🖥️ Amazon EC2 शाळेच्या पद्धतीने शिका

# the 60-second wow — every lesson, live:
git clone https://github.com/BaluRaut/learn-ec2-school.git && cd learn-ec2-school
python3 ec2/demo.py                # 12 lessons: guest lists, credits, a fleet, a reception, the bill
python3 ec2/test_ec2.py            # 12 checks, one per lesson

तुम्हाला काय दिसायला हवे (छाटलेले — यश असे दिसते):

═══ regions ═══
── a region is a district; each Availability Zone is separate buildings with their own power and network
   🏫 all in AZ-a    AZ-a loses power → 0 of 3 desks still serving 💥 site down
   🏫 spread a/b/c   AZ-a loses power → 2 of 3 desks still serving ✅
   a desk (instance) is rented by the second; stopped = no compute bill, the disk (EBS) still bills

═══ types ═══
── the letter is the family, the number the generation, g = Graviton (ARM), then the size
   t3.micro    2 vCPU   1 GiB  burstable 🛵   ~$0.0104/h
   t4g.small   2 vCPU   2 GiB  burstable 🛵   ~$0.0168/h
   m7i.large   2 vCPU   8 GiB  general 🚗     ~$0.1008/h
   m7g.large   2 vCPU   8 GiB  general 🚗     ~$0.0816/h
   c7i.xlarge  4 vCPU   8 GiB  compute 🏎️    ~$0.1785/h
   c7g.xlarge  4 vCPU   8 GiB  compute 🏎️    ~$0.1450/h
   r7i.large   2 vCPU  16 GiB  memory 🚚      ~$0.1323/h
   r7g.large   2 vCPU  16 GiB  memory 🚚      ~$0.1071/h
── t3.micro is a scooter with a fuel tank: CPU credits (earn 12/h, hold up to 288; 1 credit = 1 vCPU·minute at 100%)
   hour 1: balance  36.0 credits · you get 100% CPU
   hour 2: balance   0.0 credits · you get 10% CPU  ← tank empty: throttled to the 10% baseline
   hour 3: balance   0.0 credits · you get 10% CPU  ← tank empty: throttled to the 10% baseline

═══ launch ═══
── a launch template = the desk's recipe card: image (AMI) + type + disk + badge + guest list + first-boot script
   ImageId              "ami-0abc1234example"
   InstanceType         "t4g.small"
   IamInstanceProfile   {"Name": "school-web"}
   SecurityGroupIds     ["sg-0web"]
   UserData (runs once, as root, on first boot):
      # Runs ONCE, as root, on the desk's first boot (cloud-init). Everything a new desk needs, written down.
      dnf install -y nginx
      echo "<h1>school web desk $(hostname)</h1>" > /usr/share/nginx/html/index.html
      systemctl enable --now nginx
   every desk from this card is identical — a broken desk is replaced, never repaired by hand

═══ storage ═══
── what survives what (root volume with DeleteOnTermination = true, one extra data volume, one instance store)
                 root EBS    data EBS  instance store
   reboot        ✅           ✅         ✅
   stop / start  ✅           ✅         ❌ wiped
   terminate     ❌ deleted   ✅ kept    ❌ wiped
── snapshots are incremental: 6 GB first copy + 0.5 GB changed/day × 6 more days = 9.0 GB stored ≈ $0.45/month
   a snapshot lives in S3-backed storage and restores into ANY AZ in the region — the volume itself lives in one AZ

═══ network ═══
── the security group (guest list at the desk, stateful)
   ✅ 198.51.100.9   → :443  sg-web: inbound rule '443 from anywhere'
   🚫 198.51.100.9   → :22   sg-web: no inbound rule matches — dropped (the sender sees a timeout)
   ✅ 203.0.113.5    → :22   sg-web: inbound rule '22 from the office laptop'
   ✅ reply 443 → 198.51.100.9:51000   sg-web: reply to a remembered conversation — stateful, no rule needed
── the network ACL (the wing door, stateless — the reply needs its own rule)
   without an ephemeral-port rule   request in: ✅ (acl-public inbound rule 100: ALLOW) · reply out: 🚫 (acl-public outbound: no rule matches → the final * DENY)
   with 1024–65535 out              request in: ✅ (acl-public inbound rule 100: ALLOW) · reply out: ✅ (acl-public outbound rule 110: ALLOW)

═══ connect ═══
── three ways to get a shell on the desk
   SSH with a key pair    port: 22 open (to your IP)        key: a .pem you must guard            audit: only the OS log
   EC2 Instance Connect   port: 22 open (to AWS's range)    key: a one-minute key pushed by IAM   audit: CloudTrail
   Session Manager        port: none — the agent calls out  key: none — IAM decides               audit: CloudTrail + session logs
   for anything real: Session Manager, and a security group with no port 22 at all

═══ metadata ═══
── every desk can ask 'who am I?' at the metadata address; a launch template decides how safely
   📄 risky.json: 6 finding(s)
      ⚠️ metadata service v2 not required → set "MetadataOptions": {"HttpTokens": "required"} — session-token mode only
      ⚠️ metadata hop limit above 2 → keep HttpPutResponseHopLimit at 1 (2 if containers on the host need it)
      ⚠️ root volume not encrypted → set "Encrypted": true on every EBS volume (or turn on EBS encryption by default for the account)
      ⚠️ no instance profile (the desk has no badge) → attach an instance profile with a narrow role instead of putting keys on the desk
      ⚠️ a key pair for SSH → prefer Session Manager: no key to lose and no port 22 to open
      ⚠️ gp2 instead of gp3 → gp3 is cheaper per GB and lets you set IOPS separately
   📄 web.json: ✅ nothing risky
   the badge (instance profile → role) is how the desk gets short-lived credentials — never paste keys onto it

═══ pricing ═══
── one m7g.large for a month (approximate us-east-1 prices — check the pricing page before trusting them)
   on-demand                  compute $  59.57 + 20 GB gp3 $1.6
   1-yr Compute Savings Plan  compute $  42.89 + 20 GB gp3 $1.6
   3-yr Compute Savings Plan  compute $  29.78 + 20 GB gp3 $1.6
   spot (typical)             compute $  17.87 + 20 GB gp3 $1.6
   office hours only (8 h × 22 days) on-demand: compute $14.36 + disk $1.6 — a stopped desk still pays for its disk
   Graviton vs Intel, same size: m7g $0.0816/h vs m7i $0.1008/h

═══ scaling ═══
── an Auto Scaling group: min 2, max 6, target 50% average CPU, new desks warm up for 2 minutes
   min  1 demand  90 · desks 2 (2 serving) · CPU  45%  
   min  2 demand 100 · desks 2 (2 serving) · CPU  50%  
   min  3 demand 160 · desks 4 (2 serving) · CPU  80%  📈 CPU 80% > target 50% → launch 2 (warming up 2 min)
   min  4 demand 240 · desks 4 (2 serving) · CPU 100%  
   min  5 demand 300 · desks 6 (4 serving) · CPU  75%  📈 CPU 75% > target 50% → launch 2 (warming up 2 min)
   min  6 demand 320 · desks 6 (4 serving) · CPU  80%  
   min  7 demand 300 · desks 6 (6 serving) · CPU  50%  
   min  8 demand 200 · desks 5 (5 serving) · CPU  33%  📉 quiet → scale in ONE desk (then wait 3 min — slowly, on purpose)
   min  9 demand 120 · desks 5 (4 serving) · CPU  30%  💥 a desk fails its health check → terminated; a fresh one launches and warms up
   min 10 demand 100 · desks 5 (4 serving) · CPU  25%  
   min 11 demand  80 · desks 4 (4 serving) · CPU  16%  📉 quiet → scale in ONE desk (then wait 3 min — slowly, on purpose)
   min 12 demand  80 · desks 4 (4 serving) · CPU  20%  
   min 13 demand  80 · desks 4 (4 serving) · CPU  20%  
   min 14 demand  80 · desks 3 (3 serving) · CPU  20%  📉 quiet → scale in ONE desk (then wait 3 min — slowly, on purpose)
   min 15 demand  80 · desks 3 (3 serving) · CPU  27%  

═══ balancing ═══
── a load balancer checks every 10 s; 2 failures → unhealthy, 3 passes → healthy again; traffic only to healthy desks
   t=10s  web-a:✅ 4  web-b:✅ 4  web-c:✅ 4
   t=20s  web-a:✅ 4  web-b:✅ 4  web-c:✅ 4
   t=30s  web-a:✅ 6  web-b:🚫 0  web-c:✅ 6
   t=40s  web-a:✅ 6  web-b:🚫 0  web-c:✅ 6
   t=50s  web-a:✅ 6  web-b:🚫 0  web-c:✅ 6
   t=60s  web-a:✅ 6  web-b:🚫 0  web-c:✅ 6
   t=70s  web-a:✅ 4  web-b:✅ 4  web-c:✅ 4
   t=80s  web-a:✅ 4  web-b:✅ 4  web-c:✅ 4

═══ monitoring ═══
── two status checks, two different fixes
   ❌ system status check   → AWS's hardware or network under your desk → stop + start (moves to a new host)
   ❌ instance status check → YOUR operating system (full disk, bad config, kernel) → reboot, read the console log, fix
── metrics: CPU, network and disk I/O come free every 5 min (1 min with detailed monitoring);
   memory and disk-space-used need the CloudWatch agent — the hypervisor cannot see inside your OS
   🔔 alarm idea: CPUCreditBalance < 20 → in the busy run above it fires from hour 2

═══ lifecycle ═══
── a daily snapshot policy at 03:00 that keeps 7 (Data Lifecycle Manager / AWS Backup)
   2026-09-27  📸 kept
   2026-09-26  📸 kept
   2026-09-25  📸 kept
   2026-09-24  📸 kept
   2026-09-23  📸 kept
   2026-09-22  📸 kept
   2026-09-21  📸 kept
   2026-09-20  🗑️ deleted by the policy
   2026-09-19  🗑️ deleted by the policy
   2026-09-18  🗑️ deleted by the policy
── stop · hibernate · terminate — what each keeps
   stop       RAM lost                      root EBS kept                           public IP changes
   hibernate  RAM saved to the root volume  root EBS kept                           public IP changes
   terminate  RAM lost                      root EBS deleted (DeleteOnTermination)  gone
   bake a golden AMI (patched, tested), roll it out with an instance refresh — patch by replacing desks

✅ done — the study hall ran every lesson

🗺️ संपूर्ण चित्र — एक आकृती, पूर्ण कोर्स

संपूर्ण कोर्स एका कॅनव्हासवर. 4K आवृत्तीसाठी क्लिक करा.

🪑 भाग 1 — बाक भाड्याने घेणे (धडे 1–6)

एक git branch = एक कल्पना; branch 04 मध्ये धडे 01–04 आहेत. Labs साध्या Python 3 वर चालतात — AWS account लागत नाही.

🏫 भाग 2 — बाकांची fleet चालवणे (धडे 7–12)

Production EC2 ला काय लागते: roles, खर्च नियंत्रण, Auto Scaling, load balancing, monitoring आणि lifecycle योजना.

📐 धड्यांच्या आकृत्या — क्रमांक अनुसरा

प्रत्येक धडा एका क्रमांकित बॉक्स-आणि-बाण आकृतीत — स्वतंत्र पानावरही.