❯ cat << 'EOF' > trust-policy.json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "lambda.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
EOF

❯ aws iam create-role \
    --role-name exrecord-lambda-role \
    --assume-role-policy-document file://trust-policy.json
{
    "Role": {
        "Path": "/",
        "RoleName": "exrecord-lambda-role",
        "RoleId": "AROA0a1b2c3d4e5f67890",
        "Arn": "arn:aws:iam::123456789012:role/exrecord-lambda-role",
        "CreateDate": "2026-04-18T04:00:35+00:00",
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "lambda.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                }
            ]
        }
    }
}

❯ aws iam attach-role-policy \
    --role-name exrecord-lambda-role \
    --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

❯ cat << 'EOF' > lambda_function.py
def lambda_handler(event, context):
    print("Hello from Lambda!")
    return {
        "statusCode": 200,
        "body": "Hello, World!"
    }
EOF

❯ zip function.zip lambda_function.py
  adding: lambda_function.py (deflated 21%)

❯ aws lambda create-function \
    --function-name exrecord-hello \
    --runtime python3.12 \
    --role arn:aws:iam::123456789012:role/exrecord-lambda-role \
    --handler lambda_function.lambda_handler \
    --zip-file fileb://function.zip

❯ aws lambda invoke \
    --function-name exrecord-hello \
    --payload '{}' \
    response.json
{
    "StatusCode": 200,
    "ExecutedVersion": "$LATEST"
}

❯ cat response.json
{"statusCode": 200, "body": "Hello, World!"}

❯ aws lambda delete-function \
    --function-name exrecord-hello
{
    "StatusCode": 204
}

❯ aws iam detach-role-policy \
    --role-name exrecord-lambda-role \
    --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

❯ aws iam delete-role \
    --role-name exrecord-lambda-role

❯ aws rds create-db-subnet-group \
    --db-subnet-group-name exrecord-rds-subnet-group \
    --db-subnet-group-description "Subnet group for exrecord RDS" \
    --subnet-ids subnet-0a1b2c3d4e5f67890 subnet-0a1b2c3d4e5f67891
{
    "DBSubnetGroup": {
        "DBSubnetGroupName": "exrecord-rds-subnet-group",
        "DBSubnetGroupDescription": "Subnet group for exrecord RDS",
        "VpcId": "vpc-0a1b2c3d4e5f67890",
        "SubnetGroupStatus": "Complete",
        "Subnets": [
            {
                "SubnetIdentifier": "subnet-0a1b2c3d4e5f67891",
                "SubnetAvailabilityZone": {
                    "Name": "ap-northeast-1c"
                },
                "SubnetOutpost": {},
                "SubnetStatus": "Active"
            },
            {
                "SubnetIdentifier": "subnet-0a1b2c3d4e5f67890",
                "SubnetAvailabilityZone": {
                    "Name": "ap-northeast-1a"
                },
                "SubnetOutpost": {},
                "SubnetStatus": "Active"
            }
        ],
        "DBSubnetGroupArn": "arn:aws:rds:ap-northeast-1:123456789012:subgrp:exrecord-rds-subnet-group",
        "SupportedNetworkTypes": [
            "IPV4"
        ]
    }
}

❯ aws ec2 create-security-group \
    --group-name exrecord-rds-sg \
    --description "Security group for exrecord RDS" \
    --vpc-id vpc-0a1b2c3d4e5f67890
{
    "GroupId": "sg-0a1b2c3d4e5f67890",
    "SecurityGroupArn": "arn:aws:ec2:ap-northeast-1:123456789012:security-group/sg-0a1b2c3d4e5f67890"
}

❯ aws ec2 authorize-security-group-ingress \
    --group-id sg-0a1b2c3d4e5f67890 \
    --protocol tcp \
    --port 3306 \
    --cidr 172.31.0.0/16
{
    "Return": true,
    "SecurityGroupRules": [
        {
            "SecurityGroupRuleId": "sgr-0a1b2c3d4e5f67890",
            "GroupId": "sg-0a1b2c3d4e5f67890",
            "GroupOwnerId": "123456789012",
            "IsEgress": false,
            "IpProtocol": "tcp",
            "FromPort": 3306,
            "ToPort": 3306,
            "CidrIpv4": "172.31.0.0/16",
            "SecurityGroupRuleArn": "arn:aws:ec2:ap-northeast-1:123456789012:security-group-rule/sgr-0a1b2c3d4e5f67890"
        }
    ]
}

❯ aws rds create-db-instance \
    --db-instance-identifier exrecord-mysql \
    --db-instance-class db.t3.micro \
    --engine mysql \
    --engine-version 8.0 \
    --master-username admin \
    --master-user-password MyPassword123! \
    --allocated-storage 20 \
    --db-subnet-group-name exrecord-rds-subnet-group \
    --vpc-security-group-ids sg-0a1b2c3d4e5f67890 \
    --no-publicly-accessible \
    --backup-retention-period 7

❯ aws rds describe-db-instances \
    --db-instance-identifier exrecord-mysql \
    --query "DBInstances[0].DBInstanceStatus"
"available"

❯ aws rds describe-db-instances \
    --db-instance-identifier exrecord-mysql \
    --query "DBInstances[0].Endpoint"
{
    "Address": "exrecord-mysql.c0a1b2c3d4e5.ap-northeast-1.rds.amazonaws.com",
    "Port": 3306,
    "HostedZoneId": "Z24O6O9L7SGTNB"
}

[ec2-user@ip-172-31-x-x ~]$ mysql -h exrecord-mysql.c0a1b2c3d4e5.ap-northeast-1.rds.amazonaws.com \
    -u admin \
    -p
Enter password:
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MySQL connection id is 39
Server version: 8.0.45 Source distribution

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]>

❯ aws rds delete-db-instance \
    --db-instance-identifier exrecord-mysql \
    --skip-final-snapshot

❯ cat > trust-policy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

❯ aws iam create-role \
    --role-name exrecord-s3-readonly-role \
    --assume-role-policy-document file://trust-policy.json
{
    "Role": {
        "Path": "/",
        "RoleName": "exrecord-s3-readonly-role",
        "RoleId": "AROA0a1b2c3d4e5f67890",
        "Arn": "arn:aws:iam::123456789012:role/exrecord-s3-readonly-role",
        "CreateDate": "2026-04-15T09:47:12+00:00",
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "AWS": "arn:aws:iam::123456789012:root"
                    },
                    "Action": "sts:AssumeRole"
                }
            ]
        }
    }
}

❯ aws iam attach-role-policy \
    --role-name exrecord-s3-readonly-role \
    --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

❯ aws sts assume-role \
    --role-arn arn:aws:iam::123456789012:role/exrecord-s3-readonly-role \
    --role-session-name test-session
{
    "Credentials": {
        "AccessKeyId": "ASIA0a1b2c3d4e5f67890",
        "SecretAccessKey": "0a1b2c3d4e5f67890",
        "SessionToken": "AQoDYXdzEJr...",
        "Expiration": "2026-04-15T10:48:56+00:00"
    },
    "AssumedRoleUser": {
        "AssumedRoleId": "AROA0a1b2c3d4e5f67890:test-session",
        "Arn": "arn:aws:sts::123456789012:assumed-role/exrecord-s3-readonly-role/test-session"
    }
}

❯ export AWS_ACCESS_KEY_ID=ASIA0a1b2c3d4e5f67890
❯ export AWS_SECRET_ACCESS_KEY=0a1b2c3d4e5f67890
❯ export AWS_SESSION_TOKEN=AQoDYXdzEJr...

❯ aws s3 ls
2026-04-15 18:57:05 exrecord-test-bucket

❯ aws s3 cp test.txt s3://exrecord-test-bucket
upload failed: ./test.txt to s3://exrecord-test-bucket/test.txt An error occurred (AccessDenied) when calling the PutObject operation: User: arn:aws:sts::123456789012:assumed-role/exrecord-s3-readonly-role/test-session is not authorized to perform: s3:PutObject on resource: "arn:aws:s3:::exrecord-test-bucket/test.txt" because no identity-based policy allows the s3:PutObject action

❯ aws ec2 describe-instances

aws: [ERROR]: An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation. User: arn:aws:sts::123456789012:assumed-role/exrecord-s3-readonly-role/test-session is not authorized to perform: ec2:DescribeInstances because no identity-based policy allows the ec2:DescribeInstances action

❯ aws sso login --profile my-profile

❯ aws ec2 create-key-pair --key-name exrecord-key --query 'KeyMaterial' --output text > ~/.ssh/exrecord-key.pem
❯ chmod 400 ~/.ssh/exrecord-key.pem

❯ aws ec2 describe-key-pairs --key-name exrecord-key
{
    "KeyPairs": [
        {
            "KeyPairId": "key-123456789012",
            "KeyType": "rsa",
            "Tags": [],
            "CreateTime": "2026-04-13T10:14:14.561000+00:00",
            "KeyName": "exrecord-key",
            "KeyFingerprint": "ae:13:16:b7:01:71:11:4f:78:60:0e:75:aa:87:af:25:b1:1a:36:3b"
        }
    ]
}

❯ aws ec2 create-security-group --group-name exrecord-sg --description "exrecord security group"
{
    "GroupId": "sg-0a1b2c3d4e5f67890",
    "SecurityGroupArn": "arn:aws:ec2:ap-northeast-1:123456789012:security-group/sg-0a1b2c3d4e5f67890"
}

❯ aws ec2 authorize-security-group-ingress \
    --group-id sg-0a1b2c3d4e5f67890 \
    --protocol tcp \
    --port 22 \
    --cidr 203.0.113.1/32
{
    "Return": true,
    "SecurityGroupRules": [
        {
            "SecurityGroupRuleId": "sgr-0a1b2c3d4e5f67890",
            "GroupId": "sg-0a1b2c3d4e5f67890",
            "GroupOwnerId": "123456789012",
            "IsEgress": false,
            "IpProtocol": "tcp",
            "FromPort": 22,
            "ToPort": 22,
            "CidrIpv4": "203.0.113.1/32",
            "SecurityGroupRuleArn": "arn:aws:ec2:ap-northeast-1:123456789012:security-group-rule/sgr-0a1b2c3d4e5f67890"
        }
    ]
}

❯ aws ec2 describe-images \
    --owners amazon \
    --filters "Name=name,Values=al2023-ami-2023*" "Name=architecture,Values=arm64" \
    --query 'sort_by(Images, &CreationDate)[-1].ImageId' \
    --output text
ami-0ceb31eb57b9abaa8

❯ aws ec2 run-instances \
    --image-id ami-0ceb31eb57b9abaa8 \
    --instance-type t4g.micro \
    --key-name exrecord-key \
    --security-group-ids sg-0a1b2c3d4e5f67890 \
    --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=exrecord-instance}]' \
    --query 'Instances[0].InstanceId' \
    --output text
i-0a1b2c3d4e5f67890

❯ aws ec2 wait instance-running --instance-ids i-0a1b2c3d4e5f67890
❯ aws ec2 describe-instances \
    --instance-ids i-0a1b2c3d4e5f67890 \
    --query 'Reservations[0].Instances[0].{State:State.Name,PublicIP:PublicIpAddress}' \
    --output table
------------------------------
|      DescribeInstances     |
+----------------+-----------+
|    PublicIP    |   State   |
+----------------+-----------+
|  203.0.113.2 |  running  |
+----------------+-----------+

❯ ssh -i ~/.ssh/exrecord-key.pem ec2-user@203.0.113.2
   ,     #_
   ~\_  ####_        Amazon Linux 2023
  ~~  \_#####\
  ~~     \###|
  ~~       \#/ ___   https://aws.amazon.com/linux/amazon-linux-2023
   ~~       V~' '->
    ~~~         /
      ~~._.   _/
         _/ _/
       _/m/'
Last login: Mon Apr 13 15:53:13 2026 from 203.0.113.1
[ec2-user@ip-172-31-xx-xx ~]$

❯ aws ec2 terminate-instances --instance-ids i-0a1b2c3d4e5f67890
{
    "TerminatingInstances": [
        {
            "InstanceId": "i-0a1b2c3d4e5f67890",
            "CurrentState": {
                "Code": 32,
                "Name": "shutting-down"
            },
            "PreviousState": {
                "Code": 16,
                "Name": "running"
            }
        }
    ]
}

❯ aws s3 mb s3://exrecord-test-bucket
make_bucket: exrecord-test-bucket

❯ aws s3 ls
2026-04-12 05:07:26 exrecord-test-bucket

❯ aws s3api get-public-access-block --bucket exrecord-test-bucket
{
    "PublicAccessBlockConfiguration": {
        "BlockPublicAcls": true,
        "IgnorePublicAcls": true,
        "BlockPublicPolicy": true,
        "RestrictPublicBuckets": true
    }
}

❯ aws s3 cp test.txt s3://exrecord-test-bucket
upload: ./test.txt to s3://exrecord-test-bucket/test.txt

❯ aws s3 ls s3://exrecord-test-bucket
2026-04-12 05:10:22          0 test.txt

❯ aws s3 cp s3://exrecord-test-bucket/test.txt .
download: s3://exrecord-test-bucket/test.txt to ./test.txt