Challengeaws
EC2 Operations: SSM, CloudWatch Logs & Metrics — Challenge
Operate an instance without SSH: run commands, ship logs, and alarm on something that matters.
- Time
- 25 min
- Level
- Intermediate
- Objectives
- 4 objectives
- Cost
- Low cost
Before you start
You will need
- AWS CLI v2, configured
- An AWS account
You will be able to
- Administer an instance with no inbound ports open
- Ship application logs to CloudWatch and query them
- Alarm on a symptom rather than on CPU
Cost — Low cost
— one `t3.micro`, and CloudWatch's free tier covers 5 GB of logs and 10 custom metrics. Leave the instance running and expect ~$8/month after the first year.
You are done when
0 of 4
The goal#
Achieve the same outcome as EC2 Operations: SSM, CloudWatch Logs & Metrics, from an empty starting point, without the steps.
An instance has port 22 open to the world, a key everyone shares, and logs that exist only on its disk — so when it is replaced, the evidence goes with it.
All three are avoidable, and the alternatives are free.
What must be true when you are done#
- You ran a command on the instance with no SSH key and no inbound rule.
- Application logs appear in a CloudWatch log group and you can query them.
- An alarm exists on a metric that reflects user impact, and you can justify the threshold.
- You can explain why the default EC2 metrics do not include memory or disk.
Rules#
- Do not open the guided lab until you are finished, or until the same problem has held you up for 20 minutes.
- Documentation is allowed and encouraged.
- Verify every criterion with a command whose output you can read.
If you get stuck#
- What did you expect, exactly?
- What happened instead — the error text, not a paraphrase?
- Which layer is that error from?
- What is the smallest command that proves the layer below is fine?
The concept behind it
Next up
Lab 18 of 58 on the project path