AWS CLI:
https://blog.ipspace.net/2021/02/vpc-subnets-aws-azure-gcp.html
Note we will use the cli account for Terraform as well (more below). 

aws configure --profile jaimecli
./refresh_mfa.py jaimecli    # to refresh the token with my mfa (it'll be a new entry in ~/.aws/config)
aws --profile jaimecli sts get-caller-identity    # to test all is good. Do not forget the profile

Refreshing workaround for error “…The security token included in the request is expired”: disruptive 

mv .aws/credentials credentials.bak2
aws configure
./refresh_aws_mfa.py jaimecli

SIMPLER SETUP. remove credentials when done and set them up again when start working: 

# or just keep credentials but gran/revoke 'AdministratorAccess' policy during works : 
# https://us-east-1.console.aws.amazon.com/iamv2/home?region=us-east-1#/groups/details/gr2?section=permissions
rm /home/pi/.aws/credentials*
aws configure 
aws sts get-caller-identity
! when logging off
rm /home/pi/.aws/credentials*
aws ec2 describe-vpcs | jq .[]
aws ec2 describe-subnets
aws ec2 describe-internet-gateways
aws ec2 describe-network-acls --query NetworkAcls[1]   # this is just to output the 2nd acl
aws ec2 describe-instances --region us-east-1 | jq -r .Reservations[].Instances[].PublicIpAddress  # lists all addresses: public and elastic
aws ec2 describe-regions --output text


aws ec2 describe-regions  | jq -r "[[.Regions[].Endpoint[]]"     # to parse json output

Find all instances in all regions: 

for region in `aws ec2 describe-regions --profile jaime-personal --output text | cut -f3`
do
     echo -e "\nListing Instances in region:'$region'..."
     aws ec2 describe-instances --profile jaime-personal --region $region
done

Find all IPs (elastic and public) for instances in all regions. Or this other WAY: External Link 

for region in `aws ec2 describe-regions --output text | cut -f3`
do
     aws ec2 describe-instances --region $region | jq -r .Reservations[].Instances[].PublicIpAddress  
done

Find all IPs (elastic and public) for LB in all regions: 

# ALB LOAD BALANCERS
for region in `aws ec2 describe-regions --output text | cut -f3`
do
     aws elbv2 describe-load-balancers --region $region | jq -r .LoadBalancers[].DNSName
done
# ELB LOAD BALANCERS
for region in `aws ec2 describe-regions --output text | cut -f3`
do
     aws elb describe-load-balancers --region $region | jq -r .LoadBalancerDescriptions[].DNSName
done

AWS TERRAFORM
Install Terraform ; Vault

AS14618 ; ASN15509
For a full current amazon IPs, see THIS

There's really one route table attached to each interface and all goes through gre tunnels. Nonetheless, logically there are multiple rts.
All rts are egress except the IG.
Ingress table only happens on the IG. It is specially named rt called 'gateway-rt'


From the IG to the VPC (in case dst is not the vm, ie: firewall in the dmz or similar):

Another use case for the gateway-rt is the network-firewall:
The trick here is for the traffic coming from internet, the gateway-rt routes traffic destined to the vpc prefix to the firewall nic instead (see picture)

Egress Only IG (eigw) is needed for IPv6 because they get the public ipv6 straight in the ec2 interfaces, therefore there is not natgw. eigw is the only way to have an outbound only internet connection.

DIRECTCONNECT [dgw] External Link

LoadBalancers ELB( ALB/NLB):
See External Link

)

TO FIND THE SECURITY GROUP SG FROM AN IP (normally that IP is from an ELB but this works the same for instances):

  1. section-EC2: go to network interfaces and search for that IP. You will get an eni interface, copy the description (an elb description, trim the elb bit)
  2. section-EC2 go to load balancers and paste the descriptio. You will see the lb containing that IP. scroll down and the SG is there ;-)

DNS:
Options:


ROUTE 53

AWS GATEWAY LOAD BALANCER (ipspace)
GWLB is used for NVAs (network virtual appliances) that can be provided by 3rd parties. Geneve tunnels between gwlb and the nvas
Review traffic flow ig has ingress table!

AWS FIREWALL (ipspace)

Ingress tablet Only happens on the IG (that's why we need IG to redirect to the firewall rt (and when using natgw we have peculiar placement of natgw see ipspace:
Flow:

LAN TO AWS VPN TUNNEL:
Meraki to AWS VPN
Always two tunnels to the vgw. If need very high speec (up to 25G), use a EC2-based-vpn (vendor specific).


Cisco Intercloud extender: from private cloud (OVA) format to AWS (AMI format)

CFT (Cloud Formation Templates) Allow to create a whole environment on demand. Consider that we pay for what we use in aws, therefore whatever infrastructure not in used shouldn't be deployed empty.
There are just txt templates that can be invoked via API (by the own dev team and/or the application)·

AWS LIMITS:

More info here

MONITORING:

For my tests:
Instance types: Instance Type (tX X is the number, edition): Price: T3a instances offer an additional 10% cost savings over T3 instances. T3 instances are 10% cheaper than the older T2 instances and offer up to a 30% better price to performance ratio.

To control charges:

STORAGE:

SECURITY FOR PROGRAMATIC ACCESS:
aws_security.pdf slides by from Michael J. Shannon (oreilly presentation aws security crash course)_

REGIONS AND AVAILABILITY ZONES

AWS EDGE LOCATIONS

AUTOESCALE CLOUD INFRASTRUCTURE: AWS autoescaling features only deal with EKS (workers) or EC2 instances. If we want to dynamically allocate other resources like, subnets, directconnects, vpc peerings ans so on, we can use:

Amazon VPC Flow Logs - TODO