Monday, June 8, 2026

Cohort 3 | Project CloudIgnite Topics: System Operations (SysOps) Overview, AWS CLI, AWS Systems Manager, IAM Recap, Troubleshooting Knowledge Base Duration: ~3 hours

Key Takeaways

• SysOps responsibilities: build, test, deploy, monitor, maintain, safeguard — automate repetitive tasks with Bash/Python/CloudFormation/Terraform
• Troubleshooting Knowledge Base: structured document tracking issues, symptoms, root causes, resolutions — enables consistent, fast incident response
• IAM Recap: Users, Groups, Roles; identity-based vs resource-based policies; SCPs at org level; least privilege, MFA, never use root
• AWS CLI: terminal-based management; aws configure stores keys in ~/.aws/credentials; common commands: describe-instances, stop-instances, s3 ls; --dry-run checks permissions without executing
• AWS Systems Manager (SSM): manage many EC2 instances centrally; Run Command, Session Manager (no SSH), Parameter Store (secrets/config), Fleet Manager, Patch Manager
• Session Manager vs SSH: no port 22 needed, no key pairs, audit logging built-in
• Parameter Store: store config values and passwords; EC2 reads at runtime for dynamic configuration

Table of Contents

1. System Operations Overview
2. Troubleshooting Knowledge Base
3. AWS Identity and Access Management (IAM) — Recap
4. AWS Command Line Interface (CLI)
5. Lab 168 — Installing & Configuring AWS CLI
6. AWS Systems Manager
7. Lab — AWS Systems Manager
8. CLF-C02 Relevance Map
9. Quick-Reference Cheatsheet

1. System Operations Overview

What is SysOps?

System Operations (SysOps) is the discipline responsible for the deployment, administration, monitoring, maintenance, and security of cloud infrastructure.

Core SysOps Responsibilities

Automation in SysOps

The goal is to automate repetitive tasks. Common tools and formats:

• Bash / Shell scripts — Linux scripting
• Python — Most versatile; recommended for this program
• C# / Ruby — Alternative languages
• AWS CloudFormation — Infrastructure-as-Code (IaC) template format, similar to Terraform
• Terraform — Third-party IaC tool

⚠️ Common Misconception: Creating reusable infrastructure templates is done with CloudFormation, not IAM. IAM manages user/group permissions only.

2. Troubleshooting Knowledge Base

What Is It?

A structured, categorised document (e.g., Excel sheet or CSV) that records known issues, their symptoms, root causes, and resolution steps. It helps teams respond to incidents quickly without starting from scratch each time.

Why Build One?

• Avoid guessing — knowing the category narrows down where to investigate
• Consistent response across the team
• Institutional memory — knowledge stays even when people leave

Knowledge Base Structure

Example Entries

• EC2 Connectivity Issue (Networking) — Symptom: browser shows "cannot connect". Root cause: Security Group missing inbound rule, or server not running.
• SSH to EC2 Fails (Networking) — Root cause: Port 22 not open in Security Group.
• EC2 Out of Disk Space (Compute) — Symptom: instance stops running. Root cause: EBS volume full.

Category Reference Table (Partial)

📝 Activity: A knowledge base deliverable is expected at the end of the cohort. Use the provided Excel template to fill it in. Follow the category table to classify issues correctly.

3. AWS Identity and Access Management (IAM) — Recap

Three Ways to Access AWS Services

MFA (Multi-Factor Authentication) adds an extra layer on top of any method, especially recommended for root and IAM users.

Key IAM Concepts

Identity Types

• User — Individual person or service account
• Group — Collection of users; attach policies to the group
• Role — Assumed by users, services, or cross-account principals; acts as a bridge

Policy Types

IAM Policy Structure (JSON)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:*",
      "Resource": "*",
      "Condition": {
        "BoolIfExists": { "aws:MultiFactorAuthPresent": "true" },
        "IpAddress": { "aws:SourceIp": "192.0.2.0/24" }
      }
    }
  ]
}

• Effect: Allow or Deny
• Action: What operations are permitted (e.g., ec2:* = all EC2 actions)
• Resource: Which resources the policy applies to (* = all)
• Condition: Optional constraints (e.g., MFA required, specific source IP)

IAM Best Practices

1. Never use the root account for everyday tasks — it is off-limits
2. Principle of Least Privilege — grant only the permissions needed; nothing extra
3. Use IAM Roles for cross-account access instead of sharing credentials
4. Enable MFA for all IAM users, especially root

Single Sign-On (SSO) & Federated Access

• SSO allows one set of credentials to access multiple services (e.g., logging into AWS Restart portal and being automatically signed into the AWS Management Console)
• Roles enable cross-account access — one account can consume a role that grants access to resources in another account, without sharing passwords

4. AWS Command Line Interface (CLI)

What Is AWS CLI?

A tool that lets you manage AWS resources from the terminal using commands — instead of clicking through the AWS Management Console.

Supported Operating Systems

• Windows
• Linux
• macOS

CLI Installation Steps (Linux/EC2)

# 1. Download the CLI package
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"

# 2. Unzip
unzip awscliv2.zip

# 3. Install
sudo ./aws/install

# 4. Verify installation
aws --version

Configuration

aws configure
# Prompts:
# AWS Access Key ID
# AWS Secret Access Key
# Default region name        (e.g., us-east-1)
# Default output format      (json | table | text)

Configuration is stored in:

• ~/.aws/config — region and output format
• ~/.aws/credentials — access key and secret key

⚠️ CLI configuration is instance-specific. If you configure CLI on an EC2 instance, it only applies to that instance.

Output Formats

Change output format on the fly using an environment variable:

export AWS_DEFAULT_OUTPUT=table

Common CLI Command Structure

aws <service> <operation> [parameters] [--output <format>]

Examples:

# Stop an EC2 instance
aws ec2 stop-instances --instance-ids i-1234567890abcdef0 --output json

# List all S3 buckets
aws s3 ls

# Describe all running EC2 instances
aws ec2 describe-instances

# Get info on first instance only (JMESPath query)
aws ec2 describe-instances --query "Reservations[0].Instances[0]"

# Filter by instance type
aws ec2 describe-instances \
  --query "Reservations[].Instances[].InstanceId" \
  --filters "Name=instance-type,Values=t3.micro,t3.small"

# List IAM users
aws iam list-users

Using the Help System

aws help                  # All top-level commands
aws ec2 help              # All EC2 subcommands
aws ec2 describe-instances help   # Specific command help

# Filter help output using grep (Linux)
aws ec2 help | grep start   # Show only "start"-related commands
aws ec2 help | grep stop

Dry Run

A dry run simulates a command without actually executing it. It:

• Checks whether you have the required permissions
• Predicts if the command would succeed
• Does not change any resources

aws ec2 stop-instances --instance-ids i-1234567890abcdef0 --dry-run

AWS SDK vs AWS CLI

5. Lab 168 — Installing & Configuring AWS CLI

Goal: Install AWS CLI on a Red Hat Linux EC2 instance, configure it with IAM credentials, and run basic commands.

Key Tasks

1. Task 1 — Connect to the EC2 instance via SSH (download .pem key, set permissions, connect)
   • Linux/macOS: chmod 400 keyfile.pem
   • Windows: use icacls
2. Task 2 — Download and install AWS CLI on the EC2 instance (commands above)
3. Task 3 — Go to IAM in Management Console → find aws-student user → inspect the Lab Policy (JSON) under the Permissions tab → copy the Access Key ID and Secret Key from the Security Credentials tab (or the lab Details panel)
4. Task 4 — Run aws configure with the copied credentials
5. Activity Challenge — Use the CLI to download the Lab Policy document in JSON format:

   # Get the policy ARN first
   aws iam list-policies --scope Local
   
   # Then retrieve and save the policy document
   aws iam get-policy-version \
     --policy-arn <YOUR_POLICY_ARN> \
     --version-id v1 \
     > lab-policy.json
   
   # View the saved file
   less lab-policy.json
   

   ⚠️ The ARN in the lab example is a placeholder — always copy the real ARN from list-policies output.

6. AWS Systems Manager

What Is It?

AWS Systems Manager (SSM) is a centralised management service that lets you manage and automate tasks across many EC2 instances (or on-premises servers) without connecting to each one individually via SSH.

Why Use It?

Instead of SSH-ing into 100 EC2 instances one by one to install a patch or software, Systems Manager lets you do it all from one place in minutes.

Key SSM Capabilities

SSM Documents

• A document is an instruction file — like a Bash script stored in AWS
• Types: AWS-managed documents, custom documents, shared documents from other users
• Used by Run Command, State Manager, and Automation

Parameter Store

• Stores secrets and config values (e.g., database passwords, API tokens, feature flags, environment variables)
• EC2 instances can read parameters at runtime — enables dynamic configuration without hardcoding values
• Example use: a web app reads a beta_features parameter; if it exists and is True, the app shows a beta UI

Patch Manager Workflow

1. Create a patch baseline (define which patches to apply)
2. Apply the baseline to target instances
3. Monitor results (pending / success / failed)
4. (Optional) Schedule via a Maintenance Window

Session Manager vs SSH

7. Lab — AWS Systems Manager

Goal: Use Fleet Manager, Run Command, Parameter Store, and Session Manager to manage an EC2 instance from a central point without SSH.

Task Walkthrough

Task 1 — Generate Software Inventory (Fleet Manager)

1. Go to Systems Manager → Node Management → Fleet Manager
2. Click Account Management → Set Up Inventory
3. Name the inventory association (optional)
4. Target: choose Manually selecting instances, pick your EC2 instance
5. Click Set Up Inventory
6. Click on the Node ID → go to the Inventory tab
7. View all installed software packages on the instance

Task 2 — Install Software via Run Command

1. Go to Systems Manager → Node Tools → Run Command
2. Filter by Owner: Owned by me
3. Select the install-dashboard-app document
4. Target: choose your EC2 instance
5. Uncheck Enable S3 bucket output (not needed for this lab)
6. Click Run
7. Wait for status → Success
8. Copy the EC2 public IP → open in browser (use HTTP, not HTTPS)
9. Verify the dashboard app is running

Task 3 — Create a Parameter Store Entry

1. Go to Systems Manager → Application Management → Parameter Store
2. Click Create Parameter
3. Name: beta_features (copy exact name from lab instructions)
4. Value: True (capital T)
5. Save the parameter
6. Refresh the dashboard URL → beta feature section should now appear

Task 4 — Connect via Session Manager

1. Go to Systems Manager → Node Tools → Session Manager
2. Click Start Session
3. Select target EC2 instance → click Start Session
4. A browser-based terminal opens (no SSH / no key pair needed)
5. Run commands to explore:

   # Set session reason (metadata)
   # Retrieve instance metadata
   # Describe EC2 instances
   aws ec2 describe-instances
   

CLF-C02 Relevance Map

The following topics covered in today's lecture map directly to the AWS Certified Cloud Practitioner (CLF-C02) exam.

✅ Domain 2 — Security and Compliance

✅ Domain 3 — Cloud Technology and Services

✅ Domain 4 — Billing, Pricing, and Support

(Not directly covered today, but CLI/automation context is relevant for cost optimisation questions.)

⚠️ Topics Covered Today But Lower Priority for CLF-C02

• SysOps day-to-day workflow details (Build / Test / Deploy cycle) — more relevant for SysOps Associate (SOA-C02)
• Troubleshooting Knowledge Base structure — practical skill, not directly tested on CLF-C02
• CLI installation steps — hands-on skill; CLF-C02 tests concepts, not commands
• Detailed SSM lab steps (Run Command document, Fleet Manager inventory) — deeper than CLF-C02 scope

Quick-Reference Cheatsheet

# Check CLI version
aws --version

# Configure CLI
aws configure

# List IAM users
aws iam list-users

# Describe EC2 instances
aws ec2 describe-instances

# Stop an EC2 instance
aws ec2 stop-instances --instance-ids <INSTANCE_ID>

# Start an EC2 instance
aws ec2 start-instances --instance-ids <INSTANCE_ID>

# Simulate a command (dry run)
aws ec2 stop-instances --instance-ids <INSTANCE_ID> --dry-run

# List all S3 buckets
aws s3 ls

# Get help for a service
aws ec2 help
aws s3 help

# Filter help output
aws ec2 help | grep describe

# Get a specific IAM policy version
aws iam get-policy-version \
  --policy-arn <POLICY_ARN> \
  --version-id v1

Notes compiled from lecture transcript · AWS re/Start Program Cohort 3 · June 8, 2026