Cloud Server Setup & Security

1. From Localhost to the Cloud: Infrastructure as a Service

So far, "deployment" has meant running containers on your local machine. To make your application accessible to the world, you need a server that's always on and connected to the internet. This is where cloud providers like Amazon Web Services (AWS) come in.

We'll be using a service model called Infrastructure as a Service (IaaS). In IaaS, a cloud provider gives you the fundamental computing resources—virtual servers, storage, and networking—over the internet. You are responsible for managing the operating system and the applications you run on top. This gives you maximum control, which is perfect for our learning goals.

Our tool of choice will be Amazon Elastic Compute Cloud (EC2), which is AWS's service for providing scalable virtual servers.

To start, let's get a high-level overview of what EC2 is and the core concepts you'll be working with.

2. Step 1: Provisioning Your First Cloud Server

"Provisioning" is the process of setting up IT infrastructure. In our case, it means launching and configuring a new EC2 instance. This involves making several key decisions that define your server's characteristics and security posture.

Let's walk through the practical process. The following video and text resources provide a step-by-step guide. I recommend having the AWS Console open in another window to follow along.

For a detailed text reference you can follow, the official AWS documentation is excellent.

Here is a breakdown of the essential choices you are making during the launch process:

1. Amazon Machine Image (AMI): This is the software template for your server, which includes the operating system. For this course, a popular and robust choice is Ubuntu Server (choose the latest LTS version that is Free Tier eligible).
2. Instance Type: This determines the hardware resources (CPU, memory, storage). To stay within the AWS Free Tier, select t2.micro. It's more than enough for our current needs.
3. Key Pair: This is your first major security configuration. AWS uses a key pair for authentication instead of a password. It consists of:
   • A public key, which AWS places on the EC2 instance.
   • A private key (a .pem file), which you must download and store securely on your own computer.
     You will not be able to download the private key again after you create it. Guard this file carefully; it is the only way to access your server. We will explore exactly how this works in the next section.
4. Network Settings (Security Group): This acts as a virtual firewall that controls inbound and outbound traffic to your instance. By default, AWS may create a security group that allows SSH access from anywhere (0.0.0.0/0). We will refine this shortly.

Once you click "Launch instance," AWS will provision your virtual server. After a minute or two, its status will change to running, and it will be assigned a Public IP address.

3. Step 2: Securing Access with SSH

You've downloaded a .pem file. This is your private key, and it's used with a protocol called Secure Shell (SSH) to log in to your server. Your interest in "under the hood" mechanisms will be well served here, as understanding SSH is fundamental to secure backend management.

How SSH Works

SSH replaces insecure protocols like Telnet by creating an encrypted communication channel between your computer (the client) and the EC2 instance (the server). The key pair you created is used for asymmetric cryptography to verify your identity without ever sending a password over the network.

The following video gives an excellent explanation of the entire process.

Connecting to Your Instance

Now, let's use your private key to connect.

1. Locate your private key file (.pem) that you downloaded from AWS.
2. Set the correct permissions. Your private key must be protected from being read by other users on your system. On Linux or macOS, open a terminal and run this command:

   chmod 400 /path/to/your-key.pem
   

3. Connect using the ssh command. The command structure is as follows:

   ssh -i /path/to/your-key.pem ubuntu@YOUR_INSTANCE_PUBLIC_IP
   

   • -i: Specifies the identity file (your private key).
   • ubuntu@...: The default username for Ubuntu AMIs is ubuntu. For Amazon Linux, it's ec2-user.
   • YOUR_INSTANCE_PUBLIC_IP: Find this in the EC2 console.

You can find the exact command to use by selecting your instance in the EC2 console and clicking the "Connect" button.

The first time you connect, you'll see a message about the authenticity of the host. Type yes to proceed. If successful, you'll be greeted with the command prompt of your new cloud server!

4. Step 3: Configuring the Firewall (Security Groups)

A firewall is a non-negotiable security control. In AWS, the Security Group associated with your EC2 instance acts as this firewall. It's a stateful firewall, meaning if you allow an incoming request, the corresponding outgoing response is automatically allowed.

You configure it by defining inbound rules (traffic coming to your server) and outbound rules (traffic going from your server).

For our application, we need to allow two types of inbound traffic:

1. SSH (Port 22): This allows you to manage the server. For maximum security, you should restrict the source to your own IP address (My IP in the AWS console), not the default Anywhere (0.0.0.0/0). This prevents anyone else on the internet from even attempting to connect.
2. HTTP/HTTPS (Ports 80/443): This will allow users to access your web application. For a public website, the source must be Anywhere (0.0.0.0/0 for IPv4 and ::/0 for IPv6).

Go to the EC2 console, find "Security Groups" in the left navigation pane, select the group attached to your instance, and edit the inbound rules to reflect the above.

5. Essential Concepts for a Stable Deployment

To build a truly robust backend, there are two more concepts you should be aware of.

Elastic IP Address: A Static IP

By default, the public IP address of your EC2 instance will change if you stop and start it. This is a major problem for a live server, as any DNS records pointing to it would break. The solution is an Elastic IP address—a static public IP that you can allocate to your account and attach to your instance. It will remain associated with your instance until you explicitly release it.

This video demonstrates the problem and the solution perfectly.

IAM Roles: Securely Granting Permissions

In the future, your application might need to interact with other AWS services (like S3 for file storage). The most secure way to grant these permissions is not by storing secret keys on your server, but by attaching an IAM Role to your EC2 instance. The role grants the instance temporary, secure credentials to access specific services. We won't need this for our immediate next step, but it's a core security best practice you should know about.

Conclusion

Congratulations! You have successfully stepped into the world of cloud infrastructure. You've gone from a theoretical concept to provisioning and securing your own virtual server on the internet.

Key Takeaways:

• Provisioning a server in the cloud involves launching a virtual machine like an AWS EC2 instance, choosing its OS (AMI) and hardware (Instance Type).
• SSH with key pairs is the secure standard for remote server administration. Your private key is your password—protect it.
• Security Groups are your server's virtual firewall, controlling all inbound and outbound traffic based on port and source IP. Restricting access is a critical security measure.
• For a stable production server, you need a static IP address, which you can get by using an Elastic IP.

Preview of the Next Lesson:
We now have a clean, secure, and accessible cloud server waiting for our application. In the next lesson, we will deploy the containerized application to the provisioned cloud server. This will involve installing Docker on our new EC2 instance, transferring our project files, and finally running our Nginx-Gunicorn-Django stack in the cloud.