EC2, S3 & VPC as DS/AI Infrastructure

Goal: launch a Linux server, connect to it, install a Python/ML environment, and run a real training script — proving EC2 is just "a computer you rent by the hour," sized to the job.

1. 1Launch the instance

   EC2 Console → Launch Instance → Amazon Linux 2023 AMI → instance type t3.micro. Create a new key pair and download the .pem file — you cannot re-download it later.

2. 2Configure the security group

   Allow inbound SSH (port 22) from "My IP" only — never "Anywhere" (0.0.0.0/0). Teaching moment: this is the first networking decision students make — it sets up Module 3.

3. 3Connect

   Use EC2 Instance Connect (browser-based, no SSH client setup needed) — click "Connect" in the console. This is the easiest path for a classroom of laptops on different operating systems.

4. 4Set up the DS/AI environment

   Install Python, pip, and the core DS stack:

   sudo dnf install -y python3-pip pip3 install --user jupyter scikit-learn pandas numpy
5. 5Run a real training script

   Create train.py and run a small, fast model — proving the instance can actually do DS/AI work, not just host a webpage:

   # train.py from sklearn.datasets import load_iris from sklearn.tree import DecisionTreeClassifier from sklearn.model_selection import train_test_split X, y = load_iris(return_X_y=True) X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.2) clf = DecisionTreeClassifier().fit(X_train, y_train) print("Accuracy:", clf.score(X_test, y_test))
   python3 train.py
6. 6Discuss: sizing compute to the job

   t3.micro was enough for this. Real deep learning uses GPU instances (e.g., the g4dn or p-series families) — don't launch one in class, just show the pricing page so students see the cost jump from cents/hour to dollars/hour, and understand why instance selection is itself an infrastructure decision.

Goal: create a bucket, move a dataset between S3 and EC2, and understand why object storage — not a local hard drive — is how real DS/AI teams manage data at scale.

1. 1Create a bucket

   S3 Console → Create bucket → globally unique name (e.g., yourname-dsai-masterclass) → same Region as your EC2 instance, to avoid cross-region transfer costs and latency.

2. 2Upload a dataset

   Drag-and-drop any CSV (or use a public sample dataset) into the bucket via the console. This is the "data lake" pattern — raw data lives in S3, not on any one machine.

3. 3Attach an IAM role to EC2 — not access keys

   EC2 Console → your instance → Actions → Security → Modify IAM role → attach a role with AmazonS3ReadOnlyAccess. Teaching moment: hardcoded access keys on a server are a classic security mistake — IAM roles are the correct pattern.

4. 4Pull the dataset onto EC2

   Back on the EC2 instance (AWS CLI is pre-installed on Amazon Linux):

   aws s3 cp s3://yourname-dsai-masterclass/dataset.csv . python3 -c "import pandas as pd; print(pd.read_csv('dataset.csv').head())"
5. 5Push results back to S3

   Save your model's output and upload it — completing the round trip that defines a real DS/AI workflow:

   aws s3 cp results.csv s3://yourname-dsai-masterclass/outputs/
6. 6Discuss: storage classes & cost

   S3 Standard vs. Intelligent-Tiering vs. Glacier — for a real ML data lake with terabytes of training data, storage class choice can be the difference between a reasonable and an unreasonable monthly bill.

Goal: understand why real DS/AI infrastructure — often handling sensitive data — isn't dropped into the internet-facing default network, and build a properly isolated environment.

1. 1Default VPC vs. custom VPC

   Every AWS account has a default VPC that's fully internet-connected. That's fine for a 5-minute demo — it is not how DS/AI infrastructure handling real (especially sensitive) data should be run in production.

2. 2Create a custom VPC

   VPC Console → Create VPC → "VPC and more" wizard → CIDR 10.0.0.0/16 → 1 public subnet, 1 private subnet, 1 Availability Zone (fine for a classroom exercise).

3. 3Understand the public/private split

   The public subnet (with a route to an Internet Gateway) is where an EC2 instance needing internet access lives. The private subnet (no direct internet route) is where sensitive data-processing instances belong — reachable only from inside the VPC.

4. 4Harden the security group from Module 1

   Revisit the security group created earlier. Confirm SSH is still locked to "My IP" only, and — if Jupyter was ever opened on port 8888 to "Anywhere" — close that immediately. Teaching moment: this closes the loop on the risky shortcut some students may have taken in Module 1.

5. 5VPC Gateway Endpoint for S3 (concept + demo)

   Show — don't require hands-on due to time — how a Gateway Endpoint lets a private-subnet EC2 instance reach S3 without ever touching the public internet. This is the real pattern used for sensitive DS/AI data pipelines in industry.