Welcome back to BackSpace Academy. In this lecture and follow-up lab 2
we're going to be looking at how we can connect to our AWS services and 3
resources using a command-line interface. So instead of having to use the AWS 4
management console as we've done before, we can use text commands to achieve a 5
lot of what we would normally do with that graphical user interface 6
we'll start off by looking at the backend service that makes this happen and 7
that is the AWS application programming interface or API for short 8
then we'll look at the number of different command-line interface applications 9
that we can install on our computer that will allow remote access to those services 10
and resources. We'll also look at the AWS Cloud 9 service and we'll discuss why I 11
primarily use this for anything to do with the command line interface and 12
the security concerns around not using AWS Cloud 9, and finally we'll finish up by 13
having a lab on using the Cloud 9 service with the command line interface 14
When you're using the AWS management console like we've done in the past 15
AWS uses an application programming interface to enable that communication 16
between your remote computer and the AWS services and resources. 17
How that works is that the AWS management console that you have been using is simply an 18
application that is running on your browser and it is sending HTTP calls 19
backwards and forwards to this application programming interface 20
back-end on AWS. Now the documentation is available for the AWS API for many services 21
for example for the s3 API or the EC2 query API but not for everything 22
So if you wanted to create your own application and there wasn't a software 23
development kit for that language you're using, I can't imagine what language that would be 24
because there's certainly a very broad range of software development kits 25
that are available but it is possible for you to send HTTP calls to 26
the API provided you have that authentication done beforehand to 27
actually do that. So it provides that back end mechanism for that communication 28
and it's utilized again by the AWS management console and we will also use it 29
with the AWS command line interface. So that again is an application that's 30
running on your remote computer that will be sending HTTP calls to this API 31
back-end. Also there are a number of software development kits that wrap the 32
API up into libraries that can be used with for example JavaScript for PHP and Python 33
and the like and so you don't have to actually know how to do these 34
HTTP calls you just need to know how to use that software development kit and 35
the documentation for that is of course brilliant and, many other AWS services 36
also use the API for communication within the AWS cloud. API calls to AWS 37
can only be made by authenticated users with valid security credentials for 38
example if you're using the management console you would have been 39
authenticated through your username and password. If you're using the command 40
line interface application on a remote computer then you would need to download 41
an access key ID and secret and use that for authentication with AWS. 42
If you're using an application on your browser that has been developed using one of the 43
many AWS software development kits then normally you would be issued with IAM 44
temporary credentials. What that means is that this 45
application that you have may use login for Google, may use it login for Facebook 46
or whatever and it might use your Google account or your Facebook account to 47
authenticate you and then that will be issuing temporary credentials for you to 48
access the AWS resources through that browser-based application, and finally we 49
can actually log all of these API calls using the AWS CloudTrail service 50
that's great if we have any security issues or any performance issues 51
we can go back through those CloudTrail logs and make sure that there's nothing 52
untoward going on there. A picture tells a thousand words. So how does this all work? 53
down the bottom there we've got our AWS cloud that we want to connect to using 54
our remote computer and so that remote computer will be sending HTTP API calls 55
to the AWS cloud to get information from the AWS cloud and to issue instructions 56
to the AWS services. So the first way we can do it there is we could have an IAM user 57
and that user will have an username and password and they can use that 58
username and password to login to the AWS management console that is running 59
inside of their browser and the AWS management console running on that 60
remote computer will then issue those API calls to the AWS cloud 61
the second option there is that we could have an IAM user download IAM 62
credentials in the form of an access key and a secret to go with that access key 63
and so if that is presented to the AWS command line interface application that 64
is running on that remote computer that will authenticate that IAM user and that 65
IAM user will then be able to issue command line interface commands to the 66
AWS Cloud, and finally if we've got an external user, so this user 67
doesn't have an AWS account for example you might have an application 68
like Dropbox for example and you have millions of users and it's not practical 69
it's actually not even possible to create a million IAM users so you need 70
to be able to somehow authenticate those users and to allow those users to 71
temporarily access the AWS cloud, so you would use an application that is running 72
using the software development kits and that application could authenticate you 73
using an OAuth authentication service for example it could use the AWS Cognito 74
service it could use Google login with Google or login with Facebook to 75
authenticate you and from that authentication you will have limited and 76
temporary access through that remote computer to the AWS cloud. Now to start using 77
the command-line interface the first thing that you need to do is that 78
you need to have an application running on your computer that can allow that to 79
happen. So the AWS standard CLI application it's available for download 80
for Windows Mac and Linux and it allows those API commands to be sent to AWS 81
using the Windows command line or a Linux or Mac terminal application 82
there is also the AWS Shell application which is a cross-platform stand-alone 83
integrated shell environment that is written in Python that can provide even 84
more features and more automation features to the CLI application and 85
finally we've also got the AWS tools for Windows PowerShell 86
so you can run CLI commands within Windows PowerShell and at the same time 87
use all of those automation tools that are available within PowerShell 88
If you want to have a look at all of those CLI tools that are available just 89
go to the AWS website aws.amazon.com/CLI 90
the AWS Cloud9 service is an integrated development environment or IDE for short 91
that is running on an ec2 instance inside one of your VPCs and you access 92
it through the AWS management console the Cloud9 service has a lot of tools 93
already installed, so it also has the AWS CLI application pre-installed now I 94
predominantly use the AWS Cloud9 service for anything that requires CLI 95
commands to be sent to AWS cloud, the reason being is that it provides 96
increased security because I don't have to download IAM credentials and have 97
them sitting on a computer to be able to access that service and that's very 98
important because if those credentials are compromised someone can not only use it 99
with the CLI application they could create their own application using a 100
software development kit, use those IAM credentials and could run bad malicious 101
scripts that could cause a massive amount of damage and a massive amount of 102
financial impact to your AWS infrastructure. Now you may well ask but 103
what about the username and password that were used to connect to the 104
management console? What if that gets compromised? Doesn't it have the same effect? 105
and yes you are correct but coming up in the IAM section of this course 106
we'll be talking about how to implement multi-factor authentication on IAM 107
accounts. So what that means is that if these username and passwords are 108
compromised they cannot be used to log into your account because there is a 109
secondary a multiple factor authentication process that also needs 110
to be followed 111
Ok so that brings us to the end of our discussion on the command line interface 112
coming up next we're going to be getting our 113
hands-on with the command-line interface so I look forward to seeing you in the 114
lab.