Cloud computing is an on-demand computing that provides multi-tenant or dedicated computing resources, such as compute, storage, and network that are delivered to users over the network.

Network in the form of internet or LAN is based on the deployment model of the cloud. According to NIST's definition of cloud computing, it has cloud deployment models and cloud service models.

Cloud deployment models defines the way resources are deployed, that is, accessible over the LAN or accessible over the internet. There are four cloud deployment models:

1. Public cloud that is accessible over the internet
2. Private cloud that is accessible over LAN and owned by an organization
3. Community cloud where resources are shared by specific set of organizations that share similar types of interests
4. Hybrid cloud that combines two or more deployment models to form a cloud based on specific use cases such as database on premise due to security reasons

Cloud service model defines the way cloud resources are used considering the flexibilities or options provided to the users. There are three cloud service models:

1. Infrastructure as a Service (IaaS): Resources such as compute, storage, and network are accessible to users. Security and control is in the hands of users. The cloud service provider plays a limited role in resource management in this service model.
2. Platform as a Service (PaaS): Users gets a platform where he or she can deploy a package directly without worrying about setting up runtime environment. Security and control is in the hands of cloud service provider. Users can do some configuration for versions of web server or enabling logs or setting up load balancers, and so on. Users play a limited role in resource management in this service model.
3. Software as a Service (SaaS): User creates an account, and all services are available directly. Office 365, Google Docs, and Zoho Docs are some popular examples of SaaS. The cloud service provider or service provider is responsible for resource management in this service model.

Cloud computing has a few characteristics which are significant such as the multi-tenancy, pay as you go billing model that is similar to electricity billing, on-demand self service, resource pooling for better utilization of cloud resources, rapid elasticity for scaling up and scaling down instances that are served in case of IaaS or PaaS based on needs in an automated manner, and measured services for billing.

There are many cloud service providers providing public cloud services in the market. However, among all the providers, Amazon Web Services (AWS) has established itself as a leader in terms of innovation and services it provides.

It all started in 2006 when AWS started providing infrastructure services.

Now, AWS services are utilized in more than 190 countries all over the world and many research firms have announced AWS as a leader in the cloud space as well.

The AWS Cloud operates in 16 geographic Regions with 44 Availability Zones around the world. 

A region is a location in any part of the world while Availability Zones (AZs) are separate data centers available in a specific region.

Each region is isolated from another region, and each Availability Zone is planned as an independent failure zone to support highly Available Resources, Fault-Tolerant Resources, and Scalable Application Architecture.

Security in AWS is a shared responsibility based on the cloud service model used by the customer or user. In AWS, physical resources, such as servers, storage, and network, are managed by the AWS, and users need not worry about it as AWS has already put in best practices and it is transparent about it.

It is up to you to configure security in the AWS as per the proven best practices available for the AWS infrastructure.

Users can configure security groups, access control lists, Virtual Private Cloud (VPC), and identity and access management to make the resources in cloud more secure.

Compliance is extremely important for assurance of security and protection. Security and compliance both are shared responsibilities for AWS and  the AWS customer based on the usage of cloud service model used by the customer. AWS complies to SOC 1/ISAE 3402, SOC 2, SOC 3, FISMA, DIACAP, and FedRAMP, PCI DSS Level 1, ISO 9001, ISO 27001, ISO 27018, and so on.

Amazon EC2 is a web service. Remember, Amazon Web Services?

Amazon EC2 provides compute services in the Amazon Cloud.

Is it easy to get your hands on it?

Yes; create an account and use free tier to create a simple instance that is allowed in the free tier:

You need to follow these steps to create an instance:

1. Go to aws.amazon.com and log in with the credentials.
2. Click on Services in the top-bar.

3. Select EC2 from the Compute services available in AWS Portal.
4. Amazon EC2 dashboard provides details related to a number of running instances, Elastic IPs, Volumes, Key Pairs, Snapshots, Load Balancers, Security Groups, Service Health, Supported Platforms, Default VPC-related information, and so on.

5. Click on the Launch instance and follow the simple wizard to create an instance.
6. If you create an instance, the EC2 dashboard will give complete details of your Amazon EC2 instance.
7. Click on the Instances in EC2 dashboard to get details on the all the instances that are created in Amazon EC2.

You can edit instance configuration, restart instance, or terminate instance from the Action menu available in the EC2 dashboard.

Instances come in different types based on usage and based on pricing:

A security group is a virtual firewall. It manages the traffic flow from and to AWS instances. It is easy to associate security group with instances in AWS as you can do it while creating an instance. You can assign up to five security groups at the time of launching instance or after launching the instance too. Each security group can serve one or more instances. Security groups are associated with the primary network interface (eth0) of an instance.

Each AWS account comes with a default security group for each VPC and for each region. By default, instances are associated with default security group. Default security group can't be deleted, and it allows all inbound traffic from other instances associated with the default security group and all outbound traffic from the instance.

Let's try to create a security group and see what exactly can be done.

1. Go to EC2 or VPC dashboard Network & Security | Security Groups  click on Create Security Group.
2. Provide security group name and select VPC to which the security group belongs.
3. You need to configure security rules for inbound and outbound traffic, and based on this, traffic is controlled with the use of security group in AWS.  By default, a security group includes an outbound rule that allows all outbound traffic:

4. Click on Add Rule and select Type, Protocol, Port Range, Source, and Description.
5. You can create one or multiple rules based on the requirements.

6. Click on Create and verify the security group in EC2 Dashboard or VPC Dashboard.

If the instance or the web server is not accessible using the putty or browser, then the first step to troubleshoot the issue is to figure out whether everything is fine with the security group and whether the appropriate rules are configured or not.

If you change the inbound or outbound traffic rules, then it will be applied to the instances immediately.

In this section, we will have an overview of networking services and then we will cover them in detail in the coming chapters.

Let's start with Amazon Virtual Private Cloud.

Amazon Virtual Private Cloud (Amazon VPC) is more secure because it allows you to create instances in a logically isolated virtual network.

The following screenshot shows few components that are important in the Amazon VPC:

AWS Account supports EC2 instances in VPC only. Now the question can be, do you need to create a VPC the moment you create your account?

The answer is no. Default VPC is available in the Amazon VPC. If you delete default VPC, then you cannot restore it. You need to contact AWS Support.

Default VPC contains the following:

• VPC with a size /16 IPv4 CIDR block (172.31.0.0/16); it means 65,536 private IPv4 addresses. For more details on CIDR, visit: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing.
• Default subnet /20 in each Availability Zone; it means 4,096 addresses per subnet.
• One internet gateway.
• A main route table for default VPC.
• Default security group and associate it with your default VPC.
• Default network access control list (ACL).

1. Click on Your VPCs in the VPC Dashboard
2. Verify the VPC ID, State, IPv4 CIDR, Route table, Network ACL, and so on

The subnet can be defined as a section of a VPC's IP address range where you can place groups of isolated compute resources.

3. Click on Subnet on the left sidebar in VPC Dashboard. Below Subnets, we have Route tables, Internet Gateways, NAT Gateways, and Elastic IP addresses

• Route Tables help us define subnets that need to be routed to the Internet Gateway, the virtual private gateway, or other instances.
• Internet Gateway allows connection to the public internet from Amazon VPC.
• NAT Gateway represents a highly available and managed Network Address Translation (NAT) service for resources in a private subnet to access the internet. NAT gateway is created in public subnet.
• An Elastic IP address is a public static IPv4 address, so you can access the resource. If elastic IP address is not allocated with a running instance, then hourly charge has to be paid by the user.

In the next section, we will discuss Amazon CloudFront.

Amazon CloudFront is a CDN, a content delivery network service. It helps speedy content delivery to the user with the use of edge locations established by AWS.

Go to AWS Management Console | Services | Networking & Content Delivery | CloudFront:

The following sequence takes place when the user requests static or dynamic content:

1. If the content is available in the edge location nearby the user, CloudFront delivers the content immediately
2. If the content is not available in the edge location nearby the user, CloudFront requests content from the source, such as Amazon S3 bucket or an HTTP server, and deliver to the user

In the next section, we will discuss Amazon Route 53.

Amazon Route 53 is a domain name or DNS service. It is a reliable and scalable service that has DNS servers distributed globally. It scales automatically to manage the spike in the DNS queries so services are robust.

Let's note down what services it provides to a user. The following things can be achieved using Amazon Route 53:

• Highly available domain name system
• Domain name registration
• Health checks
• Scalable domain name system

Go to AWS Management Console | Services | Networking & Content Delivery | Route 53:

In the next section, we will cover AWS Direct Connect in brief.

Can we connect to AWS from internal network of an organization without accessing the internet? The answer is yes!

It's quite simple! Connect the internal network to the AWS Direct Connect location using standard 1 Gigabit or 10 Gigabit Ethernet fiber-optic cable. Once this is achieved, you can create virtual interfaces to AWS services.

Go to AWS Management Console | Services | Networking & Content Delivery | Direct Connect:

In the next section, we will cover Elastic Load Balancing in brief.

Elastic Load Balancing/Elastic Load Balancers (ELB) can be used to distribute traffic to multiple targets. ELB can be configured on Amazon VPC and Amazon Elastic Beanstalk. It distributes traffic to only healthy targets.

There are two types of load balancers that are supported by Elastic Load Balancing:

• Application Load Balancers
• Classic Load Balancers

Go to AWS Management Console | Services | EC2 | EC2 Dashboard | Load Balancing | Load Balancers:

In the next section, we will cover Auto Scaling in brief.

Auto scaling creates a scenario where you have an appropriate number of instances or targets to serve the traffic load based on certain conditions. Based on configured Auto Scaling policies, instances are increased and decreased on demand.

Go to AWS Management Console | Services | EC2 | EC2 Dashboard | Auto Scaling | Launch Configurations or Auto Scaling Groups:

In the next section, we will cover AWS Billing Dashboard.

How do we find how much it has cost for the usage of AWS resources? In AWS portal, you can easily find it. AWS Billing and cost management provides detailed information on your usage of resources, budget, notifications, and to pay the bill.

In AWS portal, click on the username at the top-right bar and select My Billing Dashboard.

Billing & Cost Management Dashboard provides Spend Summary and Month-to-Date Spent by service as well.

Spend Summary provides a forecast also regarding the cost of the current month:

It is very easy to understand at a first glance regarding what services have cost you the money.

Click on Cost Explorer to get a monthly EC2 running hours, costs, and usage.

On the Reports drop-down menu, select Daily costs to get details of cost on a daily basis, as shown in the following screenshots:

Click on the Bill Details in the Month-to-Date spend by service section. You can expand all services to get more details on the cost incurred by the usage of it:

Click on the drop-down arrow of each service, and you will get the complete details, as shown in the following screenshot:

You can also manage budgets from My Billing Dashboard. You can create and manage budgets, refine your budget using filters, and add notifications to a budget.

The Payment Methods section will allow you to edit and remove Payment Methods and also making payments.

You can also configure Preferences to get the following:

• Receive PDF invoice by email
• Receive billing alerts
• Receive billing reports

In the next section, we will see a sample architecture using Amazon VPC.

Is there any way to find a cost comparison of the application hosted on-premises and on the application hosted in AWS environment?

The answer is yes!

1. Go to https://aws.amazon.com/tco-calculator/ and click on Launch the TCO Calculator or go to https://awstcocalculator.com/.

Let's see what the cost comparison is for three web servers with 4 cores and 8 GB Memory and 1 TB storage.

2. Click on Calculate TCO.

3. It will provide a 3 year's cost breakdown.

Scroll down to Environment details and get more details on the comparison of cost calculation:

In the Cost Breakdown section, you will get on-premise and AWS cost breakdowns for server or instances and storage in charts:

In the next section, we will discuss architecture—compute and networking services for sample application in brief.

The following is a simple and sample architecture for compute and networking services. It is just for understanding purposes:

>

Preceding is the  sample architecture for the VPC environment with the following features:

• The different Availability Zones for Different tiers for high availability and to avoid single point of failure
• Auto Scaling to satisfy varied traffic load
• Different subnets (public and private subnet) for unique routing requirements
• Highly available NAT gateway to provide internet access to a private subnet
• Security groups to control the traffic flow

Well done! We are at the end of the chapter, and let's summarize what we covered in this chapter.

We covered Core Concepts of AWS, such as Regions and Availability Zones, Security and Compliance, Amazon Elastic Compute Cloud (Amazon EC2), and Security groups.

In this chapter, we covered brief details on Networking Services, such as Amazon Virtual Private Cloud, Amazon CloudFront, Amazon Route 53, AWS Direct Connect, Elastic Load Balancing, Auto Scaling, Billing Dashboard, AWS Total Cost of Ownership (TCO) Calculators, Architecture: Compute and Networking services for Sample Application.

In the next chapter, we will cover Amazon Virtual Private Cloud in detail.