Amazon EC2
Compute · AWS
Explanation pending
1 concept teaches Amazon EC2, so everything below is real — but the written explanation hasn't been authored yet. It appears in the build report as work to do, and nothing invented fills the gap in the meantime.
Properties CloudSynth teachesderived from synthesized templates
These are the CloudFormation properties you actually configure in the lessons — read out of the template the reference solution synthesizes, so this list can't drift from what's taught.
| Resource | Property | Taught in |
|---|---|---|
| AWS::EC2::Instance | AvailabilityZone | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::Instance | IamInstanceProfile | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::Instance | ImageId | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::Instance | InstanceType | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::Instance | NetworkInterfaces | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::Instance | UserData | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::Route | DestinationCidrBlock | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::Route | GatewayId | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::Route | RouteTableId | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::RouteTable | VpcId | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::SecurityGroup | GroupDescription | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::SecurityGroup | SecurityGroupEgress | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::SecurityGroup | SecurityGroupIngress | ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::SecurityGroup | VpcId | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::Subnet | AvailabilityZone | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::Subnet | CidrBlock | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::Subnet | MapPublicIpOnLaunch | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::Subnet | VpcId | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::SubnetRouteTableAssociation | RouteTableId | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::SubnetRouteTableAssociation | SubnetId | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::VPC | CidrBlock | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::VPC | EnableDnsHostnames | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::VPC | EnableDnsSupport | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::VPC | InstanceTenancy | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::VPCGatewayAttachment | InternetGatewayId | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
| AWS::EC2::VPCGatewayAttachment | VpcId | ec2-02-launch-instance, ec2-03-security-group, ec2-04-user-data |
Security & best practice
CloudSynth grades your infrastructure against the same cdk-nag rules real teams run in CI. These are the rules that actually fire on the lessons' templates:
AwsSolutions-EC23The Security Group allows for 0.0.0.0/0 or ::/0 inbound access. Large port ranges, when open, expose instances to unwanted attacks. More than that, they make traceability of vulnerabilities very difficult. For instance, your web servers may only require 80 and 443 ports to be open, but not all. One of the most common mistakes observed is when all ports for 0.0.0.0/0 range are open in a rush to access the instance. EC2 instances must expose only to those ports enabled on the corresponding security group level.
AwsSolutions-EC26The resource creates one or more EBS volumes that have encryption disabled. With EBS encryption, you aren't required to build, maintain, and secure your own key management infrastructure. EBS encryption uses KMS keys when creating encrypted volumes and snapshots. This helps protect data at rest.
AwsSolutions-EC28The EC2 instance/AutoScaling launch configuration does not have detailed monitoring enabled. Monitoring data helps make better decisions on architecting and managing compute resources.
AwsSolutions-EC29The EC2 instance is not part of an ASG and has Termination Protection disabled. Termination Protection safety feature enabled in order to protect the instances from being accidentally terminated.
AwsSolutions-VPC7The VPC does not have an associated Flow Log. VPC Flow Logs capture network flow information for a VPC, subnet, or network interface and stores it in Amazon CloudWatch Logs. Flow log data can help customers troubleshoot network issues; for example, to diagnose why specific traffic is not reaching an instance, which might be a result of overly restrictive security group rules.
For your role
DevOps / Platform
Relevant to this role — role note not yet written.
Solutions Architect
Relevant to this role — role note not yet written.
Build it, graded
Reading is half of it. Everything above you can go build in the browser — your CDK code synthesized and graded against these exact properties.