Learn to work with the most fundamental services AWS offers such as DynamoDB, S3, and EC2 to create reliable and scalable systems.

Scalability & System Design for Developers

In this module, we’ll learn to work with the most fundamental services AWS offers, such as DynamoDB, S3, and EC2 to create reliable and scalable systems. Walk through getting a basic web application running in the cloud on AWS. You won’t find most of the knowledge that's shared here in the AWS docs.

The Good Parts of AWS: Cutting Through the Clutter

# Objective
Make our instances inaccessible from the internet.
 

# Steps
- Set up SSM for SSH access.
---

In this section, we're going to make our EC2 instances inaccessible from the internet. The instances will be able to reach the internet using a [NAT gateway](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html), but the network will not allow anything from the internet to reach the instances without going through the load balancer.


> 🔍 Once we make our instances use a NAT gateway to connect to the internet, an additional data transfer charge (currently [$0.045/GB in us-east-1](https://aws.amazon.com/vpc/pricing/)) will apply to all traffic that transits the gateway. This includes traffic to other AWS services.

> **NOTE:** It is very important to note that the prices mentioned above are only for the purpose of understanding cost comparisons. These prices are subject to change anytime by AWS. Therefore, most current prices should be referenced for final business decisions.

To avoid the extra charge, most AWS services can be configured to expose an endpoint that doesn't pass through the internet. This can be done via [Gateway VPC Endpoints](https://docs.aws.amazon.com/vpc/latest/userguide/vpce-gateway.html) or [Interface VPC Endpoints (AWS PrivateLink)](https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html).

# Set up SSM for SSH access

One thing that won't work after we lock down our hosts is EC2 Instance Connect. In order to acquire SSH access to our instances, we'll have to use [AWS Systems Manager Session Manager (SSM)](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html).

Let's start by adding two new managed policies to the IAM role used by our instances.

Network Security: Set up SSM for SSH Access

Objective

Steps