Tutorials: compute-batch-4 (5 tutorials)

tuts/172-lambda-concurrency/README.md

@@ -0,0 +1,40 @@
+# Lambda Concurrency
+
+An AWS CLI tutorial that demonstrates Iam operations.
+
+## Running
+
+```bash
+bash lambda-concurrency.sh
+```
+
+To auto-run with cleanup:
+
+```bash
+echo 'y' | bash lambda-concurrency.sh
+```
+
+## What it does
+
+1. Getting account concurrency limits
+2. Setting reserved concurrency
+3. Getting function concurrency
+4. Removing reserved concurrency
+
+## Resources created
+
+- Function
+- Role
+- Function Concurrency
+
+The script prompts you to clean up resources when it finishes.
+
+## Cost
+
+Free tier eligible for most operations. Clean up resources after use to avoid charges.
+
+## Related docs
+
+- [AWS CLI iam reference](https://docs.aws.amazon.com/cli/latest/reference/iam/index.html)
+- [AWS CLI lambda reference](https://docs.aws.amazon.com/cli/latest/reference/lambda/index.html)
+

tuts/172-lambda-concurrency/REVISION-HISTORY.md

@@ -0,0 +1,8 @@
+# Revision History: 172-lambda-concurrency
+
+## Shell (CLI script)
+
+### 2026-04-14 v1 published
+- Type: functional
+- Initial version
+

tuts/172-lambda-concurrency/lambda-concurrency.md

@@ -0,0 +1,27 @@
+# Lambda Concurrency
+
+## Prerequisites
+
+1. AWS CLI installed and configured (`aws configure`)
+2. Appropriate IAM permissions for the AWS services used
+
+## Step 1: Getting account concurrency limits
+
+The script handles this step automatically. See `lambda-concurrency.sh` for the exact CLI commands.
+
+## Step 2: Setting reserved concurrency
+
+The script handles this step automatically. See `lambda-concurrency.sh` for the exact CLI commands.
+
+## Step 3: Getting function concurrency
+
+The script handles this step automatically. See `lambda-concurrency.sh` for the exact CLI commands.
+
+## Step 4: Removing reserved concurrency
+
+The script handles this step automatically. See `lambda-concurrency.sh` for the exact CLI commands.
+
+## Cleanup
+
+The script prompts you to clean up all created resources. If you need to clean up manually, check the script log for the resource names that were created.
+

tuts/172-lambda-concurrency/lambda-concurrency.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/conc.log") 2>&1
+REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null))}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+RANDOM_ID=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 8 | head -n 1); FUNC="tut-conc-${RANDOM_ID}"; ROLE="lambda-conc-role-${RANDOM_ID}"
+handle_error() { echo "ERROR on line $1"; trap - ERR; cleanup; exit 1; }; trap 'handle_error $LINENO' ERR
+cleanup() { echo ""; echo "Cleaning up..."; aws lambda delete-function-concurrency --function-name "$FUNC" 2>/dev/null; aws lambda delete-function --function-name "$FUNC" 2>/dev/null && echo "  Deleted function"; aws iam detach-role-policy --role-name "$ROLE" --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole 2>/dev/null; aws iam delete-role --role-name "$ROLE" 2>/dev/null && echo "  Deleted role"; rm -rf "$WORK_DIR"; echo "Done."; }
+ROLE_ARN=$(aws iam create-role --role-name "$ROLE" --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}' --query 'Role.Arn' --output text)
+aws iam attach-role-policy --role-name "$ROLE" --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole; sleep 10
+cat > "$WORK_DIR/index.py" << 'EOF'
+import time
+def handler(event, context):
+    time.sleep(1)
+    return {"remaining_ms": context.get_remaining_time_in_millis()}
+EOF
+(cd "$WORK_DIR" && zip func.zip index.py > /dev/null)
+aws lambda create-function --function-name "$FUNC" --zip-file "fileb://$WORK_DIR/func.zip" --handler index.handler --runtime python3.12 --role "$ROLE_ARN" --architectures x86_64 > /dev/null
+aws lambda wait function-active-v2 --function-name "$FUNC"
+echo "Step 1: Getting account concurrency limits"
+aws lambda get-account-settings --query 'AccountLimit.{Total:TotalCodeSize,Concurrent:ConcurrentExecutions,Unreserved:UnreservedConcurrentExecutions}' --output table
+echo "Step 2: Setting reserved concurrency"
+aws lambda put-function-concurrency --function-name "$FUNC" --reserved-concurrent-executions 5 --query 'ReservedConcurrentExecutions' --output text > /dev/null
+echo "  Reserved: 5 concurrent executions"
+echo "Step 3: Getting function concurrency"
+aws lambda get-function-concurrency --function-name "$FUNC" --query 'ReservedConcurrentExecutions' --output text
+echo "Step 4: Removing reserved concurrency"
+aws lambda delete-function-concurrency --function-name "$FUNC"
+echo "  Reserved concurrency removed"
+echo ""; echo "Tutorial complete."
+echo "Do you want to clean up? (y/n): "; read -r CHOICE; [[ "$CHOICE" =~ ^[Yy]$ ]] && cleanup

tuts/175-ec2-tags/README.md

@@ -0,0 +1,38 @@
+# Ec2 Tags
+
+An AWS CLI tutorial that demonstrates Ec2 operations.
+
+## Running
+
+```bash
+bash ec2-tags.sh
+```
+
+To auto-run with cleanup:
+
+```bash
+echo 'y' | bash ec2-tags.sh
+```
+
+## What it does
+
+1. Adding tags
+2. Describing tags
+3. Finding resources by tag
+4. Removing a tag
+
+## Resources created
+
+- Security Group
+- Tags
+
+The script prompts you to clean up resources when it finishes.
+
+## Cost
+
+Free tier eligible for most operations. Clean up resources after use to avoid charges.
+
+## Related docs
+
+- [AWS CLI ec2 reference](https://docs.aws.amazon.com/cli/latest/reference/ec2/index.html)
+

tuts/175-ec2-tags/REVISION-HISTORY.md

@@ -0,0 +1,8 @@
+# Revision History: 175-ec2-tags
+
+## Shell (CLI script)
+
+### 2026-04-14 v1 published
+- Type: functional
+- Initial version
+

tuts/175-ec2-tags/ec2-tags.md

@@ -0,0 +1,27 @@
+# Ec2 Tags
+
+## Prerequisites
+
+1. AWS CLI installed and configured (`aws configure`)
+2. Appropriate IAM permissions for the AWS services used
+
+## Step 1: Adding tags
+
+The script handles this step automatically. See `ec2-tags.sh` for the exact CLI commands.
+
+## Step 2: Describing tags
+
+The script handles this step automatically. See `ec2-tags.sh` for the exact CLI commands.
+
+## Step 3: Finding resources by tag
+
+The script handles this step automatically. See `ec2-tags.sh` for the exact CLI commands.
+
+## Step 4: Removing a tag
+
+The script handles this step automatically. See `ec2-tags.sh` for the exact CLI commands.
+
+## Cleanup
+
+The script prompts you to clean up all created resources. If you need to clean up manually, check the script log for the resource names that were created.
+

tuts/175-ec2-tags/ec2-tags.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/tags.log") 2>&1
+REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null))}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+RANDOM_ID=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 8 | head -n 1)
+VPC_ID=$(aws ec2 describe-vpcs --filters "Name=isDefault,Values=true" --query 'Vpcs[0].VpcId' --output text)
+SG_ID=$(aws ec2 create-security-group --group-name "tut-tags-${RANDOM_ID}" --description "Tag tutorial" --vpc-id "$VPC_ID" --query 'GroupId' --output text)
+handle_error() { echo "ERROR on line $1"; trap - ERR; cleanup; exit 1; }; trap 'handle_error $LINENO' ERR
+cleanup() { echo ""; echo "Cleaning up..."; aws ec2 delete-security-group --group-id "$SG_ID" 2>/dev/null && echo "  Deleted SG"; rm -rf "$WORK_DIR"; echo "Done."; }
+echo "Step 1: Adding tags"
+aws ec2 create-tags --resources "$SG_ID" --tags Key=Environment,Value=tutorial Key=Project,Value=tag-demo Key=Owner,Value=tutorial-user Key=CostCenter,Value=12345
+echo "  Added 4 tags to $SG_ID"
+echo "Step 2: Describing tags"
+aws ec2 describe-tags --filters "Name=resource-id,Values=$SG_ID" --query 'Tags[].{Key:Key,Value:Value}' --output table
+echo "Step 3: Finding resources by tag"
+aws ec2 describe-security-groups --filters "Name=tag:Project,Values=tag-demo" --query 'SecurityGroups[].{Id:GroupId,Name:GroupName}' --output table
+echo "Step 4: Removing a tag"
+aws ec2 delete-tags --resources "$SG_ID" --tags Key=CostCenter
+echo "  Removed CostCenter tag"
+aws ec2 describe-tags --filters "Name=resource-id,Values=$SG_ID" --query 'Tags[].{Key:Key,Value:Value}' --output table
+echo ""; echo "Tutorial complete."
+echo "Do you want to clean up? (y/n): "; read -r CHOICE; [[ "$CHOICE" =~ ^[Yy]$ ]] && cleanup

tuts/177-lambda-destinations/README.md

@@ -0,0 +1,39 @@
+# Lambda Destinations
+
+An AWS CLI tutorial that demonstrates Iam operations.
+
+## Running
+
+```bash
+bash lambda-destinations.sh
+```
+
+To auto-run with cleanup:
+
+```bash
+echo 'y' | bash lambda-destinations.sh
+```
+
+## What it does
+
+1. Creating roles and functions"; RID=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 8 | head -n 1); R="dest-role-$RID"; Q="dest-queue-$RID"; F="dest-func-$RID"; ROLE_ARN=$(aws iam create-role --role-name "$R" --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}' --query Role.Arn --output text); aws iam attach-role-policy --role-name "$R" --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole; aws iam attach-role-policy --role-name "$R" --policy-arn arn:aws:iam::aws:policy/AmazonSQSFullAccess; sleep 10; QU=$(aws sqs create-queue --queue-name "$Q" --query QueueUrl --output text); QA=$(aws sqs get-queue-attributes --queue-url "$QU" --attribute-names QueueArn --query Attributes.QueueArn --output text); D=$(mktemp -d); echo "def handler(e,c): return {\"result\":\"success\"}" > "$D/i.py"; (cd "$D" && zip f.zip i.py > /dev/null); aws lambda create-function --function-name "$F" --zip-file "fileb://$D/f.zip" --handler i.handler --runtime python3.12 --role "$ROLE_ARN" --architectures x86_64 > /dev/null; aws lambda wait function-active-v2 --function-name "$F"; echo "Step 2: Configuring on-success destination"; aws lambda put-function-event-invoke-config --function-name "$F" --destination-config "{\"OnSuccess\":{\"Destination\":\"$QA\"}}" > /dev/null; echo "  On-success -> SQS queue"; echo "Step 3: Invoking async"; aws lambda invoke --function-name "$F" --invocation-type Event --cli-binary-format raw-in-base64-out --payload '{}' "$D/out.json" > /dev/null; echo "  Invoked async"; sleep 10; echo "Step 4: Checking SQS for result"; aws sqs receive-message --queue-url "$QU" --max-number-of-messages 1 --wait-time-seconds 5 --query "Messages[0].Body" --output text 2>/dev/null | python3 -c "import sys,json;d=json.loads(sys.stdin.read());print(f\"  Result: {d.get('requestPayload',{})}\n  Response: {d.get('responsePayload',{})}\")" 2>/dev/null || echo "  No message yet"; echo "Do you want to clean up? (y/n): "; read -r C; [[ "$C" =~ ^[Yy]$ ]] && { aws lambda delete-function --function-name "$F" 2>/dev/null; aws sqs delete-queue --queue-url "$QU" 2>/dev/null; aws iam detach-role-policy --role-name "$R" --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole 2>/dev/null; aws iam detach-role-policy --role-name "$R" --policy-arn arn:aws:iam::aws:policy/AmazonSQSFullAccess 2>/dev/null; aws iam delete-role --role-name "$R" 2>/dev/null; rm -rf "$D
+
+## Resources created
+
+- Function
+- Queue
+- Role
+- Function Event Invoke Config
+
+The script prompts you to clean up resources when it finishes.
+
+## Cost
+
+Free tier eligible for most operations. Clean up resources after use to avoid charges.
+
+## Related docs
+
+- [AWS CLI iam reference](https://docs.aws.amazon.com/cli/latest/reference/iam/index.html)
+- [AWS CLI lambda reference](https://docs.aws.amazon.com/cli/latest/reference/lambda/index.html)
+- [AWS CLI sqs reference](https://docs.aws.amazon.com/cli/latest/reference/sqs/index.html)
+

tuts/177-lambda-destinations/REVISION-HISTORY.md

@@ -0,0 +1,8 @@
+# Revision History: 177-lambda-destinations
+
+## Shell (CLI script)
+
+### 2026-04-14 v1 published
+- Type: functional
+- Initial version
+

tuts/177-lambda-destinations/lambda-destinations.md

@@ -0,0 +1,15 @@
+# Lambda Destinations
+
+## Prerequisites
+
+1. AWS CLI installed and configured (`aws configure`)
+2. Appropriate IAM permissions for the AWS services used
+
+## Step 1: Creating roles and functions"; RID=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 8 | head -n 1); R="dest-role-$RID"; Q="dest-queue-$RID"; F="dest-func-$RID"; ROLE_ARN=$(aws iam create-role --role-name "$R" --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}' --query Role.Arn --output text); aws iam attach-role-policy --role-name "$R" --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole; aws iam attach-role-policy --role-name "$R" --policy-arn arn:aws:iam::aws:policy/AmazonSQSFullAccess; sleep 10; QU=$(aws sqs create-queue --queue-name "$Q" --query QueueUrl --output text); QA=$(aws sqs get-queue-attributes --queue-url "$QU" --attribute-names QueueArn --query Attributes.QueueArn --output text); D=$(mktemp -d); echo "def handler(e,c): return {\"result\":\"success\"}" > "$D/i.py"; (cd "$D" && zip f.zip i.py > /dev/null); aws lambda create-function --function-name "$F" --zip-file "fileb://$D/f.zip" --handler i.handler --runtime python3.12 --role "$ROLE_ARN" --architectures x86_64 > /dev/null; aws lambda wait function-active-v2 --function-name "$F"; echo "Step 2: Configuring on-success destination"; aws lambda put-function-event-invoke-config --function-name "$F" --destination-config "{\"OnSuccess\":{\"Destination\":\"$QA\"}}" > /dev/null; echo "  On-success -> SQS queue"; echo "Step 3: Invoking async"; aws lambda invoke --function-name "$F" --invocation-type Event --cli-binary-format raw-in-base64-out --payload '{}' "$D/out.json" > /dev/null; echo "  Invoked async"; sleep 10; echo "Step 4: Checking SQS for result"; aws sqs receive-message --queue-url "$QU" --max-number-of-messages 1 --wait-time-seconds 5 --query "Messages[0].Body" --output text 2>/dev/null | python3 -c "import sys,json;d=json.loads(sys.stdin.read());print(f\"  Result: {d.get('requestPayload',{})}\n  Response: {d.get('responsePayload',{})}\")" 2>/dev/null || echo "  No message yet"; echo "Do you want to clean up? (y/n): "; read -r C; [[ "$C" =~ ^[Yy]$ ]] && { aws lambda delete-function --function-name "$F" 2>/dev/null; aws sqs delete-queue --queue-url "$QU" 2>/dev/null; aws iam detach-role-policy --role-name "$R" --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole 2>/dev/null; aws iam detach-role-policy --role-name "$R" --policy-arn arn:aws:iam::aws:policy/AmazonSQSFullAccess 2>/dev/null; aws iam delete-role --role-name "$R" 2>/dev/null; rm -rf "$D
+
+The script handles this step automatically. See `lambda-destinations.sh` for the exact CLI commands.
+
+## Cleanup
+
+The script prompts you to clean up all created resources. If you need to clean up manually, check the script log for the resource names that were created.
+

tuts/177-lambda-destinations/lambda-destinations.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+WORK_DIR=$(mktemp -d); exec > >(tee -a "$WORK_DIR/lambda-destinations.log") 2>&1
+REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null))}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+echo "Step 1: Creating roles and functions"; RID=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 8 | head -n 1); R="dest-role-$RID"; Q="dest-queue-$RID"; F="dest-func-$RID"; ROLE_ARN=$(aws iam create-role --role-name "$R" --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}' --query Role.Arn --output text); aws iam attach-role-policy --role-name "$R" --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole; aws iam attach-role-policy --role-name "$R" --policy-arn arn:aws:iam::aws:policy/AmazonSQSFullAccess; sleep 10; QU=$(aws sqs create-queue --queue-name "$Q" --query QueueUrl --output text); QA=$(aws sqs get-queue-attributes --queue-url "$QU" --attribute-names QueueArn --query Attributes.QueueArn --output text); D=$(mktemp -d); echo "def handler(e,c): return {\"result\":\"success\"}" > "$D/i.py"; (cd "$D" && zip f.zip i.py > /dev/null); aws lambda create-function --function-name "$F" --zip-file "fileb://$D/f.zip" --handler i.handler --runtime python3.12 --role "$ROLE_ARN" --architectures x86_64 > /dev/null; aws lambda wait function-active-v2 --function-name "$F"; echo "Step 2: Configuring on-success destination"; aws lambda put-function-event-invoke-config --function-name "$F" --destination-config "{\"OnSuccess\":{\"Destination\":\"$QA\"}}" > /dev/null; echo "  On-success -> SQS queue"; echo "Step 3: Invoking async"; aws lambda invoke --function-name "$F" --invocation-type Event --cli-binary-format raw-in-base64-out --payload '{}' "$D/out.json" > /dev/null; echo "  Invoked async"; sleep 10; echo "Step 4: Checking SQS for result"; aws sqs receive-message --queue-url "$QU" --max-number-of-messages 1 --wait-time-seconds 5 --query "Messages[0].Body" --output text 2>/dev/null | python3 -c "import sys,json;d=json.loads(sys.stdin.read());print(f\"  Result: {d.get('requestPayload',{})}\n  Response: {d.get('responsePayload',{})}\")" 2>/dev/null || echo "  No message yet"; echo "Do you want to clean up? (y/n): "; read -r C; [[ "$C" =~ ^[Yy]$ ]] && { aws lambda delete-function --function-name "$F" 2>/dev/null; aws sqs delete-queue --queue-url "$QU" 2>/dev/null; aws iam detach-role-policy --role-name "$R" --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole 2>/dev/null; aws iam detach-role-policy --role-name "$R" --policy-arn arn:aws:iam::aws:policy/AmazonSQSFullAccess 2>/dev/null; aws iam delete-role --role-name "$R" 2>/dev/null; rm -rf "$D"; echo Done; }

tuts/178-ec2-amis/README.md

@@ -0,0 +1,29 @@
+# Ec2 Amis
+
+A read-only script that queries Ec2 resources and displays information.
+
+## Running
+
+```bash
+bash ec2-amis.sh
+```
+
+## What it does
+
+1. Listing Amazon Linux 2023 AMIs
+2. Listing Ubuntu AMIs
+3. Describing a specific AMI
+4. Listing your own AMIs
+
+## Resources created
+
+None — this script is read-only.
+
+## Cost
+
+No cost. This script only reads existing resources.
+
+## Related docs
+
+- [AWS CLI ec2 reference](https://docs.aws.amazon.com/cli/latest/reference/ec2/index.html)
+

tuts/178-ec2-amis/REVISION-HISTORY.md

@@ -0,0 +1,8 @@
+# Revision History: 178-ec2-amis
+
+## Shell (CLI script)
+
+### 2026-04-14 v1 published
+- Type: functional
+- Initial version
+

tuts/178-ec2-amis/ec2-amis.md

@@ -0,0 +1,23 @@
+# Ec2 Amis
+
+## Prerequisites
+
+1. AWS CLI installed and configured (`aws configure`)
+2. Appropriate IAM permissions for the AWS services used
+
+## Step 1: Listing Amazon Linux 2023 AMIs
+
+The script handles this step automatically. See `ec2-amis.sh` for the exact CLI commands.
+
+## Step 2: Listing Ubuntu AMIs
+
+The script handles this step automatically. See `ec2-amis.sh` for the exact CLI commands.
+
+## Step 3: Describing a specific AMI
+
+The script handles this step automatically. See `ec2-amis.sh` for the exact CLI commands.
+
+## Step 4: Listing your own AMIs
+
+The script handles this step automatically. See `ec2-amis.sh` for the exact CLI commands.
+

tuts/178-ec2-amis/ec2-amis.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+exec > >(tee -a "$(mktemp -d)/amis.log") 2>&1
+REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null))}; [ -z "$REGION" ] && echo "ERROR: No region" && exit 1; export AWS_DEFAULT_REGION="$REGION"; echo "Region: $REGION"
+echo "Step 1: Listing Amazon Linux 2023 AMIs"
+aws ec2 describe-images --owners amazon --filters "Name=name,Values=al2023-ami-2023*-x86_64" "Name=state,Values=available" --query 'sort_by(Images, &CreationDate)[-3:].{Id:ImageId,Name:Name,Created:CreationDate}' --output table
+echo "Step 2: Listing Ubuntu AMIs"
+aws ec2 describe-images --owners 099720109477 --filters "Name=name,Values=ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04*" "Name=architecture,Values=x86_64" --query 'sort_by(Images, &CreationDate)[-3:].{Id:ImageId,Name:Name}' --output table
+echo "Step 3: Describing a specific AMI"
+AMI=$(aws ec2 describe-images --owners amazon --filters "Name=name,Values=al2023-ami-2023*-x86_64" --query 'sort_by(Images, &CreationDate)[-1].ImageId' --output text)
+aws ec2 describe-images --image-ids "$AMI" --query 'Images[0].{Id:ImageId,Arch:Architecture,Root:RootDeviceType,Virt:VirtualizationType}' --output table
+echo "Step 4: Listing your own AMIs"
+aws ec2 describe-images --owners self --query 'Images[:5].{Id:ImageId,Name:Name,State:State}' --output table 2>/dev/null || echo "  No custom AMIs"
+echo ""; echo "Tutorial complete. No resources created — read-only."