# AWS EC2实例管理
# 创建EC2实例
$ aws ec2 run-instances \
–image-id ami-0c55b159cbfafe1f0 \
–instance-type t3.medium \
–count 1 \
–key-name my-key-pair \
–security-group-ids sg-12345678 \
–subnet-id subnet-12345678 \
–tag-specifications ‘ResourceType=instance,Tags=[{Key=Name,Value=web-server}]’

# 查看EC2实例
$ aws ec2 describe-instances \
–filters “Name=tag:Name,Values=web-server”

# 启动EC2实例
$ aws ec2 start-instances \
–instance-ids i-12345678

# 停止EC2实例
$ aws ec2 stop-instances \
–instance-ids i-12345678

# 终止EC2实例
$ aws ec2 terminate-instances \
–instance-ids i-12345678

# 监控EC2实例
$ aws cloudwatch get-metric-statistics \
–namespace AWS/EC2 \
–metric-name CPUUtilization \
–dimensions Name=InstanceId,Value=i-12345678 \
–start-time 2026-04-03T00:00:00Z \
–end-time 2026-04-03T12:00:00Z \
–period 3600 \
–statistics Average

# AWS S3存储管理
# 创建S3存储桶
$ aws s3 mb s3://my-bucket

# 上传文件到S3
$ aws s3 cp file.txt s3://my-bucket/

# 下载文件从S3
$ aws s3 cp s3://my-bucket/file.txt .

# 列出S3存储桶内容
$ aws s3 ls s3://my-bucket/

# 删除S3存储桶中的文件
$ aws s3 rm s3://my-bucket/file.txt

# 删除S3存储桶
$ aws s3 rb s3://my-bucket –force

# 配置S3存储桶策略
$ cat bucket-policy.json
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Allow”,
“Principal”: {“AWS”: “arn:aws:iam::123456789012:user/user1”},
“Action”: “s3:*”,
“Resource”: “arn:aws:s3:::my-bucket/*”
}
]
}

$ aws s3api put-bucket-policy \
–bucket my-bucket \
–policy file://bucket-policy.json

# AWS VPC管理
# 创建VPC
$ aws ec2 create-vpc \
–cidr-block 10.0.0.0/16 \
–tag-specifications ‘ResourceType=vpc,Tags=[{Key=Name,Value=my-vpc}]’

# 创建子网
$ aws ec2 create-subnet \
–vpc-id vpc-12345678 \
–cidr-block 10.0.1.0/24 \
–availability-zone us-west-2a \
–tag-specifications ‘ResourceType=subnet,Tags=[{Key=Name,Value=public-subnet-1}]’

# 创建Internet网关
$ aws ec2 create-internet-gateway \
–tag-specifications ‘ResourceType=internet-gateway,Tags=[{Key=Name,Value=my-igw}]’

$ aws ec2 attach-internet-gateway \
–vpc-id vpc-12345678 \
–internet-gateway-id igw-12345678

# 创建路由表
$ aws ec2 create-route-table \
–vpc-id vpc-12345678 \
–tag-specifications ‘ResourceType=route-table,Tags=[{Key=Name,Value=public-route-table}]’

$ aws ec2 create-route \
–route-table-id rtb-12345678 \
–destination-cidr-block 0.0.0.0/0 \
–gateway-id igw-12345678

$ aws ec2 associate-route-table \
–route-table-id rtb-12345678 \
–subnet-id subnet-12345678

# 创建安全组
$ aws ec2 create-security-group \
–group-name web-sg \
–description “Web server security group” \
–vpc-id vpc-12345678

$ aws ec2 authorize-security-group-ingress \
–group-id sg-12345678 \
–protocol tcp \
–port 80 \
–cidr 0.0.0.0/0

$ aws ec2 authorize-security-group-ingress \
–group-id sg-12345678 \
–protocol tcp \
–port 22 \
–cidr 10.0.0.0/16

风哥风哥提示：IaaS服务管理是云服务管理的基础，需要从虚拟机、存储和网络等多个层面进行管理。

3. PaaS服务管理

3.1 容器服务管理

# AWS ECS管理
# 创建ECS集群
$ aws ecs create-cluster \
–cluster-name my-cluster

# 注册ECS任务定义
$ cat task-definition.json
{
“family”: “web-task”,
“containerDefinitions”: [
{
“name”: “web-container”,
“image”: “nginx:latest”,
“cpu”: 256,
“memory”: 512,
“portMappings”: [
{
“containerPort”: 80,
“hostPort”: 80
}
],
“essential”: true
}
]
}

$ aws ecs register-task-definition \
–cli-input-json file://task-definition.json

# 创建ECS服务
$ aws ecs create-service \
–cluster my-cluster \
–service-name web-service \
–task-definition web-task \
–desired-count 2 \
–launch-type FARGATE \
–network-configuration “awsvpcConfiguration={subnets=[subnet-12345678],securityGroups=[sg-12345678]}”

# 查看ECS服务
$ aws ecs describe-services \
–cluster my-cluster \
–services web-service

# 更新ECS服务
$ aws ecs update-service \
–cluster my-cluster \
–service web-service \
–desired-count 3

# 删除ECS服务
$ aws ecs delete-service \
–cluster my-cluster \
–service web-service \
–force

# AWS RDS管理
# 创建RDS实例
$ aws rds create-db-instance \
–db-instance-identifier mydb \
–allocated-storage 20 \
–db-instance-class db.t3.small \
–engine mysql \
–master-username admin \
–master-user-password password \
–vpc-security-group-ids sg-12345678 \
–availability-zone us-west-2a \
–backup-retention-period 7 \
–multi-az

# 查看RDS实例
$ aws rds describe-db-instances \
–db-instance-identifier mydb

# 修改RDS实例
$ aws rds modify-db-instance \
–db-instance-identifier mydb \
–allocated-storage 40 \
–apply-immediately

# 重启RDS实例
$ aws rds reboot-db-instance \
–db-instance-identifier mydb

# 删除RDS实例
$ aws rds delete-db-instance \
–db-instance-identifier mydb \
–skip-final-snapshot

# 创建RDS快照
$ aws rds create-db-snapshot \
–db-instance-identifier mydb \
–db-snapshot-identifier mydb-snapshot

# 从快照恢复RDS实例
$ aws rds restore-db-instance-from-db-snapshot \
–db-instance-identifier mydb-restored \
–db-snapshot-identifier mydb-snapshot

# AWS Elastic Beanstalk管理
# 创建Elastic Beanstalk应用
$ aws elasticbeanstalk create-application \
–application-name my-application \
–description “My Elastic Beanstalk application”

# 创建Elastic Beanstalk环境
$ aws elasticbeanstalk create-environment \
–application-name my-application \
–environment-name production \
–solution-stack-name “64bit Amazon Linux 2 v3.2.0 running Node.js 14”

# 部署应用
$ aws elasticbeanstalk create-application-version \
–application-name my-application \
–version-label v1 \
–source-bundle S3Bucket=my-bucket,S3Key=application.zip

$ aws elasticbeanstalk update-environment \
–application-name my-application \
–environment-name production \
–version-label v1

# 查看环境状态
$ aws elasticbeanstalk describe-environments \
–application-name my-application \
–environment-names production

# 终止环境
$ aws elasticbeanstalk terminate-environment \
–environment-name production

学习交流加群风哥微信: itpux-com

4. SaaS服务管理

4.1 SaaS应用管理

# Microsoft 365管理
# 连接到Microsoft Graph API
$ Connect-MgGraph -Scopes “User.Read.All”, “Group.Read.All”

# 查看用户
$ Get-MgUser -All

# 创建用户
$ New-MgUser -DisplayName “John Doe” -UserPrincipalName “john.doe@fgedu.net.cn” -PasswordProfile @{Password = “Password123!”} -AccountEnabled $true

# 查看组
$ Get-MgGroup -All

# 创建组
$ New-MgGroup -DisplayName “IT Team” -MailEnabled $false -SecurityEnabled $true -MailNickname “ITTeam”

# 添加用户到组
$ Add-MgGroupMember -GroupId “groupId” -DirectoryObjectId “userId”

# Google Workspace管理
# 安装Google Workspace PowerShell模块
$ Install-Module -Name GoogleWorkspace

# 连接到Google Workspace
$ Connect-GoogleWorkspace -ClientId “clientId” -ClientSecret “clientSecret” -RedirectUri “http://fgedudb:8080”

# 查看用户
$ Get-GWUser

# 创建用户
$ New-GWUser -PrimaryEmail “john.doe@fgedu.net.cn” -GivenName “John” -FamilyName “Doe” -Password “Password123!”

# 查看组织单位
$ Get-GWOrganizationUnit

# 创建组织单位
$ New-GWOrganizationUnit -Name “IT Department” -ParentOrgUnitPath “/”

# 移动用户到组织单位
$ Move-GWUser -UserKey “john.doe@fgedu.net.cn” -OrgUnitPath “/IT Department”

# Okta身份管理
# 安装Okta PowerShell模块
$ Install-Module -Name OktaPS

# 连接到Okta
$ Connect-Okta -Domain “your-domain.okta.com” -ApiToken “api-token”

# 查看用户
$ Get-OktaUser

# 创建用户
$ New-OktaUser -FirstName “John” -LastName “Doe” -Email “john.doe@fgedu.net.cn” -Password “Password123!”

# 查看应用
$ Get-OktaApplication

# 分配应用给用户
$ Assign-OktaApplication -AppId “appId” -UserId “userId”

# OneLogin身份管理
# 安装OneLogin PowerShell模块
$ Install-Module -Name OneLogin

# 连接到OneLogin
$ Connect-OneLogin -ClientId “clientId” -ClientSecret “clientSecret”

# 查看用户
$ Get-OneLoginUser

# 创建用户
$ New-OneLoginUser -Email “john.doe@fgedu.net.cn” -FirstName “John” -LastName “Doe” -Password “Password123!”

# 查看应用
$ Get-OneLoginApp

# 分配应用给用户
$ Add-OneLoginUserApp -UserId “userId” -AppId “appId”

学习交流加群风哥QQ113257174

5. 云服务安全管理

5.1 身份与访问管理

# AWS IAM管理
# 创建IAM用户
$ aws iam create-user \
–user-name john.doe

# 创建IAM组
$ aws iam create-group \
–group-name developers

# 将用户添加到组
$ aws iam add-user-to-group \
–user-name john.doe \
–group-name developers

# 创建IAM策略
$ cat policy.json
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Allow”,
“Action”: [“s3:*”],
“Resource”: “arn:aws:s3:::my-bucket/*”
}
]
}

$ aws iam create-policy \
–policy-name s3-access \
–policy-document file://policy.json

# 附加策略到组
$ aws iam attach-group-policy \
–group-name developers \
–policy-arn arn:aws:iam::123456789012:policy/s3-access

# 创建IAM角色
$ aws iam create-role \
–role-name ec2-role \
–assume-role-policy-document ‘{“Version”: “2012-10-17”, “Statement”: [{“Effect”: “Allow”, “Principal”: {“Service”: “ec2.amazonaws.com”}, “Action”: “sts:AssumeRole”}]}’

# 附加策略到角色
$ aws iam attach-role-policy \
–role-name ec2-role \
–policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess

# 创建实例配置文件
$ aws iam create-instance-profile \
–instance-profile-name ec2-instance-profile

$ aws iam add-role-to-instance-profile \
–instance-profile-name ec2-instance-profile \
–role-name ec2-role

# 创建安全组
$ aws ec2 create-security-group \
–group-name web-sg \
–description “Web server security group” \
–vpc-id vpc-12345678

# 配置安全组规则
$ aws ec2 authorize-security-group-ingress \
–group-id sg-12345678 \
–protocol tcp \
–port 80 \
–cidr 0.0.0.0/0

$ aws ec2 authorize-security-group-ingress \
–group-id sg-12345678 \
–protocol tcp \
–port 443 \
–cidr 0.0.0.0/0

$ aws ec2 authorize-security-group-ingress \
–group-id sg-12345678 \
–protocol tcp \
–port 22 \
–cidr 10.0.0.0/16

# 创建网络ACL
$ aws ec2 create-network-acl \
–vpc-id vpc-12345678 \
–tag-specifications ‘ResourceType=network-acl,Tags=[{Key=Name,Value=web-acl}]’

# 配置网络ACL规则
$ aws ec2 create-network-acl-entry \
–network-acl-id acl-12345678 \
–rule-number 100 \
–protocol tcp \
–rule-action allow \
–cidr-block 0.0.0.0/0 \
–port-range From=80,To=80

$ aws ec2 create-network-acl-entry \
–network-acl-id acl-12345678 \
–rule-number 101 \
–protocol tcp \
–rule-action allow \
–cidr-block 0.0.0.0/0 \
–port-range From=443,To=443

$ aws ec2 create-network-acl-entry \
–network-acl-id acl-12345678 \
–rule-number 102 \
–protocol tcp \
–rule-action allow \
–cidr-block 10.0.0.0/16 \
–port-range From=22,To=22

$ aws ec2 create-network-acl-entry \
–network-acl-id acl-12345678 \
–rule-number 1000 \
–protocol -1 \
–rule-action deny \
–cidr-block 0.0.0.0/0

# 关联网络ACL到子网
$ aws ec2 associate-network-acl \
–network-acl-id acl-12345678 \
–subnet-id subnet-12345678

# AWS KMS管理
# 创建KMS密钥
$ aws kms create-key \
–description “My encryption key”

# 创建密钥别名
$ aws kms create-alias \
–target-key-id key-id \
–alias-name alias/my-key

# 加密数据
$ aws kms encrypt \
–key-id alias/my-key \
–plaintext “Hello, World!” \
–output text \
–query CiphertextBlob

# 解密数据
$ aws kms decrypt \
–ciphertext-blob fileb://encrypted-data \
–output text \
–query Plaintext | base64 –decode

# 配置S3桶加密
$ aws s3api put-bucket-encryption \
–bucket my-bucket \
–server-side-encryption-configuration ‘{“Rules”:[{“ApplyServerSideEncryptionByDefault”:{“SSEAlgorithm”:”aws:kms”,”KMSMasterKeyID”:”key-id”}}]}’

# 配置EBS卷加密
$ aws ec2 create-volume \
–availability-zone us-west-2a \
–size 10 \
–volume-type gp2 \
–encrypted \
–kms-key-id key-id

更多学习教程公众号风哥教程itpux_com

6. 云服务成本管理

6.1 成本分析

# AWS Cost Explorer
# 查看成本和使用情况
$ aws ce get-cost-and-usage \
–time-period Start=2026-03-01,End=2026-03-31 \
–granularity MONTHLY \
–metrics BlendedCost \
–group-by Type=DIMENSION,Key=SERVICE

# 查看成本预测
$ aws ce get-cost-forecast \
–time-period Start=2026-04-01,End=2026-04-30 \
–granularity MONTHLY \
–metric BlendedCost \
–prediction-interval-level 90

# 创建成本预算
$ aws budgets create-budget \
–account-id 123456789012 \
–budget ‘{“BudgetName”:”MonthlyBudget”,”BudgetType”:”COST”,”TimeUnit”:”MONTHLY”,”BudgetLimit”:{“Amount”:1000,”Unit”:”USD”}}’ \
–notifications-with-subscribers ‘[{“Notification”:{“NotificationType”:”ACTUAL”,”ComparisonOperator”:”GREATER_THAN”,”Threshold”:80,”ThresholdType”:”PERCENTAGE”},”Subscribers”:[{“SubscriptionType”:”EMAIL”,”Address”:”user@fgedu.net.cn”}]}]’

# 查看预算
$ aws budgets describe-budgets –account-id 123456789012

# 配置成本分配标签
$ aws tag create-cost-allocation-tag \
–tag-key Environment \
–tag-value Production

# 标记资源
$ aws ec2 create-tags \
–resources i-12345678 \
–tags Key=Environment,Value=Production Key=Department,Value=Engineering

$ aws s3api put-bucket-tagging \
–bucket my-bucket \
–tagging TagSet=[{Key=Environment,Value=Production},{Key=Department,Value=Engineering}]

# 使用预留实例
$ aws ec2 purchase-reserved-instances-offering \
–instance-type t3.medium \
–availability-zone us-west-2a \
–term 1 \
–offering-type Standard \
–instance-count 1 \
–dry-run

# 使用Savings Plans
$ aws savingsplans create-savings-plan \
–savings-plan-offering-id spoffer-12345678 \
–commitment ‘{“Amount”: “10”, “Unit”: “USD”}’ \
–term 1 \
–purchase-time “2026-04-03T00:00:00Z”

# 清理未使用的资源
# 停止未使用的EC2实例
$ aws ec2 describe-instances \
–filters “Name=instance-state-name,Values=running” \
–query “Reservations[*].Instances[*].InstanceId” \
–output text | xargs -I {} aws ec2 stop-instances –instance-ids {}

# 删除未使用的EBS卷
$ aws ec2 describe-volumes \
–filters “Name=status,Values=available” \
–query “Volumes[*].VolumeId” \
–output text | xargs -I {} aws ec2 delete-volume –volume-id {}

# 删除未使用的快照
$ aws ec2 describe-snapshots \
–owner-ids self \
–query “Snapshots[*].SnapshotId” \
–output text | xargs -I {} aws ec2 delete-snapshot –snapshot-id {}

# 使用自动伸缩
$ aws autoscaling create-auto-scaling-group \
–auto-scaling-group-name my-asg \
–launch-configuration-name my-lc \
–min-size 1 \
–max-size 5 \
–desired-capacity 2 \
–vpc-zone-identifier subnet-12345678,subnet-87654321

author:www.itpux.com

7. 云服务监控

7.1 CloudWatch监控

# 创建CloudWatch仪表盘
$ aws cloudwatch put-dashboard \
–dashboard-name MyDashboard \
–dashboard-body ‘{“widgets”:[{“type”:”metric”,”x”:0,”y”:0,”width”:12,”height”:6,”properties”:{“metrics”:[[“AWS/EC2″,”CPUUtilization”,”InstanceId”,”i-12345678″]],”period”:300,”stat”:”Average”,”region”:”us-west-2″,”title”:”EC2 CPU Utilization”}},{“type”:”metric”,”x”:0,”y”:6,”width”:12,”height”:6,”properties”:{“metrics”:[[“AWS/S3″,”BucketSizeBytes”,”BucketName”,”my-bucket”,”StorageType”,”StandardStorage”]],”period”:86400,”stat”:”Average”,”region”:”us-west-2″,”title”:”S3 Bucket Size”}}]}’

# 创建CloudWatch告警
$ aws cloudwatch put-metric-alarm \
–alarm-name HighCPU \
–alarm-description “Alarm when CPU exceeds 70%” \
–metric-name CPUUtilization \
–namespace AWS/EC2 \
–statistic Average \
–period 300 \
–threshold 70 \
–comparison-operator GreaterThanThreshold \
–dimensions Name=InstanceId,Value=i-12345678 \
–evaluation-periods 2 \
–alarm-actions arn:aws:sns:us-west-2:123456789012:MyTopic

# 查看CloudWatch指标
$ aws cloudwatch get-metric-statistics \
–namespace AWS/EC2 \
–metric-name CPUUtilization \
–dimensions Name=InstanceId,Value=i-12345678 \
–start-time 2026-04-03T00:00:00Z \
–end-time 2026-04-03T12:00:00Z \
–period 3600 \
–statistics Average

# 配置CloudWatch日志
$ aws logs create-log-group –log-group-name my-log-group

$ aws logs create-log-stream \
–log-group-name my-log-group \
–log-stream-name my-log-stream

$ aws logs put-log-events \
–log-group-name my-log-group \
–log-stream-name my-log-stream \
–log-events ‘[{“timestamp”:1649090400000,”message”:”Error: Connection failed”},{“timestamp”:1649090401000,”message”:”Info: Service started”}]’ \
–sequence-token 1234567890

# 安装Datadog
$ curl -L “https://github.com/DataDog/dd-agent/releases/download/7.36.1/datadog-agent_7.36.1-1_amd64.deb” -o datadog-agent.deb
$ sudo dpkg -i datadog-agent.deb

# 配置Datadog
$ sudo vim /etc/datadog-agent/datadog.yaml
# 添加api_key: “your-api-key”

# 启动Datadog
$ sudo systemctl start datadog-agent
$ sudo systemctl enable datadog-agent

# 查看Datadog状态
$ sudo datadog-agent status

# 安装New Relic
$ curl -Ls https://download.newrelic.com/install/newrelic-cli/scripts/install.sh | bash && sudo NEW_RELIC_API_KEY=your-api-key /usr/local/bin/newrelic install

# 启动New Relic
$ sudo systemctl start newrelic-infra
$ sudo systemctl enable newrelic-infra

# 安装Prometheus和Grafana
$ docker-compose up -d

$ cat docker-compose.yml
version: ‘3’
services:
prometheus:
image: prom/prometheus:latest
volumes:
– ./prometheus.yml:/etc/prometheus/prometheus.yml
ports:
– “9090:9090”
grafana:
image: grafana/grafana:latest
ports:
– “3000:3000”
environment:
– GF_SECURITY_ADMIN_PASSWORD=admin

$ cat prometheus.yml
global:
scrape_interval: 15s

scrape_configs:
– job_name: ‘prometheus’
static_configs:
– targets: [‘fgedudb:9090’]
– job_name: ‘node’
static_configs:
– targets: [‘node-exporter:9100’]

# 创建Lambda函数
$ cat lambda-function.py
import boto3
import datetime

def lambda_handler(event, context):
ec2 = boto3.client(‘ec2’)
# 停止未使用的EC2实例
response = ec2.describe_instances(Filters=[
{‘Name’: ‘instance-state-name’, ‘Values’: [‘running’]}
])
for reservation in response[‘Reservations’]:
for instance in reservation[‘Instances’]:
instance_id = instance[‘InstanceId’]
# 检查实例是否有标签表明需要一直运行
tags = {tag[‘Key’]: tag[‘Value’] for tag in instance.get(‘Tags’, [])}
if tags.get(‘AlwaysOn’) != ‘true’:
# 停止实例
ec2.stop_instances(InstanceIds=[instance_id])
print(f’Stopped instance: {instance_id}’)
return {
‘statusCode’: 200,
‘body’: ‘Successfully stopped unused instances’
}

# 创建Lambda函数
$ aws lambda create-function \
–function-name stop-unused-instances \
–runtime python3.8 \
–role arn:aws:iam::123456789012:role/lambda-role \
–handler lambda-function.lambda_handler \
–zip-file fileb://lambda-function.zip

# 创建CloudWatch Events规则
$ aws events put-rule \
–name stop-unused-instances \
–schedule-expression “cron(0 18 * * ? *)” \
–state ENABLED

# 为规则添加目标
$ aws events put-targets \
–rule stop-unused-instances \
–targets “[{\”Id\”:\”1\”,\”Arn\”:\”arn:aws:lambda:us-west-2:123456789012:function:stop-unused-instances\”}]”

# 授予Lambda权限
$ aws lambda add-permission \
–function-name stop-unused-instances \
–statement-id events-rule \
–action “lambda:InvokeFunction” \
–principal events.amazonaws.com \
–source-arn arn:aws:events:us-west-2:123456789012:rule/stop-unused-instances

# 创建自动化文档
$ cat automation-doc.yaml
—
description: “Automatically update EC2 instances”
schemaVersion: “0.3”
assumeRole: “{{ AutomationAssumeRole }}”
parameters:
AutomationAssumeRole:
type: String
description: “(Required) The ARN of the role that allows Automation to perform the actions on your behalf.”
default: “”
InstanceIds:
type: StringList
description: “(Required) The IDs of the instances to update.”
default: []

mainSteps:
– name: updateInstances
action: “aws:runCommand”
inputs:
DocumentName: “AWS-RunPatchBaseline”
InstanceIds: “{{ InstanceIds }}”
Parameters:
Operation: “Scan”

# 创建自动化文档
$ aws ssm create-document \
–name UpdateEC2Instances \
–content file://automation-doc.yaml \
–document-type Automation

# 执行自动化
$ aws ssm start-automation-execution \
–document-name UpdateEC2Instances \
–parameters “AutomationAssumeRole=arn:aws:iam::123456789012:role/ssm-automation-role,InstanceIds=i-12345678”

# 查看自动化执行状态
$ aws ssm describe-automation-executions \
–filter Key=ExecutionId,Values=12345678-1234-1234-1234-123456789012

# 使用CloudFormation
$ cat cloudformation-template.yaml
AWSTemplateFormatVersion: ‘2010-09-09’
Resources:
MyVPC:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.0.0.0/16
Tags:
– Key: Name
Value: my-vpc
MySubnet:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref MyVPC
CidrBlock: 10.0.1.0/24
AvailabilityZone: us-west-2a
Tags:
– Key: Name
Value: public-subnet-1
MyInternetGateway:
Type: AWS::EC2::InternetGateway
Properties:
Tags:
– Key: Name
Value: my-igw
MyVPCGatewayAttachment:
Type: AWS::EC2::VPCGatewayAttachment
Properties:
VpcId: !Ref MyVPC
InternetGatewayId: !Ref MyInternetGateway
MyRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref MyVPC
Tags:
– Key: Name
Value: public-route-table
MyRoute:
Type: AWS::EC2::Route
Properties:
RouteTableId: !Ref MyRouteTable
DestinationCidrBlock: 0.0.0.0/0
GatewayId: !Ref MyInternetGateway
MySubnetRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref MySubnet
RouteTableId: !Ref MyRouteTable
MySecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Web server security group
VpcId: !Ref MyVPC
SecurityGroupIngress:
– IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0
– IpProtocol: tcp
FromPort: 22
ToPort: 22
CidrIp: 10.0.0.0/16
Tags:
– Key: Name
Value: web-sg

# 创建CloudFormation堆栈
$ aws cloudformation create-stack \
–stack-name my-stack \
–template-body file://cloudformation-template.yaml

# 查看CloudFormation堆栈状态
$ aws cloudformation describe-stacks \
–stack-name my-stack

# 删除CloudFormation堆栈
$ aws cloudformation delete-stack \
–stack-name my-stack

# 创建AWS Organizations组织
$ aws organizations create-organization

# 创建组织单位
$ aws organizations create-organizational-unit \
–parent-id root-123 \
–name Production

# 将账户添加到组织单位
$ aws organizations move-account \
–account-id 123456789012 \
–source-parent-id root-123 \
–destination-parent-id ou-123-456789

# 创建服务控制策略
$ cat scp.json
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Deny”,
“Action”: “ec2:RunInstances”,
“Resource”: “arn:aws:ec2:*:*:instance/*”,
“Condition”: {
“StringNotEquals”: {
“ec2:InstanceType”: [“t3.small”, “t3.medium”, “t3.large”]
}
}
}
]
}

$ aws organizations create-policy \
–content file://scp.json \
–description “Restrict EC2 instance types” \
–name RestrictEC2InstanceTypes \
–type SERVICE_CONTROL_POLICY

# 附加服务控制策略到组织单位
$ aws organizations attach-policy \
–policy-id p-12345678 \
–target-id ou-123-456789