Domande per il colloquio di lavoro come Junior Cloud Engineer AWS: Guida completa

# Esempi AWS CLI

# Arresta un'istanza
aws ec2 stop-instances --instance-ids i-1234567890abcdef0

# Avvia un'istanza arrestata
aws ec2 start-instances --instance-ids i-1234567890abcdef0

# Termina un'istanza
aws ec2 terminate-instances --instance-ids i-1234567890abcdef0

# Crea bucket S3
aws s3 mb s3://my-bucket-name

# Carica file
aws s3 cp myfile.txt s3://my-bucket-name/

# Elenca oggetti
aws s3 ls s3://my-bucket-name/

# Scarica file
aws s3 cp s3://my-bucket-name/myfile.txt ./

# Crea security group
aws ec2 create-security-group \
  --group-name web-sg \
  --description "Security group per server web" \
  --vpc-id vpc-1234567890abcdef0

# Aggiungi regola in entrata (consenti HTTP)
aws ec2 authorize-security-group-ingress \
  --group-id sg-0123456789abcdef0 \
  --protocol tcp \
  --port 80 \
  --cidr 0.0.0.0/0

# Aggiungi regola in entrata (consenti SSH da IP specifico)
aws ec2 authorize-security-group-ingress \
  --group-id sg-0123456789abcdef0 \
  --protocol tcp \
  --port 22 \
  --cidr 203.0.113.0/24

// Esempio di Policy IAM (S3 in sola lettura)
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    }
  ]
}

# Avvia istanze in più AZ
aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type t2.micro \
  --subnet-id subnet-1a \
  --count 1

aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type t2.micro \
  --subnet-id subnet-1b \
  --count 1

# Crea AMI da istanza in esecuzione
aws ec2 create-image \
  --instance-id i-1234567890abcdef0 \
  --name "My-Web-Server-AMI" \
  --description "Server web con Apache configurato"

# Avvia istanza da AMI
aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type t2.micro \
  --key-name my-key-pair

# Crea volume EBS
aws ec2 create-volume \
  --availability-zone us-east-1a \
  --size 100 \
  --volume-type gp3 \
  --iops 3000 \
  --throughput 125

# Collega all'istanza
aws ec2 attach-volume \
  --volume-id vol-1234567890abcdef0 \
  --instance-id i-1234567890abcdef0 \
  --device /dev/sdf

# Formatta e monta (sull'istanza)
sudo mkfs -t ext4 /dev/sdf
sudo mkdir /data
sudo mount /dev/sdf /data

# Rendi permanente (aggiungi a /etc/fstab)
echo "/dev/sdf /data ext4 defaults,nofail 0 2" | sudo tee -a /etc/fstab

# Crea snapshot
aws ec2 create-snapshot \
  --volume-id vol-1234567890abcdef0 \
  --description "Backup prima dell'upgrade"

# Ripristina da snapshot
aws ec2 create-volume \
  --snapshot-id snap-1234567890abcdef0 \
  --availability-zone us-east-1a \
  --volume-type gp3

# Copia snapshot in un'altra regione
aws ec2 copy-snapshot \
  --source-region us-east-1 \
  --source-snapshot-id snap-1234567890abcdef0 \
  --destination-region us-west-2

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-public-bucket/*"
    },
    {
      "Sid": "RestrictByIP",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ],
      "Condition": {
        "NotIpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        }
      }
    }
  ]
}

# Crea file di policy (policy.json)
# Quindi applicalo
aws s3api put-bucket-policy \
  --bucket my-bucket \
  --policy file://policy.json

# Visualizza la policy corrente
aws s3api get-bucket-policy \
  --bucket my-bucket

# Elimina policy
aws s3api delete-bucket-policy \
  --bucket my-bucket

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-website/*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::shared-bucket",
        "arn:aws:s3:::shared-bucket/*"
      ]
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        }
      }
    }
  ]
}

# Visualizza le metriche CPU di EC2
aws cloudwatch get-metric-statistics \
  --namespace AWS/EC2 \
  --metric-name CPUUtilization \
  --dimensions Name=InstanceId,Value=i-1234567890abcdef0 \
  --start-time 2024-11-25T00:00:00Z \
  --end-time 2024-11-25T23:59:59Z \
  --period 3600 \
  --statistics Average,Maximum

# Pubblica metrica personalizzata
aws cloudwatch put-metric-data \
  --namespace MyApp \
  --metric-name PageLoadTime \
  --value 0.5 \
  --unit Seconds

# Crea allarme per CPU alta
aws cloudwatch put-metric-alarm \
  --alarm-name high-cpu-alarm \
  --alarm-description "Avviso quando la CPU supera l'80%" \
  --metric-name CPUUtilization \
  --namespace AWS/EC2 \
  --statistic Average \
  --period 300 \
  --threshold 80 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 2 \
  --dimensions Name=InstanceId,Value=i-1234567890abcdef0 \
  --alarm-actions arn:aws:sns:us-east-1:123456789012:my-topic

# Crea gruppo di log
aws logs create-log-group \
  --log-group-name /aws/application/myapp

# Crea stream di log
aws logs create-log-stream \
  --log-group-name /aws/application/myapp \
  --log-stream-name instance-1

# Inserisci eventi di log
aws logs put-log-events \
  --log-group-name /aws/application/myapp \
  --log-stream-name instance-1 \
  --log-events \
    timestamp=1234567890000,message="Applicazione avviata" \
    timestamp=1234567891000,message="Elaborazione richiesta"

# Interroga i log
aws logs filter-log-events \
  --log-group-name /aws/application/myapp \
  --filter-pattern "ERROR" \
  --start-time 1234567890000

# Crea dashboard con boto3
import boto3
import json

cloudwatch = boto3.client('cloudwatch')

dashboard_body = {
    "widgets": [
        {
            "type": "metric",
            "properties": {
                "metrics": [
                    ["AWS/EC2", "CPUUtilization", {"stat": "Average"}]
                ],
                "period": 300,
                "stat": "Average",
                "region": "us-east-1",
                "title": "Utilizzo CPU EC2"
            }
        },
        {
            "type": "metric",
            "properties": {
                "metrics": [
                    ["AWS/RDS", "DatabaseConnections"]
                ],
                "period": 300,
                "stat": "Sum",
                "region": "us-east-1",
                "title": "Connessioni RDS"
            }
        }
    ]
}

cloudwatch.put_dashboard(
    DashboardName='MyAppDashboard',
    DashboardBody=json.dumps(dashboard_body)
)

# Le metriche CPU, Rete, Disco sono automatiche
# Per la memoria, è necessario l'agente CloudWatch

# Installa l'agente CloudWatch
wget https://s3.amazonaws.com/amazoncloudwatch-agent/amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm
sudo rpm -U ./amazon-cloudwatch-agent.rpm

# Configura l'agente (crea il file di configurazione)
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-config-wizard

# Avvia l'agente
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl \
  -a fetch-config \
  -m ec2 \
  -s \
  -c file:/opt/aws/amazon-cloudwatch-agent/bin/config.json

# Applicazione Python con logging CloudWatch
import boto3
import logging
from datetime import datetime

class CloudWatchHandler(logging.Handler):
    def __init__(self, log_group, log_stream):
        super().__init__()
        self.client = boto3.client('logs')
        self.log_group = log_group
        self.log_stream = log_stream
        
    def emit(self, record):
        log_entry = self.format(record)
        self.client.put_log_events(
            logGroupName=self.log_group,
            logStreamName=self.log_stream,
            logEvents=[{
                'timestamp': int(datetime.now().timestamp() * 1000),
                'message': log_entry
            }]
        )

# Utilizzo
logger = logging.getLogger()
logger.addHandler(CloudWatchHandler('/aws/myapp', 'instance-1'))
logger.info("Applicazione avviata")