Software Craftsman, Young Curmudgeon

AWS Loft - Infrastructure as a Code

    tech cloud  

As with other sessions from AWS Loft in Stockholm, Sweden I attended, I will log my notes here in order to dump the information somewheere. Yesterday in particular I attended a session related to Infrastructure as Code (I will refer onwards as IaC) and the role it currently plays in modern software solutions.

Premise

In the past I had been able to use IaC for very simple solutions that would focus merely on provisioning machines, particularly enforcing a desired state, commonly known as Desired Configuration State or DSC; during the session however it was remakred that IaC plays a much bigger role and spans to other areas in the organization where undoubtably is of great help.

The game changing aspect about all this is that this introduces a new paradigm to work with and understand when it comes to managing infrastructure and resources, resources are now virtual and declaratively expressed through Code, the fact they’ve become that yields a few benefits right off the bat, Resources can now be Versioned as any other piece of code, it becomes easier to Audit them, we gain Consistency in our stack and increase productivity through Automation.

Applied Infrastructure as Code

As mentioned before, IaC spans to various areas which are mentioned hereinafter, the tools and techniques as well as exceptions may vary for each one; I have also added the corresponding AWS offering.

Resource Provisioning

This is where we rely on a Provisioning Engine which will ingest and follow the instructions expressed in our code and take certain Actions and as a result we will have Infrastructure Resources created.

It is here where we can have a degree of Automation but also is very common to see Templatizing as a technique through which we declare how we want to structure our resources, i.e. Type of Instance (defined HW profile), Networking settings, etc.

A couple of Common Approaches to resource provisioning were mentioned during the session:

Day1 + Day2 are usually used together and it is also refererred to as Incrementally Patching your resources, of course, each use case will warrant to use of one or the other.

AWS CloudFormation

This is the offering from AWS and it works based on the concept of a Stack which is defined through a Template which declare our infrastructure resources, some of the features/capabilities:

Configuration Management

The common scenarios are Day 2 tasks, where we need to make changes upon existing managed infrastructure, for instance roll out a new version of an Application to an exiting server farm or make changes to infrastructure itself.

At the time of this writing, AWS offers two solutions:

AWS Systems Manager

Offers the capabilities to manage EC2 instances, on-premise servers or virtual machines and provides a central place to access operational data and automate tasks across all the managed resources. The typical lifecycle while using it usually goes as:

Some basic concepts to grasp from AWS Systems Manager:

Another interesting concept is Run Commands which allow the execution of arbitrary commmands on your managed instances.

Monitoring & Performance

In this particular area, we are concerned about the overall operation of our resources, paying special attention on things such as performance, throughput, etc. Visibility over metrics is crucial to detect and troubleshoot issues.

IaC can be used to define routines that shall be executed based on what monitoring reports, this is, a reactive approach to respond to issues to make operating environments eventually recover and perform normally.

AWS CloudWatch and AWS Lambda

AWS CloudWatch offers metrics and logs collected from the various AWS Services, Alarms are raised when configured thresholds are reached. AWS Lambda can be used to react to this alarms and apply countermeasures in order to ensure a level of resiliency in operating environments.

Given that AWS Lambda are user-defined functions, regardless of the language, it brings all the perks we are know from handling code, it can be versioned and maintained as part of the overall solution.

Governance & Compliance

Infrastructure as Code spans into the Gov. and Compliance space by definig rules and routines that react to certain events that may compromise the compliance of our resources to a desired state. Let’s mention some scenarios:

It is about the sudden change in the state of our Infrastructure, what need to be able to audit such events and act upon them.

AWS Config

This Service allows you to continuously Audit, Assess and Evaluate your Resources Configuraton and builds an Inventory out of it where you can track changes to them. There are a few concepts to grasp:

Of course, corrective actions can be taken besides monitoring an alerting, a rule will flag a resource as non-compliant if applicable, however, AWS Lambda can be used to take corrective actions. Some examples of non-compliance:

Config can produced aggregate data from multiple regions and accounts. More on AWS Rules.

Resource Optimization

This is about interrogating the operating environment to ensure things are provisioned as we wanted and operating to our expectations; the ultimate goal being the overal state and operation of our resources is as optimal as possible; to continuously monitor the environment to optimize aspects such as performace, security and cost.

AWS Trusted Advisor

Exposes an API that allow us to interrogate our Infrastructure hence get recommendations on thigs we could improve and take actions, such actions we could express through code. Trusted Advisor can hook into the support system in order to raise a ticket or use cloud watch to setup metrics and automate corrective actions with AWS CloudWatch.

Resources