AWS Certified Cloud Practitioner
Ways to access AWS: console vs CLI vs SDK vs CloudFormation
The AWS Management Console is a web application where you click through each service. The AWS CLI runs the same tasks as commands in a shell, and the AWS SDKs do it from code in your own programming language, both by calling the AWS API. AWS CloudFormation is different: you describe the resources you want in a template, and it creates them for you.
Console, CLI and SDKs
The AWS Management Console is a web-based application that gives you access to every individual service console. You manage resources with no programming. AWS CloudShell, which you open from the console, lets you run AWS CLI commands in the browser.
The AWS CLI is an open source tool for running commands against AWS services in a command-line shell, such as bash or zsh on Linux and macOS, or the Windows command prompt or PowerShell. It gives direct access to the public APIs of AWS services, and you can write shell scripts with it to manage resources.
AWS states that all IaaS administration, management and access functions in the console are available in the AWS API and the AWS CLI. So anything an administrator does by clicking can also be done by command or by code.
The AWS SDKs are libraries and sample code for languages such as Java, Python, JavaScript, .NET, Go and Ruby. They call the AWS API for you and handle details such as signing requests, retrying requests and handling errors. Developers use them to build applications that use AWS.
Credentials for the CLI and SDKs
The console uses a sign-in. Programmatic requests from the CLI, the API or the SDKs are signed with credentials instead. For an IAM user, the long-term credential for this is an access key: an access key ID plus a secret access key, used together.
The secret access key can be retrieved only when you create it. If you lose it, you delete the access key and create a new one. AWS recommends temporary credentials, such as IAM roles, over long-term access keys where possible.
Infrastructure as code and CloudFormation
Infrastructure as code (IaC) means provisioning and supporting your infrastructure using code. Declarative IaC describes the end state you want, the resources and their settings, and the tool works out the steps. Imperative IaC describes every step needed to set the resources up.
AWS CloudFormation is declarative. You write a template, a text file in JSON or YAML, that describes resources such as EC2 instances or RDS DB instances. CloudFormation creates them as a stack and works out what depends on what. Deleting the stack deletes all its resources.
Because the template is reusable, you can describe resources once and provision the same resources over and over, in the same Region or in multiple Regions. Because it is a text file, you can keep it in version control and see what changed, who changed it and when, and go back to an earlier version.
Where the exam catches people
- Believing some administration tasks can only be done in the console: AWS states all IaaS administration functions in the console are also available in the AWS API and AWS CLI.
- Believing the CLI and the SDKs are separate from the API: both are ways of calling the public AWS APIs.
- Believing CloudFormation runs a list of steps you write: you describe the resources you want in a template and CloudFormation works out how to create them.
- Believing a lost secret access key can be shown again: it can be retrieved only at creation, so you delete the access key and create a new one.
- Believing a CloudFormation stack is what goes into version control: the template is the text file you track, and the stack is the set of resources made from it.