03 · AWS by handLab 18 / 59
Challengeaws
EC2 Operations: SSM, CloudWatch Logs & Metrics — Challenge
Operate an instance without SSH: run commands, ship logs, and alarm on something that matters.
- Time
- 25 min
- Level
- Intermediate
- Objectives
- 4 objectives
- Cost
- Low cost
Where this fits in the platform
Already built
This lab adds
- An instance you can reach without opening SSH to the world
Which lets you
—
Before you start
You will need
- AWS CLI v2, configured
- An AWS account
You will be able to
- Administer an instance with no inbound ports open
- Ship application logs to CloudWatch and query them
- Alarm on a symptom rather than on CPU
Cost — Low cost
— one `t3.micro`, and CloudWatch's free tier covers 5 GB of logs and 10 custom metrics. Leave the instance running and expect ~$8/month after the first year.
The goal#
Achieve the same outcome as EC2 Operations: SSM, CloudWatch Logs & Metrics, from an empty starting point, without the steps.
An instance has port 22 open to the world, a key everyone shares, and logs that exist only on its disk — so when it is replaced, the evidence goes with it.
All three are avoidable, and the alternatives are free.
Hands-on environment
Run this lab in a real terminal, free and in your browser. The environment is temporary and yours alone — break it as much as you like.
Start the challengeOpens in Killercoda, in a new tab — keep this page open for the steps.
This is the guided lab's environment — the same machine, with its walkthrough on the left. Work from the task above and leave those steps alone until you are done, or you are reading the answers.
Run it on AWS
This lab builds real cloud infrastructure, so it needs your own AWS account. Follow the cost and cleanup notes above — the resources are yours, and so is the bill.
Anything you tick here is your own record. EgyKode cannot see inside that terminal, so the success criteria stay self-assessed even when the environment checks your work for you.
What must be true when you are done
Step 1 of 3
What must be true when you are done#
- You ran a command on the instance with no SSH key and no inbound rule.
- Application logs appear in a CloudWatch log group and you can query them.
- An alarm exists on a metric that reflects user impact, and you can justify the threshold.
- You can explain why the default EC2 metrics do not include memory or disk.
Rules#
- Do not open the guided lab until you are finished, or until the same problem has held you up for 20 minutes.
- Documentation is allowed and encouraged.
- Verify every criterion with a command whose output you can read.
If you get stuck#
- What did you expect, exactly?
- What happened instead — the error text, not a paraphrase?
- Which layer is that error from?
- What is the smallest command that proves the layer below is fine?
You are done when
0 of 4
The concept behind it
Next up
Lab 18 of 59 on the project path