Uncodemy AWS Course Complete Guide

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadOnlyOnAppBucket",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-app-bucket",
        "arn:aws:s3:::my-app-bucket/*"
      ]
    },
    {
      "Sid": "DenyDeleteOnAppBucket",
      "Effect": "Deny",
      "Action": "s3:DeleteObject",
      "Resource": "arn:aws:s3:::my-app-bucket/*"
    }
  ]
}

// What this policy demonstrates:
// - Least-privilege: only the required permissions.
// - Explicit Deny: a critical safeguard on production data.
// - Resource-level scoping: no wildcards across all buckets.
//
// What interviewers test on this:
// - Do you understand Allow vs Deny precedence?
// - Can you scope permissions to resources, not "*"?
// - Do you know when to use roles vs users?

# create_vpc_and_ec2.sh — Phase 1, Week 5–6
# What "build a custom VPC" actually looks like with the AWS CLI.

set -euo pipefail

REGION="ap-south-1"

# 1. Create the VPC
VPC_ID=$(aws ec2 create-vpc \
  --cidr-block 10.0.0.0/16 \
  --region "$REGION" \
  --query 'Vpc.VpcId' --output text)

aws ec2 create-tags --resources "$VPC_ID" \
  --tags Key=Name,Value=uncodemy-demo-vpc --region "$REGION"

# 2. Public subnet
PUBLIC_SUBNET=$(aws ec2 create-subnet \
  --vpc-id "$VPC_ID" \
  --cidr-block 10.0.1.0/24 \
  --availability-zone "${REGION}a" \
  --query 'Subnet.SubnetId' --output text)

# 3. Internet gateway + route table
IGW=$(aws ec2 create-internet-gateway \
  --query 'InternetGateway.InternetGatewayId' --output text)

aws ec2 attach-internet-gateway --vpc-id "$VPC_ID" --internet-gateway-id "$IGW"

ROUTE_TABLE=$(aws ec2 create-route-table \
  --vpc-id "$VPC_ID" \
  --query 'RouteTable.RouteTableId' --output text)

aws ec2 create-route --route-table-id "$ROUTE_TABLE" \
  --destination-cidr-block 0.0.0.0/0 --gateway-id "$IGW"

aws ec2 associate-route-table --subnet-id "$PUBLIC_SUBNET" \
  --route-table-id "$ROUTE_TABLE"

# 4. Security group for SSH and HTTP
SG=$(aws ec2 create-security-group \
  --group-name demo-sg \
  --description "SSH and HTTP access" \
  --vpc-id "$VPC_ID" \
  --query 'GroupId' --output text)

aws ec2 authorize-security-group-ingress --group-id "$SG" \
  --protocol tcp --port 22 --cidr 0.0.0.0/0

aws ec2 authorize-security-group-ingress --group-id "$SG" \
  --protocol tcp --port 80 --cidr 0.0.0.0/0

# 5. Launch a t3.micro (free tier friendly)
aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type t3.micro \
  --key-name my-key \
  --security-group-ids "$SG" \
  --subnet-id "$PUBLIC_SUBNET" \
  --region "$REGION"

# What this exercise teaches:
# - The real building blocks of a VPC.
# - Why route tables and IGWs matter.
# - How security groups protect instances.
# - That everything in the console can be done via CLI.
#
# Why interviewers love this:
# - Shows you understand networking, not just clicking buttons.
# - Demonstrates automation thinking.

# s3_static_site.sh — Phase 1, Week 4
# Setting up an S3 bucket as a static website — with policy.

BUCKET="uncodemy-demo-site-$(date +%s)"
REGION="ap-south-1"

# 1. Create the bucket
aws s3api create-bucket \
  --bucket "$BUCKET" \
  --region "$REGION" \
  --create-bucket-configuration LocationConstraint="$REGION"

# 2. Enable static website hosting
aws s3 website "s3://$BUCKET" \
  --index-document index.html \
  --error-document error.html

# 3. Public-read bucket policy (required for static site)
cat > policy.json <