Cloud Fundamentals (AWS / Azure / GCP)

# Check your current identity
aws sts get-caller-identity

# List IAM users
aws iam list-users

# List IAM roles
aws iam list-roles

# Who has access to what (for a user)
aws iam list-attached-user-policies --user-name alice
aws iam list-user-policies --user-name alice

# Check effective permissions (IAM Policy Simulator via CLI)
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/alice \
  --action-names s3:GetObject \
  --resource-arns arn:aws:s3:::my-bucket/file.txt

# Generate least-privilege policy from CloudTrail
# Use IAM Access Analyzer to see unused permissions

# Launch instance (aws CLI)
aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type t3.medium \
  --key-name my-key-pair \
  --security-group-ids sg-12345 \
  --subnet-id subnet-12345 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=my-server}]'

# List instances
aws ec2 describe-instances \
  --query 'Reservations[].Instances[].[Tags[?Key==`Name`].Value|[0],InstanceId,State.Name,PublicIpAddress]' \
  --output table

# Stop / start / terminate
aws ec2 stop-instances --instance-ids i-1234567890abcdef0
aws ec2 start-instances --instance-ids i-1234567890abcdef0
aws ec2 terminate-instances --instance-ids i-1234567890abcdef0

# Create security group
aws ec2 create-security-group \
  --group-name web-sg \
  --description "Web server security group" \
  --vpc-id vpc-12345

# Allow inbound HTTPS from anywhere
aws ec2 authorize-security-group-ingress \
  --group-id sg-12345 \
  --protocol tcp \
  --port 443 \
  --cidr 0.0.0.0/0

# Allow SSH from specific IP only
aws ec2 authorize-security-group-ingress \
  --group-id sg-12345 \
  --protocol tcp \
  --port 22 \
  --cidr 203.0.113.10/32

# Allow traffic from another security group (e.g., from load balancer SG)
aws ec2 authorize-security-group-ingress \
  --group-id sg-app \
  --protocol tcp \
  --port 8080 \
  --source-group sg-alb

# Key components:
# Internet Gateway (IGW) — allows public subnet traffic to/from internet
# NAT Gateway — allows private subnet instances to reach internet (outbound only)
# Route Table — rules for where to send traffic

# Check route tables
aws ec2 describe-route-tables --filters "Name=vpc-id,Values=vpc-12345"

# Create bucket
aws s3 mb s3://my-unique-bucket-name --region us-east-1

# Upload file
aws s3 cp localfile.txt s3://my-bucket/prefix/file.txt

# Upload directory
aws s3 sync ./local-dir s3://my-bucket/prefix/

# Download
aws s3 cp s3://my-bucket/file.txt ./

# List contents
aws s3 ls s3://my-bucket/
aws s3 ls s3://my-bucket/ --recursive

# Delete
aws s3 rm s3://my-bucket/file.txt
aws s3 rm s3://my-bucket/prefix/ --recursive

# List RDS instances
aws rds describe-db-instances \
  --query 'DBInstances[].[DBInstanceIdentifier,DBInstanceStatus,Engine,DBInstanceClass]' \
  --output table

# Create parameter group snapshot (before changing DB params)
aws rds create-db-snapshot \
  --db-instance-identifier my-db \
  --db-snapshot-identifier pre-migration-snapshot-$(date +%Y%m%d)

# Authenticate Docker to ECR
aws ecr get-login-password --region us-east-1 | \
  docker login --username AWS --password-stdin \
  123456789012.dkr.ecr.us-east-1.amazonaws.com

# Create repository
aws ecr create-repository \
  --repository-name myapp \
  --image-scanning-configuration scanOnPush=true \
  --encryption-configuration encryptionType=AES256

# Tag and push image
docker build -t myapp:latest .
docker tag myapp:latest 123456789012.dkr.ecr.us-east-1.amazonaws.com/myapp:1.0
docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/myapp:1.0

# List images
aws ecr list-images --repository-name myapp

# Lifecycle policy (auto-delete old images)
aws ecr put-lifecycle-policy \
  --repository-name myapp \
  --lifecycle-policy-text '{
    "rules": [
      {
        "rulePriority": 1,
        "description": "Keep last 10 images",
        "selection": {
          "tagStatus": "any",
          "countType": "imageCountMoreThan",
          "countNumber": 10
        },
        "action": { "type": "expire" }
      }
    ]
  }'

# Find unattached EBS volumes
aws ec2 describe-volumes \
  --filters "Name=status,Values=available" \
  --query 'Volumes[].[VolumeId,Size,CreateTime]' \
  --output table

# Find old snapshots
aws ec2 describe-snapshots --owner-ids self \
  --query 'Snapshots[].[SnapshotId,VolumeSize,StartTime,Description]' \
  --output table

# Check for idle EC2 instances (CPU < 5% over 2 weeks)
# Use AWS Cost Explorer and Compute Optimizer
aws compute-optimizer get-ec2-instance-recommendations