Getting Started

0:00Well, hello and welcome. I'm Scott Pletcher and this is the AWS Certified Generative AI Developer Professional course. Wow, normally this is the part of the course where some talking head like me would regale you with their decades of experience in whatever topic is being taught. The reality is this stuff is pretty brand spanking new and that's certainly the case with many of the AWS Generative AI services. What I do have to offer is that somehow I've been able to amass enough knowledge, experience, and abilities to clear all the AI and AI adjacent AWS certifications and I wanted to help you do the same. I say somehow because there was a time when I was convinced that all this AI stuff just was too far out of my reach. About 10 years ago when I started my AI learning journey, I, like most people, sought out an online course. I picked one from a well-respected AI expert and settled in. Well, a few moments into that course, the instructor said something like, and it's easy to see how this works and then proceeds to scroll out a screen full of complex calculus equations with lots of lines and brackets and Greek symbols.

1:13Well, me not being a math person, it was certainly not easy to see how that worked and I just resigned myself to the fact that maybe I wasn't cut out for learning this stuff. Well, some time went by and I decided to give it another go. I took a different approach. Well, things started to click. I built a convolutional neural network in Excel to understand how image recognition worked. I created a potentially sadistic reinforcement learning environment where agents fought in cage matches. I trained a chat bot to be an expert on Nicolas Cage movies.

1:48The reason I share all this is to let you know that there are many learning paths and if one path doesn't fit, keep looking until you find one that does. What I hope to offer is a path that's approachable, effective, definitely not boring. So, if this sounds interesting, what are you waiting for? Let's go.

0:00So where I wanted to start is just an overview of the certification landscape, specifically that stuff around the AI space or AI adjacent space. And I wanted to lay out some expectations just so we know that you're coming into this course with a certain level of knowledge on AWS. So here we have the generative AI developer professional certification. It is a top level certification, meaning that generally people are going to go the foundational, then the associate, then the professional. And that is a flow I would definitely recommend. The AI practitioner is kind of more for non-technical people, maybe business people, project managers, stuff like that. But that's still going to help you out. Now, where you're really going to get the bulk of knowledge that you're going to need to know for the generative AI developer is in this space right here. And data engineer, well, we all know that machine learning thrives on data. So you need to know the tools and techniques that AWS has to put that data into a shape that we can use for generative AI purposes. Now, likewise, machine learning engineer here really goes in depth of supporting workloads and deploying workloads, machine learning workloads on the AWS infrastructure,

1:17and it dives heavily into SageMaker. Now you're not going to need to know a whole lot of SageMaker, but there are probably this little Venn diagram here. I would say that there's probably about 30% of the data engineer that is going to map well over here to the generative AI developer. And I would say the same over here, about 30% of this is going to map over. So if you have one or both of these certifications, or you've taken those courses, you are sitting in a very good position going into the generative AI developer. If you don't happen to have any of these particular certifications, then that's still okay. You can probably manage, but it's probably going to be much more work for you because I'm not going to step through the basics of AWS, setting up some of the general things that most AWS people would know if they've been using the platform for any amount of time.

2:11And of course, the next logical question is, well, how long is that amount of time? Well, AWS has in the certified generative AI developer blueprint, some rough guidelines. They say two years using AWS and machine learning, and one year with generative AI solutions. Take this with a grain of salt because I can be working in AWS for two years. Maybe all I do is upload a file to S3. That's the extent of my AWS experience. Well, that is not going to give you the basis that you need to come into that exam, nor to come into this course. Now, similarly, if you have done a lot of stuff, if you've basically been embedded in SageMaker and Bedrock and all these other generative AI services that AWS has for two years, then you're probably in a pretty good position. So it's very relative. What I like to do to help people kind of self-evaluate is just pose a sentence. Let's take this scenario right here. Hey, can you go set up a SageMaker domain with Canvas and SageMaker Studio? We're going to need to sync some Parquet data in an S3 bucket to the EFS share that that SageMaker domain uses. And we want to use DataSync to do that. So if this is completely nonsense,

3:27you don't understand anything that's going on here, then you're probably not ready to walk into this course. If on the other hand, you're already thinking about how you're going to do exactly this thing, then you're probably in a pretty good position. So this is the level of knowledge that I'm going to expect for folks stepping into this course. So we're not going to spend a whole lot of time on the basics. Those are things you should have developed when you were going through maybe this curriculum or this curriculum. And certainly down here in Cloud Practitioner, I think the different modes of S3 are covered in Cloud Practitioner. So we are not going to belabor any points with regard to some of those services. What is in the blueprint or what is expected of us before we go to sit this exam? Well, first and foremost, we should know how to analyze business objectives and make sure we're aligning them to proper AI approaches. And that's sometimes more difficult than it sounds because there are a bunch of different AI approaches.

4:31And you also have to know the limitations of those approaches. In other words, in certain situations, a particular algorithm may work well. In other situations, it may be totally inappropriate. For example, the difference between a regression problem versus a binary classifier. Those are two different types of problems. Now, I'm going to expect that you know at least a little bit about the different problem types that we would want to approach with AI. And that's going to help us get started in this business objective and alignment bullet point here. Next, we're going to have to know some stuff about vector stores, rags, knowledge bases, and model data prep. In other words, how do we get some raw data into a form that we can feed into a generative AI process and maybe create a customized or a specifically tailored model for our use? And we are going to cover these things in this course. We're also going to cover prompt engineering and we're going to build some agents and we're going to build these agents to do our bidding. Well, actually, we're just going to build agents to do stuff because agentic AI is one of the big focuses of AWS. And the idea being that

5:48they want to create a whole ecosystem and a whole toolkit that will allow us to agentify, I guess is the right term. Maybe it's the wrong term, but we can agentify these AI tools and then have them do work for us. Now, it's not enough just to build a gen AI model and throw it out there because most often there's some tuning or performance improvements because if our gen AI model is costing a thousand bucks a month to run and our competitor has the same model is doing in essence the same thing for a hundred bucks a month, well, that's putting us at a disadvantage. So we're going to need to know how to tune those things, make them more accurate, make them more performant and also reduce the cost as well. Now, a very important focus of most organizations that are dabbling in the AI space is to be sure that they do their AI development in a safe and ethical manner. So we are going to explore guardrails and some of the safety concerns and AWS has a set of tools that will help us do this. And then we also need to be able to test our models to see if they're behaving the way we think they need to behave. And that's one of the things with especially like large language models, oftentimes, or at least in the beginning, they were very much

7:07black box things. So we would put an input in and stuff would happen. And in some cases, we weren't exactly sure how that stuff was happening and then it would spit out some results. And we didn't really know how that happened. Well, in the past few years, this has really been a point of focus for some of the AI vendors and they have developed quite a bit of tools around this area to help us with explainability and bias detection and drift and that sort of thing. And we are going to explore all that stuff as well. So what is out? It's just as important to know what is out of scope versus what is in because we don't want to waste our time focusing on stuff that is not part of that exam.

7:48But that said, you can't really ignore it because some of it is just part of doing business on AWS. So first up, software development. Software development is a whole separate discipline, and we are not going to dive into that. There's really not going to be very much in the way of programming and where there is programming. I'm going to provide you the code that you can pretty much just copy and paste. But about the only thing that is still in scope is the software development lifecycle and some of the flows there. So for example, if we were developing an AI model and we check in some code to our repository, well, then we can trigger a build process, a test process, and then a deploy process. And that sort of CI-CD workflow is definitely in scope for the generative AI exam. And for the most part, network design is out of scope. I mean, we have some things that we're going to talk about that's about network isolation and being able to protect our workloads. We do have some VPCs set up that we're going to have to do, and we also have some endpoints that we are going to cover as well. And these are kind of in the networking realm. Now, general compute with EC2 is pretty much out of scope, but serverless and

9:04containers are very much in scope. Not necessarily using them specifically, but these are very useful things when we're talking about AI workloads on AWS. For example, containers are really the backbone of how SageMaker works. So we are going to need to know some about how we can deploy containers. And especially when we get into MCPs, we are going to need to know about Lambda, and that brings us into the serverless world. For the most part, analytics are out of scope, so we're not going to have to analyze data for certain patterns and stuff like that. We're probably not going to use QuickSight or anything like that, but I would encourage you to, if you have not used QuickSight or you don't know about it, then do explore it a little bit because it could come up in some exam questions. And also out of scope is some really deep security and IAM stuff. That's not part, really part of this certification. I mean, yes, we do have some stuff where we're going to need to protect our resources from other people getting access to them, but that's not really deep IAM stuff. And my favorite part of the blueprint, AWS says right up front that they reserve the right

10:20to change their mind. So this list is non-exhaustive, and it is subject to change. One of the questions I get all the time is, hey, this new service just came out last week, is it going to be on the exam? Well, AWS has an internal rule that they say that a service has to be GA for six months. And that just means generally available for six months. So anything in preview or beta or something like that is not eligible to be a scored question on the exam. You may get questions on your exam for services that were introduced last week, for example, and that's generally a question that they are testing. They're just beta testing that question to see if it's too hard or awkwardly worded or something like that. And chances are it is not going to affect your score. So as a matter of fact, let's look at what the exam entails. We have some multiple choice, multiple response, ordering, matching, those types of things. This is all standard AWS exam fare. And if you have not taken an AWS exam before, I would really encourage you to take some other exam other than the generative AI developer as your very first exam. And that goes for any professional level exam.

11:35They should be something you work up to and not something that you start with because they are comprehensive, they are exhaustive, and they are exhausting to take. Now, this particular exam has 65 scored questions and we're advised that there's probably going to be maybe 10 unscored questions. Now, importantly, if you happen to be taking this exam as a beta exam, as I did, well, these rules don't apply because maybe most of the questions might be beta questions. That's the whole idea behind a beta exam is they're testing these questions. So the passing score is 750 out of a total possible points of 1000 points. You get no points for unanswered questions. So even if you have to guess at an answer, then definitely guess at an answer because that's better than no points.

12:24And the exam is scored on a scaled basis. What does that mean? Well, there is this giant database of questions. And I won't say that no two tests are exactly the same, but they will pick questions out of that giant database of many different questions. And so what that means is that each test taker gets a slightly different exam experience. And some of those questions could be harder than others. Some could be easier. And so AWS has some logic behind the scenes where they will take your results and scale it based on what sort of questions you got. And I would also try to avoid comparing your score to your colleague's score and somehow deciding that, yeah, you knew more than your colleague because you scored higher. That is really not the case. There is a passing score. And if you passed, you met the criteria that AWS has set that says, hey, you're worthy of having this certification. You have enough knowledge that we're confident in giving you this certification. It does not mean that you are better than your colleague at Generative AI.

13:32So that is just a quick overview of the certification and some of my expectations. In the next video, I wanted to share some of my learning philosophy and how we're going to go about learning some of this stuff.

0:00So I wanted to take a moment just to acknowledge the fact that people are coming to this course from different backgrounds and they have different learning journeys. And I've tried very hard to make sure that depending on where you are in your learning journey, that this course is going to be accessible. So there may be cases in here where I'm going over something that you've been using for the past five years and you're like, why is he covering this? Well, it's because some of the people coming to this course maybe had a different background. So you can just skip over that stuff if you already know it.

0:32And if you don't know it, definitely dive in and don't be afraid to seek out other resources because I'm not going to do a deep dive in some of these things that as I mentioned in the last video, I kind of expect you to already have. The first case that I've seen very commonly is people just have a love of learning. They wanna learn all the things. And I can definitely sympathize with that because I consider myself a lifelong learner. Maybe you're seeking career advancement. Maybe you wanna figure out how to get into this generative AI space, or maybe you've been into the generative AI space or just the AI space in general, and you wanna get a certification to put on your resume or help you get a promotion or something like that.

1:15That is definitely admirable. And one of the things in designing this course that I wanted to do, and we'll talk about it in a second here, but I want you to come away from this course with stuff in hand that you can show to a potential employer as evidence of your abilities, not just the certification hanging on the wall, but actual projects. Now, maybe you're curious or maybe you're skeptical. Maybe you're coming to this course saying, hey, what's this generative AI stuff about? Or, hey, I've heard a lot of stuff about some of the bad things that can happen with generative AI models, and I wanna know how to prevent that or get in front of those things.

1:55And we are definitely going to go down those rabbit holes as well. And one of the things you'll quickly pick up is that I am not the typical generative AI cheerleader saying, hey, it's the greatest thing since canned beer. No, that is not me. I am just as skeptical as all the rest. And those lousy chatbots out there frustrate me just like they frustrate you. So we want to try to create chatbots that don't suck. So don't feel like you're an outsider here if you happen to be skeptical or curious.

2:27I'm kind of the same way, to be honest. And then there is the subset of folks who maybe have been voluntold. They have been told that, hey, you need to sign up for this course because you need to learn generative AI. And I completely understand that as well, and I empathize with that as well. Hopefully this is going to be an enjoyable course. If you've taken any of my other courses, you know that it's not the standard boring examples where I use some pretty interesting and maybe sometimes eyebrow raising examples and sample data.

2:59And that is no different in this course. We have some pretty interesting sample data that we are going to use as we build our gen AI models. So I did want to talk a little bit about what the focus of this course is going to be. And to do that, I often use something called Bloom's Taxonomy. And it's just a hierarchy of showing the different levels of learning, the different levels of understanding and mastery of a particular topic. Down here, we have understand and remember. That's just memorization and recall and stuff like that.

3:31And then we get into apply, analyze, evaluate, and create. If you're talking about an employer, this stuff down here is table stakes. The employer expects you to have that stuff. Never in an interview process in my entire career was I asked to recall EC2 instance types, never. And the reason for that is because that stuff is not valuable to an employer. It's what we can do with our knowledge. Can we apply it? Can we analyze problems and figure out the best way to use that technology to address that problem?

4:04And then ultimately, can we create new stuff ourself that our employer finds value in? So throughout this course, we are not gonna spend any time on this understand and memorize. We're gonna focus on the apply. And to do that, we are going to have a series of projects that we are going to do over the course of this course that is hopefully going to help you develop these apply, analyze, and evaluate skills. Once you have that certification, that means you know the stuff, right?

4:34Well, no. Is a certification proof of knowledge? I'm sure we know many people who are absolutely brilliant, but in an exam environment, they just crumble. Maybe you're like that too. Now, conversely, I've met some people who have loads of credentials, but in a practical setting, they couldn't find their way out of a wet paper bag. So just so we're on the same page, I want you to think of this course as a framework for learning, not necessarily a path to earning that certification.

5:05Now, certification is a happy side effect that I definitely hope you reach. But the main goal of earning certifications is not to earn the piece of paper, but to develop the knowledge. And I like to think of these courses as just a framework for learning. The certification is not necessarily the destination. It's the journey that has the value. Here are some goals for this course that I have. First, I want you to be able to understand, apply, and analyze rather than just simply recall.

5:37That's back on Bloom's Taxonomy about that higher level understanding is going to have more value for you and your employer. And I want you to get to a point where you're comfortable enough with the AWS services that you can improvise. I don't want you to just replicate what I'm doing or what somebody else is doing. I want you to be able to create your own stuff. And kind of an example of this is if you're a music fan, there are some artists out there who can sit down in a jam session and just improvise a song with other folks.

6:10And that's just not pure dumb luck. That comes after many, many years of doing the simple stuff. And being able to improvise is a form of mastering that particular skill. If all you're doing is following step-by-step instructions and replicating what somebody else is doing, well, guess what? AI can do that. So that's not really going to have very much value now or in the future. So I want you to really try to go into the improvisational area. And that means whenever we're doing activities, don't be afraid to color outside the lines.

6:44Do your own thing. Use your own data source. Recreate it using a different data source or a different technique. That's where the real learning is going to happen. So one of the things that makes AI kind of intimidating to a lot of people is because in some cases we just marvel at it like it's this magical black box and we don't understand what's going on in there. And so it's just magic to us. Well, I want to change that. I want to be sure that you understand what these models are doing inside, how they work conceptually, not only so you understand it, but you can explain that to other business users, for example, so that we can be sure that we are applying the right AI to the right problems.

7:25Now here's something else that a lot of folks sometimes get tripped up by, and I call it the practitioner's curse. Now, an example of this is let's say you're working in the industry for many, many years and you know how things are done in business and you know the best practices and stuff like that. Well, when you walk into an AWS exam, you have to leave all of that knowledge about all these other things at the door because that exam happens in an AWS walled garden, meaning that it is a perfect world within the AWS ecosystem.

7:59And that's what that exam is testing. So a lot of times what I hear from other folks who have been in the industry for a while is maybe they'll overthink some of the questions that are asked on the exam, and that leads them to a lot of doubt and sometimes missing the question. So that's why I call it the practitioner's curse, kind of almost the more you know, the more difficult it is to answer these simple questions because you tend to overthink and you tend to insert a lot of other stuff that you know from your experience is a definite requirement, but with regard to AWS, it's not so much.

8:32So I wanted you to be aware of that. And I'm going to try to call those things out when we come across them, where something maybe in industry is done a certain way, but inside the AWS ecosystem, it's done this way, that sort of thing. Okay, stepping back a bit to this conceptual knowledge versus this black box, I'm going to reference back to my intro monologue where I talked about my original attempt to learn AI. And then I had to put that on the shelf and I came back and tried to approach it a different way. Well, here's what I mean by conceptual knowledge.

9:03That does not mean that to be successful in this course or this exam that you need to be a PhD in mathematics. So let me explain. So here we have our business users here. They want the latest and greatest technology. And I've been around in the industry for about, I guess, 35, 40 years, something like that. And it doesn't matter what technology it is. First was enterprise data warehouses. Then serverless was a thing that was really hot. Then data analytics, then enterprise resource planning systems, then CRM, then this, then that, and so forth and so on.

9:36So the latest darling is of course, generative AI. And our business users are clamoring, hey, we need the generative AI stuff. We're not really sure what we're going to do with it, but we got to use it because somebody else is using it and maybe they're going to get a leg up on us or something. Then we have over here, the assorted propeller head types that seem to take pleasure in making things more difficult and challenging than it really is. And this is where I kind of hung myself up before I was listening to what these folks were saying and just taking it as face value.

10:11And because I didn't understand the vernacular, the words that they were using, it was very confusing to me and it kind of turned me off. And then in between here, we have all this complex mathematics. And I am not trying to downplay the importance of mathematics in generative AI or AI in general. That is the backbone of how this stuff works, but really it's not magic. It's just math underneath all that stuff. And when you're talking about math on the scale of billions and billions of parameters, for example, we can do some really fascinating things that look like magic, but really all they are is mathematics.

10:48And then, so here we are kind of caught in the middle here. One option we have is to resign ourselves to the fact that it's just beyond us and we need to call in an expert, that person right over here. And believe me, the expert likes things that are confusing because they can charge more for that expertise. I've seen it time and time and time again in the consulting industry over my career, where an expert will be very reluctant to train somebody in an organization because then that removes their value from that equation.

11:21Now, another option we have is that we can learn it well enough. And when I say well enough, we can learn it well enough to know how it works conceptually, but maybe we don't have to learn all these mathematical formulas because that's not what we're going to use day to day. And how can we do this? Well, let me give you an example. So I have one of these things. And when I put it on, I don't sit there and say, oh my gosh, this is some wondrous magic. How does it work? I did not need to read an academic paper on stereoscopic vision or memorize formulas on how stereoscopic vision works.

11:59When I was a kid, I had one of these things, a ViewMaster. And it's the same principle. It's two pictures here in each eye, but they're slightly off center. They're slightly, they're different in some way. And that is the same principle that the Oculus here uses. So that's what I'm talking about when I say that if we understand conceptually how things work, oftentimes that's good enough. And we don't have to mire ourselves in all the underlying mathematical formulas and Greek symbols and stuff like that to be able to make a decision as to whether that thing is going to be a good fit for our business problem at hand.

0:00I wanted to also mention very quickly, my learning philosophy. I very much have a crawl, walk, run approach. I see a lot of tutorials out there, especially from AWS, where they try to create the perfect reference architecture example through these big old long Python notebooks. I do not like those things. I like to start at the simplest possible stage and then embellish on that over and over. And you're going to see that reflected in this course. I also like origin stories. Now this is one thing that really helped me with my machine learning journey is I would see some sort of thing, for example, like a convolutional neural network.

0:38And if you look at it in its present day implementation, it's pretty complex. So what I did is I wanted to go back to earlier in history. And I think it dates back to maybe the fifties or the forties or something like that. And I wanted to see how that thing originally started and how it was thought up. And so I saw how it was thought up and it was pretty simple and it made sense in its very early stage. And I could see how over the years as computing power increased and we had more access to data, you can see how that thing evolved, but the underlying concept is still the same. So where appropriate, I'm going to use origin stories to kind of bring us back to the true basics and the underlying concepts.

1:22And then I also like to use something called analogical learning. And that's just a fancy way of saying, I like to use similes and metaphors. And then it's just a way to be able to compare something that you already know to something that you're just learning about. And all these things have kind of technical learning theory, backgrounds and stuff like that. But these are just three points that I like to incorporate in some of my training. So let's talk about the learning methods that we're going to use. We're going to, of course, have audio and visual. You're watching an audio visual representation of learning right now.

1:55We're going to have text. Now I will include text between the videos. Do not sleep on this text. A lot of times I will include stuff that you really need to know that's in the text, but it's not in the videos. AWS content is also a very valuable learning reference where appropriate. I'm going to maybe give you a link to a blog article or some sort of portion of the AWS documentation. We are also going to have a quiz questions. And for the most part, I'm going to try to design the quiz questions, at least the questions at the end of each skill, to be as close to exam questions as possible.

2:32There's some tricks and stuff that AWS likes to employ and walk through that. And I'll try to help give you some pointers on how to go through those questions and increase your likelihood of answering them properly. And then we're also going to have hands-on exercises. Now, this whole thing, this whole thesis of you being able to learn this stuff does not work unless you roll up your sleeves and do the stuff. You have to do the work. It's not enough just to watch me do the work. You have to do the work and internalize it. And also if you want to take away these portfolio projects and put them on your portfolio, you're going to need to create those artifacts as well.

3:10So by the end of this course, I want you to be comfortable with the current crop of Gen AI tools. And I say current crop because they're coming out with new tools basically every week and every month. So the best we can do is just go through what is available out there now and then start building that intuition whenever we see new services, considering how AWS would implement that new service and use that experience to our benefit. I also want you to know something about the AWS best practices and some of the potential danger zones inside AWS.

3:43And by danger zones, I mean potential for exposing customer data, potential for racking up a really high bill potential for accidentally deleting some data that you really didn't want to delete. Of course, I also want you to smash the AWS certified Gen AI developer exam. And I want to send you away with some very portfolio worthy projects that you can use to showcase your knowledge. So what are those projects? Well, here they are. The first project we're going to do is an enterprise rag system using a vector search.

4:19We're going to create some autonomous AI agents with a custom MCP integration. We are going to create a production scale Gen AI API deployment workflow. If you remember, I was talking a little bit about that CICD workflow. That's where we're going to cover that stuff. And we are also going to cover some security and governance frameworks and we are going to implement monitoring and compliance controls, which are very important, especially if you are in a regulated industry and happen to be using Gen AI.

4:49All these things sound very stuffy. Well, they sound very stuffy. Yes, but they are not going to be very stuffy. We have some pretty interesting datasets that we're going to be using to make these things pretty fun and enjoyable. So by the end of this course, I would expect you to have these four projects that you can upload into your website or blog article or GitHub repo or stuff like that, where you can put that link on a resume or show your colleagues or show a hiring manager and use that as demonstration of your abilities versus just kind of waving a certificate in their face.

0:00First up, we need to do some stuff. For starters, I am going to assume that you have enough AWS experience to know how to create your own Sandbox account. You can do it. Now, once you've created that Sandbox account, you must enable MFA for that root account. I want you to do these first two things all by yourself. Then I am going to pick up with you, with your brand new Shiny account, we are going to enable CloudTrail, we are going to set up IAM Identity Center.

0:30Now, I do have a little asterisk here for IAM Identity Center. If you are using IAM Identity Center already in your organization and you had somebody provision you a Sandbox account, well, this doesn't really apply. But what I really mean here is that you should not be using an IAM regular account anymore. That's not a best practice. AWS wants us to use the IAM Identity Center with either that as an identity provider or maybe some other federated identity provider.

1:01And that is what we are going to set up. I also want to be sure that you have root-ish permissions in your account. So, again, this applies if somebody else created an account for you. Maybe your organization uses Control Tower or AWS organizations. One thing to look out for is there is something called SCPs, and that is something that maybe your organization has applied to Sandbox accounts that they maybe create. And those are guardrails that prevents you from doing certain things.

1:31You want to be sure that you have enough permissions to basically roam around and do whatever you need to do in the VPC space, in the SageMaker space, in the Data Wrangler, Data Glue, that sort of thing. And just to make it a little bit easy, because this should be a Sandbox account, just ask for admin access. And that is going to give you most everything that you need. There are a few things that only the root account can do, but once we get past those initial things here, we are done with the root account. We're not going to come back and use that root account anywhere in this course.

2:04After we're sure we have root-ish permissions, we are definitely going to set up a budget alert. This is something that everybody should do to make sure that they don't end up with this crazy AWS bill at the end of the month because they forgot and left the service running. And unfortunately, there are some services in this course, especially if your account is not in the free tier, that could end up costing you a lot of money. So we want to be aware of those things as well. So let's get started.

2:36All right, now I am going to assume that you have created your AWS account, you've logged in using your root user, you've set up MFA on that root user. I use AWS Organizations and Control Tower to set up my accounts. And yes, this is my account number right here. Oh no, he's showing his account number. That's going to allow his account to be hacked. Well, no, just because you have my account number doesn't mean you can hack my account, especially if you do the right things.

3:08And to take it further, because I use Control Tower, AWS accounts are pretty disposable to me. So by the time this video gets published publicly, this account is going to be long gone and deleted. So you may see my account numbers in here. I don't sweat it. And in fact, AWS doesn't consider them to be confidential or sensitive. But I also understand that some organizations don't like to have any additional information out there than they really need to.

3:38So if you want to obscure this on your own notes or screenshots, then you can do that as well. So we are going to set up CloudTrail first. I'm going to go out to S3, and I'm going to create a bucket. Now I could let CloudTrail create a bucket for me, but I'm just going to call this GenAI CloudTrail. Now, if you've never used CloudTrail, CloudTrail is kind of the eye in the sky. It is going to log everything.

4:09And everything that we do from an API standpoint, in other words, logging in, calling this service, interacting with this thing, is going to be logged via CloudTrail. And it's a good practice to get into because if you have some sort of problem with your account, or maybe you have a security breach, you can come in here and analyze these logs and kind of replay what happened. Now, I did that pretty quick. I'm not going to step through creating an S3 bucket. I'm going to assume that you know how to do that. But I do want to point out something right here that has bit me before. And so if we scroll down here, where is it?

4:43There it is, default encryption. So, bucket key, using a bucket key. This is something that you probably should enable, and it's enabled by default. And what it does is S3 can use a KMS key to encrypt things. And so by default, it has the server-side encryption turned on. It's using the built-in S3 managed keys, or you can use customer managed keys if you wanted to. But encryption is good. We always want to encrypt our data.

5:13But one of the things that I had to figure out the hard way is that whenever any of these things are written or readed, readed, readed, any time something is written or read from the bucket, then it's going to make a call out to the KMS API. And that can be a lot of calls. And you can easily surpass your free layer or the allotted amount per month and start having to pay for these things. So AWS saw that as a problem as well.

5:44So they invented something called a bucket key. And this bucket key is basically just a local cache of that encryption key, so that we don't have to go out and call the KMS API, and it just works much easier. Especially when we're talking about CloudTrail, because there's going to be a lot of traffic coming in, being written to this bucket. We want to enable that. We want to make sure that is enabled. So it's enabled by default, which helps us out there. Okay, so we have our bucket configured. Get out of here. We have our bucket configured. Now we can go out to CloudTrail.

6:15We're going to go out, and I already have a trail set up. That is because I use Control Tower. And Control Tower is just a way to set up a list of pre-configured requirements whenever we create a new account. It's going to pre-populate that account with some best practices. And that is how I choose to create my accounts, because I go through accounts very frequently. So it already has a CloudTrail set up, and this is streaming to my management account. So I have one place where I can see all the activity across all my accounts.

6:47But if you have created an account from scratch, then you will not have that here. And maybe your organization just uses AWS Organization, and it doesn't use Control Tower to implement some of these things, then you may not have a CloudTrail enabled here. So I'm going to click on Create Trail, and I'm just going to call this Management Events. And I'm going to use an existing bucket. We could have had it create a bucket here, but I don't really like the name format that it does. It's kind of an eyesore to me.

7:17So I'm going to select the bucket that we created. And I don't want to log my CloudWatch logs. Click on Next. And here we have the option to choose which events we want to log. Management events, data events, I would really caution you to think carefully before checking data events. And that's stuff like every single read and write to an RDS instance, a database or something like that. That's a lot of stuff. Now, AWS can absolutely handle that. And if you need that layer of detail, then definitely do that.

7:51But this is probably not something we're going to need in our sandbox account. And down here we have management events. That's what we're really after, the reads and the writes. And we can also exclude KMS events. If you remember, I talked about there's a lot of KMS calls because KMS is that central place where our keys for encryption are stored. And so anything that uses encryption on AWS is going to use KMS. And because this is just a sandbox account, we're not going to have that much traffic.

8:22And I'm just going to leave that alone here. But if we are in a production account, I might want to check that because that's a lot of traffic. Click on next and create the trail. So here is our trail right down here. And we go back over here to our bucket. And we're saying, hey, where's our stuff? Well, it takes some time for CloudTrail to log things. It's not instantaneous. Usually, in my experience, it takes about five minutes or so for stuff to show up here in the log after you've actually done something.

8:57So if you want, let's go around, do some other stuff, and you can come back here and see what is logged.

0:00All right, so log out of whatever other account you're in, log back into the account in your sandbox that you're going to be using for this Generative AI course, and hopefully you're logging in using your IAM Identity Center account rather than your root account because we really don't need the root account anymore. So let's go over here and we're going to go down to Billing and Cost Management, and I'm going to go down here to Budgets right there. So we can create a budget. We can use a template or we can customize. Let's just use a template. Now here are the templates that are available. We have a zero spend budget. This means that if we exceed one penny, we're going to get notified, and that's pretty good if you're dealing with a free tier account. Now one thing to note is if you're using AWS Organizations and you have an account created underneath AWS Organizations, guess what? That's not necessarily considered a free tier account. You could end up having to pay for some of those services. So I am going to use monthly cost budget right here, and here's my monthly cost budget, and I'm going to set a threshold here. Let's just say $50, and I'm going to enter my email address that I want it to notify when I reach that threshold

1:17or when I'm trending to reach that threshold. We can scroll down here. You'll be notified if your actual spend reaches 85% or your actual spend reaches 100% or your forecasted spend. So that's the trend I was talking about right there. So we're going to click on Create Budget, and that's it. So we have just created a budget. We have created a notification that is going to email us whenever we reach that budgetary number or we're trending to that, and that is a very good thing. Quite literally, it will save your wallet. I have many stories of where I have failed to shut something down, and this notified me, and I went out there and avoided a very expensive AWS bill. So that's all there is to it. Very quick and easy to set up, but it is going to save you if you happen to leave something running accidentally.

0:00Okay, let us enable Identity Center. Now the old-school way of doing things was you'd go out to IAM and then you'd create a user here and then you'd log in using that user. Well, if we go through the process of setting this up, it's going to become fairly obvious that AWS doesn't want you to do this anymore. They want you to use other services and so that is IAM Identity Center. That's a pretty good service. It basically is an identity provider that we create and it can be reused several places across our account. Now, mine is a little bit different because I am in an account within an account that already has Identity Center set up. So, if your organization has implemented those SCPs, chances are they've probably turned off your ability to create an IAM Identity Center because that would be kind of weird if you have a top-level Identity Center and then an Identity Center somewhere down in a sandbox and that could get very confusing.

1:03But if this is a standalone account, you probably won't have that problem. So, I'm going to go as far as I can to show you the process. Again, this is not a tutorial on using Identity Center. I just wanted to call it out because it is a current best practice that AWS says we should do and it's very useful across AWS, certainly within SageMaker and some in Bedrock because some of those services are able to work with Identity Center nowadays. All right, so I am in another account here. I'm going to go under Identity Center and if you click enable, you're going to get something that looks like this. It has set up some stuff and it will set up an instance name, an instance Identity Center directory and it'll give you this URL here that you can customize if you wanted to.

1:51It's kind of like a little wizard. You got to step through the process there. You'll be able to figure it out. So, I'm going to go under user. We can create users. I would first recommend that you create a group here. First, if you don't already have a group, I already have a group. It's just real easy. You click on create group and it just lets you create a group. So, I'm going to go back over here to users, add a user and I'm just going to call this Bob and oddly enough, Bob's email address is similar to mine, but it has to be unique across accounts. So, I'm going to add that little plus trick. If you know, you know. I'm going to call this Bob Pletcher and click on next and I'm just going to check that little administrator group saying, hey, this person is part of that administrator group and click on next, add user. There we go. So, what has happened is an email was sent to Bob's email address, probably your email address if you're creating yourself an account and you have to click on that and enroll and set a password and stuff like that.

2:54The next thing that we want to do with IAM Identity Center is we need to set up a permission set and this is how we can define what permissions we are going to allocate to our users. So, you can see I already have one set up for administrator access. Let's just create another one here. We can use predefined or custom permissions. For our purposes, predefined is just fine. I would suggest you select this administrator access button right there and I'm also going to set up a billing permission set as well. So, let's just go down here. All that stuff looks good. This is kind of important here. This is a session duration. So, once you log into Identity Center via the provided URL, your permissions have an expiration time limit and that is a very good thing. You can set this to whatever you want, but I would recommend setting it to probably no bigger than eight hours.

3:48So, we'll just keep it at one hour here. Click on next, create. So, there we have a permission that's set for billing. All right. So, now we can go over here to accounts. Now, these are accounts that have been pulled in and I have my little hierarchy here. These are accounts, actually these are OUs, but within these folders, I have accounts that have been set up and I can assign users and groups to those accounts. And one of the things I want to do is I want to assign that billing ability to my account that I'm using for the Gen AI Pro here.

4:32There we go. Click that. And I want to say, hey, we can use billing and we can use administrator access. Submit. And now it is going out there and configuring that particular account to allow me to log into that account using a billing role or an administrative access role. So, once you log into the access portal from Identity Center, if you go back over here, you will see a little URL down here. You'll get something that looks like this. If you have multiple accounts, if you just have one account, it's just going to show one account there and you will be able to, if I refresh here, there we go. So, here's my role that I can click on that and that will enter that account using administrator access, or I can enter that count using billing. And it has my access keys right here. This is why this is a better way of doing this, because these access keys are time sensitive. They expire. Back when we were using IAM users, they did not necessarily expire.

5:34You had to manually go out there and rotate them. And that is the source of many AWS security breaches. It's not AWS's fault that people mishandled the keys. It's their own fault that they mishandled the keys. If we use Identity Center, that lessens that risk.