AWS IAM Account and Policy

IAM (Identity Access Management) in AWS is services which control the access of AWS Resource and Services which is always user Based.

• AWS IAM provide the Facility of User Management,  AWS Resource and services access control management, Security Management of AWS resource. It defines the user Access permission to the AWS Services. 
• Every AWS account is assigned with the root account which controls everything including resource access, users, security etc. Root Account is the head of your account which have the full power of AWS IAM Resource. Never Share the root account credential with any one. Don't Use the root account for your daily task or for your administrative purpose. 
• Root User is called the creator of the account Which have the full permission and access to the AWS Resource. 
• By default 5000 users can be created per AWS account Using IAM. At a time you can add 10 user.
• By default you can create max 300 Groups per AWS account using IAM.
• You can create 1000 roles per AWS Account using IAM.
• IAM User can be the member of 10 Group.
• IAM services is available free of cost. And it is not region specific. IAM is Global services.
• While creating group in IAM, you can't create group inside group. Nested group is not possible in IAM AWS.
• Using IAM in AWS you can control the resource access and action by applying various default policy and IAM inline policy 

 Feature of IAM in AWS

• Shared Access to your AWS Account with giving them the root Credential.
• Granular Permission means here is level of access to the AWS resource. Example sometime you want to give user only Read Permission.
• Secure Access of Application which will run on EC2 Instance.
• Multifactor Authentication 
• Identity Federation
• Identity Information for Assurance.(You can check which user have access which resource using log record).
• PCS DSS compliance (PCI : Payment card Industry, DSS : Data Security Standard).
• Eventually Consistent and highly Available.

AWS IAM Terms

• Principal ( Principal can be Users Perform and use the resources or It can be Application also because sometime request will go through the Application, Roles etc. )
• Request : Principal which send the request.
• Authentication :  Authentication will check and verify the principal. Only Authentic Users can have the access of the AWS Resource.
• Authorization : Authorization check the level of task permission and restrict the task performed by the authentic user if it is not permitted and assigned to him. 
• Action / Operation : Any task what you performed which is authorized to do by root user. 
• Resources : It's Basically AWS resource. 

IAM Default Policy and Inline Policy

AWS Autoscaling and Amazon Auto Scaling Group

Most of the company is migrating to the cloud because of Scalability, Fault Tolerance, High Availability of resource. AWS Auto scaling Group is one of the most important feature of AWS cloud. 

Scalability or Autoscaling have the same mean. In terms of Cloud Scalability or AWS Autoscaling means based on the requirement scaling the server resource up and down to meet the users request requirement without fault Tolerance and with high availability of resource .

• AWS Autoscaling is region Specific Amazon services.
• Auto scaling is a process of scaling (Scale Out[Increase] or Scale In[Decrease]) your EC2 Instance up or down based on the set of condition. 
• Amazon Autoscaling is Horizontal Scaling of EC2 Resource. This Horizontal scaling ensure that you must have the right number of server to handle the Request.
• Auto Scaling help in the cost Management. In cost management Auto scaling don't have extra charge for creating instance in AWS ASG.
• Instance Running only you can include in Autoscaling Group. Terminated or Stopped Instance can't be included in ASG Group. 
• EC2 instance can be the part of only one Auto scaling Group. It can't be the part of Multiple auto scaling Group. You can have multiple AWS ASG but we can't attach single EC2 Instance in multiple ASG.
• When you want to delete the AWS Auto scaling group first you have to detach the Existing EC2 of that particular ASG and then you can delete it.  If you delete the ASG without detaching the EC2 instance then it will delete the EC2 Instance also.
• We can attache multiple Elastic Load balancer with auto scaling group. 
• Whenever you apply Scale-Out Policy you must apply Scale-in Policy also. Other wise your cost will come high.
• If you are creating AWS ASG using CLI then the basic monitoring will be 60 second. But if you are using console then the basic monitoring time will be 300 second (5 min). Through CLI by default it will be detailed monitoring will be created which is chargeable. Basic Monitoring is free of cost.
• Merging of AWS ASG is possible only through CLI(Command Line Interface).

Component of AWS Autoscaling

Launch Configuration : In launch Configuration we define the type of instance, Key pair, AMI, Security Group. Once the Launch configuration is created after that you can't edit it. You can only delete it or Copy it.

Auto Scaling Group : Here we define the AWS ASG name, group Size, Group Subnet , vpc etc.

Scaling Policy : Metric Type, Target Value

Autoscaling Group always try to balance the EC2 Instance distribution across Region AZ's. Because if it is not balanced then in case of any failure of AZ's the load will come to the other AZ's for short time. To avoid that AWS Autoscaling Group distribute instance equally in multiple AZ's in that region itself (Autoscaling is Region Specific.). Below is the image as a example.

SNS (Simple Notification Services) in Auto Scaling Group sends email in four condition  which is below for your reference. SNS is chargeable services.

• An Instance Is Launched
• An Instance is terminated
• An Instance is fail to launch
• An Instance is fail to terminate 

Amazon Auto Scaling Policy

• Manual AWS Auto Scaling Policy ( In this scaling Policy the Min and Max Number of server will be same in all the condition.)
• Dynamic AWS Auto Scaling policy ( In this scaling Policy the Min and Max Number of server will not be same and based on the condition it increase within the min and max range)
  
  • Target Tracking Policy : In this policy we define the target. To maintain that target AWS ASG will increase or decrease the EC2 Instance. Like we are setting the target that one EC2 instance can have 70% of traffic. If that traffic will cross 70% automatically new EC2 instance will be launched. Target Tracking Policy always maintain the level of 70%. If it traffic decreases across all the Instance then it will terminate the EC2 instance and bring down the instance. In this we define or set the CPU Utilization. Below is the Image where target Tracking Policy we set.
    
     
  • Simple Scaling Policy :
  • Step Scaling Policy :  We have to set Increase and decrease group Size as well as we have to the alarm before applying this scaling policy.
    
  • Predictive Scaling / Schedule Scaling / Cyclic Scaling : Predictive scaling will check the traffic history and based on the history it will scale up and down. Or we can decide like Scale Out on Saturday and Sunday. It uses machine learning Help and help in Scaling Out and In.