successfully. We've got our app.js. We need to replace it. 300
Okay we'll just drag that across now. 301
Okay that's done so what we need to do now is we need to connect in to our 302
server using SSH. So again what we do is we get Git for windows up, but we first 303
need to get this connection string here. Now if you have a look at this it's 304
using root as the username. Now that's not correct, for all Amazon Linux AMIs 305
it must be ec2 - user. So we need to change that. I'm just going to 306
copy that and change it and what I'll do now is I'll paste that in to our 307
Git for Windows bash screen. So I just paste that in there and then we can see we've 308
changed it here to ec2-user and enter and we should be getting in. There we go 309
Wonderful! So now we've got our new application or updated application with 310
the new private IP address we should now just be able to do nodejs and run our 311
application, and there we go. So it's running there fine and we'll just grab 312
this public IP address and go to it in our browser and see what happens, 313
and there we go. So that's fantastic. All worked perfectly. 314
We created an AMI and it took all of the hard work of creating or installing 315
Nodejs on our server and the AWS software development kit. So what we can 316
do now is that we're just going to clean it all up so first things first of all 317
terminate this instance. 318
We'll delete that AMI or deregister the AMI and, we will go into the IAM or 319
we will get rid of that that security group as well. 320
We'll go into the IAM management console. 321
We will delete that s3 role 322
and we'll delete that user as well 323
and finally we'll delete that group as well of developers. 324
Okay so that brings us to the end of the lab. Just one more thing I want to talk 325
about is the credentials because we downloaded two sets of credentials here 326
so and we only really used one of those and that was the the key that we needed 327
for ec2 so we downloaded at the PEM file and we use that with Git for Windows 328
to have this secure shell access and we also use it with cyberduck as 329
well for SFTP access. So that is related specifically to that ec2 instance but we 330
also downloaded when we created that user we downloaded programmatic access 331
or credentials for that user and they were downloaded as a CSV file. So that 332
will have the users name which was backspace - lab and it will have 333
an access key ID and a secret access key and, what they're used for is, if that 334
user connects into that ec2 instance and then they want to use the command-line 335
interface which will be already installed because it was an Amazon Linux AMI, 336
they can actually access the resources within AWS for example they 337
could access ec2 service, for example they could access Cloudwatch or 338
something like that and they could have that access by using these access key ID 339
and the secret access key ID and setting that up in the command line interface in 340
the parameters of it or they could also use it with the software development kit 341
as well - to access it through an application. So that's the two different 342
types of credentials that we were using. There's one of them we used and the 343
other one we didn't use, but one of them you're going to be using with the 344
command-line interface or the software development kit. So that brings us to the 345
end of a good lab and I hope you've got something out of it and learned a little 346
bit more about ec2 and I look forward to seeing you in the next one.