Skip to content

Commit ab4d060

Browse files
mwunderlmwunderl
committed
Add management tutorials (batch 17)
1 parent 49f07d9 commit ab4d060

7 files changed

Lines changed: 318 additions & 0 deletions

File tree

‎tuts/115-aws-backup-gs/README.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Backup: Create a vault and backup plan
2+
3+
## Source
4+
5+
https://docs.aws.amazon.com/aws-backup/latest/devguide/getting-started.html
6+
7+
## Use case
8+
9+
- **ID**: backup/getting-started
10+
- **Level**: beginner
11+
- **Core actions**: `backup:CreateBackupVault`, `backup:CreateBackupPlan`
12+
13+
## Steps
14+
15+
1. Create a backup vault
16+
2. Create a backup plan (daily schedule, 30-day retention)
17+
3. Describe the plan
18+
4. List backup vaults
19+
5. List backup plans
20+
21+
## Resources created
22+
23+
| Resource | Type |
24+
|----------|------|
25+
| `tut-vault-<random>` | Backup vault |
26+
| `tut-plan-<random>` | Backup plan |
27+
28+
## Cost
29+
30+
No cost until a backup actually runs. This tutorial creates a plan and vault but does not execute a backup. AWS Backup pricing varies by resource type and storage amount.
31+
32+
## Duration
33+
34+
~6 seconds
35+
36+
## Related docs
37+
38+
- [Getting started with AWS Backup](https://docs.aws.amazon.com/aws-backup/latest/devguide/getting-started.html)
39+
- [Creating a backup plan](https://docs.aws.amazon.com/aws-backup/latest/devguide/creating-a-backup-plan.html)
40+
- [AWS Backup pricing](https://aws.amazon.com/backup/pricing/)
41+
- [Supported resources](https://docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.html#supported-resources)
42+
43+
---
44+
45+
## Appendix: Generation details
46+
47+
| Field | Value |
48+
|-------|-------|
49+
| Generation date | 2026-04-14 |
50+
| Source script | New, 83 lines |
51+
| Script test result | EXIT 0, 6s, 5 steps, suppressed delete-backup-plan JSON output |
52+
| Issues encountered | None |
53+
| Iterations | v1 |

‎tuts/115-aws-backup-gs/aws-backup-gs.md‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# Create a backup vault and backup plan with AWS Backup
2+
3+
This tutorial shows you how to create a backup vault, create a backup plan with a daily schedule and 30-day retention, inspect the plan details, and list your vaults and plans.
4+
5+
## Prerequisites
6+
7+
- AWS CLI configured with credentials and a default region
8+
- Permissions for `backup:CreateBackupVault`, `backup:DeleteBackupVault`, `backup:CreateBackupPlan`, `backup:DeleteBackupPlan`, `backup:GetBackupPlan`, `backup:ListBackupVaults`, `backup:ListBackupPlans`
9+
10+
## Step 1: Create a backup vault
11+
12+
Create a vault to store recovery points.
13+
14+
```bash
15+
VAULT_NAME="tut-vault-$(openssl rand -hex 4)"
16+
17+
aws backup create-backup-vault --backup-vault-name "$VAULT_NAME" \
18+
--query 'BackupVaultArn' --output text
19+
```
20+
21+
A backup vault is a container for recovery points (backups). Each vault has its own encryption key and access policy. The default vault uses the AWS managed key for Backup.
22+
23+
## Step 2: Create a backup plan
24+
25+
Create a plan with a daily backup rule that targets the vault and retains backups for 30 days.
26+
27+
```bash
28+
PLAN_NAME="tut-plan-$(openssl rand -hex 4)"
29+
30+
PLAN_RESULT=$(aws backup create-backup-plan --backup-plan "{
31+
\"BackupPlanName\":\"$PLAN_NAME\",
32+
\"Rules\":[{
33+
\"RuleName\":\"DailyBackup\",
34+
\"TargetBackupVaultName\":\"$VAULT_NAME\",
35+
\"ScheduleExpression\":\"cron(0 12 * * ? *)\",
36+
\"StartWindowMinutes\":60,
37+
\"CompletionWindowMinutes\":180,
38+
\"Lifecycle\":{\"DeleteAfterDays\":30}
39+
}]
40+
}")
41+
PLAN_ID=$(echo "$PLAN_RESULT" | python3 -c "import sys,json;print(json.load(sys.stdin)['BackupPlanId'])")
42+
```
43+
44+
`ScheduleExpression` uses a cron expression — this one runs daily at noon UTC. `StartWindowMinutes` is how long Backup waits before canceling a job that hasn't started. `Lifecycle` controls retention.
45+
46+
## Step 3: Describe the plan
47+
48+
View the plan details and rule configuration.
49+
50+
```bash
51+
aws backup get-backup-plan --backup-plan-id "$PLAN_ID" \
52+
--query 'BackupPlan.{Name:BackupPlanName,Rules:Rules[0].{Rule:RuleName,Schedule:ScheduleExpression,Retention:Lifecycle.DeleteAfterDays}}' \
53+
--output table
54+
```
55+
56+
A plan can have multiple rules targeting different vaults or schedules. Each rule can also specify copy actions to replicate backups to another Region.
57+
58+
## Step 4: List backup vaults
59+
60+
List vaults in your account.
61+
62+
```bash
63+
aws backup list-backup-vaults \
64+
--query 'BackupVaultList[].{Name:BackupVaultName,Created:CreationDate,RecoveryPoints:NumberOfRecoveryPoints}' \
65+
--output table
66+
```
67+
68+
Every account has a `Default` vault created automatically. The tutorial vault will show zero recovery points since no backup has run yet.
69+
70+
## Step 5: List backup plans
71+
72+
List plans in your account.
73+
74+
```bash
75+
aws backup list-backup-plans \
76+
--query 'BackupPlansList[].{Name:BackupPlanName,Id:BackupPlanId,Created:CreationDate}' \
77+
--output table
78+
```
79+
80+
Plans are independent of resource assignments. To actually back up resources, you create a backup selection that assigns resources (by ARN or tag) to a plan.
81+
82+
## Cleanup
83+
84+
Delete the backup plan and vault:
85+
86+
```bash
87+
aws backup delete-backup-plan --backup-plan-id "$PLAN_ID"
88+
aws backup delete-backup-vault --backup-vault-name "$VAULT_NAME"
89+
```
90+
91+
No actual backup ran during this tutorial, so there is no cost. AWS Backup charges only when backups are stored — pricing varies by resource type and storage amount. Deleting the plan stops future scheduled backups, and deleting an empty vault is immediate.
92+
93+
The script automates all steps including cleanup:
94+
95+
```bash
96+
bash aws-backup-gs.sh
97+
```
98+
99+
## Related resources
100+
101+
- [Getting started with AWS Backup](https://docs.aws.amazon.com/aws-backup/latest/devguide/getting-started.html)
102+
- [Creating a backup plan](https://docs.aws.amazon.com/aws-backup/latest/devguide/creating-a-backup-plan.html)
103+
- [AWS Backup pricing](https://aws.amazon.com/backup/pricing/)
104+
- [Supported resources](https://docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.html#supported-resources)

‎tuts/115-aws-backup-gs/aws-backup-gs.sh‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
#!/bin/bash
2+
# Tutorial: Create a backup vault and backup plan with AWS Backup
3+
# Source: https://docs.aws.amazon.com/aws-backup/latest/devguide/getting-started.html
4+
5+
WORK_DIR=$(mktemp -d)
6+
LOG_FILE="$WORK_DIR/backup-$(date +%Y%m%d-%H%M%S).log"
7+
exec > >(tee -a "$LOG_FILE") 2>&1
8+
9+
REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null)}}
10+
if [ -z "$REGION" ]; then
11+
echo "ERROR: No AWS region configured. Set one with: export AWS_DEFAULT_REGION=us-east-1"
12+
exit 1
13+
fi
14+
export AWS_DEFAULT_REGION="$REGION"
15+
echo "Region: $REGION"
16+
17+
RANDOM_ID=$(openssl rand -hex 4)
18+
VAULT_NAME="tut-vault-${RANDOM_ID}"
19+
PLAN_NAME="tut-plan-${RANDOM_ID}"
20+
21+
handle_error() { echo "ERROR on line $1"; trap - ERR; cleanup; exit 1; }
22+
trap 'handle_error $LINENO' ERR
23+
24+
cleanup() {
25+
echo ""
26+
echo "Cleaning up resources..."
27+
[ -n "$PLAN_ID" ] && aws backup delete-backup-plan --backup-plan-id "$PLAN_ID" > /dev/null 2>&1 && \
28+
echo " Deleted backup plan $PLAN_NAME"
29+
aws backup delete-backup-vault --backup-vault-name "$VAULT_NAME" 2>/dev/null && \
30+
echo " Deleted vault $VAULT_NAME"
31+
rm -rf "$WORK_DIR"
32+
echo "Cleanup complete."
33+
}
34+
35+
# Step 1: Create a backup vault
36+
echo "Step 1: Creating backup vault: $VAULT_NAME"
37+
aws backup create-backup-vault --backup-vault-name "$VAULT_NAME" \
38+
--query 'BackupVaultArn' --output text
39+
echo " Vault created"
40+
41+
# Step 2: Create a backup plan
42+
echo "Step 2: Creating backup plan: $PLAN_NAME"
43+
PLAN_RESULT=$(aws backup create-backup-plan --backup-plan "{
44+
\"BackupPlanName\":\"$PLAN_NAME\",
45+
\"Rules\":[{
46+
\"RuleName\":\"DailyBackup\",
47+
\"TargetBackupVaultName\":\"$VAULT_NAME\",
48+
\"ScheduleExpression\":\"cron(0 12 * * ? *)\",
49+
\"StartWindowMinutes\":60,
50+
\"CompletionWindowMinutes\":180,
51+
\"Lifecycle\":{\"DeleteAfterDays\":30}
52+
}]
53+
}")
54+
PLAN_ID=$(echo "$PLAN_RESULT" | python3 -c "import sys,json;print(json.load(sys.stdin)['BackupPlanId'])")
55+
echo " Plan ID: $PLAN_ID"
56+
57+
# Step 3: Describe the plan
58+
echo "Step 3: Backup plan details"
59+
aws backup get-backup-plan --backup-plan-id "$PLAN_ID" \
60+
--query 'BackupPlan.{Name:BackupPlanName,Rules:Rules[0].{Rule:RuleName,Schedule:ScheduleExpression,Retention:Lifecycle.DeleteAfterDays}}' --output table
61+
62+
# Step 4: List backup vaults
63+
echo "Step 4: Listing backup vaults"
64+
aws backup list-backup-vaults \
65+
--query 'BackupVaultList[?starts_with(BackupVaultName, `tut-`)].{Name:BackupVaultName,Created:CreationDate,RecoveryPoints:NumberOfRecoveryPoints}' --output table
66+
67+
# Step 5: List backup plans
68+
echo "Step 5: Listing backup plans"
69+
aws backup list-backup-plans \
70+
--query 'BackupPlansList[?starts_with(BackupPlanName, `tut-`)].{Name:BackupPlanName,Id:BackupPlanId,Created:CreationDate}' --output table
71+
72+
echo ""
73+
echo "Tutorial complete."
74+
echo "Note: No actual backup was started — the plan runs on a daily schedule."
75+
echo "Do you want to clean up all resources? (y/n): "
76+
read -r CHOICE
77+
if [[ "$CHOICE" =~ ^[Yy]$ ]]; then
78+
cleanup
79+
else
80+
echo "Manual cleanup:"
81+
echo " aws backup delete-backup-plan --backup-plan-id $PLAN_ID"
82+
echo " aws backup delete-backup-vault --backup-vault-name $VAULT_NAME"
83+
fi

‎tuts/121-aws-organizations-gs/aws-organizations-gs.sh‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/bin/bash
2+
WORK_DIR=$(mktemp -d)
3+
exec > >(tee -a "$WORK_DIR/orgs-$(date +%Y%m%d-%H%M%S).log") 2>&1
4+
REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}
5+
[ -z "$REGION" ] && echo "ERROR: No region" && exit 1
6+
export AWS_DEFAULT_REGION="$REGION"
7+
echo "Region: $REGION"
8+
echo "Step 1: Describing organization"
9+
aws organizations describe-organization --query 'Organization.{Id:Id,MasterAccount:MasterAccountId,FeatureSet:FeatureSet}' --output table 2>/dev/null || echo " No organization found (this account may not be part of an organization)"
10+
echo "Step 2: Listing accounts"
11+
aws organizations list-accounts --query 'Accounts[:5].{Id:Id,Name:Name,Status:Status,Email:Email}' --output table 2>/dev/null || echo " Cannot list accounts (requires organization master)"
12+
echo "Step 3: Listing organizational units"
13+
ROOT_ID=$(aws organizations list-roots --query 'Roots[0].Id' --output text 2>/dev/null)
14+
[ -n "$ROOT_ID" ] && [ "$ROOT_ID" != "None" ] && aws organizations list-organizational-units-for-parent --parent-id "$ROOT_ID" --query 'OrganizationalUnits[].{Id:Id,Name:Name}' --output table 2>/dev/null || echo " No OUs found"
15+
echo "Step 4: Listing policies"
16+
aws organizations list-policies --filter SERVICE_CONTROL_POLICY --query 'Policies[].{Id:Id,Name:Name,Type:Type}' --output table 2>/dev/null || echo " Cannot list policies"
17+
echo ""
18+
echo "Tutorial complete. No resources were created — this tutorial is read-only."
19+
rm -rf "$WORK_DIR"

‎tuts/122-aws-health-gs/aws-health-gs.sh‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash
2+
WORK_DIR=$(mktemp -d)
3+
exec > >(tee -a "$WORK_DIR/health-$(date +%Y%m%d-%H%M%S).log") 2>&1
4+
REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}
5+
[ -z "$REGION" ] && echo "ERROR: No region" && exit 1
6+
export AWS_DEFAULT_REGION=us-east-1
7+
echo "Region: us-east-1 (Health API is global)"
8+
echo "Step 1: Describing events (last 7 days)"
9+
aws health describe-events --filter '{"startTimes":[{"from":"'$(date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ)'"}]}' --query 'events[:5].{Service:service,Type:eventTypeCode,Status:statusCode,Region:region}' --output table 2>/dev/null || echo " No recent events (or Health API requires Business/Enterprise support)"
10+
echo "Step 2: Describing event types"
11+
aws health describe-event-types --filter '{"services":["EC2"]}' --query 'eventTypes[:5].{Code:code,Service:service,Category:category}' --output table 2>/dev/null || echo " Cannot describe event types"
12+
echo "Step 3: Describing affected entities"
13+
aws health describe-affected-entities --filter '{"eventArns":["arn:aws:health:us-east-1::event/EC2/example"]}' 2>/dev/null || echo " No affected entities (expected with no active events)"
14+
echo ""
15+
echo "Tutorial complete. No resources were created — Health API is read-only."
16+
echo "Note: Full Health API access requires Business or Enterprise Support plan."
17+
rm -rf "$WORK_DIR"

‎tuts/124-aws-ssm-gs/aws-ssm-gs.sh‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/bin/bash
2+
WORK_DIR=$(mktemp -d)
3+
exec > >(tee -a "$WORK_DIR/ssm-$(date +%Y%m%d-%H%M%S).log") 2>&1
4+
REGION=${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null)}
5+
[ -z "$REGION" ] && echo "ERROR: No region" && exit 1
6+
export AWS_DEFAULT_REGION="$REGION"
7+
echo "Region: $REGION"
8+
RANDOM_ID=$(openssl rand -hex 4)
9+
handle_error() { echo "ERROR on line $1"; trap - ERR; cleanup; exit 1; }
10+
trap 'handle_error $LINENO' ERR
11+
cleanup() { echo ""; echo "Cleaning up..."; aws ssm delete-parameter --name "/tutorial/$RANDOM_ID/db-host" 2>/dev/null; aws ssm delete-parameter --name "/tutorial/$RANDOM_ID/db-password" 2>/dev/null; aws ssm delete-parameter --name "/tutorial/$RANDOM_ID/app-config" 2>/dev/null; echo " Deleted parameters"; rm -rf "$WORK_DIR"; echo "Done."; }
12+
echo "Step 1: Creating a String parameter"
13+
aws ssm put-parameter --name "/tutorial/$RANDOM_ID/db-host" --value "db.example.com" --type String --query 'Version' --output text > /dev/null
14+
echo " Created /tutorial/$RANDOM_ID/db-host"
15+
echo "Step 2: Creating a SecureString parameter"
16+
aws ssm put-parameter --name "/tutorial/$RANDOM_ID/db-password" --value "s3cret-pass-123" --type SecureString --query 'Version' --output text > /dev/null
17+
echo " Created /tutorial/$RANDOM_ID/db-password (encrypted)"
18+
echo "Step 3: Creating a StringList parameter"
19+
aws ssm put-parameter --name "/tutorial/$RANDOM_ID/app-config" --value "debug=false,timeout=30,retries=3" --type StringList --query 'Version' --output text > /dev/null
20+
echo " Created /tutorial/$RANDOM_ID/app-config"
21+
echo "Step 4: Getting parameters"
22+
aws ssm get-parameter --name "/tutorial/$RANDOM_ID/db-host" --query 'Parameter.{Name:Name,Value:Value,Type:Type}' --output table
23+
aws ssm get-parameter --name "/tutorial/$RANDOM_ID/db-password" --with-decryption --query 'Parameter.{Name:Name,Value:Value,Type:Type}' --output table
24+
echo "Step 5: Getting parameters by path"
25+
aws ssm get-parameters-by-path --path "/tutorial/$RANDOM_ID" --with-decryption --query 'Parameters[].{Name:Name,Type:Type,Value:Value}' --output table
26+
echo "Step 6: Parameter history"
27+
aws ssm put-parameter --name "/tutorial/$RANDOM_ID/db-host" --value "db-v2.example.com" --type String --overwrite --query 'Version' --output text > /dev/null
28+
aws ssm get-parameter-history --name "/tutorial/$RANDOM_ID/db-host" --query 'Parameters[].{Version:Version,Value:Value}' --output table
29+
echo ""
30+
echo "Tutorial complete."
31+
echo "Do you want to clean up? (y/n): "
32+
read -r CHOICE
33+
[[ "$CHOICE" =~ ^[Yy]$ ]] && cleanup || echo "Manual: aws ssm delete-parameters --names /tutorial/$RANDOM_ID/db-host /tutorial/$RANDOM_ID/db-password /tutorial/$RANDOM_ID/app-config"

‎tuts/140-aws-trustedadvisor-gs/aws-trustedadvisor-gs.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/bash
2+
WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/ta.log") 2>&1
3+
export AWS_DEFAULT_REGION=us-east-1; echo "Region: us-east-1 (Trusted Advisor is global)"
4+
echo "Step 1: Listing checks"
5+
aws support describe-trusted-advisor-checks --language en --query 'checks[:10].{Id:id,Name:name,Category:category}' --output table 2>/dev/null || echo " Trusted Advisor requires Business or Enterprise Support plan"
6+
echo "Step 2: Getting check results"
7+
aws support describe-trusted-advisor-check-result --check-id Pfx0RwqBli --query 'result.{Status:status,ResourcesSummary:resourcesSummary}' --output table 2>/dev/null || echo " Cannot get results (requires Support plan)"
8+
echo ""; echo "Tutorial complete. No resources created — Trusted Advisor is read-only."
9+
rm -rf "$WORK_DIR"

0 commit comments

Comments
 (0)