ICT507 Cloud Computing (Weightage 40%)
Assessment type: Report submission
Submission due date:
Objective: The assignment aim is to set up an EC2 instance in a Virtual Private Cloud (VPC), connect it to an Amazon Simple Storage Service (S3) bucket, and work with bucket contents.
Submission: a PDF report containing all answers (i.e. screenshots and explanations), to submit via Moodle. Please make sure answers are in the same order as shown in the guide.
Note: Try to use your first name or student ID when naming your VPC, EC2, S3 Bucket, etc.
Note: Set your region to Asia Pacific (Sydney)
1. Create a VPC and a public subnet (use instructions from Lab 2)
a) Create a VPC with Internet gateway, plus a public subnet and a public Route table. Include your first name in all of them. Associate Route table with the public Subnet.
Take a full and clear screenshot of your VPC’s entire Resource map. (4 marks)
b) Launch an EC2 instance based on Amazon Linux inside your new VPC and public subnet.
Note: Make sure your account is eligible for the Free Tier, and that you use Free Tier eligible services when launching the instance.
c) Connect to the EC2 instance using SSH client.
Take a full screenshot of the Linux prompt upon successful connection. (5 marks)
Explain briefly how you setup the security group associated with your EC2 so that SSH connection is permitted. (2 marks)
End of Week 8.
Report -30% & Short Interview -10%
2. Create a S3 bucket (instructions from Lab 3, until bucket is created)
a) Go to S3 dashboard to create a bucket. Include your first name in the bucket name.
b) Under the bucket Permissions, use the Bucket policy previously discussed in Lab 3.
c) Upload a blank .txt file named with your first name (e.g., name.txt) into the S3 bucket.
Take a full screenshot of your bucket showing the object uploaded in it. (3 marks)
What is the direct URL of the .txt object in the bucket. Include the URL. (2 marks)
3. Create an endpoint using the VPC dashboard
a) Open the Amazon VPC dashboard.
b) In the navigation pane, choose Endpoints. Then choose Create endpoint.
c) For Service category, choose AWS services.
d) In Services, filter for Type= Gateway and select the option com.amazonaws.region.s3
Note: If your region is Asia Pacific (Sydney), region would be ap-southeast-2
e) For VPC, and Route table, select the VPC and public subnet you created in step 1.
f) For Policy, select Full access.
What is the “Full access” policy used for? (2 marks)
g) Choose Create endpoint.
Take another screenshot of VPC Resource Map. Show the new endpoint. (2 marks)
4. Create an IAM instance profile that grants access to Amazon S3
a) Open the IAM dashboard.
b) Choose Roles, and then choose Create role.
c) Select AWS Service and then choose EC2 under Use Case.
d) Select Next to go to Add permissions.
e) Search and select AmazonS3FullAccess policy.
What is the use case of this policy? Briefly explain. (2 marks).
f) Next, enter a Role name and include your first name in it, e.g., name-EC2-role.
g) Scroll down and click Create role.
5. Attach the IAM instance profile to the EC2 instance
a) Open the Amazon EC2 dashboard and navigate to instances.
b) Select the EC2 instance created in step 1. Attach the IAM role created in step 4 using:
c) Choose the Actions tab, choose Security, and then choose Modify IAM role.
d) Select the IAM role that you just created, and then Update IAM role.
The IAM role is assigned to your EC2 instance.
Take a screenshot of the Role details to show Role name and Description. (1 marks)
6. Update your bucket policy to restrict bucket permissions to EC2 instance
a) For the bucket created in step 2, under the bucket permissions edit Bucket policy, and change the policy code to the code shown below, and then save changes.
Note: Replace your-bucket-name with the name of your S3 bucket and vpce-xxxxxxxxxx with the ID of the VPC endpoint (created in step 3) that attached to your EC2 instance.
json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::your-bucket-name",
"arn:aws:s3:::your-bucket-name/*"
],
"Condition": {
"StringEquals": {
"aws:SourceVpce": "vpce-xxxxxxxxxx"
}
}
}
]
}
Explain briefly, what are the TWO main differences between the updated bucket policy in step 6, and the previous policy that was used in step 2. (2 marks)
Take a full and clear screenshot of your bucket policy. (2 marks)
7. Access your S3 from the EC2 instance, in Linux prompt
Note: if the commands execute but do not return results, you may review the traffic rules in the Security group or Network ACL (assigned to the instance and subnet, respectively).
a) Use the Linux command below to list all S3 buckets, including the one created in step 2:
aws s3 ls
b) List file (or files) in the new bucket created in step 2:
aws s3 ls s3://your-bucket-name
c) List any EC2 files:
ls
d) Get the file in the bucket created in step 2 (e.g., name.txt):
aws s3 cp s3://your-bucket-name/name.txt .
e) Then again list the files in EC2:
ls -l
f) Finally delete the file from EC2:
rm name.txt
Explain briefly the function of the code in 7.a to 7.f (1 marks)
Take a full screenshot of the prompt showing all 6 commands and results (2 marks)
8. Completion
Terminate the EC2 (or EC2s). Submit a PDF copy of the answers containing the screenshots and descriptions via Moodle LMS. Include a one liner caption on the top of each screenshot, to describe its contents. Number the captions (e.g. Screenshot 1. VPC Resource map) etc etc.