Hands-onScenarios

Real-world Scenarios

Practice four common implementation scenarios: deploy on EC2, store files in S3, scale app traffic, and secure access with IAM roles.

Scenario 1: Deploying Web App on EC2

  1. Launch EC2 in public subnet with web Security Group.
  2. Install runtime and app package.
  3. Put ALB in front for production traffic.
# Basic remote setup sketch
ssh -i key.pem ec2-user@PUBLIC_IP
sudo yum update -y
sudo systemctl start nginx
sudo systemctl enable nginx

Scenario 2: Storing Files in S3

  1. Create bucket with encryption enabled.
  2. Upload files via SDK/CLI.
  3. Use presigned URLs for controlled access.
aws s3 cp invoice.pdf s3://company-docs-prod/invoices/invoice.pdf
aws s3 presign s3://company-docs-prod/invoices/invoice.pdf --expires-in 900

Scenario 3: Scaling Application

  1. Create Auto Scaling group from launch template.
  2. Attach to ALB target group.
  3. Scale based on CPU or request count.

Scenario 4: Securing Access with IAM

  1. Create least-privilege role for app service.
  2. Attach role to EC2/Lambda.
  3. Avoid embedding static access keys in code.

Debugging Scenario

Problem

App can read public content but cannot write private objects to S3.

Check object path permission scope in IAM policy and bucket policy deny statements.

Interview Questions

Beginner: Why place ALB before EC2 fleet?
To distribute traffic and remove single-instance dependency.
Intermediate: Why use presigned URL for file download?
Temporary controlled access without exposing bucket publicly.
Scenario: Security team rejects access keys in app config. Alternative?
Use IAM role attachment and short-lived credentials.

Summary

<- PreviousBack to CourseNext Lesson ->