Task 1: Static Website Hosting Using S3 + IAM

** Steps Performed **

Created S3 Buckets

** cloudlaunch-site-bucket-1

** Enabled static website hosting.

** Configured public read-only access for the website content using a policy named '-s3-site-bucket-policy.json'

** Uploaded a basic HTML/CSS/JS page.

cloudlaunch-private-bucket

** Private bucket, no public access this will store internal documents.

cloudlaunch-visible-only-bucket

** Private bucket, no public access to contents.

** IAM user can only list this bucket.

Configured Bucket Policies

** Allowed anonymous read-only access for cloudlaunch-site-bucket-1.

** Denied all public access for other buckets.

## Created IAM User

** Username: cloudlaunch-user

** Attached custom policy with: --ListBucket on all three buckets. --GetObject + PutObject only on cloudlaunch-private-bucket-2. --GetObject on cloudlaunch-site-bucket-1.

--No delete permissions.

--No access to cloudlaunch-visible-only-bucket contents.

Enabled Programmatic Access (Access Keys).

--Enforced change password on first login.

Attached JSON Policy

View policy file: ~/cloudlaunch/policies/cloudlaunch-user.json, ~/cloudlaunch/policies/AmazonVPCReadOnly.json, ~/cloudlaunch/policies/s3-site-bucket-policy.json, ~/cloudlaunch/policies/IAMUserChangePassword.json

S3 Static Site URL: (https://cloudlaunch-site-bucket-1.s3.eu-west-1.amazonaws.com/index.html)

Task 2: VPC Design

** VPC Details **

--Name: cloudlaunch-vpc

--CIDR: 10.0.0.0/16

Subnets

--Public Subnet: 10.0.1.0/24

--Intended for load balancers or public-facing services.

Application Subnet: 10.0.2.0/24

--Private subnet for app servers.

Database Subnet: 10.0.3.0/28

--Private subnet for database services.

Internet Gateway

--Created cloudlaunch-igw.

--Attached to cloudlaunch-vpc.

Route Tables

Public Route Table: cloudlaunch-public-rt

--Associated with public subnet.

--Added route to 0.0.0.0/0 via Internet Gateway.

Private Route Tables:

--cloudlaunch-app-rt (for app subnet).

--cloudlaunch-db-rt (for DB subnet).

--No internet routes, fully private.

Security Groups

created the following security groups and allowed the following inbound rules

cloudlaunch-app-sg:

--Allows HTTP (port 80) access within the VPC only.

cloudlaunch-db-sg:

--Allows MySQL (port 3306) access from the app subnet only.

IAM Permissions for VPC

employed the AmazonVPCReadOnly.json policy to ensure cloudlaunch-user has read-only access to: --VPC, --Subnets, --Route tables, --Security groups