6. Deployments & Managing Infrastructure at Scale

What is CloudFormation?

A declarative way of outlining your AWS infrastructure, for any resources (most of them are supported)

What does CloudFormation do with a template?

Creates the resources you declared (e.g. a security group, two EC2 instances using it, an S3 bucket, a load balancer) in the right order, with the exact configuration you specify

Why is CloudFormation excellent for control as Infrastructure as Code?

No resources are manually created, and changes to the infrastructure are reviewed through code

How does CloudFormation help with cost?

Each resource within the stack is tagged with an identifier so you can easily see what a stack costs, and you can estimate costs using the template

What is a CloudFormation savings strategy for Dev environments?

Automate deletion of templates at 5pm and recreate them at 9am safely

What productivity benefits does CloudFormation give?

Destroy and re-create infrastructure on the fly, automated diagram generation for templates, and declarative programming (no need to figure out ordering and orchestration)

How does CloudFormation help you avoid re-inventing the wheel?

Leverage existing templates on the web and leverage the documentation

What do you use in CloudFormation for resources that are not supported?

Custom resources

What is the AWS Cloud Development Kit (CDK)?

Define your cloud infrastructure using a familiar language: JavaScript/TypeScript, Python, Java, and .NET

What is CDK code "compiled" into?

A CloudFormation template (JSON/YAML)

What is a key advantage of the CDK?

You can deploy infrastructure and application runtime code together — great for Lambda functions and Docker containers in ECS/EKS

What problems do developers face on AWS?

Managing infrastructure, deploying code, configuring databases/load balancers etc, and scaling concerns

What architecture do most web apps share?

The same architecture: ALB + ASG

What do developers actually want?

For their code to run, possibly consistently across different applications and environments

What is Elastic Beanstalk?

A developer-centric view of deploying an application on AWS — it uses components we've seen before (EC2, ASG, ELB, RDS) but in one view that's easy to make sense of, with full control over configuration

What service model is Elastic Beanstalk?

Platform as a Service (PaaS)

How is Elastic Beanstalk priced?

Beanstalk is free but you pay for the underlying instances

What does Elastic Beanstalk handle as a managed service?

Instance configuration/OS, deployment strategy (configurable but performed by Beanstalk), capacity provisioning, load balancing & auto-scaling, and application health-monitoring & responsiveness

What is the developer's responsibility with Elastic Beanstalk?

Just the application code

What are the three Elastic Beanstalk architecture models?

Single instance deployment (good for dev), LB + ASG (great for production or pre-production web applications), and ASG only (great for non-web apps in production, e.g. workers)

Which platforms does Elastic Beanstalk support?

Go, Java SE, Java with Tomcat, .NET on Windows Server with IIS, Node.js, PHP, Python, Ruby, Packer Builder, Single container Docker, Multi-container Docker, Pre-configured Docker

What is AWS CodeDeploy?

A service to deploy your application automatically — works with EC2 instances and on-premises servers (a hybrid service)

What must be done before CodeDeploy can deploy to servers?

Servers/instances must be provisioned and configured ahead of time with the CodeDeploy Agent

Why does application code need to be stored before pushing to servers?

Developers usually store code in a repository using git technology — a famous public offering is GitHub; AWS's competing product is CodeCommit

What is AWS CodeCommit?

A source-control service that hosts Git-based repositories, making it easy to collaborate on code, with changes automatically versioned

What are the benefits of CodeCommit?

Fully managed, scalable & highly available, private, secured, and integrated with AWS

What is AWS CodeBuild?

A code building service in the cloud — compiles source code, runs tests, and produces packages ready to be deployed (by CodeDeploy for example)

What are the benefits of CodeBuild?

Fully managed, serverless, continuously scalable & highly available, secure, pay-as-you-go pricing — only pay for the build time

What is AWS CodePipeline?

A service to orchestrate the different steps to have code automatically pushed to production: Code => Build => Test => Provision => Deploy

What is CodePipeline the basis for?

CICD — Continuous Integration & Continuous Delivery

What is CodePipeline compatible with?

CodeCommit, CodeBuild, CodeDeploy, Elastic Beanstalk, CloudFormation, GitHub, 3rd-party services & custom plugins — with fast delivery & rapid updates

What is artifact management?

Storing and retrieving code dependencies (software packages that depend on each other to be built); traditionally you set up your own artifact management system

What is AWS CodeArtifact?

A secure, scalable, and cost-effective artifact management service for software development

Which dependency management tools does CodeArtifact work with?

Maven, Gradle, npm, yarn, twine, pip and NuGet

Who can retrieve dependencies straight from CodeArtifact?

Developers and CodeBuild

What is AWS Systems Manager (SSM)?

A hybrid AWS service that helps you manage your EC2 and on-premises systems at scale and get operational insights about the state of your infrastructure — a suite of 10+ products

What are the most important SSM features?

Patching automation for enhanced compliance, running commands across an entire fleet of servers, and storing parameter configuration with the SSM Parameter Store

Which operating systems does SSM work with?

Linux, Windows, MacOS, and Raspberry Pi OS (Raspbian)

How does Systems Manager work?

You install the SSM agent onto the systems you control; thanks to the agent you can run commands, patch and configure your servers

Where is the SSM agent installed by default?

On Amazon Linux AMI & some Ubuntu AMI

If an instance can't be controlled by SSM, what is the likely issue?

An issue with the SSM Agent

What is SSM Session Manager?

Allows you to start a secure shell on your EC2 and on-premises servers — no SSH access, bastion hosts, or SSH keys needed, and no port 22 needed (better security)

Which operating systems does Session Manager support?

Linux, macOS, and Windows

Where can Session Manager send session log data?

S3 or CloudWatch Logs

What is SSM Parameter Store?

Secure storage for configuration and secrets — API keys, passwords, configurations

What are Parameter Store's characteristics?

Serverless, scalable, durable, easy SDK, access permissions controlled using IAM, version tracking & encryption (optional)

Summarise CloudFormation (AWS only)

Infrastructure as Code, works with almost all AWS resources, repeat across Regions & Accounts

Summarise Beanstalk (AWS only)

Platform as a Service (PaaS), limited to certain programming languages or Docker; deploy code consistently with a known architecture, e.g. ALB + EC2 + RDS

Summarise CodeDeploy (Hybrid)

Deploy and upgrade any application onto servers

Summarise Systems Manager (Hybrid)

Patch, configure and run commands at scale

What does CodeCommit do in one line?

Store code in private git repository (version controlled)

What does CodeBuild do in one line?

Build and test code in AWS

What does CodeDeploy do in one line?

Deploy code onto servers

What does CodePipeline do in one line?

Orchestration of pipeline (from code to build to deploy)

What does CodeArtifact do in one line?

Store software packages / dependencies on AWS

What does AWS CDK do in one line?

Define your cloud infrastructure using a programming language