Hey, this session is being recorded, so you should see a recording button showing up on the screen on your side. With that, let us quickly recap on what we did the last time. The last time what we did was a layout. We created a very simple layout in which we had something like a subnet, another subnet. And in here, we had a NAT device. In here, we had a machine. We had Ubuntu here, by the way. This NAT device is also a machine, but it was converted into a NAT device by doing certain things. This was an Amazon AMI. It's a different type of Linux like Ubuntu Linux, like Amazon Linux. Amazon Linux is basically a derivative of Red Hat Linux. It's a distribution extension of Red Hat that becomes Amazon Linux. It functions very similarly. They have created a machine image based on Amazon Linux. That is what we used to create this box. Then we had modified its source destination check capabilities to convert it into a NAT box. That's what we did. And then we also did a couple of things such as making sure that we are able to connect with a hop to this box, even though our traffic from outside is not really routable. The route is available only up to this point because this thing is a public IP. This thing is a private IP. It is not routable. We were able to jump like this through what is known as SSH proxy command. That thing is available in your example file called tilde ssh and then config.example. We modified that example a little bit to make sure that the configuration file is renamed. This example thing was deleted. We renamed the file to be just config and then gave it appropriate values of the public IP from here and the private IP for this guy and we were able to jump, hop, and connect. Now, all of this, I should draw a different color. All of that was actually in a private cloud. This was the private cloud boundary. We chose to put this machine directly on the public internet. That is the reason why we were able to route and this is you in your home. That's how we were able to route our traffic to this public address and then through and through, we were able to jump through this SSH proxy command. That's how we went in. You know that. Now, I want to understand and explain this idea of what I would call. Here we go. Here we go. I'll introduce a new concept. The concept is called security groups. Security group. What exactly is a security group? Think of it as a firewall. I think we have a person who is attempting to join this meeting right now and they don't have the link. I don't know that person actually. Hold on. Let's deal with this later. They're not in the group that we have. There's somebody else attempting to join this meeting and requesting permission. I'll deal with that later. For right now, stay focused on this. There is this thing called security group, which is basically a collection of rules. Collection of rules. Collection means there will be a rule, there will be another rule like that. It will be collection, lots of rules together. That's what a security group essentially boils down to. Now, adjusting a little bit here. Give me a second. I fixed that. I was able to adjust my view on the other computers. I can see whether you have a question or something like that. That's what I was changing. I'm able to adjust and see all of you guys as your cameras are popping up. I see almost everybody's here now. What I was doing is to describe this concept of what is a security group. It is basically a collection of rules, rules containing multiple rules, like one, two, three, four, like that. Let us now look at a rule, one rule. What would it look like? One rule, some rule. The rule will constitute three things. One, where the traffic is originating from. Two, the protocol or port being used. Three, whether it should be allowed or not. That's three things, yes or no, whether you want to allow it or not. It's a permission. An example of this, you probably saw yes or no. That is what a permission would look like. Let's go look at an example security group very, very quickly here. I'm going to log into this website and here we go. Full screen logging in and I'll just go look at an example. Token, copy, AWS, I thought I logged in, didn't I? Yes, I did. Here is the login and here is the token. Come on, token, please. Here is the token, let me in. Now I'm in and let's go look at an example security group as we may have a bunch of these guys. I'm choosing one region here, a Virginia region, and looking at some example security groups here. Here is one, it's called the app or the NAT or one of those two or three that we created the last time. We created this NAT security group as an example. In that security group, we have a number, a unique ID, and then a collection of rules. The collection is defined in this inbound segment. That is one collection of rules. You can see it right here. In fact, in this, there is only one rule. The rule is SSH traffic, TCP protocol, port number 22, and the source is the origin that I mentioned. Origin is 0000 slash zero. That's the rule defined here in this example. Now let us translate this back to what our discussion here is. Origin can be anywhere that I am going to be. I can be in Sammamish, I can be in Tokyo or India, wherever I want. That is the origin location. The reason I chose it to be like that just to give me flexibility. I can be anywhere on the world and still be able to connect. This is the place where my traffic originates from. This is also known as source. Source of the traffic is anywhere on the internet. Port number is 22. The function will be SSH. For every function, there is a list of ports in use. You can see that in Wikipedia. You can find it, a list of SSH. Let's go find out all the ports. Here is a list of port numbers available. You can see that there are quite a big list of numbers. Then you can zoom in on the port number 22 right there. It says it is used for secure shell. That's the standard. Everybody on the planet uses port number 22 for transport of SSH traffic. This is a long list. You can see a bunch of ports available that many different types of applications and methods use. I will paste this link in Slack chat so you have it. What I will do now is so that you can actually even search it yourself. Don't need to worry about it, but now that I have opened it up, I would rather paste it right here. This is where you can get a list of ports of variety of applications. Our scenario that we are discussing is that I want to use this application to connect to something so I will correspondingly make use of this port. In addition to this port, there is also a thing called protocol. They actually go together. Protocol and port go hand in hand. Here, in case of SSH, the traffic actually travels on the TCP protocol, port number 22. That's how ports are defined. Sometimes you will use a UDP protocol and another port number, some number here. There are broadly two types of protocols available on every port. Now, let us do one step below this concept, which is what is a port? You see that in your home, you have a router from your manufacturer router and a modem from a company like Comcast. Comcast will give you a modem. This modem will have a public IP address. On that modem, you will directly connect your router. Then inside your home, you will have multiple endpoints that you will have, your TV, your laptop, your iPad, things like that. You will connect all internally behind the router. On every port, every IP address, wherever there is an IP address, each one of these will have a private IP address. On every IP address for every device comes a collection of ports, numbering usually from zero all the way through 65535. That's the usual range of ports that are available. All of them are open if you don't use a firewall. If you have a firewall, you can selectively open these things and say no to every other thing. That's the idea of these concepts of a port. It applies to an IP address. For every IP address in a classic scenario of your router, everything is closed. That's what router will do to begin with. Every port is closed out, except certain ports are open, such as 53 for your DNS traffic. Port number 80 may be open depending on what you decide on your router. Port number 443 may be open for you what you decide to run a website on your home, if you like. These two are using protocol like HTTP protocol will use that port. This HTTPS protocol will use the port number 443. Of course, you can always go back to that link I gave you to find out the port number used by a variety of services. These things will apply if you intend to run a website somewhere in your home. People from outside will want to visit your website. In that case, they will like to enter using these ports. That is not true in most of the cases. People don't run websites in their homes. These are probably blocked in your homes. You will typically open only very few ports that are essential for your services to run, such as 53, for example. Some other ports may be open depending on your configuration. Most of the ports are closed from the outside. Everything is typically open inside, open, open, open. You keep all the ports open from inside so that your machine A can connect to machine B. That's the scenario. From an IP address standpoint, you will have usually 0 through 65535 ports available and lock all of them down, lock down, close them by default. That's a good security practice. Just close everything down so that no traffic flows and you break the internet. That's the idea for security, nothing works. Beautiful. Beautiful as in the case of security that nothing works. Good. Now, you have to selectively open certain things. You can open every protocol, for example, port number 22 for SSH traffic. You need to open TCP for port number 22 to allow SSH access from outside. If you want to run a website somewhere here, you need to open TCP port number 80 to allow HTTP traffic. If you want to run a secure website, you need to open port number TCP 443 to allow HTTPS traffic. You need to run a database, MySQL server. You need to open port number TCP 3306 if you want to run a database server. That's the idea. You will selectively open up specifically exactly what you need on your IP address for the collection of port, the entire range of ports available to you. You will basically lock down everything except you will very carefully open up certain things. That opening up is what these security groups do. You will define that allow SSH traffic to come in from port number TCP 22 on this location, by the way, this IP address. I want to come, this may be some specific IP address like a public IP, some specific IP address. I want to be able to come here from anywhere on the world, including Japan and Mexico and India and US and like that. I can travel anywhere on the world and I should be able to connect through SSH, going through port number 22, allow, the policy is to allow. That's the rule that I want to set. That is the reason why I succeeded in getting in. That's the concept of a security group. This is just one rule described, one rule. You can have more, for example, here. You can just edit the security groups and say, add one more rule, click. Here I can say, I want to run a website, so add a rule to allow HTTP. I can just quickly select HTTP and click and I'm done. However, this is not correct. I need to make that change and I'll say, allow from anywhere. I'll delete all that good stuff. Sorry, I think I made a mistake. I typed the wrong button, add rule again, HTTP. Here we go. Then I will say, allow from anywhere and I will basically empty this out. I made a mistake again, I think I'm hitting the wrong key. Add a rule, HTTP and allow from anywhere. What you see here is the IPv6 addressing scheme of anywhere on the internet. What you see is 0000 slash zero is the IPv4 method of addressing on the internet, anywhere on the internet and comma, colon, colon, slash zero is an indication of IPv6 address space anywhere on the internet. That is what you see here and I can save this rule. You will see that now my HTTP rule are expanded to two additional rules. One that say, allow traffic from TCP port number 80 to be anywhere on the internet on the IPv4 version 4 and anywhere on the internet IPv6. Both rules came into play. Nilesh, one question. Yes. If you go back to that rule again, you said there's an IPv6 and an IPv4 rule. Correct. You mean that if I don't have the IPv6 rule there, does it mean somebody with an IPv6 coming in traffic will not be allowed in? They will have an alias to IPv4 very likely and so that way they will come in. You can save it like that and exclude the IPv6 portions and let's refresh. I think this IPv6 capability has been very recently introduced into the Amazon Cloud. I have not played with it, but I think it will translate and work effectively allow, it will effectively allow traffic. I deleted that IPv6 entry currently, so I don't have that IPv6 entry anymore in my inbound rules, but let's say add edit one more rule and this time I'm going to say allow HTTP secure traffic. There is an HTTP secure traffic here. I can click that and say HTTPS TCP 443 port number and allow from anywhere on the internet and here I have both IPv4 and IPv6. I can save that. You will see that I have now four rules, one for IPv4 anywhere on the internet, allow port number 443 traffic coming from TCP protocol to allow secure HTTP traffic. That's the idea here. You can remove this rule and test it out. It is fairly new for me also, so I have not played with it, but we will do that. We'll find out what happens, how it behaves. I think it will still allow. Even if you have an IPv6 address, it will still allow because the IPv4 enables that. That's my reading, but I have not played with it, so we'll find out. Now, we discussed this thing briefly. Now, let us understand what we want to go and expand the whole thing in a different fashion. What does that mean? It means something that I want to make it a little bit more complex and more reliable and available than we did the last time. Last time, we just had one subnet, two subnets, and boom, that's our cloud. It's very simple, very trivial. What I want to be able to do is, as I said the last time, we have this Virginia region. In that Virginia region, you get multiple availability zones. You have A, B, C, D, and E. At least these are the visible availability zones to make a highly available infrastructure. Basically, what these are are independent buildings in somewhere in Virginia, somewhere in the state of Virginia, northern Virginia to be specific. There are these multiple buildings and every one of us is allocated five, A, B, C, D, and E. There are probably more. There are probably more than five buildings, but from an allocation perspective in Virginia, you will notice that when you try to create a subnet, let's go create a subnet in the VPC section. We have to go to the Amazon dashboard, look at the VPC section here, and try to create a subnet right now. You will find something interesting. Here, go subnet, select our Cloud Genius VPC, and create a subnet. You will find something that is different from the last time, which is here, I'm going to say I'm going to create a test subnet. In this subnet, I can decide to allocate in a specific availability zone, one to A, B, C, D, E. I have five of these availability zones available to my account. These are five different buildings that we want to put our machines in. We want to be able to create a higher availability scenario than what you see in a simple example with a public subnet and a private subnet. This is a very trivial simple example. If something goes down in that building, everything shuts down, you're basically screwed. You don't want to have that set up. There's a question here from somebody else again. Aha, I see what's going on. I think what's going on is people are watching our videos that we post on the website, and they want to participate in this class, which is fair enough. I'll talk to them separately. That's what's going on. People seem to have caught up on the fact that there are these four sessions that have happened with all of you together, and they are seeing those sessions, and they're figuring out that they should join again, and I will figure out something for them. I'm constantly getting things from other people who were participating before. They want to join for having fun. I don't know why, but we'll talk to them separately. For right now, what I'm describing here is this idea that we want to create a higher availability setup. Higher availability, meaning if something goes down, we should not be impacted. For example, we decide to put all our eggs in this one basket, in this one building, and the building goes down for some reason. We should not go down. That's our scenario. That's the design we want to be able to implement. We can implement that design by doing certain things differently, by designing for multiple subnets to span across multiple buildings. Here is how you will do it. What you will do is for your public subnet, like we created, we call it the border check subnet, we'll create one in this building and one in another building. This is this building and here is another building, so two buildings. We'll have a subnet called border check here and another subnet called border check here. We will also have a private application subnet for us and another application subnet for us. This is the extension of higher availability scenario you will build. You will have a place for you to put your databases here, you will have a subnet to put your databases here or you can use Amazon service called the database as a service and not use your own databases. This service already occupies multiple subnets for you, multiple availability zones for you. They will already do it for you by way of the design of a database as a service. They have a solution like that already. They will provide you a solution to run your database services but you don't have to worry about running your own database machines, although you can. You can get rid of these guys and just use a database service. Now that you have a border check subnet here and a border check subnet here, you will have a NAT device here and a NAT device here. How exactly are you going to basically mix and match and be able to have your end-user customer decide where do they go, here or here? And for that scenario, there is this concept of a traffic cop. And the traffic cop, I'm simply using that word, the actual word is called load balancer. A load balancer is something like this. Let's say you want to go to the DMV, a department of licensing, get a driver license. So here is a queue of people standing in line. They all want to receive a driver license. So they go to the officer number one, officer number two. There are lots of officers sitting and asking, receiving applications. So you want to go to the office of DMV, this office. At the front door, you will find a traffic cop. This cop will say, you know what? Right now, you sir should go to this person. And you should go to officer number two. And you sir, you should go to this. And you, please wait. And there are more people waiting to be served. And these people will complain that it is taking too long, a time and all that good stuff. A usual complaint with the government, right? The government is slow, things like that. But you know what, you have to understand that these officers can process only at a certain speed. They're not superhumans. What you can do is maybe get a superhuman. So you can get a bigger officer and a bigger second officer like that. You can get a faster processing officer who can process driver license applications quicker. So you can scale up the officer if you like. But this traffic cop is the person that decide where you go and where you go. So that decision making is very important. Where you go. So that decision making is what we need to be able to implement in a load balancer scenario. This is also another open source application called HAProxy. HAProxy is an application in the open source that is here. It looks like a website that you would not want to visit. But trust me, it is a pretty darn good application, this HAProxy software. And you will see that there are many companies, for example, F5 Networks, they have built secure application delivery infrastructure on top of this application, which is an open source product. It's a pretty fantastic application and it is very high performing. And that is the foundation of this company, the foundation of Elastic Load Balancer from Amazon and a bunch of other things that you will see and you will understand that all these things are actually using this thing under the hood, HAProxy. So now from a picture illustration perspective, it will look something like this. You will have a public subnet here and a public subnet here. And these are like two availability zones, like call them A and call them E, for example, A and E. Ignoring D and C and D, I'm not using. I'm just using A and E, just focusing on these two, I decide that. And I choose to create a public subnet here and a public subnet here, and a private subnet here and a private subnet here. And one for database here, one for database here. And this is my bucket. A bucket is a separate service, it is outside of the private cloud. So it independently runs, you don't even have to create machines. It is completely isolated from your private cloud. Your private cloud is all this boundary. That becomes your private cloud boundary. The buckets that you might have and this cloud front content delivery network, all of these things will be completely outside on the public internet that you already can use. You can put a bucket out there and use it. It is a part of Amazon solution, but it is outside your private cloud. It is public resource, publicly accessible. And that is what you will, you use the bucket and you understand that they are outside of a VPC. Now, from an implementation perspective, what we want to be able to do is create a NAT device here. So this is your NAT. Another one, NAT device here. We will get to this multiple levels of complexity at some point, not right away. But I want to tell you because the fact that things can go wrong means that it will go wrong. The fact that Murphy is a person that you may have heard of, Murphy. And he has a law called the Murphy's Law. You may have heard of it. And it will strike at the wrong, at the least desirable point in time. When you have everything, if you haven't heard of Murphy's Law, you should read about it. Murphy's Law. Murphy's Law is basically, yeah, go read about it. It's a fun law to read. So there's nothing technical about it. All it means is when disaster will strike, when you don't want it to strike, it exactly strikes at that point in the worst possible way. So what it means is if this entire thing goes down, you're dead, but not really. Because you have this alternative availability zone still alive and still kicking and your customers are happy. That's what you really want. And so even if you have an entire availability zone that goes out of commission, out of service, your application that you run will continue to function by use of an independent availability zone in that cloud, in say, Virginia Cloud, for example. That's the kind of concept we will build as an example. And we'll go back to our setup here in the Amazon Cloud here. And let us create those subnets that we need to. And this time, we will pay attention to creating our VPC, especially our subnets that we have. We want to be able to create these subnets in 1A this time, 1A. We got by default allocation in 1E. That was my example. Your example may be different. When you create a subnet and you don't select, say, no preference, it gave me 1E by default. I can choose to select whatever I need, for example, here. I can actually redefine my IP addressing scheme a little bit. What I want to be able to do is assign IP addressing scheme a little bit differently. So for example, I'm erasing this illustration, my handwritings, and then allocate IP addressing scheme to the subnets so that we can have a very clear, meaningful way of representing our subnets and then associate with security groups as we build a private cloud. And then we'll go on to discussing some applications using Git. And eventually, in the next couple of days, we'll be creating and building our own application to run on a platform as a service. We'll get to that point. But for right now, let us understand that last time we said, I want the IP address scheme for a subnet to be something like 10.000 slash 24. So give me this. And we chose something like a 10.010 slash 24 for this. So this is what we chose. I'm going to change it a little bit. How I want to change is something like this. I will make it 10 just to disambiguate that this digit here is what I will choose as 10. And here, I want to say 10.010 slash 24. So I'll say 10.011.0 slash 24. So I'm just changing a little bit the addressing scheme for this one. And for this one, I'm using 10 and 11 as opposed to this was 0 and 1 before here. It was 1 here, but it is not 1 anymore. It is 10. And 1 is here. And this is 11. And this is 10. That just gives me a way of very clearly understanding which IP addressing scheme will apply to which subnet. And I will divide this into 1E. And here, I will have 1A. These are the two availability zones I will get. I have been allocated the 1E already for this, for the border check subnet. I will rename that to be border check E. And this will be application E. I'll create as application A. I'll create this one as border check A. And I'll create these things right now. So here, we have the wrong location. I want to modify that. Or rather, I'll just delete it, easy. So I'll just say, delete the subnet and say, go bye-bye. And here, I'll rename my existing subnets. This border check, I'll rename it to be border check in the E availability zone. That is what I have here. It is the US East 1E availability zone for me. And I have only one subnet. I'll create one more. And I'll create the border check A. And I'll select the availability zone A. And here, I can choose 10, 0, 1, 0, 24. That is according to our design that we had in mind. I'll bring that design side by side so you can compare and contrast. And here we go. My design is, where is that here? So bringing it side by side so you can make notes and compare notes. Here we go. Excuse me. And so what I'm doing is I'm fulfilling this idea here. So 10, 0, 1, 0, 24 will become BCA. And that is what I just did, BCA 10, 0, 1, 0, 24. And I chose to be availability zone East 1A. That's a deliberate choice as opposed to automatically assigned. So that gets a new border check subnet for me, BCA. And we'll do the same thing here with app E. So create the 10, 0, 10, 0, 24. Here we go, create a subnet. We'll name it app E and choose the Cloud Genius VPC, choose the E availability zone and say 10, 0, 10, 0, 24. That's the range I will get for this app E and I will say create. And I'll do the last one, which is app C. That gives us four subnets in two different availability zones for us to get a higher level of reliability and availability, even if one zone goes out of service for some reason. So here, another one, last one, app. This is going to be A. And so we will choose the Cloud Genius VPC, choose the A region and select our IP addressing scheme, 10, 0, 11, 0, slash 24, and then create. So now we have four. The idea behind doing it like this is to improve reliability and availability of our infrastructure. Even if one building goes out of service, no problem. Because what we have done is we have these app subnets in two different buildings. We have the border check subnets in two different buildings. So that is the concept that I want you to understand very clearly. And you will see the IP addressing scheme here according to what we designed. 10, 0, 1, 0, 10, 0, 0, 0. This digit here is indicative of which, whether it's border check or application. So if it is 10 and 11, those are the application layer, application subnets, like these guys here and here. That's what you're looking at when app E and app A are involved. So corresponding to these guys, we can have route tables that we can associate pretty similarly. And what we need to be able to do is edit the route table and make associations with the application route table and call it this and this, both of them. So selecting the application subnets for that route table, saving it, and we'll do the same for our border check route table. We'll associate our subnets and make sure that we get the border check subnets in place and save like that. And we'll continue to ignore the other, ignore this, which we never wanted to begin with, but they have given it to us. So we have it, but we'll not use this, this route table is not used. Now, these two route tables are the ones that we have correct associations. The app is associated with these two application subnets, border check route table is associated with the border check subnets. So we have that good. So next, the routing for border check is fairly easy. It goes through the gateway, and that's done. We have a gateway already, but for our applications, our routing to anywhere on the internet is not there yet because our NAT device is dead. We killed it the last time, you know this. If I want to add it, I don't have another route. I don't have a place to go apart from this choosing the gateway. I don't have anything else because I don't have a NAT device, which means we need to get one. We can get one fairly easily and we can get actually two if you like. I'm not necessarily making it complex because I don't want it to become complex for no specific reason. So the point that I did it this way is to illustrate the idea that a cloud that you will create professionally for a real customer that pays you money at a large scale when you have lots of customers, you need to have them provide with a higher level of availability and reliability, and this is how you begin thinking like that. You begin thinking by making sure that you are creating your infrastructure in multiple availability zones. For example, E and A. That's the way to think about it. That's the reason why I created it. There is no need, actually no need. Even for Cloud Genius, the number of customers we have is very small. So I don't feel that need to enable its scenario or something like this. So we don't have it like this, by the way. It is primarily useful for a medium to large business. We are not a large business. We don't have this infrastructure. But I want you to think like a large customer that you might have or a large employer you might have, which you have already. Many of you work for large companies. And they will expect you to think like a large enterprise to be able to design for a higher availability scenario. And that is the reason why I am introducing this complexity idea. There is no other reason for right now for you to play with this kind of a setup. But I really want you to, when you are experimenting on your own, I want you to actually create a multi-availability zone setup. So anytime you go with any cloud, not just Amazon Cloud, this is a general purpose way of thinking. The word AZ is an Amazon word. But the idea is other clouds will use a different word. For example, here, you go to cloud.google.com. They will have a different name for the word availability zone. You can go to the console. But pretty much the same idea applies. You can go to Amazon Cloud, sorry, Google Cloud here, coming up. And you have something like, let's see, that thing called Compute Engine. You try to create a machine, they call it an instance. And they have a zone. So they don't call it availability zone, but they have a thing called a zone. And so here are these zones available in the US. Central, 1A, Central, 1C, 1B, 1F. So A, B, C, and F, four are available for me right now. That's it. They're not given me exact location where exactly their central actually is. They don't tell us. They don't have to. But somewhere in the US is apparently where the central 1A, B, C, and F are located. I can choose to create my machines in that C zone. That will be a completely different location. And I'll do it in multiple zones to improve a higher level of availability for my infrastructure, for my applications. That's the fundamental way to think about high availability. That's the reason why I had drawn this illustration and showed you the example of how you would go about thinking and implementing what we just discussed. You can do that in any cloud that you like. Any respectable cloud will allow you to do these things. So I've got a question. Yes. If you had it in two different zones, like geographic is dispersed across the US, would traffic naturally come into the closest implementation? You would not actually. They're not geographically dispersed. They're more or less in the same state. So you couldn't have one in Virginia and one in Oregon? Correct. You should not. It will really create havoc on your application because you have to plan for it. If you want to have a distance like Oregon and Virginia replicating and playing together, this is not the solution. You have to plan for it in a different fashion. And I'll talk more about that at some point when we discuss in the architecture segment, how will you go about implementing a larger scale failover like something happens in the state of East Coast, somewhere on the East Coast. It should automatically fail over to the West Coast. If that's the scenario you want to be able to implement, this is not the solution. Not at all. These are replicating though, right? Yes, you are. But for our disaster recovery scenario, this is not the solution. For disaster recovery, you will have exactly similar setup created in another region, let's say Oregon, as opposed to this Virginia, and keep it on a standby, hot standby. So when disaster strikes and the whole thing goes down, you have Oregon activated. That's what you would do at a very high availability scenario. So extremely high, higher than what this thing is. This is a cheaper way of implementing higher availability, practically speaking. But this is not foolproof. Actually, nothing is foolproof. Disaster will strike and when it does, things will go bad. Let's understand this. This is not a complete solution. No solution can be complete because the fact that you cannot achieve 100% high availability, it is not mathematically possible. There is always a chance when the whole nation can go down, right? That chance, it might happen, who knows? And if that happens, like a meteor strikes, the whole country blows out. You cannot have a setup which will be failing over, even if you have a Oregon and a Virginia setup correctly, like both failover. What if both go down? What if a meteor strikes the whole continent? You don't know those things, right? That's a mathematical possibility. And if that happens, there is no solution. Even that solution is not foolproof. So we have to plan for as to what level can we actually tolerate. If there is a cost to doing this thing, every time you want to do a duplication or a redundant setup in another location, there is a cost associated. Just the fact that you have machines here and also here makes it expensive, makes it double the cost already. You will do the same thing in Oregon, doubles the cost again. You'll do it again in maybe Asia Pacific, it doubles up again. It is hard. It is never going to be a completely 100% mathematical 100%, not possible. What if another big meteorite comes and strikes the whole planet? That mathematical possibility is very, very rare, but I'm talking about those kind of numbers. That's how you should think. It's always boils down to how much money you want to spend, how much money you have, and how much can you afford to lose. That's how you should think about higher availability. It is never 100%. That's why even Amazon will say it is 11 nines, so 99.999999. They'll never claim 100%. No, that'll be stupid if they claim it. That's the reason why I bring it up for a discussion for our practical usage. We will stick to just one to begin with, to understand, to play, and when we want to play a little bit more complex, we'll introduce the idea of double availability zone, sometimes even more. Depending on how we want to go and understand the concepts, our goal in the program is to learn, not to actually implement a full-blown high availability solution. We can, we'll tear it down. We'll not leave it running up and running because it will cost you money. Now, the next idea. We'll introduce this aspect of security groups into the play and see how it plays out. Here, what I want to be able to do to simplify further down, now that we have understood that we can expand and make it available across multiple availability zones, I want to come back to our single availability zone scenario and just have those two, public and private. This is just to simplify. Now, here, what I want to be able to do is have an app device and have a machine running here. I want to run some application here, actually, so I'll run some active application and I want people outside on the internet. This is me and this is people. I want people to be able to visit this point and access this machine, for which I have to go and use a traffic cop. The traffic cop is where people will go and basically connect to. The way we would go about doing that is you will have these people. We'll visit the traffic cop, the load balancer, elastic load balancer, as they call it. This load balancer will just handle one machine, which will run some simple application right here on that machine. We will have this NAT device so that this machine can connect to the world outside, anywhere outside, worldwide, wherever they want. The machine wants to go, it can. That's the purpose of this NAT. Another purpose of this NAT would be to allow me to go into the box through and through jump and go to this machine if I want to go in there. I need to construct security group rules accordingly. Let us think about those rules, understand them, and then implement such a setup. Very, very simply, just two subnets, not making it super complex because we want to understand our security group aspects clearly, and then make it complex. I don't want to unnecessarily make it complex without a solid reason. Here, how would you think about putting security groups right now? We have a public subnet and a private subnet. We have a machine here called Machine M. We have a NAT device called N. We have this user called me. We have these users called public, or rather I should say people. These people will visit our elastic load balancer. That elastic load balancer will say, you know what, your traffic should go to this machine. This machine will run some application. Very, very simple application, we will install it. This application will be a website. This website will run on this machine. It will show its output on port number 80 through HTTP traffic. A very simple website we will construct very, very quickly. That's the idea that I want to be able to do. Now, this guy, me, wants to connect to this machine, M, so I want to be able to go like this through the NAT and then to the machine. That rule I want. That's the kind of structure I want to be able to put. Now, I will need a security group here for this device. I will need a security group here for the machine. I will also need a security group here for the traffic cop. Those rules, we have to write down, first of all, understand and then write them down in this whiteboard and then go and implement. I want to be able to create those rules very, very simply. From three rules that we have, so here, first rule, sorry. This is a new pen today and a new writing equipment. I'm not used to it. I just got it like 10 minutes ago before the class. That's why it's so jumping around. Upgrades. Yes, sir. Yes, I just did that 10 minutes ago before the class started. I just hooked it up and it is kind of new for me. What I am going to talk about is that we want to construct one, two, and three security groups, one for our elastic load balancer, one for our NAT devices, and one for our machines. We want to construct those three security groups in plain and simple language. You want to write that down. In here, for the load balancer, the traffic cop, the idea is that you want to allow random people on the internet to come in on port number 80 via HTTP protocol and let them go into the traffic cop. Through the traffic cop, the transport will happen forward. You will also want to allow, so this allow permission has to be there in place. You will also want to allow the traffic cop itself to connect to the machine here, meaning the machine rule here here should allow all traffic from the cop to come in to the machine. Similarly, you want to allow all traffic from the NAT coming in to the, sorry, no, no, no, no, no, sorry, wrong, wrong, wrong. I'll go back, roll back. You want to allow me to come in to the NAT device at port number 22. You also want to allow NAT devices, traffic from the NAT to go to the machine, any traffic, you want to allow that. Not just a port number 22 traffic, you want to allow anything that you want. Our choice is that we are designing these rules so that the traffic actually flows. What else should be, let me see if I'm missing something. We have a user, that user hits the load balancer. The load balancer traffic should allow, so this, let me change the color. Here, this person, he or she wants to hit the load balancer. We want to allow the port number 20, sorry, port number 80 HTTP traffic should be open and then the person will reach here successfully. We would like that person, the traffic to be transported over from the load balancer over to the machine, which runs some application. That application happens to be running on port number 80, which is where all websites run, by the way. You want that traffic to be transported from load balancer to the machine. The machine's rule should be to allow load balancer traffic come in. That's the rule that will take care of the person here, will be able to see the website. For me, the operator, I should be allowed to come into the NAT device. This is me going into the NAT device. I have that rule open that will let me into the NAT. Then for this machine, it should be allowed to come in from, if the traffic is beginning from the NAT, it should be allowed to come in. That rule is defined here. I hope this little illustration that I'm trying to write down is clear before I implement it. That is what I want to ask you. Is this concept clear before I go forward? People can never go through the NAT. They only go through load balancer. Yes, people don't need to go to the NAT at all. The NAT is primarily for me to get in and for the machine to run the applications to update itself. For that, we need to allow an outbound route. That machine wants to run a Windows update or a Ubuntu update, a machine updates itself. Machine can update itself, a Mac update. It can update itself by connecting to Microsoft Windows update or connecting to Apple update or connecting to Ubuntu sources for Ubuntu server updates. We need to have the machine to connect to the internet outside for which this machine traffic that originates from here should be allowed to go to the NAT. That rule is missing. We should add that rule. If the machine traffic originates from the machine, allow it into the NAT. This is the NAT rule. Similarly, we want to allow traffic that originates from NAT to be able to go outside anywhere on the internet. If there's outbound traffic that allows the machine to update itself, that needs to be permitted. Otherwise, the machine will not be able to update itself or it will not allow us to actually install this runnable website. I will install a website right there, you will see it, but I will not be able to put that software for that website to run here if the machine cannot pull it down. Machine needs to be able to download that application to run on the machine itself. The download of the application will not happen if the machine cannot connect to the internet. What I will do is instead of first creating these rules up in the cloud, I will actually not create any rules. You will see that everything fails. I will start adjusting rule one at a time and you will see that these things will start to work. We will see a big failure to begin with and slowly adjust our rules to allow certain things as we discussed like in the illustration. I will do that. I'll basically begin with just two subnets and everything that I do will not work. Then I will slowly open up our security group rules and demonstrate to you how it works and explain to you why it works. Is that a good idea? Expect failures, so let's go, do it. Now, back here in our cloud, we have these two subnets here. Let's cut down some confusion. Here, I will like to delete some of these subnets, for example, A and A. I want to cut those down, so delete the subnet and they go away. This is basically the app A and app E confusion I want to cut so that we don't have that high availability scenario set up yet. There's a question here. Nilesh, can you check if your recording is going on? I see that it is going on, but I would like you to confirm. I think it is going on. I see a recording on the webcam window, but not another window. Change your windows and see, or maybe check with somebody else. I think the recording is happening. Confirm that please, cross-check. Somebody else, please check. It does look like the recording button is blinking. Blinking is good. We have one VPC here. We have two subnets. I have simplified it to be just grab order check or app. I'll rename it to maybe public and private. Just simplifying the two names, we have a route table. Those two route tables are private and public. By the way, just checking the route tables, we have our public route table is associated with the public subnet and the route are all clear to go outside the gateway. That's good. Now, the private, we have subnet association correct. The route to the internet is broken. Good, expected. We have a gateway that is functional and attached. That's good enough to begin for right now. Now, what I want to do is go back to our whiteboard and draw what we just drew. We have a public and a private subnet. I will begin creating a machine here and we'll convert that into a NAT. This is the public subnet. Here is the machine that I will choose Amazon NAT AMI, that one AMI that we have already. We'll use that AMI machine image and that becomes a machine to begin with. Here, we'll go to EC2 like that, choose community AMI. This community AMI instances are available here. We'll search for the one we used last time is right here, I think. Amazon Linux, it doesn't say NAT. No, it is not the right one. I'll say Amazon AMI NAT, a NAT AMI. What was the name I chose? Nothing found, let's go Slack chat. Slack chat will have it or rather I'll search it right here. I just look for NAT. Yes, look for NAT and then 2016. Yes, 12. 16, that should be good. Then even later version would be this one. That should be the summer one too. Actually, it doesn't really matter too much. Any of these Amazon AMI VPC NAT HVM should do it. This string should work. I'm selecting this one, select and then configure. Here, I will say choose this VPC and the subnet I want to choose is the public subnet and I want to get an IP address. Here, you make sure you get a public IP and put it on the public subnet. This way, we can make it a NAT. Add some storage, not magnetic please and go forward. This is your NAT device. Now, we will choose a security group. We have an existing security group. The last time we created a NAT SG, we'll use that one. It has these rules already assigned. We'll have to modify those. We'll first review and launch. We have our launch configuration, select that I acknowledge and launch. We have the machine up and running. I will start my virtual machine and then connect to the machine that I just have. That way, we will be able to connect to that box that we just started. The box is this NAT box. For this NAT to function like a NAT, we need to change the source destination check. Where is that? Somewhere here, you will find that this machine needs to function like a NAT. Where is the source destination check? Where is that? You right-click on the instance ID. Yes, I would like to go right-click instance ID, networking, and change the source destination check. I want to disable it. That changes somewhere here in the view should also show that the source destination check is disabled. That's what I was looking to find, but I cannot locate it for some reason. Maybe I'll refresh. Yes, there it is. I found it on the other side. They keep moving things. It moved here at this time. Source destination check, false. It shows you false now. Now that this machine is up and running, we should be able to grab the public IP address, copy from here, go back to our machine, and then modify our config file first. Here is the Atom editor opening up in the.ssh folder. Then the Atom editor opens up, shows you the SSH config file. We want to make a change to this configuration. In there, this IP address needs to change to the one that we just copied and pasted here. Let's save. Now, we have to modify this also. Eventually, when we'll have the box on the private side, we'll modify this one later. For now, closing it. Now, I want to be able to connect to this machine that I just created. I should simply just ssh and say, dash i and give it, sorry, break it, ssh, dash i. Why am I not typing the dash character properly? Dash i, yes. Then tilde slash.ssh and the private key, like that. Then the username happens to be for an add device. If this is the username that Amazon has chosen and the IP address is pasted from the website, we should be able to connect and we'll say, yes, and we connected. This is the Amazon machine that we have, which is now acting like our NAT device. We are directly on the NAT. It is also a machine. It is connected to the internet. We should be able to see the IP address for this machine. Actually, we should just update the machine itself, update the machine. Updating will go to Linux sources and update the machine itself. How do you do that? Pretty simply, sudo yum update, enter. That's how it updates. It says, I want to update myself. Do you want me to allow? I'll say, yes, go ahead. I update. The machine itself is downloading updates and setting it up. It did that. It will not be able to connect to the internet if the security group was broken or if the gateway was not connected, but you can see that the machine updated itself correctly. No problem. That's great. We'll go and create another machine on the other side, on the other end, on the other launch and instance. This time, I want to choose this Ubuntu server and I want to select it and put the configuration in my Cloud Genes VPC and make sure that I am in the private subnet and then I have no public IP. Disable. It is by default disable, but I'm just selecting disable. There, I go add some storage. 8 GB is good enough. Next, add some tags. This is my machine. Configure security groups. Select an existing one from the last time, it is this one. You see that my rule is to only allow SSH traffic. That's it from any location, source is any and review and launch. I'm going to launch and I'm going to select this, acknowledge and proceed. Now, I have a machine there. This is a Ubuntu machine that is going to get a private IP. Private IP is this, but I get no public IP and I don't need one and I don't have one. I don't want one. Back to our atom configuration, SSH configuration. This IP address is the private IP address of the machine that I paste and now I have it, I save. This is the new IP address that I want to connect. I close this configuration and I go back to my terminal. I'm currently connected to the NAT device. I will exit, exit out of it, came out. Here, I want to connect to the underlying machine underneath. This is SSH and then the IP address of the machine under the hood. This is going to go a jump command, proxy command and go through the NAT device and connect. You can see that it is asking me, are you sure what you're doing? I'll say yes, but you will realize that there should be two hops. The first hop, it did not ask because I already answered yes to the previous attempt to connect to the NAT. This is only going to be one question, are you sure? One time, I'll say yes. I'm connected to the Ubuntu machine. You can see that updating this machine will fail. Here we go, look for the failure. Here, it is stuck. It says unable to resolve. I don't know where to go. There is no route to go to the internet. It is trying to connect to cqt.ubuntu.com to get the updates from this location, but you know what, unable to connect. It will not be able to do anything. It will not be able to update itself. It will not be able to install an application. It will not be able to run any new software. It is going to be exactly what it is, just like that, unless you find another way to push an application there, which is not dependent on the machine itself updating. I want to be able to install some application right on that box, but it is too bad. It is not going to let you. Let us now focus on the security groups as to what is going on. With the machine, it is running. We are connected through this private IP. The security groups are these, AppSG, the security inbound permissions going into the machine, allow SSH traffic coming from any location on the planet. They allow me to go in. Great. What about outbound traffic? All traffic, all protocols, all ports to any destination are allowed. Then why does the traffic not work? It does not work because, look at our route table, and you will find that in our VPC, our private route table does not have a route to the internet. Here is our route table, and the private route has the association all correct with the private subnet, but our route to the internet is missing. We will add that, add another route. Okay, dear, you can go wherever you like, as long as you're going through the NAT. Not this. I don't want you to use this because it's the private area. We want to hide from the world. We want to use the NAT. I'll save. As soon as I save, you will see that this will succeed. I did not do anything. I just waited for it to pick up. The route got picked up and it updated. The machine updated itself. You can see that I can now install an application on this Ubuntu box right here by running another command, something like, I'll install nginx application. It's a simple application called nginx. That is what I will install. It will create a website on this box, a new website. Before I install, I want to check whether right now this, I broke it. I did not install. I want to check whether this box is actually currently acting like a website. I want to see what this box is showing to the world outside on port number 80. We have this box created. It is Ubuntu box. We were able to update this box by opening up our route table, this route table to allow the traffic to go like this. Whereas this route table says, you guys, if you create a new machine here, it go directly out. That's the using the gateway. This is using the NAT device. That's the difference in this route table and that route table. The subtle difference is you guys, you go through the NAT. Anybody on this subnet goes directly through the gateway. That's the only difference in the two between public and private. Now that we were missing this NAT route table entry to go anywhere on the internet, we expanded that and then this Ubuntu box was able to update. Now, this Ubuntu box will run some application called Engine X. It's just a web server by the way, a very simple web server. You'll install it in one line command and it will start showing you something on port number 80, HTTP. That will happen and you can see it as long as the traffic can reach this box. But right now, there is no way to go there. It is all protected by security groups and the fact that your private subnet is not connected to the internet. People cannot go there, but you want to show this website to the people. You want to see what this thing is doing. You want to be able to see that if you are already on this box, like I am connected right now, I should be able to see what is going on on the port number 80 directly by running a simple command here, which is to see what do you have running there on port number 80, but simply typing curl and on that local box, please show me what you've got and it says I have nothing to show you, unable to connect, connection refused. Curl is a method to see what it is like a browser, if you will. It's a simple way of thinking about curl is a browser. So you open a website with local host, it will show you what that website shows you. So if you open some website, like for example, open this browser and say local host, unable to connect, because I don't have a website running on this machine, so it is not able to see anything. So local host refused to connect. That's what you saw the browser telling you. The same thing happens here. Curl says go to local host, see what do you have running on that site, nothing, connection refused. Now, I will include and install an application on this box, pretty simply like this, install. And it says permission denied because I need to be super user, so I'll say, okay, super user, add it. And say, do you want to install the application? I'll say yes. So it installs. Now, the application is done installing almost finished. Application is installed. Now, we'll do the curl thing again. Curl, show me what you got. And we have something here. It shows your website. The website will say, welcome to NGINX. If you see this page, the NGINX web server is successfully installed and working, further configuration is required. That's the message you will see on a website browser if you open this box. However, we are on the box already, so we can see it. But other people cannot. You try to open that IP address of that box, it is a private IP address. You cannot even reach there. So now, we have to somehow manage to connect people. Sorry, sorry. Okay, we have somehow managed to connect people on the internet with this hidden box here. How do we do that? Let's go see that. So we have this and this. We have a NAT device and a machine here. This machine is running your NGINX application. It is showing you HTTP port number 80 and some nice little site. But people on the internet cannot see it. We want these guys to be able to see this machine. It is in the private area and this is your public area. So you want to have a method of reaching that thing for which the best recommended approach is to use a load balancer. And then have the load balancer connect. If you have more such machines, have the load balancer, balance the load among multiple machines. So this is machine number one, machine number two, machine number three, like that, you can increase number of machines if you like. The load balancer will basically accordingly handle traffic pretty much like this Department of Licensing. You have officer number one, officer number two, officer number three, lots of people waiting, you can open up one more, officer number four, and the traffic cop says, you can go here like that. That's the idea here pretty much is that we have a method of scaling it out when we need to, but for right now, we just have one. And so we need that traffic cop in place. And we will create that as simply as going to this website here and say front page EC2, there should be a load balancer button here. So we'll create a load balancer, somewhere here, we'll find it. Where is that? Elastic load balancer, there we go. So we have a load balancer create like that. And there are two types. This is a application load balancer, which is preferred for HTTP. So that's what we will get. And the other type is a classic load balancer, which is a general purpose. You can use TCP and SSL and other types of load balancers, but we are sticking to this type. This is the application load balancer, and we will create one like that. We'll continue. And here, we'll give it a name. This is our traffic cop. It is facing the internet, facing the internet, right? You can have a traffic cop, internal traffic cop for internal traffic. We'll talk about that later. But right now, our idea is to have this cop face the public. This is internet-facing, and IPv4 is good. And then listener. The listener is a process that checks for connection requests using the protocol and port that you define. A default listener will be HTTP. That's the classic way of connecting load balancers, is to have people come to visit the website and let that traffic be HTTP traffic, and it goes on port number 80. So you listen on that port. You can choose this load balancer to be multiple availability zones, if you like. You can also choose the VPC of your choice. I'm going to choose the Cloud Genius VPC. And in there, we just have only one availability zone, and we want to choose this availability zone to be public. We want this traffic cop to be on the public availability zone, public subnet on the only availability zone that we have. We have only one. It's called 1E. And in that, we want to select this availability, sorry, this electric load balancer to sit on the public subnet. That's how we are choosing. We will now go and configure our security group. Our security group will be a collection of rules. It says at least two subnets must be specified. So that's a high availability requirement Amazon is forcing. We have to have two. We cannot have just one. So we'll find, we'll create two. Basically, I have to go back and redesign our layout. It is forcing us to have two subnets. We just have only one. So back to our VPC, we'll create two now. We'll have, this is familiar, we did this to begin with. But what I'm going to do is create two public and two private again. We'll call it the E. This is familiar to you. We did that at the beginning of the session. I'm putting those labels E back in place and then creating two subnets, private A, selecting A, and let's go to our design. Our design was, hold on. Let me find that illustration. Where is that? Here. We are basically creating this because Amazon seems to be forcing now to choose two, one is not enough for them, which is understood why they do that. So what I'm going to do is create those two subnets that are deleted back again. So I deleted the entire availability zone A. This one went away because I killed it. I will have to create it back because Amazon is forcing us. So we are doing that now again. Here I have to choose our private subnet and I'll give it 10, 0, 11, 0, slash 24 in the East 1A, private A, create, and then public A is also I have to create. I will create that as soon as this thing finishes. Now creating public A in the Cloud Genius VPC with a preference to East 1A and the range is 10, 0, 1, 0, slash 24. That's the numbering scheme I chose. I create. I should allow it two private, two public, one A and one is B, one is E. Those two will be available to us both in private, both in public as well. So in our scenario right now, in our Cloud Genius VPC, we have private A, private E, public A, private public E. Now going back to the EC2 section and load balancer, and then again, creating a load balancer, which is in this segment. It did not allow us to proceed forward. The last time we saw, it forced us to have two availability zones for higher availability, that design, forcing that design right now. And so here I'm going to call it traffic cop again, internet facing, HTTP load balancer, availability zone listings that I would like to choose. In the Cloud Genius VPC are these two subnets, which are the public A and public E. That's what I want to choose, two different availability zones, one A and one C, and the public subnets in that availability zones. Here it says you are creating an internet facing load balancer, but there is no gateway attached to the subnets that you have selected. That means there is something else that we need to be able to do that we did not do. And so these two are indicative of the fact that there is no gateway, which is an easy fix to address. We'll go back here in our account and our different tab and associate those routes that we have not done for these things. So we'll go back here, our routes are missing. That's why it is complaining, we'll go to our route tables. These are public and private routes. We can, again, be very elaborate in saying this is the route table for E, this is the route table for E, for private and public. We'll create two more route tables. This is the public A and create. We'll create one more called private A and then associate the routing accordingly. We'll have one more route table. This will be your private A and create, and then associate the subnets accordingly. So this is the four that we have, actually five, one of them we'll ignore. The A public that we have, we have to associate a subnet. We'll do the subnet association pretty much like this is public A. So we'll associate with public A like that and save. And the route, we have to go and allow this public guide to connect to anywhere on the internet using the gateway that is already in place. So add another route and choose the gateway. This is a public route, so let the traffic go. Next, in the private A, we have no associations. We associate that, again, pretty much similar to private A, associates with private A, this line, click and save. Our routes will still be unavailable because we don't have a NAT device in that availability zone, A availability zone yet. We'll have to create a NAT, but that is not really truly necessary. We can just work with one machine and one NAT. That's not really, I don't think it will force us to go and create another NAT. It'll work with just one NAT. It'll assume that the other NAT is broken, and that's fine. And so we are waiting for this to save and finish. And then we'll go back to the other tab here. And here we will say, we want to be able to refresh. So refresh. And now we have our traffic cop, internet-facing. And now in our Cloud Genius VPC, we'll have these two. And in there, we have a public and this public are chosen. Our complaint that it had before has gone away. The complaint went away because we have actually created a system timed out on the route table creation that is awesome, beautiful, very beautiful, save again. Sometimes, Cloud services behave improperly. So we have the save successful. We also see the private route is not open to the internet, but that's fine. We can leave it alone. So private E is okay, and it's going through the NAT device we have. Private A is not, and we understand that. Public A and public E are connected to the gateway, which is fine. So back in this screen, it'll allow us to create a load balancer. We'll create a new security group right now. This name should not contain a space, so we'll say fine. No space there for you. And then proceed to create security group. It will say, improve your load balancer security, not using a security listener. What do you mean by listener? They're changing things here. Oh, secure listener. So they want us to add a listener for HTTPS also. That's what it means. So it says you have to have the forcing HTTP, by the way, this thing that you should understand is that this is new. The idea is the world is moving towards HTTPS. This is what everybody is trying to force. I was attempting to just get away with only this. They are forcing us to use HTTPS to make it secure, which runs on a different port. That's what you are just noticing. It complains that, you know what? You're not using a secure listener. Secure listener should be used. They're forcing us. That's what you just saw in this example. And so if you just say, no, I don't want to use secure listener and attempt to go forward, it will complain, but still allow you to go forward. You don't have to use secure listener. But in practice, you absolutely should. Absolutely should. It translates to something like here. You will see that in this example, that here this lock shows up, this padlock, this padlock. It shows you that the Safari is using an encrypted connection to this site. And you can see the certificate is issued by an authority to the Cloud Genius website. And this certificate is valid. That's the secure protocol that you're talking about. Everybody on the internet is expected to see secure certificates being used. That's what Google is forcing, Bing is forcing, Amazon is doing. So everybody wants the world to be secure. That's the reason why you see those alerts popping up. It says your load balancer is not using a secure listener. Yeah, we understand. We will still proceed forward without it for right now. We'll come back to security examples at another time, not right now. So go now, configure security group settings. Here, we have to create a new security group. And we'll assign it and name it the ELB security group. Elastic Load Balancer Security Group. That's the name I will choose. And our idea here is to allow public traffic to come in, not all protocol, but only the HTTP protocol, so all HTTP. That's what I want to select. So all HTTP, where is that rule? Or rather, just HTTP here. That should do it. So allow public to come into port number 80 from any location on the internet. That's our rule. So let public come in. That's our original discussion we had here, by the way. If you remember our security group discussion back here, we said we'll create a new security group, like ELB security group, that will allow HTTP traffic port number 80 from anywhere on the internet. That's what we are doing right now. Here, Elastic Load Balancer Security Group. HTTP traffic allowed from anywhere on the internet. And then we configure routing. Our target for the load balancer will be a target group. We'll call it those machines that we have on the back end. Our machines are only one, by the way. Our machines are these machines. So we have our load balancer. This load balancer will connect to multiple machines, M1, and pretend that we have M2 and M3. These are pretend right now. We don't have them yet, but that's a group. And that's what we are creating for the load balancer to balance traffic across multiple machines. We are creating that right now. So back in here, it says, give it a name. And so I'm going to call it our machines. And the protocol that these machines work on is HTTP. They are listening at port number 80. And the health check, whether the machine is active or not, is basically look at the slash path, meaning just open the website and see if the website operates, then it is considered to be healthy. Otherwise, it is not. And so we will now register targets. The target here is that we have to have the load balancer listen to some machine. We want to use this machine as the target, not the NAT. The machine that is running, this machine, is the target for the load balancer. The idea is this machine, ELB, will interact with M1, M2, M3 like that on the private subnet, not with NATs. NATs are just for us to go in and for the machines to go out. That's it. So the elastic load balancer does not interact with the NAT devices, but instead with M1, M2, M3 like that. So it is right now asking me, what is the registered target? And I'll say, you know what, go connect to that machine, M1. That is our machine, M1, here. And that machine is running an application. It is called the NGINX application right now, as you know. You saw it in the terminal. We'll go and now review our connections. Here you see that there's a traffic cop internet facing using port number 80 HTTP protocol in the VPC called Cloud Genius. It has a subnet public A and public E. It is using the security group called ELB SG. It has a target group called Our Machines. The machines are operating on port number 80, running HTTP protocol, the path is slash, meaning the main website. And the health check, we'll talk about health check later. The idea is for ELB to check whether the machine is active or not. So it checks, that's the health check. And then we create a load balancer, click to create. And it finishes, the load balancer was created. The load balancer is called Traffic Cop. We'll go to that load balancer. And here it says that this load balancer is called Traffic Cop. It has a DNS name here. That's the DNS name we have. We'll use that DNS name, by the way. We'll copy that DNS name, and we'll see whether the listeners are active, and whether the monitoring is functional, and whether the listeners are actually... Let's go see, I think, give me a second, I'm going to examine where the security groups are and whether the machines are responding. That's what I'm doing right now, give me a second. Targets, edit. And this machine, I think I added it. Oh, I did not add to the registered group. That's why I did not do that. I forgot this step, adding to the registered group. This machine needs to be add to registered, and then save. And then it will participate in the Elastic Load Balancer. What was the step I was missing? Even though I selected the button, I did not click the Add button to add this M1 as a person who is going to participate in balancing the load. That piece was missing. That's why it was not showing you. Now, let's go back to the front page, let's look at our Load Balancer services. We have one Load Balancer here, and that Load Balancer is called Traffic Cop, that should show up here. This Traffic Cop shows up. It shows you that there is a listener listening at port number 80, and then there are these machines that are showing you called Our Machines. In the collection of Our Machines, we have only one. The target shows as, and none of them are healthy, apparently, which is interesting, but that machine shows you. None of the availability zones contains a healthy target. We have to go check the health. Let's also check whether our security groups are open. We'll go understand our security groups right now. I will go back here. You will find, like I said, initially, you will see failures. We have the Load Balancer connected to a group of machines here, called M1, M2, M3, out of which we have only one machine. We have this thing in a security group called ELBSG. We have this machine in a security group called Application Security Group. What we need to do is to allow traffic coming from this group to go into the group where our machine lies. That traffic permission has to be allowed. We don't have that allowed yet. That's why this Load Balancer doesn't see anything alive and healthy. This health check was missing because it was not able to reach the machine, because the security group permissions for this to let anybody in the ELB security group to come into it. That piece is missing. In our security groups, you will find the Application SG does not allow random people like the Elastic Load Balancer to come in. We had to allow that. It is not really random. We created that. Back in our security groups here, you will find our Application Security Group. The inbound traffic is allow only SSH traffic. It doesn't allow any other traffic currently. That is our Application Security Group here. That's what the machines follow. They follow this group. This security group rule contains only one rule, which is to allow me to get in port number 22. I got in. What about the Load Balancer? That Load Balancer should be allowed in. Let's open that rule. We'll edit the Application Security Group, edit, and allow a rule for all traffic as long as it comes from the Load Balancer. Allow everything as long as it comes from Load Balancer. How do you specify that? You just type ELB here, ELB. You will see that the security group correspondingly automatically pops up. You select that and save. That expands the definition of the application. I did not save or what? Let me refresh. I thought I saved. Application Security Group inbound rules should allow all traffic if it originates from the Load Balancer. That is a change that we have to do in order for traffic to flow from the Load Balancer and come into these guys. Who are these guys? These guys are the Application Security Group. Now, we enabled traffic originating from here to go to the machine, which will eventually in five to 10 seconds find that this machine is healthy. Then this machine M1 will participate in the Load Balancer group, M1, M2, M3 like that. You will see that happening back in the Load Balancer screen. That project should now pass. Here is our Load Balancer, click. Then we see that our Load Balancer health check status. Let's go see our listeners. In our listeners, you will see that there is a group called our machines. In our target group called M1, M2, M3, we just have only one. That target is unhealthy. It requests timed out. It attempted to connect, the request timed out. That means in the next few five to 10 seconds, it should pick up and find that that machine is actually healthy. We can alternatively test this same concept by going to expand the security group one more time and allow another scenario. I'll play a different scenario for you right now. The idea that I have for you is to validate whether our security groups are functional or not. The way you can do that is we have this elastic Load Balancer, we have a NAT device, and we have our machine. This machine is under the control of application security group. This machine is under control of NAT security group, and this machine is under control of ELB security group. We allowed anybody from this group to go in. This is all allowed. We want to test this validated separately, so we'll allow any traffic from the NAT to go into this also, and then be on the NAT and see what this shows. We'll be able to examine that. We had to open this port also just to test. We'll see that right now. We'll go back to our security groups in the application subnet, sorry, application security group, inbound routes, all traffic as long as it comes from our NAT device and save. When you save that, it allows traffic from NAT to come into the application security group, which is nice because now we can be on the NAT and test whether this machine responds properly and shows you the same response you saw here. You saw it locally on the machine, we'll come out of it like this, and then connect to the NAT device like we have already before in the previous attempt like that. Now we are on the NAT device. We like to do a curl command on the other machine pretty much like this. See URL and then the IP address of the box inside, which happens to be, go to dashboard on EC2, look at the two running instances, identify the machine, get its private IP address from here, copy that, bring it here, and paste. You're now looking at the website shown by the other internal machine sitting on the NAT box and see what shows up. You see that the website showing you welcome to NGINX showed up. Similarly, it shows that our NAT can access the website, which is nice, but we don't need to. Nobody on NAT is going to open the browser and see that site, but we just tested and validated our security group settings. Now we'll go back to our ELB here, and there you will find in our load balancer, we'll again check for the health status, health check. Listeners and our listeners are called our machines, the target group. In the target group, we should have at least one, the only one active and health, and the health check should be passing. It shows that it is healthy now. It was able to detect that the machine called M1 or the machine called machine is actually active and functional. Now what we're noticing is that it shows you health checks are passing. That means this load balancer was able to connect to the machine, and it was able to check for health on this protocol on that port, and it passed the health check, which means now our random person on the internet can come and visit our load balancer and should be able to get transported over to the machine called M1. No problem, we should be able to see that. Now where does the user go? Where will this person go? They will go to the load balancer front end. Where is that? You go to the load balancer, again on the front page, ELB, and you will see that the ELB called Traffic Cop will give you a public facing address. It is called the DNS name. This is the name. We'll copy that name and open it in a browser window, just like a random user on the internet, and off we go. Now, welcome to NGINX. That is the application running on the machine inside. Now let us recap. I'll paste this link for you so you can also play. Here is the link. Let us check. Here we have, so that's the Slack chat. Now, the thing that I want to click on it is to make sure that you are able to see it. I'll make it further interesting now. Before I make it further interesting, I would like to recap what we did. It was involved, so I'll recap the whole thing so you get a clear idea. Rad says it works, that's nice. Let's recap. What we did, we had a public subnet and we had a private subnet. We tried to go and create a machine here and created a NAT here. I was able to have this person called me. I was able to go in like this and then install NGINX here. All nice and fancy. Great. We saw that this NGINX works locally and we did a curdle here. Curdle, CURL, and it showed it works. That's great, but still this random person on the internet, I'm interested in this customer of mine who wants to be able to see this site that shows on port number 80, they cannot go there. I need to put a load balancer. I put that load balancer there and then I created a new security group for the load balancer. There was a security group for this guy and a security group for these guys. There'll be more machines like that later on, M2 and M3 and like that. We'll be able to scale the load among these various machines pretty much like this. We'll participate together in a collection called Our Machines. Right now, it's just M, no M2, no M3 yet. We also did something which is to allow security traffic to flow. We said, we want to be able to make sure that our machine traffic flows nicely. For that, the security group for these application called NGINX that I have, it should allow people who are originating from the load balancer to come in. If that doesn't work, then this poor guy will not see anything. He or she will see the load balancer, but the load balancer itself will not be able to see this machine which belongs in the application security group and so that ability to see for the load balancer to come inside the application security group and examine what is showing on this port via the HTTP protocol on this machine which runs NGINX, by the way, NGINX was possible only when you open the security group between the load balancer, allowing it to come into the application security group. We also, to test it out, opened up the NAT security group to go from the NAT to the application security group, which is an unnecessary step. I did that to test, so I should remove that. I should go back to my rules and remove the ability for NAT to come into this application security group because it is not necessary. What I'm going to do is, back in our console in the security groups, for application security group, the inbound routes allow NAT traffic. That is unnecessary. It is only for me to test and validate, so I should remove that. I'll remove the NAT thing. Which one was NAT? So 9c7, this is the NAT thing, so I'll go and edit and remove the 9c7. Get rid of that piece and save. You will find that your load balancer still works. It works because of... Hold on, let me refresh the screen. It works because the application security group inbound routes allow traffic, allows traffic from the load balancer. If you don't have this rule, the load balancer will never be able to see your machine M1. We will now create one more machine, launch an instance, another Ubuntu server, and this is going to be launched. Configuration details, and I'm going to select a security group called... I think we'll go back to previous, previous again. I think I've bunched... Let me begin again. I've bunched a lot of things. Launching an instance. What I'm going to show you actually is, I'm going to demonstrate this M2 now and show you how this load balancer is actually balancing. That balancing act between this and this and this and this. That balancing act is what I want to demonstrate to you as to how the load balancer actually balances load. That's the action I will show. I can show you the balancing for which I need another machine. That machine needs to be something different than the one we have. We'll create one, put that in the application security group, and then have this load balancer hook up and participate in the group. We'll do that piece. Back here, this machine, Ubuntu server, select. We'll T2 Micro, configure the details. We'll say, go to Cloud Genius VPC. We'll say, private E, the last time we selected. This time we'll select private A. Don't get a public IP, add some storage, add some tags. This is my machine number M2, add some security groups. Sorry, previous. Add some security groups. I'll select an existing security group. I'll create this security group, application security group. That's what I would like to have these machines M1 and M2 to belong. To do that, click review and click launch and select and launch. The machine is starting up. We have to go and make sure that this new machine is a member of the group of my machines in the load balancer. What it means is that you have this load balancer who needs to participate and manage a bunch of machines. We have now just only one, but we are adding one more. This M2 has to be included in the group. That's what we are going to do as soon as the M2 starts. While it takes time to start, I will conclude our security group-related discussion. The simple thing to remember is that you're running an application here on these bunch of machines that you have, like that. If you have more of them, you can have them in multiple availability zones. AZ-A, AZ-E availability zone, A availability zone, E like that. You can distribute among multiple availability zones. They will need to participate in a load balancer function, which also happens to be at least two availability zones, AZ-A and AZ-E. These guys will be able to connect like this. Actually, it's collectively one service. It connects to machines in multiple availability zones. That's what a load balancer will do. These guys need to allow traffic. The application security group has to allow traffic coming from the load balancer security group. This traffic has to be permitted. After you permit, you will find that these machines will pass the health check if the machine is actually healthy. If the machine is dead, if there is no application running here, NGINX, for example, if it is not running here, it will be unhealthy and it will not participate in the load balancer. It is similar to an officer in the DMV taking a lunch break. You can have the machine go away on a lunch break, for example, and then the machine might come back and become healthy again. If you can do these things automatically, it will perform exactly the way you would expect. For our example, what we are doing is this machine M2 that we have created. It needs to be included in our load balancer discussion. We'll go to the load balancer section, identify our load balancer called Traffic Cop, look at our listeners, look at our listener groups. In there, we have this target group called our machines. We want to expand that to include one more machine which is M2 this time. Our targets, we have to edit and then I want to say that I want to grab the M2 machine also and add to the group. Now, we have the machine called machine and another machine called M2. We have to save this screen, so we'll save. Now, we'll go and look at whether it is healthy or not. We can see that this is healthy, the machine is healthy here. Great. This is a blank machine too. It is initial testing happening. It is checking for health. It will fail because that machine does not yet have NGINX. We did not install anything. It's just a blank machine. I need to go to this IP address, connect to that IP address, which is our M2 address and in there, we have to make sure that we are able to connect to that IP, which is not this machine by the way, this is the NAT box. I'll come out of here and go to our SSH configuration, this file. Here, I would like to connect to this IP address, which is different from this IP address. It's our machine IP address and this is our M2. We would like to copy this segment. This, I'm doing for generally to make your concept clear, to help you understand. That's the reason why we are doing it like this. This copying and pasting is not really necessary if you reconstruct your config file in a different fashion. What I'm doing right now is to help you comprehend what happens under the hood is when you have another machine to connect to, you will basically construct it like this and you will get the new IP address in place of the other machine, M1, here is M2 and then you remove the empty spaces, which are not really necessary and save. Now, lines number 8 through 12 will allow you to connect to the machine called machine. Lines number 14 through 18 will allow you to connect to the machine called M2. The only difference is the IP address. This machine belongs in the private E. This belongs in the private A. We can connect to this machine also now that we have a configuration ready for it. The way you write this configuration like this is the only reason to write it like this is to help you understand there is a simpler, shorter way of writing configuration, we'll talk about that later, which is just make a change like here and say this, that will cover all of it, but we are not doing it right now. I'm just illustrating the point. You can just make it an asterisk to generalize access to internal machines in your subnet, in your entire VPC like that, but for right now, just leave it like this, two entries, machine called machine, machine called M2, so that's the IP address, we'll copy that, close this file, go to the terminal and connect. This will allow us to connect to the machine M2, we'll say yes, and now we are connected to the Ubuntu machine, we'll test whether it's able to connect to the internet, we'll say sudo apt-get update, are you able to update? It says no, do you know why? Because there is no route to the internet, the reason there is no route is because our VPC, where is that VPC, we'll go to the VPC and our route table, you'll recall our route table is empty for anywhere on the internet route, so you go back here and our route tables and you will find that our private A route to the internet is missing, we'll say edit and say add another route and say 0000, go anywhere on the internet please using the NAT device, which happens to be on a different, completely different availability zone, but that is okay, you can just use the NAT on another zone, that is totally fine, it works, I saved, the route becomes open, you can see that this thing will update momentarily, it's a little slow, so I'll break it, it starts to update because the route became available, the routing is happening from one building to another building and then out to the internet and that's okay, we just have one NAT, you can have two NATs if you like to speed up the process, this was a little slow but it's okay, I'm just conceptually describing, you don't have to create multiple NATs, you can do with one NAT but in practice, you will have two NATs that will actually fail over, so if one NAT dies, the other NAT will take over and things like that, right now the box updated, nice, we'll install NGINX here as well and this installs, so we now have the machine M2 also running NGINX and that is the same application running in two boxes, one called machine, one called machine M2, both of them running NGINX, you can test, can I ask you to please show me what you're running and it says, yes, I'm running NGINX, it shows you the exact same thing, welcome to NGINX but how do I know that this box is different from the other box, I really cannot, in fact, in real life, you don't want your users to get confused between whether I'm connected to box number A or box number B or machine M1 or M2 or anything like that because you want to have a consistent experience, no matter where they get connected to officer number one or officer number two, the experience of getting a driver license is identical, with that in mind, back to EC2 and look for the load balancer and here is our EC2 in which we'll have a load balancer entry, at the left side, you will find load balancer here and we'll go to our load balancer, traffic cop, go to the listeners, look at the active listeners group, there is one group called my machines, so our machines are something like that, that's loading right now and so here are our machines, in our machines, we have two machines, a machine called machine and a machine called M2, the targets are these two, one of them is healthy, the other one is not and that is something that we have to understand why it is still unhealthy, it is unhealthy because probably the health checks failed the last time, but we want to make sure that the security groups are actually clear for this machine, which I think they are, it's only a matter of time before this M2 gets healthy, it's a matter of time, it is in 1A and this is in 1E, 1E is still healthy and functional, which means this website should continue to work, you can just keep hitting that website, no problem, however, what I want to do while this M2 comes online and becomes healthy, I want to create a new hack, this hack will illustrate the point much better than it would otherwise do without the hack, what I mean by hack is something like this, I have machine called machine, another machine called M2 which is coming online is still unhealthy yet, but this is healthy and so we have a load balancer, which lets people on the internet come and visit and right now this thing says, you go here, because we don't know what's going on, we are still examining and checking the health for this machine, so right now all of us go here, that's what's going on, you are visiting that site, when you go here, you click on the link I gave you, all of you go here, nice, now when this comes online, it will be impossible for this guy to tell whether they're going here or here, they have no idea, so we will make a hack, we'll actually make this different from this, we'll call this the machine, sorry, we'll call this the machine M1, welcome to NGINX from M1, we'll call this welcome to NGINX from M2, we'll make those little tweaks, so users can tell whether they're going here or here, we should be able to do that, for which I need to go in the machine and hack it, I'll do that right now, make it a little different, so we'll go here and come out of this and then come log in to this machine and then modify that file in there in which we have the NGINX application running a little bit, so here's a quick hack, you can do this hack yourself, I'm just doing it very quickly right now, making a change in. Okay, I should have, I made a typing mistake, I need to quit and I need to use this as a super user and now I'll make the change, only privileged users can hack this file, which is fine and now you should be able to open that same website, this link, and you should see something different. Hey, Nilesh, how do you know you're a privileged user, is that from the NAT because you came in from the NAT and other users, other people are going in from the gateway? The privileged user comes from the fact that I'm using this command, that's it, that's the only reason, only I can get privileged because I am an administrator on the box because I created it, it's not who is visiting but it's whether you have admin permissions on the box or not, that's the reason why I had to use the pseudo thing going and now you can probably see that the health check, let's go check the health check and so our health checks, let's see what shows up here, the health check must have passed by now I suspect and so the health checks on targets, both of them are healthy, which is very nice, so what it boils down to is that we have this machine called machine and the other machine called M2, both are healthy, that means some of us when we visit this website, the link I gave you, you should see a message which is different from what you saw before, whereas others will not and that is simply by the fact that some of us will see welcome to engine X and others will see welcome to machine M1, so let me see if I can open that piece. Is there anybody who sees something different? Bottom line is we are looking at two different machines but they are all giving the same experience, however, I was able to modify the file in one of them, which is this file I modified and I made it welcome to machine 1 instead, so if there is anybody who sees this, please tell me, some of us will see machine 1, some of us will see engine X, I should actually go to the other machine as well and modify that also, so I'm coming out of this, going to the other machine and hack it pretty much the same way and instead call it welcome to machine 2, so here is sudo vi, this is a quick hack, you need to know how to hack to get to do this hack quickly like this, otherwise it takes time, I have done it so many times, I know how to hack, that's what I'm doing right now and so don't worry about the hack part, the hack is just an illustration to illustrate the point which is that there are two different machines operating and acting in conjunction with each other, we should be able to see those changes now, so here, what is it, caching, maybe it is caching, let's reboot those machines, some of you will find this hacking very, very complex to understand, so bear with me, you don't have to waste too much time on this hack part, the thing that I want you to take away is that we are actually balancing load among two different machines, M1 and M2 both showing you the same experience, the experience looks like this, if any of you are able to see something different than this, please tell me because I'm actually looking forward to seeing that other screen which is different from what I see and there is a request for a break, I think break is a good idea, so we should take that break, right now it is 6 o'clock, I will open up a timer and in the meanwhile, we'll take it a 10-minute break and start the timer and I will ask anybody who's able to see something different than this screen, please tell me, if none of you don't see anything different, that means our hack failed, but bottom line is our services work, the services that we are trying to run are behind a load balancer and two machines, one called machine, another called machine two. Maybe try your curl from one of the machines that you updated to see if it's showing you the update. I'll do exactly that as you go on break, I'll go examine why my hack did not work as I expect, so I'll do that curl thing. Aha, my hack did not complete. Okay. Okay. I think the hack did not work, but we'll find another way to hack, let's not focus on the hack part, stay focused on the concept, which is what we discussed, after the break, we'll talk about that as to why the hack did not work and other things, but this thing worked, we are seeing that it's working. We'll go back to our timer and I will also take a short break. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Can you show the command that you used to install NGINX? Yes, I will do that. The application that I installed is called NGINX. It's an application available in the open source. This is the application called NGINX. It is available in almost every Linux distribution will have it. The way to install in Ubuntu is different from installing in other Linux. The way you install it in Ubuntu is, I'm going to type it in Slack chat. The way to install NGINX on an Ubuntu machine is this. For other variations, there are slightly different commands. For example, in Fedora, Fedora will be something like this. In Red Hat, it will be something like this. Every Linux implementation will be slightly different from every other in terms of how they manage their packages. These are some of the differences you're looking at as I show you the examples. Broadly speaking, the concept is the same. Install NGINX, that's the command. Sudo is basically elevation of privilege. Gap get is the method that Ubuntu uses. DNF is the method that Fedora uses. Yum is the method that Red Hat uses. They're all basically doing the same thing, installing NGINX and say yes at the end for the question they asked. Are you sure? Yes. Thank you. This, by the way, is an application server available here, open source. This is the commercial version. Not here. NGINX open source is not this website. NGINX open source is this website. The open source version, that is what we are using in our example. It's provided free of cost to all the Linux distributions. You can also run it on Windows, I think. In our EC2 section, you have our load balancer, which has two machines connected, this load balancer called Traffic Cop has a front-end DNS name that we saw, all of us hit that. In the Traffic Cop, we have a listener mode. In the listener, we have a target group called Our Machines. In that group, in the Our Machines group, we have two machines right now. The targets are a machine called Machine, another machine called M2. Both of them healthy. Both of them running NGINX. Both of them showing you the same page that you see when people visit here. They will be allocated, go here, go here, go here, go here. Multiple people go round robin, A, B, A, B, like that. One, two, one, two, toggle. Go this way, go that way. Basically, balance the load among this guy and this guy in a round robin fashion. Round robin is basically the concept of going round and round. If you have five machines, M1, M2, M3, M4, M5, you will go like this. First person go here, second here, third here, fourth here, and fifth here, and then sixth here, seven, eight, nine, ten. Go round, round robin. That's the allocation load balancer will do. It applies to general purpose scenarios when you have people visiting DMV and getting a license. You have officers number O1, O2, O3, O4, and O5. You have more people waiting in line, you will add O6 and put that in the round robin circle. If this person takes a break for lunch, no problem, go away, mark it unhealthy. It can be remaining unhealthy forever if the person gets laid off or decides to go find another job. Unhealthy forever. We can just remove that person completely from the group, and we have one, two, three, sorry, one, two, four, five, six. Three is gone. That's okay. That's the idea where you have a person gone, gone, that's fine. We can work with two or even one. We saw it working with just one machine. That also works. If you kill that machine also, then you have a problem. We will see that problem momentarily. I tried to hack these two to show you a different page every time you load that hack did not succeed. We'll talk about the hack later, but the point that I want to make sure that this load balancer was able to balance the load among two servers, both running the same exact application called NGINX, both Linuxes, but on two different buildings. Our layout right now is slightly different like this. This is the public E, private E. Then we created a public A and a private A. We created a machine called machine here. We created a load balancer. This load balancer required to have two different availability zones. We got them two different availability zones. We have a NAT device here. We said, you want to connect to the world outside, you can go through this NAT. When we created M2, we said, you want to connect to the world outside, you can go through this NAT. That's okay. This NAT itself want to go outside, it is already connected to a gateway, so you can already go outside. You're on the public subnet already. This subnet does not contain anything, which is fine. We did that to meet the condition met by this guy that this guy required us to have two, so we created that. Also here, created two different availability zones, two different private subnets. One has M2, one has M3. We can have more. We can actually create more like here, private B, private C, like that, and have it really highly available, but that's beside the point. M2 is good enough for now. In certain cases, you might want to have more, and in which case, it's totally appropriate to go like that. If you are going that high availability route, you will want to create these public B and public C as well, and have NAT devices here and here, and have these NAT devices participate in a failover method. If this NAT dies, both these guys will traverse from this NAT and go out when they want to update themselves, or when they want to install a new application or do something else. When the machine wants to connect to the internet, allow them to. That's the reason why we have the NAT devices. In a best practice, the way I will describe now is a best practice in terms of me or administrator accessing. The way I suggest is this NAT device, and we have the machine here on a private area, and this public subnet and the NAT, and this is me trying to connect. The best practice is to use a separate box dedicated for jumping into machines inside, and not use the NAT. That's the best practice. You want to have a NAT for A and a NAT for B. The best practice is to leave them alone with their function, whatever their function is. What is their function for NAT is to allow the machines in here to go out if they need to. That's the primary purpose. Leave it at that. Give everything one purpose in life and leave it alone. Don't try to cobble multiple functions onto one thing. In Unix, there is a philosophy. The Unix philosophy is as simply as here. Do one thing and do it well. That is what we should follow in our life, in our machines and everything. Do one thing. Do it really well. You will succeed. The machines will succeed. You as an individual will also succeed. Do one thing. That philosophy is what I am saying here. The best practice is if you want to get into the machine M1 or M2 or anything like that, do you want to go inside? Use a separate box. Call it a jump box. The purpose of that box will be to allow you to get in. That's it. There is no other purpose of that box. The only route for you to get in will be that jump box. You don't go through like we did in the NAT. You can, but don't. Don't stick to one purpose. The purpose behind every machine used to be unique. That one thing, you do that just one thing and do it exactly how you want it to be functioning and leave it alone. Don't muddy. Don't mix other things with that thing. Keep it clean. Keep it one, which is the NAT purpose. Put just the NAT. Let it function like a NAT and no other workload. If you have an application running here, put that application there and no other crap and just that application, nothing else. That will clean up the entire environment, the entire application set and your users will be very happy. That's what we really want is to do one thing, do it well. From a best practice perspective, use a separate box to jump in. Don't use the NAT. That is the reason why in our configuration here, I have labeled it as Jumpbox and I'm not using the word NAT. In the configuration you will see here, the name is Jumpbox and here and here. That's the reason why we have chosen that name is I want to use a separate box in real life. For our practice, totally fine. Do whatever you feel like. But in real implementations, you don't want to use the NAT device for anything other than its function. Jumpbox, anything other than its function. You can go even further, elaborate and limit access to your cloud by shutting down the box. When you don't want to access the cloud, you shut down your gateway to the cloud. Even you cannot get in, forget about hackers. They can also not get in because you cannot get in, nobody can get in because you deliberately kill the Jumpbox. It's fine. You can create another one and allocate security groups accordingly and you can get in again if you want to, when you want to. But otherwise, when your cloud is all up and running and you don't need to get in there so often, just kill the Jumpbox, you're done. Automatically lock yourself out and everybody else also out. That's how you should operate from a real perspective. For our experimentation perspective, it is fine to use NAT device, no problem. It will work. You saw it working. Now, let us try killing one of these boxes. M1 and M2, both are active. I would like to kill one of them. What do you think will happen? Nothing. The user will not see anything. All we do is go back here in our Chrome browser, go to our machines setup. We have two of them healthy right now, which is great, but I don't want one of them to be healthy, so I'll kill one of the machines here. We'll go. Where did I go? Hold on. I think I accidentally closed the window, apparently. Here are our machines. I would like to open a new tab, go to EC2 console, and then kill one of them. You will find as soon as I kill is that the load balancer shows one of them is unhealthy. Here is EC2, and here is my original machine called a machine. I'll kill that one. This is the machine I want to kill, so I kill. The machine will be killed. Fine. It dies. We'll go and examine in the machine pool here for the load balancer and refresh. It will say one of them is unhealthy or something like that. It will say it just dies. It got taken out of the collection. It is not there listed as registered instance at all because the instance doesn't exist anymore. Apparently, it is shut down. It got kicked out in our target group called Our Machines. We just have one target called M2, which is live and healthy, and that's fine. That means our site at this link should be functional. Users are not impacted. We can take machines down, update them, bring them back in, put them in the place in the same collection, and that is totally fine. We can do that very simply. Launch an instance, take an Ubuntu machine, launch the configuration, select it in the Cloud Genius VPC, put that in the private E subnet or A subnet, and disable the public IP. Add some storage, add some tags, call it M1. Configure security groups, select an existing group called the application security group, and launch. When you launch, you select your key pair and you launch. This machine instance does not have the application, which is understood. What we need to do is go install the application. We can do that. Another way to approach this problem of making sure when you launch a new instance called M1 or M2 or M3 is that you take a snapshot of your existing functioning instance that you have already and then create a new machine using that snapshot. That is what I want to do instead of creating a raw machine like this. I have these instances called M1 that I just created, M1. This one, it does not have the Nginx application quite yet. I need to go in there into the private IP. I will go and, first of all, modify our configuration. Here, I will say star, dot, star, and then remove these things, or rather, remove that entry, so save. I made this change to allow anything in our VPC. Close, connect to the IP address that we have now, which is this. What's my IP address? Copy from here and then paste. It says, yes, let me in. Here, do I have Nginx running on this machine? No, it is a fresh new Ubuntu machine. I will install Ubuntu. First of all, before I install, just check our local host. Do I have anything? I don't think so. There is nothing, so I'll install, and it does. Then it will eventually, in 10 seconds or so, come and participate in the load balancer group if you make it a member. We had to go make it a member of the group called load balancer. So load balancer, and then in our load balancers, we have this listeners group called our machines. In our machines group, we had to include this M1 machine that we created, so targets, edit, and then include this new machine called M1 right there, this machine. Let's include that and add. Then we have M1 and M2, so we save. We have one of them is initial, so it's checking. The other one is healthy already, so our site continues to function. We can dynamically, on the backend, bring machines into... Let me erase this. What we are really doing, I'll illustrate this, will show you much better from a picture perspective. So making some cleaning here, cleaning up, and focus on one of our... Taking a pen, and so here's our load balancer. These people visit that site. The load balancer is balancing the load among M1 and M2. We don't have the other machines quite yet. It's an elaborate illustration, so just ignore these guys. Ignore. Let's ignore this. We don't have them yet. Between these and this, we are basically balancing the load. As users come along, more of these guys, there will be M1, M2 shuttling between the two. If there are more users that your machines get bogged down, you will need to add more. How do you add more? Like this. More like this. Pretty much like this. Practically, that's what we did when I created M1 in here. That health check is probably finishing up, and it is going to be healthy pretty soon. You will find the target, both are healthy, which is nice. Now, I will illustrate this next logical point of killing both the machines and see what happens. If both the machines are dead, you are screwed practically. That is expected. You go to the running instances, and you select M1 and M2, and kill both of them like this, and say M1 and M2, both of them, goodbye. Both of them die. Fine. You are screwed by the way right now. Load balancers, you have listeners, you have the listener on HTTP, there are our machines group, and there is nobody in the group. What do you think is going to happen here now? Nothing. Unable to connect. It will show you 302 error, I think. 503 error. Service temporarily unavailable. Nobody is there to serve you, sir. This is the Amazon Web Services Elastic Load Balancer version 2. That's the HAProxy software running on the backend. This is what you see when there is nobody to service. All the officers are on lunch break. You cannot get a driver license. You are just waiting in line for nothing. That is very unfortunate. This is an unfortunate situation when all the machines are dead. You still have this setup right now. If you kill everything, you have this one gone, made a mistake, and cancel. I didn't mean to edit you, sir. Go back here. This one is also gone. Now, the load balancer cannot actually transfer traffic to any machine. There is nothing to go to. We need to put a machine back in place like that. Any number of machines that you need, you bring them back online and they will start to function. What people see from outside is what these machines show. Now, if you run Nginx, it will show you Nginx. If you run something else, it will show you something else, pretty much. Here is what you run your applications. They need to be identical, exactly like one another. Otherwise, this user will get confused. Hey, I saw something here. Now, it's different. It should not be like that. It should be consistently the same application running here. Ideally, you take an image of one application, run it with one machine, set up your application, and then create an image and replicate it and create more of the same so that these users who are coming through the load balancer will understand what's going on very, very clearly and carefully. That's the overall concept of using classic infrastructure as a service. Let's recap the IaaS discussion. In our infrastructure story, we discussed quite a bit of things, different things, variety of things, mixed and matched. Broadly speaking, we talked about infrastructure as a service, three broad things, storage, compute, and network capabilities. When you use storage, you get a variety of options there. You can get a disk like a C drive or a disk that you connect to your laptop or a disk that you connect to a machine M1 like that, or you can get a file system that you can go to like a bucket, for example, that you put an object in there. This is not really a file system. It's more like a bucket, an object. You can also get a file system these days. It is called Elastic File System available from Amazon and I think one more company has given that out. This EFS solution is actually a classic file server available to your M1, M2, M3 like that. You can use a file system. It's available as a service these days in here, somewhere you will find it. Elastic File System EFS right there, click. This is the solution you will activate, create a file system, and map it to M1, M2, M3, pretty much like that. That's the storage solution. You can extend this idea with a content delivery network to make it global. Then there are some methods of sending data, receiving data like transport or snowball or UPS or direct connection, storage gateways, a variety of solutions available for storage perspective. In compute, you get the CPU horsepower, you get memory, and you get more of the type. In here, there are these days a different type of processor available in the cloud. That is called a GPU, Graphical Processing Unit. There are certain type of math that requires this. Graphics Card, Graphics Processing Unit, GPU, not the CPU, this is your CPU, the processor, 4 gigahertz Intel Core i7, that's the CPU. Certain type of mathematics requires and is done more efficiently if you happen to have a GPU. That is also available in the cloud. Some cloud providers provide you that compute horsepower in form of GPU to doing special math. Here is that example. There are a variety of different instance types in EC2. One of them are the ones that you know already like CPU. Sometimes you may want to, where is that? Sometimes you may want to receive more memory, more RAM needed. You want to get a bigger RAM on a machine. You can receive a bigger memory machine if you ask for it. There are machine types, the standard type. Some are memory intensive machines. Some others are GPU intensive machines. They give you a lot more graphical processing power for your mathematical computations that require that kind of a GPU. You will receive those types of compute instances if you ask for them. You can see here, M4 is a general purpose machine. You will see further, compute optimized. This is optimized on your CPU. You get large CPUs, like for example, here. Virtual CPU, you get two and four and eight like that. It's 1636, so you can get any number of CPUs as long as they provide. You also get memory optimized, large memory configurations. When the CPU remains small, but your memory available, the RAM available can be really, really large, 1952 gigabytes of RAM. It's enormously large. 976 gigabytes of RAM available on this machine type. That's heavy RAM optimized. There are certain functions that are done better if you're doing in-memory computing. This is basically storing all the data in the RAM, not even worrying about going to the disk. Just store it in the RAM, make the RAM as big as you can get, and this is the max limit available today. That's the memory optimized machines available. There are certain other types of machines which are memory intensive applications. These are R4, R3 machine types. Again, focused on RAM usage. R3 are also RAM based. Then there are accelerated computing type. These are faster CPU. They have Intel Xeon processors as opposed to Core i7 processors. Faster CPU available with a P2 level, like P2 large, P2 extra large, P2 8 extra large, P2 16 extra large. Now comes G2, which are graphical enhanced units. They get you a GPU in the machine there. You can get Nvidia GPU included with your virtual machine. This will help you do graphical processing, just like I described here in this machine I have here has a large GPU with 4 GB of video memory, but I'm not using it for graphical computation. Instead, I use it to drive my Retina 5K display. You can use the same graphical horsepower to do those specific mathematical computations like I mentioned. One of them is to do Bitcoin mining. That is done much efficiently if you're using a GPU in your machine. That's the application scenario. When you want to render video on a target application, you will use these encoding devices, the GPU encoders. That's where these are low-latency frame capture and encoding for any high-quality display target you want to go on the cloud. That's where they are used also for Bitcoin. Then here are a new instance type available. This is a couple of months ago, they started with this. It is called F1, F1 type. This is something I will describe in a white sheet of paper. This F1 type is not really any of these, but instead it is FPGA, Field Programmable Gate Array. What you can do is program your hardware to tune it finely to your given application. You can modify your CPU, that's what it boils down to, FPGA. FPGA are raw circuits, you can tweak it so that the circuit itself operates most efficiently according to what your application requires. It is a programmable silicon piece that you can program before you load your application. It's a very custom, very specific for certain application types that are needed to even further fine-tune. For example, would be Siri or Alexa. Alexa, what's the name? Amazon Alexa. Or Google Voice Assistant, whatever these artificial intelligence bots that are being created. They have a very specific purpose in life to respond to, in an intelligent fashion, respond to human questions. For that, people are designing new FPGA applications. That's where this is one scenario where this becomes really useful. That is why Amazon has recently started FPGA and so has Microsoft, if I understand it correct. Those FPGA cloud instances, F1, are also available. Some other machine types are storage-optimized, meaning the disk that you get along with them, the hard disk connected to those machines, is a high-performing SSD, high-optimized instances. They are called I2 extra-large, I2-2 extra-large, I2-4 extra-large, like that. Sometimes the other machines get a dense storage. This dense means you have a big fat hard disk, really fat. For example, 24 two-terabyte hard disks on one machine. That's the dense storage type. You can mix and match depending on what you need. It's a long list. The bottom line is, in our infrastructure discussion, what we are looking at are the top-level three things, storage capabilities, compute capabilities, and the third one, networking capabilities. In the network capability, you saw it allows us to construct whatever we feel like in terms of a layout for our data center, in our cloud. You saw this illustration here. We are able to mix and match, create subnets, create routes, place machines wherever we feel like, remove them, add them, align them, connect them, let the traffic flow through this direction, that direction, control security through firewall. That's what this thing is, the security group aspect. The network-level firewall is what is implemented across a variety of clouds. They allow you to control your traffic as to what can flow from where to where, like in the form of security group discussion that we had earlier today. That is a quick, short one-picture summary of the three broad things, storage, compute, and networking. I'll go to another cloud to show you one example that I find it very interesting. I should point it out to you. Again, do not sign up for this. They cost you money. Don't go sign up for fun. It'll cost you money if you do, so don't sign up. I'm just showing you as to what I mean to describe. It costs $50 for no reason. I don't want to waste money, so don't do that. I'm showing you if I can log in. Let's see. I think I will succeed. I will go and go to my Gmail, get the token there. There's a token coming up by SMS. I should receive a token that will let me log in. This is the Rackspace Cloud. Here is the token. I will go and apply that token here. Then proceed to show you what I'm describing. The thing that I want to show here is actually very interesting from my viewpoint is that it nicely summarizes as to what we intend to use. Here is create a machine. They call it a server. Some people call it instances. Some people call it boxes. Some people call it droplets. These guys call it server. They call it server, Linux server, Ubuntu server, and I'm going to select Johnny Alzira server. It's going to charge me 96 cents per day. Now comes the interesting part. I'd like you to look at this picture here, this picture. I'm going to adjust some of the properties of the machine, adjust the flavor, how big the machine should be. I'm going to tweak this button, go move it up. You'll see how the picture changes. You see that the picture slightly changes. It's a five-dimensional chart. This picture, the blue item here, changes a little bit as I adjust the properties of the machine making it bigger, making it smaller. You can see that probably. I'll focus on some very specific parameters here. Say compute, and I will increase just the computational horsepower. Say plus, plus, plus. You will see that the number of CPUs will increase as I go up. That means this picture will go up towards the vCPU segment here, like that. You saw that it's going and bumping up in that direction. It's also bumped in the lower direction towards the network. If you look at the network characteristic, the disk capacity, the disk IO performance, the RAM available, and the number of CPU available, these guys have attempted to draw this in a visual fashion. If I want to add more memory, I can just go plus, plus, plus, and you will see that the RAM gets increased. My graph illustration gets skewed towards RAM. Same thing with IO. If I want to boost the IO performance of the disk, you will see that it is boosting across the board in all directions. That's the idea that I want to point out is that you are able to adjust the CPU number, the RAM available, the network capacity, the size of the disk, and the speed of the disk. You can tweak this according to what the cloud provider may provide. Accordingly, choose the right size machine for you in this IaaS discussion. It is these aspects that we discussed, storage, compute, and network capabilities together comprise of the infrastructure elements that go and constitute infrastructure as a service. These things allow us to create that foundation needed for us to then put our applications on top. At the foundation, we will have infrastructure as a service. These things are programmable. We can design whatever we want and get whatever we want, but all of that basically gives us bare bones machines, bare bones infrastructure with OS installed. Yes, pretty much it. That's it. We design our layout. We design our network. We design our security concepts and security groups and traffic and how it flows and control and IP address and everything associated. Then again, there is no application quite yet. It is just bare bones. It is complete, but not functional. You have to install some application, like I installed the NGINX application as a quick example, NGINX. I added this application on the OS to give us some example, otherwise it's hard to understand what's going on. I threw that application quickly to illustrate a point. This is not how people run real applications are way more complex. Real applications are complex. In fact, some of you have already finished one of those discussions that I want to have next time, which is how I'll point out. You should read that and then we'll discuss next time. That discussion is coming up. Twelve-factor app. I think a couple of you have read that already. The idea here is, where is that? Twelve-factor map manifesto. This is module number 13, this link you should read before we meet next time. That will help us. Where is the Slack chat? Here. Read that. This describes the concepts, the principles as to how cloud-based applications should be written. If you meet these things, your cloud applications will function very nicely. We'll discuss this and then we'll create a simple application. We'll also use some of the tools that developers use that we also want to use that will allow us to take an application. Put that in a repository called Git repository. We'll play with the Git a little bit. Then once we have that in control of a repository, we'll assign it to ask somebody to run it for us. That somebody will be a platform as a service. We'll use a ready-made platform to begin with. That will in turn run on top of some infrastructure as a service, by the way. Our plan will be to create an application, put that in a Git repository and send it off to a platform. We'll use the Heroku example. This Heroku thing runs on the Amazon Web Services infrastructure as a service, EC2. They use that under the hood. We don't see that. You see this Heroku thing. We'll take our application. It will not be a super complex application, very simple application, but it will be a full application that will open up in a browser and all that good stuff. We'll put that in a Git repository and then push to a platform. Let the platform worry about the underlying infrastructure. We'll see how platforms help us, help application developers in using cloud services. Then we'll proceed in that direction. That's the general direction we have done. We skipped the software as a service part, but I know that most of you have already seen those videos. If there's a question, please bring it up. We also understood how infrastructure helps in constructing whatever we need to as we go along. We will begin with using platform as a service, understand how people use it, and then also run our own platform as a service at a subsequent date. We'll get to that point. Then we will switch on to more interesting examples in the second segment which begins with using this in real life. We'll take our own application. You'll understand a lot more greater depth and more interesting concepts, the modern way of application development and deployment, creating services, making them run in the cloud through complete end-to-end automation. How do we do that? Those aspects we'll cover in the second segment and then we'll go on to the third one, which is the architectures. We'll follow along that route. For right now, I want to ask you if you have any questions on what we discussed or what we intend to discuss or anything that we have missed. Let's have a quick question. Please. On Tuesday, you had mentioned that inside of creating the VPCs that Amazon had some built-in VPCs and others, items, security groups and whatnot to leave that alone. I don't want the answer now, but is that something you plan on discussing down the road as far as why that is or is there something I can go read to explain why they do that just for my own curiosity? Exactly. They do that to make it easy on people. People don't want to go through the trouble of what we are going through. They make it simple for customers. You go to click and basically it's like one button operation. You click and you're done. You go to VPC and you create a new VPC and start the wizard and there are four choices. As long as you are fit and okay with these one, two, three and four choices, then you are good. If you want something custom, they will not tell you how to do it. You have to do it yourself. They have these four choices. Single VPC with a single public subnet. Not interesting for us. The single public subnet, no, no, no. It's not interesting. It's not high availability scenario. I'm not doing that. What about this? VPC with a public and private subnet? Yes, interesting. We did this by the way. We created a public and a private subnet. We actually expanded it to multiple availability zones and all that good stuff. Now here, third one. Here, the configuration is VPC with public and private subnets and hardware VPN access. For companies who have a VPN requirement, they want to have this company corporate data center. This is the bottom. They want to have data center access directly to the private subnet. Totally okay. You don't have to go through a jump box. You can just connect directly to the VPN. That's the setup. The hardware VPN access, you can have your data center connect directly to the private area. It appears as if you are right there, but no, you're not. It appears like you're there and that's the example here. We will create this example ourselves by hand, by creating our own VPN solution at our next exercise, subsequent exercise coming up, I think in the third segment in the architecture. We'll go more complex. Once we digest this, we'll go deeper, as much as deep as you want to go. The fourth one is there is no public access, only private. You have a company, corporate data center. You want to use the cloud as your extended data center without giving public any access. The fourth choice, you basically click that button and you're done. One more, that's it. A couple more, but all the settings are already defined. The cider blocks are set like that already. Click, click, click, select and you're done. You don't have to worry about understanding that the benefit, I mean, that's not really a benefit, but that's the customer benefit that Amazon wants to provide. If you're using the wizard, then those components are necessary. If you use the wizard, you have four choices available. That's it. Those choices are, as you saw, these choices, one, two, three, and four. That's what you get. If you want to do something on your own, you want to modify, you need to really understand in this class, our class is not for ordinary Amazon customers. This class is for people who can actually help Amazon customers. We are going to be nerds. We are already nerds. By the way, we have reached this point, we are already there. We will be able to understand what goes under the hood and then clicking this wizard button is no big deal. You just click and then understand what happened. You can actually play with it. It doesn't cost you a thing. Play with VPC does not cost you a thing. Let me tell you what costs money and what doesn't. That would be a good one. Here, go to VPC and I'll tell you. This is Kara. I have to leave class. I just wanted to let you know. Yes, thank you. I understand. I appreciate that. Thank you very much for coming. All right. Take care. Bye-bye. Bye-bye. At eight o'clock. Yes. Thank you. In the items that cost you money, the items are, let's go to a VPC for example here, this one. The items are VPC is free. Subnets are free. Route tables are free. Internet gateways are free. Egress only internet gateway is a new thing, but I think it is also free. DHCP option sets are free. Elastic IP will cost you money, like $5 some month or something like that. Don't take it. You don't need to have it. Right now, no need. You can, but don't waste money. Endpoints, I think it costs money. You don't need to have it. You already get the dynamic public IP already, so use that. NAT gateway will cost you money. It's not going to be expensive, but it is not free because it is going to generate an instance that will cost money. Peering connections do not cost money. Network access control do not cost money. Security groups, free. Customer gateway, you have to bring your gateway, which will cost money, but you don't have to have a gateway. VP virtual private gateway, it is detached right now. You can attach it to the VPC like this. We are not using it, but you can use it. It is free. VPN connections, you can get one for free, but on the cloud side, you have to have some machine, some VPN capability, which will cost money. Money cost is not expensive, but non-zero. It's trivially cheap. All of these things are cheap. Probably the total cost of running a fully functioning machine for one full month is $5. Roughly like that, depending on how many machines you allocate. $5 a month per machine is the cost, but don't leave your machines running. That will cut down any expenditure. Back here, go to EC2 and delete your machine that you may have. For example, I have one running machine. I should kill it like this machine. I have the NAT machine running. I should select that and make sure that it is dead. Then I will cut down my bill like that. Remember to do these things as you go along. That's all it takes. It is not expensive, but it is not zero. It is trivially cheap, but not zero. Just saying. You should read the pricing, of course. If you don't understand pricing, ask me or we'll ask Amazon. They'll tell you. Next session we have is on when do we have it? Saturday at 8 o'clock in the Pacific time zone, which is 11 o'clock East Coast. Can I ask a group a question? Yes, please. Did anybody get the module 12 to work? What was the module 12? Let's see. That's the one where we're doing a different way of installing things. I can get it to work. I can show it to you if you like. I never tried. We never tried in the class, but this is what you're talking about, right? Yes. You can do that. If you're interested, I'll run it right now. Okay. Here we go. Because it appears that it's failing on the newer version. It's possible, quite likely. It doesn't surprise me if it fails, but we'll find out and we'll fix if it fails. Let's see. We are going to approach the bucket-based, what is this called? Octopress, right? One Octopress in a different fashion than we ran the last time. That's what we intend to do in this exercise. We will bring up our workstation. We'll put that on the side here like that. Come on. Then begin. We'll go to a folder called MKDIR Octopress. There might already be one. Yes. It exists. Let's use another one, right? Yes. Just call it Octo. Sorry. It's MKDIR OCTO. That's the name. CDOCTO. That's the folder I have. Download a gem file. This gem file is this one. Let's go bring it down. Here it comes. Now that I have the gem file, I will open it up in Atom Editor and see what it contains. Here is my gem file. Let us see what it contains. It says, use this Octopress version. Use Amazon SDK version 1 and these other things, other gems that are required. Then you say bundle install. When you run bundle install, see what happens. It might fail. We'll see. Bundle. First of all, check the Ruby version. We have 233. Then we say bundle install and see what happens. It might fail. I think that's the failure you saw. We will try to see if we can fix it. It is installing those extensions, the required gems in the listing that you saw in this listing here. That's what's getting installed right now. It's all happening. Let us see what the response is. I think it was actually during the new fungal that we were trying to create that. I think what may be the issue on your side is that, I don't know. I'll let you tell me what the issue was when you saw a failure. I'm 90% confident that the failure happened in this line. Is that correct? Well, it couldn't find. It says something bundler resolve or just copied into the Slack. I think it succeeded for me. What I'll do is maybe... Try the next step. I'll try the next step. We have bundle install finished. We'll now Octopress new and some new static site. I'll create a new static site. We'll say Octopress new and then we'll call it Themens. It's creating a new Themens site. We'll go to Themens. Now what? The next step. Well, go up. Kind of scroll up to the top of this. Yes. No, not on the right hand. Go to the left hand in your execution screen. Okay, here. Yes. Can you scroll up? Yes, I will do that. It was up. Right where you start the execution of the command. Down here. I don't see the error message that I got. Yes, I did not receive any error yet. We'll see. We'll proceed forward. We have a Jekyll build. We'll run the command to run the build of this and we see errors. Okay, this is where it's on. We see some errors. I think it's in Jekyll build. There is an error blocking verify gem file. Could not find a gem called minima. Any of the sources. What we will do is include that minima gem. We'll copy that minima. Put that in the gem file here and say, gem, get me some minima please. Like that. Save it. That was the point that was complaining about. Could not find gem called minima. We said, okay, add it to my gem file. I added that right there like this. Then I will bundle again. I'll bundle update. I'll go back one step and say bundle update please to get the minima thing going. It'll get the minima. It installs the minima 210. If you go up again and find the error, it says get me the gem called 2.0 or higher. We got the gem 210 minima. Now, we will go to Theman's folder and then Jekyll build. We get another error called Jekyll feed not found. We'll copy that Jekyll feed. Go to the gem file in here and then install Jekyll feed. These are updates to Jekyll that we are not accounted for when the last time I ran. That's why you're looking at these errors. I'm looking at the dependencies like this as we go along and close and back here and then go a step out. Then bundle update again to get the Jekyll missing item which was feed. The Jekyll feed came along and then we go to Theman's again and then say Jekyll build and see the error and it's no error, no error this time. Now, we go Jekyll watch, copy and run it here to watch the build of the item. Go to this location. We can go to that website, local host website called 4,000, port 4,000, we'll open up the browser and in that browser, what we will do is go type local host 4,000 and see your new blog and it pops up but it's there. This is the new Jekyll-based Octopress which is what you're looking at. We are going to break it now. What I need to do is go back one step and look at the gem file here, CAD the gem file. In the gem file, we have added these two lines. I need to go and update the gem file as is available in this location which is what I will do is go to GitHub and make sure to fix the code. The code needs to change. The code that I have there was a little bit old and the old code did not work because of updates to Jekyll or other dependencies. We will go and fix that piece very easily by me going to the source of that file and updating to include those minima. Let me find that gem file first. These are my gists and I would like to search my gists. Where is my gist called gem file? That's what I will locate. I have too many gists but older. My gists are the cheat sheet for Cloud Genius. If you don't find something, the answer is probably here in the cheat sheet. I'm going to find that gem file that I created a while ago. Why don't I just update a new gem file? Here is my new gem file, CAD gem file and that is my gem file. I'll just create a new gem file like that, the whole thing and put it right here like this and save. Now I have a new gem file. This gem file includes minima and Jekyll feed. Let's grab that gem file like here, go to this location and fix it. My instruction will change now to get you the correct gem file like this. Excellent. This will get you the correct up-to-date gem file now that if you run this, it will work. This is indeed an issue with updates to Octopress and Jekyll that requires two new gems that were missing in my gem file. That's the root of the problem. We fixed that. Thank you for catching. Thank you for fixing. We fixed and then we are done. I'll pause the recording now. I think we're extending the recording for… The recording becomes long and so people get confused. I'm stopping my recording.