AWS Cookbook Recipes for Success on AWS (John Culkin and Mike Zazon)（Z-Library）

# AWS Cookbook: Recipes for Success on AWS ## 【One-Line Pitch】 A practical, recipe-driven guide for AWS practitioners who need to solve specific infrastructure and security problems quickly—ideal for developers, DevOps engineers, and cloud architects who prefer working solutions over theory-heavy documentation. ## 【Book Arc】 - **Opening (~0%–10%)**: Introduces the cookbook philosophy—each recipe assumes a fresh start, provides complete steps, and includes cleanup procedures. Sets up the AWS account prerequisites, IAM admin user requirements, and the AWSCookbook GitHub repositories used throughout. - **Early (~10%–23%)**: Dives into IAM security fundamentals—creating and assuming roles for developer access, using permissions boundaries to delegate administrative capabilities, and connecting to EC2 instances via SSM Session Manager instead of traditional SSH. - **Early (~23%–32%)**: Covers content delivery and networking basics—serving web content securely from S3 through CloudFront with Origin Access Identity, creating network tiers with subnets and route tables, and managing Elastic IP addresses. - **Middle (~32%–48%)**: Explores advanced networking—using VPC Reachability Analyzer to troubleshoot network paths, configuring Application Load Balancers with HTTPS listeners, managing prefix lists, and peering VPCs for inter-VPC communication. - **Middle (~48%–end)**: Shifts to storage optimization—implementing S3 lifecycle policies to automate storage class transitions and reduce costs, with additional recipes continuing through the remainder of the book. ## 【Key Takeaways】 - **IAM roles over long-lived credentials** (Early): Use temporary credentials from AWS STS via AssumeRole rather than persistent access keys; named profiles in the AWS CLI can automatically assume and refresh these credentials for frequent operations. - **Least privilege as a practice, not a policy** (Early): Start with PowerUserAccess instead of AdministratorAccess for development, then define custom managed policies granting only specific needed actions—the more you practice this, the more natural security becomes. - **Permissions boundaries create guardrails** (Early): By defining a permissions boundary, you can delegate IAM administrative capabilities while limiting effective permissions to the intersection of the boundary and the role policy—even if you attach full-access managed policies. - **SSM Session Manager replaces SSH** (Early): Eliminates internet-facing TCP ports, removes SSH key management, and enables access to instances in private subnets—all while logging commands and output for auditability. - **CloudFront OAI for private S3 content** (Early): Using an Origin Access Identity ensures your S3 bucket serves content only through CloudFront, preventing direct bucket access while maintaining secure content delivery. - **VPC Reachability Analyzer for network debugging** (Middle): Instead of guessing why network paths fail, use Network Insights to analyze paths between resources, identify mismatches like security group rule gaps, and verify fixes by rerunning analyses. - **Lifecycle policies automate cost optimization** (Middle): S3 lifecycle rules can automatically transition objects to Infrequent Access storage classes based on age, reducing storage costs without manual intervention. ## 【Reading Tips】 - **Skim the Getting Started section** if you're already comfortable with AWS CLI and IAM basics—it covers setup steps you'll likely know, but don't skip the note about CDK v2 if you plan to use the code repositories. - **Deep-read the IAM chapters (1.x)** even if security isn't your primary focus—the patterns for roles, permissions boundaries, and least privilege are foundational for every other recipe in the book. - **Use the validation checks as your guide**—each recipe includes explicit commands to verify success (like curl commands for CloudFront or ping tests for connectivity); these are the most valuable parts for confirming you've implemented correctly. - **Pay attention to the "Challenge" sections** at the end of recipes—they extend the core recipe and often reveal the underlying pattern, helping you generalize beyond the specific example. - **Clone the GitHub repositories before starting**—the book references template files and scripts throughout; having them locally will save you significant typing and reduce errors. ## 【Coverage Limits】 The excerpts cover roughly the first half of the book (through the S3 lifecycle recipe at ~48%). Content on later chapters—including additional storage, database, and application recipes—is not covered in this guide. ##