• abbreviation for Elastic Container Service. It is a container management service for containers on a cluster.
  
• Task Definition defines one or multiple containers to construct as a application.
  
• A Task is an instance of task definition.
  
• A Service is used to guarantee that you always have some number of Tasks running at all times. Such as, make sure there are always 3 running task across different zones.
  
• A Cluster is used to manage a collection of resources such as CPU, memory, etc.
  

• Short for Elastic Compute Cloud (Amazon EC2)
  

• Both are cluster service types.
  
• Farget doesn’t need server. It still need docker image.
  
• EC2 need server and allow you to have more control on it.
  

• describes one or more containers, up to 10
  
• blueprint for your application:
  
  • which containers/image to use
    
  • which launch type ?
    
  • which port
    
  • what data volumes should be used with the containers
    
• Different task examples
  
• A task is the instantiation of a task definition within a cluster.
  
• A Service runs and maintains a specified number of tasks.
  

• A logical grouping of resources.
  
• For Fargate type, AWS ECS manages cluster resources automatically.
  
• For EC2, you need to manage a group of container instances.
  

Worker manager relies on two tables.

• app-dummy-service-task-definitions-drdev, its schema:
  

  Pooling

  ScaleTo

  TaskArn

  TaskDef

  • It manages pool. Pool lists all the workers available to use.
    
  • It acts as a plan table (like how much memory I should need). It records:
    
    • For a specific version, how many I should keep it in hot pool.
      
    • For a speicif version, it is used/defined in which ECS task definition.
      
  • The value for TaskArn and TaskDef is generated from worker-pipeline:
    
    • After pushing worker into ECR, a new ECS task definition for worker is generated for new available worker. Worker manager will use this worker-task-definition to star worker.
      

• app-worker-manager-hotpool-drdev, its schema:
  

  UUID

  DT

  Available

  Ip

  Port

  ServiceApiId

  TaskArn

  TaskDefArn

  WorkerVersion

  • It acts as a implementation/progress table for the app-dummy-service-task-definitions-drdev, plan table.
    
    • How to allocate those memory(worker), or which worker version is used in which ECS task instance.
      
    • For example, if the plan table set ScaleTo=6 and Pooling=Y for TaskDef=NX119. Then, this implementation table will add 6 records. They show where those 6 workers have been used in which ECS task instances.
      
  • After “the memory has been allocated”, if there are clients coming in and used those worker (consume some/all those memory). Then, in the next checking point (every 15mins), worker manager will need to allocate new workers as planed.
    
• A related table, app-dummy-service-data-drdev.
  
  • This table records all the client activities which also includes which worker has been used for what purpose.
    

• Think of your office as a multi-story building
  
• Each floor has multiple suites
  
• Each department like HR, Payroll can sit in one floor (or) multiple floors
  
• Every suite has few rooms
  

• Each room has couple of desk where employees work
  

  AWS	Company
  Region	Office building
  Availability Zone	Each floor
  VPC	Each department
  Subnet	Each suite
  IP	Each desk

• When company assign desk to employee vs Launch AWS EC2 instance
  

  Assign desk	Launch EC2 instance
  Which department this employee belongs to	We need to pick which VPC this instance should be deployed to
  Then identifies which floors the department spans across	Then we pick which availability zone (if not, default availability zone)
  Then identifies which suites have open desks	Then we pick the subnet (if not default subnet)
  Assigns one of the open desks to the employee	Then an IP from this subnet gets assigned to our EC2 instance (as private IP)

• Other associated terminologies
  
  • Security groups like access card
    

• What is it?
  
  • Whenever you launch an instance within your AWS account, by default it will be launched into a default VPC and gets public IP and private IP.
    
  • A logical virtual network spanning an entire AWS region (one region – one default VPC, can create multiple VPCs in a region).
    
• Six components are created as default parts of VPC
  
  • VPC CIDR block
    
    • Every VPC is associated with an IP address range that is part of a Classless Inter-Domain Routing (CIDR) block which will be used to allocated private IP addresses to EC2 instances.
      
  • Subnets
    
    • a subnet is associated with only one availability zone (can not span multiple zones)
      
    • However, a zone can host multiple subnets.
      
    • Each subnet in a VPC is associated with an IPv4 CIDR block that is a a subset of the /16 CIDR block of its VPC.
      
  • Internet gateway
    
    • Provide connectivity to outside AWS (internet)
      
    • A VPC must be attached to an Internet gateway to communicate with internet. Only one IGW can be attached to a VPC at a time.
      
    • Bi-direction source and destination network address translation for your EC2 instances.
      
  • Route table
    
    • Every subnet must be associated with a route table.
      
    • If the association is not explicitly defined, then a subnet will be implicitly associated with the main route table.
      
  • Network access control lists (ACLs)
    
  • Security Group
    
  • VPC endpoint
    
• AWS provides security mechanisms for your instances in the form of network ACLs and security groups.
  

• A subnet is a distinct network segment with its own IP address range within the larger VPC CIDR (Classless Inter-Domain Routing) range.
  
• A VPC and have all public or public/private subnet combination.
  
  • A public subnet is defined by its connection (through a Routing Table) to an Internet Gateway (IGW) within your VPC.
    
  • Any subnet without a route to the IGW is considered private.
    
• A private subnet is a subnet which doesn’t have a route to the internet gateway.
  
• Steps to create a public subnet
  
  1. VPC –> create subnet
     
     • select the VPC within which you want to create the subnet
       
     • select availability zone
       
     • enter CIDR block
       
  2. Add an IGW
     
  3. Attach IGW to a VPC
     
  4. Add a route to the IGW from your subnet
     
     • Route Tables –> Create Route Table
       
     • Select your VPC, select “Create”
       
     • Edit the Route Table just created, give it a route to the outside world
       
       • Add another route
         
       • Enter ’0.0.0.0/0’ in Destination (to allow access to any Internet address)
         
       • Enter your IGW ID in the ’Target’ field. Save it.
         
  5. Associate your route table with your subnet
     
     • Select ’Subnet Associations’ (while selecting the route table you created, the sections below show different sections)
       
     • Select the subnets you wish to associate with this route table using the check box and click “save”.
       

• AWS security groups (SGs) are associated with EC2 instances and provide security at the protocol and port access level.
  
• Working much the same way as a firewall:
  
  • a set of rules filter traffic coming into and out of an EC2 instance.
    
• Security groups are specific to a VPC (which VPC the SG will reside).
  

• Before launch
  
  1. identify the subnet where this instance need to be launched into.
     
  2. identify an available zone.
     
• After launch (Once an instance is created within the VPC/Subnet/Availability Zone)
  
  • If the you launch the instance into a subnet that has assign public ip address attribute enabled, a public IP address is assigned to the primary network interface (eth0) of the created instance.
    
  • A public IP is mapped to the primary private IP through NAT. The public IP will change whenever you stop EC2 instance and start it again.
    
  • Notic: that public IP is not the AWS Elastic IP (EIP).
    

• Bastion hosts are instances that sit within your public subnet and are typically accessed using SSH or RDP, as jump server.
  
• Purpose: use SSH to log into other instances (within private subnets) deeper within your VPC.
  
• If you require remote connectivity with your private instances over the public internet, then you need it.
  
• Basic steps to create a bastion host
  
  1. Launch an EC2 instance as you normally would for any other instance.
     
  2. Apply OS hardening as required.
     
  3. Set up the appropriate security groups (SG).
     
  4. Implement either SSH-agent forwarding (Linux connectivity) or Remote Desktop Gateway (Windows connectivity).
     
  5. Deploy an AWS bastion host in each of the Availability Zones you’re using.