LAB - Step 1 - Create a VPC for Elastic Beanstalk
41:07
for you so that it's easy to follow so for step one let's go into the AWS Management console and create that VPC
41:15
okay so here we are in my AWS account and the first thing that we're going to work with is the VPC we're going to
41:21
build out a virtual private Cloud which is going to be our isolated Network that will host our application now this VPC
41:28
is going to comprise of six subnets across two availability zones an internet gateway and that Gateway and
41:35
the two security groups that we spoke about earlier so let's go ahead and create our VPC first
41:43
and I'm just going to go into the VPC Management console open that up in another tab
41:48
and we're going to go into your vpcs and in there we're going to click creative ABC now we're building a VPC from
41:54
scratch I want to walk you through all of the steps rather than use the wizard so that you see exactly what's happening
42:01
we're gonna give this VPC a name I'm going to call it the dev hyphen VPC
42:06
and the ipv4 side 4 block is going to be 10.0.0.016. now if you're interested in
42:13
learning more about vpcs in a bit more detail and best practices for how you define your ipv4 cider block ranges then
42:21
check out our course the AWS certified Solutions architect and the cloud practitioner on our website IIs
42:27
academy.com okay so next we're going to go ahead and click create VPC and this
42:32
creates the basic core VPC in your AWS account
42:38
okay so that's how VPC created the next step is let's give this VPC an internet gateway so we're going to go ahead and
42:44
click internet gateways click create a new internet gateway we'll give this one a name so I'm going to call this Dev igw
42:50
internet gateway for short and click create internet gateway now when you create the internet gateway it isn't
42:57
attached to any vpcs so you're going to have to attach it to the VPC you just created so click attach to a VPC
43:05
click of the Box select your VPC that you just created and click attach internet gateway
43:11
at this point your VPC has an internet gateway so we can move on to the next step so we're going to create six
43:18
subnets remember they're going to be two public subnets that's going to host our Edge services
43:23
like the load balancer and the net Gateway and four private subnets two for the application layer which will host
43:30
the instances that elastic Beanstalk will configure and two for our database that we'll create using RDS
43:37
so we're going to go into subnets and I'm going to click create subnet
43:42
make sure you select the right way PC that you're placing the subnets in and Define your subnets here okay so we're
43:49
going to start with our first Subnet this is going to be Dev hyphen public
43:54
subnet01 and we're going to place that in availability Zone 1A and the IP block
44:00
for that is going to be 10.0.1.0 24. so this block is a subset
44:06
of our vpc's block remember our VPC was 10.0.0.016 which comes with 65 000 odd
44:13
IP addresses this is just a subset of that block 10.0.1.0 24 giving you a total of 256
44:21
addresses but on AWS you have 251 available usable IP addresses
44:29
Okay click add a new subnet we'll give this one a name and this is going to be our
44:35
public subnet 2. I'm going to place this in availability Zone 1B
44:41
and the IP block for it is 10.0.2.0 24.
44:47
Okay add a new subnet this time we're going to do our private subnet so I'm
44:52
going to call this one the app subnet okay or one this is where we're gonna
44:57
host our instances and we're going to do it in such a way so that it's aligned with our public subnets so
45:05
whereas we have public subnet 01 in availability Zone 1A app subnet01 is
45:10
also going to be an availability Zone 1A whereas app subnet or two is going to be an availability Zone 1B so hopefully
45:16
you're beginning to see the pattern here so this is going to go in 1A the IP block for it I'm going to go and
45:23
put 10.0.10.0 24. you want to leave a gap
45:28
between your different subnet categories and the reason for that is if we ever
45:34
need to add additional subnets like additional public subnets or additional private subnets we want to make sure
45:39
that it's within its relevant ranges so what we can think of this is that we're putting all of our public subnets
45:45
between 10.08.1.0 and 10.0.9.0 and we're putting
45:50
our private subnets 10.0 10.0 to 10.019 so zero so if you ever need to
45:56
add additional subnets you can add them in there I'm going to add another subnet this is going to be the app subnet
46:05
or two and this is going to go in availability Zone 1B and I'm going to give the IP block
46:11
10.0.11.0 24 okay and then we need to set up our database subnets so we'll
46:19
create a subnet 5 Dev hyphen data subnet
46:24
hyphen 01 and this is also going to go on an availability Zone 1A
46:29
for this subnet I'll give it the IP address 10.0.20.0 24.
46:36
okay and then finally we'll have our database subnet02
46:44
in availability Zone 1B
46:49
with an IP block of 10.0.21.0 24. okay
46:54
and just check that it is all okay so that's
46:59
zero public something two apps update 1 up subnet 2 take the
47:05
subnet 1 data subnet 2 and create subnets and that will create all of your subnets for you
47:12
fantastic now that we've got all the subnets created the next thing we want to do is
47:17
we want to set up our route tables so the route tables will Define exactly how those subnets can send traffic to each
47:24
other and outside to endpoints such as the internet gateway so we're going to go ahead and take a look at our route
47:30
tables next so click on Route tables and when you create a VPC it creates What's
47:36
called the main route table for you now subnets when you create them they attach themselves to the main route table by
47:43
default the main route table is this one over here so this is their VPC I'm just
47:48
gonna edit that name and just say Dev main RT just so I know what it is and if I look
47:56
at the routes and look at the subnet Association you will see that all of the subnets are associated with this route
48:02
table the routes has just one internal route now when you're setting up a VPC you
48:09
want to make sure that your public subnets have their own route table with routes to the internet that is
48:14
explicitly for public services Okay so we've got our main route table already
48:20
so we're just going to create one more route table we're going to create the public route table that we're going to attach to our public subnets
48:25
so click create a route table and we'll call this one Dev hyphen public RT
48:33
select the right VPC and click create route table and that creates a route
48:39
table for us which is called the public route table now if you remember we've got our internet gateway so we're going
48:45
to set up a route for the public route table we're going to send traffic to the internet via this route table or using
48:52
the routes defined in this route table so click edit routes we'll click add a
48:58
route and we'll add a route to the Internet so the four zeros zero represents external networks or any
49:04
network outside of this range and the target for that is going to be our internet gateway I'm going to select
49:10
our internet gateway and we're going to save changes at this point this route table gives you direct access to the
49:16
internet via the internet gateway and so as an additional steps we can go into
49:23
subnet associations click edit subnet associations and
49:28
select the public subnets and click save Association so what's
49:33
happened is the public subnets as we called in public subnets are now truly public subnets because they're
49:39
associated with the public route table that has a direct access to the internet via the internet gateway so if I take
49:44
you back into subnets Association again you'll see that the two public subnets are explicitly associated with the
49:51
public route table the other four subnets that we have are associated with
49:56
the main route table okay so if we go back to round tables and click on the main route table now
50:04
the main route table has just a single route which is an internal route the instances that we
50:11
deploy in the app subnets are associated with the main route table now those instances will also need internet access
50:18
but we want to make sure that we keep them private and so rather than exposing them with a public IP address and
50:24
associating them with a public route table we're going to create something called an ad Gateway so I spoke about it
50:30
and that gave me a little bit earlier which is basically a method of granting access to instances that you deploy in a
50:36
private subnet by way of a proxy okay so the not Gateway acts as that proxy as
50:42
that relay machine to relay internet requests from those instances in the private subnet out to the internet and
50:49
then translate back responses to those instances when the replies come back
50:54
from the internet so the next thing we need to do is create an ad Gateway so I'm going to go click create in our
51:00
Gateway and we're going to give it a name so we're going to call this Dev Nat GW
51:06
and and you need to place the net Gateway in a public subnet and the reason for that is because in that
51:11
Gateway will need a Target to send those internet requests through and in this
51:17
case it will be sending it to the internet gateway and in order to send traffic to the internet gateway it
51:22
physically needs to sit in a public subnets because the public subnets are associated with the public route table that has that route defined to the
51:30
internet gateway okay so normally what you would do is when you have multiple
51:35
public subnets across multiple availability zones you will create multiple Nat gateways for redundancy and high availability but for the purposes
51:41
of this lab which is creating one Nat Gateway and I'm going to put this in public subnet one
51:48
okay so that's this one will be a Dev public subnet one and this will just ensure that we keep our costs down for
51:54
the purposes of the lab but in the real world you definitely want multiple net gateways across multiple public subnets
52:00
across multiple availability zones you also need to be aware of the fact that NAD gateways need to have an elastic IP
52:06
address associated with them now an elastic IP address is basically a public IP address that is static and doesn't
52:12
change so we're going to allocate an elastic IP address to our Nat Gateway and then go ahead and click create Nat
52:19
Gateway at this point your night Gateway is getting created it takes a few seconds and then it is all good to go but if I
52:27
click on that gateways over here again you will see that it's in the pending State and it will swiftly change into
52:33
being available okay so after a few seconds that changed to the available State and you can see it's been
52:38
allocated with a public IP address as well and so this is our Nat Gateway and
52:44
so to complete this process we now need to go back into our tables and click on
52:49
the main route table click on routes and we'll create a route to the Internet so the route to the internet is going to be
52:56
indirect not via the internet gateway but instead via the NAT Gateway okay so
53:02
that will help us select on that Gateway and we click save and so at this point any resources that you deploy in the
53:10
public subnets have a direct access to the internet via the internet gateway provided they've been allocated a public
53:15
IP address any resources such as ec2 instances you deploy in the private subnets
53:21
can also access the internet but via the NAT Gateway and continue to have just a
53:26
private IP address and that way you keep it secure and this is considered best practice you don't want to expose any of
53:32
your servers out on the public subnet unless you absolutely have to okay so now at this point we've set up our VPC
53:39
our internet gateway our NAD Gateway six subnets and configure the route tables the last thing to do in our VPC
53:46
Management console is to set up those security groups so let's do that now so we go down to security groups and we're
53:54
going to be creating two security groups you're going to create one for the database and one that we'll assign to
54:00
any instances that elastic Beanstalk Provisions in the elastic Beanstalk environment so Security Group one I'll
54:07
call this one Dev hyphen app SRV SG so basically it's the app server
54:14
Security Group okay and we'll give it the same for the description obviously we can give a much better description
54:20
than that and we need to make sure we place it in the right VPC so that's the dev APC because you're creating a
54:27
security group we want to create an inbound rule I'm just going to create an HTTP rule from any location okay so
54:34
we're accepting inbound traffic on Port 80. so the app service will be able to accept HTTP traffic
54:39
on Port 80. and that's from any location and we'll create a security group okay so that is
54:47
the app server security group created for you okay so there it is so I'm also
54:52
going to just put that copy that name and edit the name tags just so that it's
54:57
in there and it's easily visible so I know which security groups I'm working with create another Security Group this
55:03
is going to be Dev database hyphen SG so this is a database Security Group
55:09
okay and again make sure you put it in the right VPC now this time the inbound
55:15
rules are going to be the MySQL traffic so MySQL Aurora which defaults to Port
55:20
3306 we will be using the default Port range and the traffic for that is going to
55:27
come from any instance associated with the dev app server SG so that basically
55:32
means that unless you're a member of Dev server app SGA you cannot talk to my database which is an additional security
55:38
measure okay and then we'll create that security group as well and again just go back
55:45
into security groups and just make sure that you've got that name edited in the name column just so that
55:53
it's easily visible okay so that's our VPC we've got our vbc
55:58
our internet gateway our NAD Gateway we've got our six subnets we've got our security groups and we're pretty much
56:04
good to go to the next step two let's launch an RDS database in our VPC
LAB - Step 2 - Launch an external RDS database for Elastic Beanstalk
56:11
okay so back into my AWS Management console we're going to move into RDS so I'm just going to search for the RDS
56:16
service here and open that up in another tab that will bring up our RDS console now
56:25
when you're setting up an RDS database you're going to launch it in your VPC and if you remember we had set aside two
56:32
subnets okay data subnet one and data subnet2 which will be used to host our
56:38
database now prior to actually launching a database you need to create something called a subnet group a subnet group is
56:43
essentially telling RDS which subnets are going to be used to launch our database and you need a minimum of two
56:50
subnets ideally across two availability zones that you need to Define for your subnet group so that's what we're going
56:56
to do first so on the left hand side I'm going to click on subnet groups and then click create a DB subnet group and we're
57:02
going to give it a name so I'll call this Dev DB subnet group okay
57:09
and we can just use the same name for the description make sure you select the
57:14
right VPC so that's the devvpc and then the availability zones that we've defined in our VPC are for availability
57:21
zones 1A and 1B in the US East one region within those two availability zones we're going to be deploying our
57:28
database in the database subnet 1 and database subnet 2. now it's a little bit
57:33
difficult to see it here because it just shows it to you in the form of an IP address and the subnet IDs but if I
57:38
quickly go back to my VPC console and I click on subnets
57:44
then I know for a fact that database subnet 1 was 10.0.20.0 24 and database subnet 2 was
57:54
10.0.21.0 24. so those are the two subnets that I want to select so from this drop down list I'll select the
58:01
subnet 21 and 20 those two okay so those are going to be my database subnets and
58:07
I'll click create and that creates my DB subnet group within which I will launch my database fantastic
58:14
right now that we've got the sub Nets click on databases okay and we'll
58:19
create a new database and we're going to set up a standard create database you want to select MySQL for this exercise
58:28
we'll leave all of the defaults in terms of the addition and the engine version and select free tier because we want to
58:36
make sure that you don't get charged that will turn off some options unfortunately but that's fine we're not
58:41
going to use it for the lab anyway specifically around things like multi-az now we have to give our database
58:46
instance a name so I'll call this one devdb okay and for the credentials I'm
58:54
going to leave the master username to admin okay and I'm going to give it a password
59:01
and I'm choosing a very simple password better in the real world you want to choose a really complex one okay and
59:08
we're not going into managing Master credentials in Secrets manager because I want to do Secrets manager if it's separate as a separate exercise because
59:14
I want to show you how it all works so for now just set a master username and a password of your choice make sure you
59:20
remember the password otherwise you will not be able to access the database so make a note of it somewhere safe
59:27
we'll scroll down and we'll select the default option of dbt3 micro instance
59:32
type for our database foreign it's going to use a general purpose SSD
59:38
with an allocated storage space of 20 gigs and I'm going to disable the enabled storage Auto scaling because we
59:43
don't need it for the purposes of this exercise so I'll just deselect that in terms of connectivity so this is
59:50
where you need to make sure that you select the right VPC so that is the dev
59:55
VPC and leave the setting to dome connect to an ec2 compute resource because we will be getting elastic bean
1:00:01
stock to provision the instances to talk to our database because I've selected the right VPC it's
1:00:08
picked up the fact that I've got a single subnet group in there the database subnet group so it selected that for me already
1:00:16
ensure that it's set to no under Public Access because this database is sitting in the back end right in the private
1:00:22
subnet so it doesn't need Public Access no public IPS and then you need to select the security prayer database now
1:00:28
we've already created a database Security Group when we did the VPC section of this exercise so untick
1:00:37
default and from the drop down list select database SG
1:00:42
okay availability Zone we'll select 1A is our
1:00:48
preference where we want to place our database expand additional configuration just make sure that the default Port is set
1:00:54
to 3306 which is exactly what we want a little bit further we'll leave the
1:01:00
database authentication to password authentication and then you want to expand additional configuration now here
1:01:06
you need to provide a database name so I'll use the same name devdb
1:01:12
we'll set the backups to enabled we'll set the retention period to one day okay
1:01:19
and we can leave the encryption enabled as well so with encryption it's going to use the
1:01:25
default KMS key for RDS and if you're interested in learning more about encryption and kms's check out our
1:01:33
website for some more videos on that I'll leave everything
1:01:38
else at its default settings okay and I'll scroll all the way down and
1:01:44
click create a database now this takes a good five to ten minutes to create so
1:01:50
you probably want to go ahead and grab yourself a cup of coffee tea or whatever I'm going to pause the video over here and then when it's all done I'll resume
1:01:56
the video so here we are our database has been launched and configured and is in the available state if we actually
1:02:03
take a quick look at the database so you've got your connectivity and security details here so that is your
1:02:09
endpoint okay so that is what your application needs to connect to in addition to that the application will
1:02:15
need to know the database name which is dvdb and obviously the username and password and these pieces of information
1:02:21
especially the username and password we're going to configure in Secrets manager so now that we've set up the
1:02:27
database okay the next step is to move on and work with Secrets manager and configure Secrets manager to store the
1:02:33
credentials of this database let's move on to step three next okay let's move on to step three where
LAB - Step 3 - Configure Secrets Manager for your RDS database
1:02:40
we're going to go into Secrets manager and configure a secret for our database
1:02:45
okay here we are back in my AWS Management console so I'm just going to go into Secrets manager
1:02:51
open that up in another tab okay so in Secrets manager we're going
1:02:56
to go ahead and store a secret Now secrets manager will allow you to store credential data for your RDS database
1:03:03
the service also provides the ability to rotate your credentials for databases like RDS but we'll do that a little bit
1:03:10
later initially what we want to do is Click store a new secret and you want to select the secret type as being
1:03:16
credentials for an RDS database next you're going to put the username and the password for your database so hopefully
1:03:22
you made a note of it okay we don't need to make any other
1:03:28
changes other than select the database that we are going to provide the secrets for click next and then you need to
1:03:35
provide a secret name you can use the strategy of using slashes to have different names for different
1:03:41
environments and different versions of your application okay so I'm just going to select Dev MySQL
1:03:49
credits okay and then you can have a description as well in there for What
1:03:55
that particular secret is used for leave everything else again as it is and click next this is the page where you
1:04:01
configure automatic rotation now we're going to skip this for now okay because I just want to revisit this a little bit
1:04:07
later click next and then once you're happy with all of this click store okay
1:04:13
so this now configures your secret so if I just quickly refresh this page there's my secret currently rotation is disabled
1:04:21
like I said we will revisit that but all of my secret information so my credential information for my database
1:04:26
is actually stored in secret so if I click retrieve secret value
1:04:33
okay you will actually see all of the data related to my database come out including the username and password that
1:04:39
I specified Okay so book manager created for us next we're
1:04:46
going to move on to step four now step four is we need to set up some permissions and an IM role in order to
1:04:52
allow ec2 to access Secrets manager as well as obviously interact with the elastic Beanstalk service okay so let's
1:04:59
do that next okay so for step four we're going to create an I am role with necessary
LAB - Step 4 - Configure IAM roles for Elastic Beanstalk
1:05:05
permissions now the purpose of creating an IM role is to create an instance profile an instance profile is something
1:05:11
that you attach to an ec2 instance when it needs to have certain permissions assigned to it so that it can go and do
1:05:19
something it can interact with other services on the AWS platform an instance profile is essentially a container for
1:05:26
the IM rule that has the required permissions so this instance profile that we're going to create will need to have an IM
1:05:32
role that we need to Define that allows our ec2 instances to interact with elastic Beanstalk environment now the
1:05:39
role is going to Grant the ec2 instances to perform specific actions so for example retrieving application versions
1:05:46
from your S3 bucket writing logs to the S3 service if you're using ECS and Docker environments as we
1:05:54
previously discussed then obviously coordinating the deployment of ECS container services and if you are
1:06:01
building a worker environment then you know performing actions like being able to read from the sqsq for example is
1:06:07
another permission that the ec2 instance is required so we're going to move on and create our IM role in this step
1:06:15
let's get back into the database Management console okay so back to my AWS Management console we're going to go
1:06:20
ahead and go into the IEM dashboard so I'm just going to open IAM in another
1:06:26
tab and then I am we're going to create this IEM role that's going to be consumed by
1:06:32
an instance profile that will be attached to your ec2 instances that elastic Beanstalk deploys the ec2
1:06:39
instances with this instance profile will have the permissions to interact with elastic Beanstalk and we also need
1:06:46
to Grant the ec2 instances permissions to interact with Secrets manager remember Secrets manager has a secret
1:06:51
that we configured that has the credentials of our database in order for your ec2 instances to talk
1:06:58
to Secrets manager and pull that secret okay it needs permissions to do so so
1:07:04
let's do that next from the left hand side go ahead and click roles and then
1:07:09
click create a role and it's an AWS service role entity type and The Trusted
1:07:15
entity is going to be ec2 in this permissions policy filter AWS
1:07:22
elastic and what that will do is that will give you a series of manage policies that AWS
1:07:29
has created already for you that you can use now the three policies that you need to use are AWS elasticbean stock web
1:07:36
tier AWS elastic Beanstalk worker tier and AWS elastic bean stock multi
1:07:42
container Docker okay we're just adding some additional policies but essentially these permissions allow you to do things
1:07:48
like upload log files to S3 interact with sqs if we did create a worker tier
1:07:54
and all that stuff so I'm just creating a role that has all the necessary policies
1:08:00
let's give the roller name so I'm going to call this one Dev EB ec2
1:08:06
I am roll okay so I know exactly what it is and then we'll click create a role so at
1:08:13
the moment what we've done is we've created the role with those three policies but we still need two if we go
1:08:19
to Dev EB ec2im role add an inline policy so that the role can also talk to
1:08:25
Secrets manager so click add permissions click create an inline policy
1:08:30
click on the Json Tab and I've actually got a policy that I have created for you
1:08:36
and here's the policy it's available to you in our GitHub repository as a sample policy and you're welcome to use this
1:08:42
policy along with the application code when you deploy the application in your AWS account
1:08:48
so just to show you what the policy does the effect is allow so it's an allow policy and the action is the ability to
1:08:54
get secret value from Secrets manager and in order for the policy to work you need to provide the secret manager Arn
1:09:00
the AR end of the secret that you created so let's grab that policy first
1:09:06
and we'll replace this with our policy and then go back to Secrets manager and
1:09:13
just grab the Arn of the secret you created which is that one over there in my case and replace the placeholder value with
1:09:22
the actual Arn okay and then click next you need to
1:09:27
give the policy a name so this is Dev EB ec2 secrets
1:09:35
policy so I know exactly what it is and click create policy right there's our IM
1:09:41
rule it's got the three elastic Beanstalk managed policies that AWS manages and it's got one inline policy
1:09:47
that I have put in there that I manage that has access to Secrets manager of
1:09:54
that specific secret Arn fantastic let's move on to step five
LAB - Step 5 - Create an Elastic Beanstalk Application
1:10:01
right you've done all of the prerequisites you've built a VPC you've deployed an RDS database in that VPC
1:10:08
you've configured Secrets manager and you've set up the necessary IM rules with all the permissions that you
1:10:14
possibly need next we're going to move on and actually work with elastic Beanstalk and deploy
1:10:19
the application into elastic Beanstalk before you do that though you need to download the application source code
1:10:24
bundle from our GitHub repository so let me show you where that is first and then we'll jump back into the AWS Management
1:10:29
console and deploy this application okay so you have access to the
1:10:35
application source code bundle that we're using for this project it's available in our GitHub repository the link of which is available to you in the
1:10:42
resources section of this video or down in the description box below you'll need to download the EBS RDS to do app code
1:10:48
version 2's zip file and place it on your desktop or in a location that's easily accessible you will actually be
1:10:55
uploading the ZIP code bundle as it is as a zip file to the elastic Beanstalk
1:11:01
application when you configure elastic Beanstalk but I wanted to extract the contents of the zip file and just show
1:11:06
you what it contains so let me do that first okay so here we are the contents of my application source code bundle
1:11:13
it's got a few files and a few folders and specifically it's also got the vendors folder which has a lot of the
1:11:18
sdks that AWS supplies for its various services so the application makes use of
1:11:24
those in order to connect to the Amazon web services platform and make use of
1:11:29
certain Services now specifically there is an index a PHP file and a server.php
1:11:35
file all of the front end look and feel is all set up in the
1:11:40
index.php file the server.php file is what connects to the backend database and performs all of the back end magic
1:11:47
let me open that up for you in Visual Studio code okay and there we are so this is my
1:11:54
visual studio code with the server.php file and it's open State and I just wanted to quickly show you a couple of
1:12:00
things over here firstly this includes the AWS PHP SDK so it allows you to
1:12:06
interact with the platform as this application is built using PHP what it does is it inputs the secret manager
1:12:12
client and the AWS exception clients as part of the code and then it also
1:12:18
specifies the region that it's working in okay and furthermore it actually is able
1:12:25
to retrieve the secret value from Secret manager okay and it stores that as an
1:12:31
environmental variable now the important thing is that the secrets particularly the username and password are encoded in
1:12:36
plain Json string and there's a Json date code function here that basically retrieves that usernames and password
1:12:42
and once it retrieves that username and password dynamically it is allocated to two variables which are DB username and
1:12:48
DB password DB server and DB database are additional names that we'll add in
1:12:54
the elastic Beanstalk environment properties from which it will retrieve those values but the username and
1:12:59
password will be dynamically retrieved from the secrets manager client okay so
1:13:05
that's why this becomes very very secure as it's dynamically retrieving the credential information and subsequently
1:13:12
we will be able to also rotate those secrets and continue to still access the database because we will dynamically
1:13:19
retrieve the credential data the ec2 instances on which this particular piece
1:13:25
of application code runs on has the instance profile and therefore the IAM role to be granted access to Secrets
1:13:31
manager and that's where the power of IAM roles and IM profiles come into play okay enough about all the code and stuff
1:13:38
let's actually jump back into the AWS Management console and set up our elastic Beanstalk application okay so
1:13:44
back into my AWS Management console we're going to go into the elastic Beanstalk dashboard so in the search bar
1:13:49
just search for elastic Beanstalk and open that up in another tab
1:13:57
so the first thing that we're going to do is create the elastic Beanstalk application remember that the application is simply the container that
1:14:04
will host your environments within which we will deploy the application and I'm going to give the application a name so
1:14:10
this is a Dev to do application so the application that you'll be
1:14:15
deploying is actually a to-do list application that allows you to create
1:14:21
your to-do list and it saves that data in a back-end RDS database and performs all the crud operations against the
1:14:27
database so let's take a look at what that application looks like so we'll go ahead and create the application
1:14:35
and once you've created the application we then need to create an environment
1:14:41
within which to deploy the actual application code into so when you click configure environment you need to select
1:14:48
whether you're setting up a web server environment or a work environment so we'll be creating a web server
1:14:53
environment which incidentally has both the front-end back-end elements in it in a real world scenario depending on how
1:14:59
complex your application is you want to properly split the two as we have discussed in our previous
1:15:05
slides but for now let's just create the web server environment so the web server
1:15:10
environment has been built for our dev2do application and you can choose your own domain name
1:15:16
I'm going to leave that as default as well you'll just need to type in a preferred name and then check that it's
1:15:22
available when it comes to the platform ensure that you select PHP because the
1:15:27
application is built using PHP the platform branch is going to run on a 64-bit Amazon Linux 2 and the version is
1:15:34
3.5.9 next you want to upload the code so this is going to be the zip file bundle
1:15:43
so you want to click local file and select the location where you have your
1:15:48
application source code bundle downloaded so in my case it's over here so remember
1:15:54
you want to upload the zip file itself okay and click open next you want to click on high
1:16:00
availability because we want elastic beam stock to provision load balances and auto scaling for us for high
1:16:06
availability and then to scale out as well as scale in Click next oh need to
1:16:12
give it a version name I'm going to call this one V1 and then click next
1:16:17
okay so the next step is to create service access now this is
1:16:23
where creating necessary I am role comes into play now what you need to be aware of are there are two roles basically
1:16:30
used by elastic Beanstalk there's a service rule that allows elastic Beanstalk to assume the service role and
1:16:36
to perform various elastic Beanstalk actions against the environment that is
1:16:41
being built now you could get a service role created for you I've got one
1:16:46
previously created so I'm just selecting the same one just to show you what permissions this service will contain
1:16:52
let's go back into IM roles and this one over here AWS elastic Beanstalk service
1:16:57
rule essentially it contains two managed policies that allows for health monitoring and managing updates on the
1:17:04
elastic Beanstalk environment okay so that needs to be selected or you create one from scratch so you
1:17:11
allow elastic Beanstalk to create it for you next you have the ec2 keypad now this is only needed if you're logging
1:17:17
onto your ec2 instances however I strongly recommend that you know instead of using easy to key pair to use SSH to
1:17:24
log into your instances you use AWS session manager if you want to know a bit more about session manager check out our other video in this course that
1:17:32
talks a little bit more about how it works and then finally you want to select the
1:17:37
instance profile now this is the IEM role we created a few moments ago that has necessary permissions to allow our
1:17:43
instances to talk to elasticbeam stock S3 sqsq depending on which environment you're placing it in
1:17:50
as well as the inline policy to allow the ec2 instances to retrieve the credentials from Secrets manager okay so
1:17:57
you select the instance profile there and click next networking database and tags option for
1:18:04
the VPC select the VPC where we're going to deploy our elastic Beanstalk instances in and that's the dev VPC that
1:18:10
we built right at the start of this lab then you need to specify where those instances need to be deployed now
1:18:17
remember in our architecture diagram we created the app subnets okay which was a private subnet that we want to use for
1:18:22
all of our instance deployment so that was app subnet02 and app subnet01 okay
1:18:29
so these two subnets are going to be used to deploy our instances this option allows you to configure
1:18:36
database integrated with your environment and we said that whilst this allowed you to quickly and easily set up
1:18:41
databases in real world production environments you probably want to have your database externally hosted from the
1:18:47
environment so we're not going to enable database here in any case we already have our RDS database already configured
1:18:54
scroll all the way down and click next okay now with regards to configuring the
1:18:59
instance traffic and scaling okay leave the root volume at its default settings
1:19:05
for the ec2 security group make sure you select the dev app server SG Security Group remember the purpose of creating
1:19:11
the security group was so that we can define a source for our database Security Group okay so our database that
1:19:18
we launched in the RDS section of this lab has this bit particular Security
1:19:23
Group attached to it the dev database SG and it allows inbound traffic on Port 3306 to mySQL port
1:19:29
only from instances associated with the app server SG so we want to make sure that when elastic Beanstalk launches
1:19:36
your instances it attaches the security group to it okay so all of our instances must be
1:19:43
attached to this Security Group from a capacity point of view it's going to be load balance and I'm just going to
1:19:48
put two over there okay scroll down a little bit further and we want to just go with the T3 micro
1:19:55
types I'm just going to remove T3 small we don't want it to be charged we're going to use free tier
1:20:01
that's the Ami ID that elastic Beanstalk is going to use we're going to leave all
1:20:06
of these other values as it is and move on to load balancer network settings now for the load balancer
1:20:12
you want to place a load balance in the public subnet okay the nodes need to be deployed in the public subnets and
1:20:19
specifically that's going to be public subnet01 and public subnet02 okay because the load
1:20:26
balancer sits right at the edge receiving traffic from the internet and Wheeling that traffic back into
1:20:31
instances in the private subnet and the type of load balancer is going to be an application load balancer because we're
1:20:36
routing HTTP traffic in this case and then you want to pretty much leave everything else on this page at its
1:20:43
default value and click next okay when it comes to configuring updates monitoring and logging for the
1:20:49
help reporting ensure that it's set to enhanced you could set up email notifications if
1:20:54
you wanted to be notified of important events in your environment and then there's also the rolling
1:21:00
updates and deployments for when you make upgrades to your application now we have another video that talks about this
1:21:06
in a bit more detail as an advanced topic feel free to check that out as well but for now just leave everything at its
1:21:13
default value scroll down until you get to environment properties now this is the important
1:21:19
part for the environment properties you're going to set up three environmental variables so the first one
1:21:24
is going to be the DB underscore endpoint okay so this is the actual DB
1:21:31
server endpoint and if you go back to your RDS Management console and go into your database
1:21:38
and click on your database that's this one over here so you've got the endpoint value there you just want to grab that
1:21:46
and place that in there next you're going to add the DB name so DB
1:21:51
underscore name and this is going to be devdb
1:21:56
okay and then finally you want to type in the secret name okay now the secret name is the name of
1:22:04
the secret that hosts my credentials so if I go back to Secrets manager that's this one over here so that's my secret
1:22:10
name and we're going to place that value in there and our ec2 instances are going to
1:22:17
connect to Secrets manager look for this name and pull the username and password for the database dynamically okay then
1:22:22
we click next this is your page to review all of your settings make sure it's all in order and
1:22:30
finally click submit and so now what we're doing is we're submitting the job to elastic Beanstalk to go and do all of
1:22:37
its magic and in the back end it's going to use cloud formation to build everything for us as per our
1:22:42
configuration requirements okay so it says elastic Beanstalk is launching environment this will take a few minutes
1:22:48
and it does take a few minutes so why don't you go ahead and grab yourself another cup of tea or coffee I'll pause
1:22:54
the video for now and once this is all set up we'll continue from where we left off right welcome back
1:23:01
free launched so elastic Beanstalk went ahead and did all this wonderful magic in the back end to set up our
1:23:08
environment and to deploy our application onto the AWS platform
1:23:14
now elastic Beanstalk gives you a domain name to connect to so if I open this up
1:23:19
in another browser tab you will see that the application has
1:23:25
now come up so this is a to-do list application okay it gives you the date
1:23:30
and the time and it gives you this little form that you can fill up so let's give it a try so let's say I have
1:23:37
a work to do list okay complete video on elastic Beanstalk
1:23:46
okay and the due date is oh it has a nice calendar format let's put in that
1:23:51
date and the status is in progress so I'm going to click submit and it says to do add it successfully
1:23:58
well nice to know and if I scroll a little bit further down you will see that my
1:24:04
table is updated okay fantastic Let's uh let's add another one another work one
1:24:10
okay um prepare elastic being stock
1:24:18
deployment presentation this is going to be the next topic that I'm going to work on
1:24:23
and the due date is oh let me give myself some time to work on this
1:24:29
and it's not started let's submit that one and there you go so you can see what's
1:24:37
happening this application interfaces with the backend database the RDS database it stores all of this data in the RDS
1:24:44
database okay and it also retrieves the data from the RDS database so it's a PHP
1:24:51
application it does this bit of magic and performs all the crud operations for the database I can change the status so
1:24:58
let's say I've already started working on something over here maybe started and
1:25:04
that will change the status and that's all done so once I've completed this
1:25:09
video I'll click completed and it will change the status and oh it gives me a nice green block as well so my intention
1:25:17
is to get everything green for you guys so that I can prepare more videos like this one well I hope you enjoyed the
1:25:23
application as I said it's just a simple application just a one pager but it demonstrates the fact that this
1:25:30
is a multi-tier application there's a front and backing element to it there's a database element to it and you can use
1:25:35
elastic Beanstalk to provision the underlining infrastructure deploy the application and manage its life cycle I
1:25:41
wanted to also give you a quick run through about some of the things that elastic Beanstalk has done so if I go into the VPC section you'll see on the
1:25:47
security groups elastic Beanstalk went ahead and created two more security groups this one over here for example
1:25:53
is the load balancer security group so that it is configured the inbound rules to allow traffic on Port 80 from the
1:26:00
internet and this next one is a VPC security group that in fact
1:26:08
has the source as the load balancer Security Group so now if I go into ec2 in another tab very quickly
1:26:17
okay let's go into ec2 you'll see that one instance is running that's my instance that was deployed by elastic
1:26:22
Beanstalk okay there it is and that particular instance if I click
1:26:28
on security is attached to two security groups one is the dev app server Security Group which we created and one
1:26:34
is the one that elastic Beanstalk created so in effect this instance has two security groups once you accept
1:26:39
traffic from the internet via the load balancer and one to act as a source for traffic that's going to hit the database
1:26:46
in the back end okay okay so that's how the security groups work in this architecture
1:26:52
so elastic bean stock has also provisioned our load balancer so if I go on the left hand side and click on load
1:26:58
balances okay and you can see this is a load balancer that elastic Beanstalk deployed
1:27:03
for me and elasticbeat stock manages this load balancer go down to Auto scaling groups
1:27:08
and you can see that elastic beanstalker also provisioned the auto scaling grip and its activities are available to me
1:27:16
as well okay so elastic Beanstalk did all of this heavy lifting that I would have had to do manually if I wasn't
1:27:23
using elastic Beanstalk okay so now that all of that is in place just go back to the application our
1:27:28
application is fully functional it's performing all its crud operations and it's connecting to the database
1:27:34
there's one more step left let's go on to step six six I wanted to go back and revisit
give me steps of these video script like 
4.Now,we need to create a Virtual Machine which is Azure virtual machine.
 
5.We need to specify the resource group which we have created and type virtual machine name as Linux-Server.
 
6.Select image as ubuntu server and size as “Standard_B1s-1vcpu, 1Gib memory”, Authentication type as password.
..etc