aws 培训

s3
dynamodb： https://aws.amazon.com/cn/dynamodb/
new-session-manager： https://aws.amazon.com/cn/blogs/china/new-session-manager/

网关终端节点： 需要建一个网关
接口终端节点： 类似插入一张网卡到你的VPC

实验：

公有子网

subnet-0d597fb95857c117f / PublicSubnetC	10.0.3.0/24	–
subnet-0158e1d139d6dfef9 / PublicSubnetD	10.0.4.0/24	–
subnet-0ee53462e26a5e0cc / PublicSubnetA	10.0.1.0/24	–
subnet-026849a8a6815c31f / PublicSubnetB	10.0.2.0/24	–

私有子网

subnet-085e7190ec48a1542 / PrivateSubnetA	10.0.11.0/24	–
subnet-0eabcffe7f0b9f8f1 / PrivateSubnetB	10.0.12.0/24	–
subnet-0d096c27030e91004 / PrivateSubnetD	10.0.14.0/24	–
subnet-0ec72221887b30030 / PrivateSubnetC	10.0.13.0/24	–

终端节点

实例访问S3

命令行配置

sh-4.2$ cd ~
sh-4.2$ trap 'printf "\n"' DEBUG
sh-4.2$ export PS1="\n[\u@\h \W] $ "

[ssm-user@ip-10-0-1-209 ~] $

[ssm-user@ip-10-0-1-209 ~] $

[ssm-user@ip-10-0-1-209 ~] $

公有子网实例访问

[ssm-user@ip-10-0-1-209 ~] $ aws s3 ls s3://qls-5195421-24fe3cc664e82b06-labbucket-19yboe2260ovl

2021-12-15 03:35:03 9 demo.txt

[ssm-user@ip-10-0-1-209 ~] $

sh-4.2$ aws ec2 describe-vpc-endpoints --query 'VpcEndpoints[*].ServiceName'
[
"com.amazonaws.us-west-2.ec2messages",
"com.amazonaws.us-west-2.cloudformation",
"com.amazonaws.us-west-2.ssmmessages",
"com.amazonaws.us-west-2.ssm"
]
sh-4.2$

私有子网实例访问s3通过vpc网关节点

[ssm-user@ip-10-0-11-87 ~] $ aws s3 ls

2021-12-15 03:33:25 ql-cf-templates-1639539204-4f66d8933d13c874-us-west-2
2021-12-15 03:34:03 qls-5195421-24fe3cc664e82b06-labbucket-19yboe2260ovl
2021-12-15 03:33:35 qls-5195421-24fe3cc664e82b06-labloggingbucket-5lvgsdsg0sir
2021-12-15 03:33:28 qltrail-lab-11502-1639539206

[ssm-user@ip-10-0-11-87 ~] $

ssm-user@ip-10-0-11-87 ~] $ aws s3 cp s3://qls-5195421-24fe3cc664e82b06-labbucket-19yboe2260ovl/demo.txt ~/

download: s3://qls-5195421-24fe3cc664e82b06-labbucket-19yboe2260ovl/demo.txt to ./demo.txt

[ssm-user@ip-10-0-11-87 ~] $ ls -alh

total 16K
drwx------ 3 ssm-user ssm-user  90 Dec 15 05:43 .
drwxr-xr-x 4 root     root      38 Dec 15 05:27 ..
drwxr-xr-x 2 ssm-user ssm-user  20 Dec 15 05:30 .aws
-rw-r--r-- 1 ssm-user ssm-user  18 Jul 15  2020 .bash_logout
-rw-r--r-- 1 ssm-user ssm-user 193 Jul 15  2020 .bash_profile
-rw-r--r-- 1 ssm-user ssm-user 231 Jul 15  2020 .bashrc
-rw-r--r-- 1 ssm-user ssm-user  88 Dec 15 04:57 demo.txt

[ssm-user@ip-10-0-11-87 ~] $

存储访问策略配置

cd ~
cat <<EOT >> policy.json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:List*",
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::<LabBucket>",
                "arn:aws:s3:::<LabBucket>/*"
            ]
        },
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::<LabLoggingBucket>",
                "arn:aws:s3:::<LabLoggingBucket>/*"
            ]
        }
    ]
}
EOT



aws ec2 modify-vpc-endpoint --vpc-endpoint-id ${vpcEndpointId} --policy-document file://policy.json





trap 'printf "\n"' DEBUG
export PS1="\n[\u@\h \W] $ "
aws configure

跨账户授权