In the high-speed world of DevOps, Continuous Integration and Continuous Delivery (CI/CD) pipelines are our bread and butter. But come on, manual code reviews are as thrilling as watching paint dry and just as slow! Fortunately, the AWS heroes have provided us with Amazon CodeGuru, an AI-powered tool that makes tedious code reviews a piece of cake.

So, What Exactly is Amazon CodeGuru?

Suppose your team had an indefatigable, coffee-less intern—who never sleeps, never misses a line of code, and never complains. That's CodeGuru. Amazon CodeGuru uses advanced machine learning to automatically identify bugs, vulnerabilities, performance problems, and even resource leaks in your code.

Why is CodeGuru a big deal?

• Languages Supported: Java, Python, JavaScript, TypeScript.

• Repositories: GitHub, AWS CodeCommit, Bitbucket.

• Key Strengths: Security, Performance Optimization, Resource Management.

Going Deep with CodeGuru Reviewer

CodeGuru Reviewer thoroughly reviews your code for defects such as:

• Security issues (SQL injections, cross-site scripting)

• Concurrency problems & resource leaks (memory leaks, CPU inefficiencies)

• Detection of secret credentials (leaked AWS keys)

• Inefficient API usage (suboptimal AWS SDK calls)

Just think of it like your own "coding Yoda," calmly prompting you, "Do or do not, there is no try," whenever you are opening up your PR.

Behind-the-Scenes with CodeGuru Profiler

Your applications need top-level fitness. CodeGuru Profiler keeps your running applications under constant watch to identify slowdowns or CPU hogs, providing easy-to-understand visual flame graphs and accurate optimization advice.

Imagine Profiler as your app's Fitbit, pointing out ways that have gained unnecessary weight, leading you to a leaner, quicker, and cheaper application.

Real-Life: CodeGuru with GitHub Actions

Let's practically integrate CodeGuru Reviewer into your GitHub CI/CD pipeline.

GitHub Actions Workflow (YAML):

name: Amazon CodeGuru Reviewer

on:
  pull_request:
    branches: [main]

jobs:
  codeguru-review:
    name: Run CodeGuru Reviewer
    runs-on: ubuntu-latest

    permissions:
      contents: read
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 0  

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'

      - name: Install dependencies (optional)
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt || true

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v3
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Run Amazon CodeGuru Reviewer
        uses: aws-actions/codeguru-reviewer@v1.1
        with:
          s3_bucket: codeguru-reviewer-demo-raychuranirav-us
          build_path: .

GitHub Actions Workflow Explained

Let's peek under the hood to see how our GitHub Actions workflow puts Amazon CodeGuru Reviewer to work. Think of this workflow as the automatic pit crew for your code, tirelessly ensuring everything stays in peak condition.

Trigger on Pull Requests

The pipeline gets going whenever someone opens or updates a pull request to the main branch. Because nothing is more comforting than a clean PR!

Checkout Repository

Step one—first, we fetch the latest and greatest from your repository with GitHub's checkout action. We take the whole history (fetch-depth: 0) since CodeGuru Reviewer is a context junkie just like developers are coffee addicts.

Setting Up Python Environment

Then, we establish a Python environment (Python 3.11). Even if your project does not absolutely need Python, this guarantees compatibility for any dependency analysis and ensures CodeGuru does not skip a beat.

Installing Dependencies (Optional but Recommended)

We install any dependencies that may be required, as outlined in requirements.txt. Don't panic if your file is empty or does not exist—this step proceeds quietly without complaint. Take this as the "just-in-case toolkit" for your project.

Configuring AWS Credentials

Then comes the magic key moment (pun intended) which is configuring AWS credentials. We securely connect GitHub Actions to your AWS account using secret keys stored in GitHub Secrets. This enables CodeGuru to do its smart, AI-driven detective work.

Running Amazon CodeGuru Reviewer

Finally, it's showtime! The workflow invokes CodeGuru Reviewer, providing it with the AWS S3 bucket name (codeguru-reviewer-demo-raychuranirav-us) for storing its analysis, and the project directory (build_path: .) to review your code in its entirety.

When this step completes, you'll see thoughtful, AI-powered comments and suggestions directly on your pull request—making your code cleaner, safer, and optimized.

Consider this workflow your own AI code-review ninja-working in the shadows quietly to detect all possible issues before your code ever sees the light of day!

Common & Complex Use Cases

Common Scenario:

Standard Web Apps

• Regular automated review guarantees fewer bugs and security issues.

• Profiler enhances app responsiveness and optimizes expense.

Complex Scenario:

Enterprise-Scale Microservices

• Reviewer protects multiple repositories at once.

• Profiler dramatically enhances performance, optimizes sophisticated resource utilization, and assists with managing large traffic efficiently.

And as they say, no matter if your app is a lemonade stand or a Netflix-scale service, CodeGuru adapts quicker than your product manager changes requirements!

Benefits Galore: Why Choose CodeGuru?

• Top-notch security: Automatically identifies security flaws early.

• Improved performance: Identifies performance bottlenecks.

• Quality coding: AI-powered insights enhance code quality.

• Cost savings: Optimize compute resources, reducing AWS costs.

In short, CodeGuru gets your app purring like a high-performance sports car quick, efficient, and a blast to drive.

Conclusion

Manual code reviews? Seriously, that's so last decade. Level up your DevOps game with Amazon CodeGuru. Your apps (and your sanity!) will thank you.

How Did I Pull It Off? 🤔

Let me spill the tea on my winning strategy. First off, it's all about consistent learning, no slacking! Every day, diving deep into AWS, absorbing all the techy goodness. But hold up, it's not just about cramming info like a robot. Nah! It's about understanding how to put that knowledge to work in real-life situations. Real talk, gotta have that mindset of not just learning but figuring out the "how" in the real world.

Blogging Hustle, Real Struggle! 💻📚

Now, you might be wondering, "Yo, where are the hands-on examples in them blogs?" Truth bomb – it's a real grind juggling learning and blogging. But hey, I dropped 10 blogs on all the AWS DevOps topics I tackled. Real talk, couldn't go too wild with hands-on examples this time, but best believe, I'm leveling up to drop more fire blogs with mad hands-on action next time. It's a work in progress, fam. 🌐💡

Why You Should Care? 🚨

If you're on that AWS journey or eyeing that certification, peep my blogs. Real talk, I gotchu! From the struggles to the wins, it's all laid out there. Ain't no fancy words – just raw, real, and relatable. Let's keep it 100 – learning ain't easy, but it's worth it!

If you have any doubts or suggestions or any questions let's connect on LinkedIn or Twitter(X).

💡 Course Progress - Day 10: Unraveling AWS Config, Control Tower, Security Services, and More!

As we delve into AWS Config and a plethora of security-focused services, let's explore the diverse topics covered and gain valuable insights for maintaining robust, secure, and compliant AWS environments.

🔍 Key Learnings

🌐 What is AWS Config?

AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. You can use AWS Config to monitor and record your AWS resource configurations and automate the evaluation of recorded configurations against desired configurations.

🔄 AWS Config Configurations Recorder and Aggregator

AWS Config Configurations Recorder and Aggregator are two features of AWS Config. Configurations Recorder is a feature that enables you to record the configurations of your AWS resources. Configurations Aggregator is a feature that enables you to aggregate the configurations of your AWS resources across multiple accounts and regions.

🔍 AWS Config Conformance Packs

AWS Config Conformance Packs are a collection of AWS Config rules and remediation actions that help you manage your AWS resources for compliance with industry standards and best practices. You can use AWS Config Conformance Packs to evaluate your AWS resources against predefined rules and remediate non-compliant resources.

📄 AWS Config Organizational Rules

AWS Config Organizational Rules are a feature of AWS Config that enables you to define rules that apply to all AWS accounts in your organization. You can use AWS Config Organizational Rules to evaluate your AWS resources against predefined rules and remediate non-compliant resources.

🌐 What is AWS Organizations?

AWS Organizations is a service that enables you to consolidate multiple AWS accounts into an organization that you create and centrally manage. You can use AWS Organizations to create groups of AWS accounts and apply policies to those groups.

🌐 SCP (Service Control Policies) in AWS Organization

AWS Organizations Service Control Policies (SCPs) are a feature of AWS Organizations that enables you to create policies that apply to all AWS accounts in your organization. You can use SCPs to restrict the actions that users and roles can perform on AWS resources.

🌐 AWS Control Tower Overview

AWS Control Tower is a service that enables you to set up and govern a secure, compliant multi-account environment on AWS. You can use AWS Control Tower to create and manage AWS accounts, apply policies, and enforce compliance.

🌐 Control Tower Landing Zones

AWS Control Tower Landing Zones are preconfigured templates that enable you to set up and govern a secure, compliant multi-account environment on AWS. You can use Control Tower Landing Zones to create and manage AWS accounts, apply policies, and enforce compliance.

🔄 Account Factories and Migrating Accounts in AWS Control Tower

AWS Control Tower Account Factories are a feature of AWS Control Tower that enables you to create and manage AWS accounts at scale. You can use Account Factories to automate the creation of new AWS accounts and migrate existing AWS accounts to AWS Control Tower.

🌐 Customizations for AWS Control Tower (CfCT)

Customizations for AWS Control Tower (CfCT) are a set of tools and resources that enable you to customize AWS Control Tower to meet your specific needs. You can use CfCT to create custom landing zones, integrate with third-party tools, and automate account creation and management.

🌐 Control Tower Config Integration

AWS Control Tower Config Integration is a feature of AWS Control Tower that enables you to use AWS Config to monitor and record the configurations of your AWS resources. You can use Control Tower Config Integration to automate the evaluation of recorded configurations against desired configurations.

🔄 Account Factory for Terraform in AWS Control Tower

AWS Control Tower Account Factory for Terraform is a feature of AWS Control Tower that enables you to create and manage AWS accounts using Terraform. You can use Account Factory for Terraform to automate the creation of new AWS accounts and manage existing AWS accounts.

🌐 IAM Identity Center Overview

AWS IAM Identity Center is a feature of AWS Identity and Access Management (IAM) that enables you to manage your IAM users, groups, and roles in a single location. You can use IAM Identity Center to create, manage, and delete IAM users, groups, and roles.

🔐 AWS Web Application Firewall (WAF) Overview

AWS Web Application Firewall (WAF) is a web application firewall that helps protect your web applications from common web exploits. You can use AWS WAF to create custom rules that block common attack patterns, such as SQL injection and cross-site scripting.

🔄 AWS Firewall Manager and Policies

AWS Firewall Manager is a service that enables you to centrally manage your AWS WAF rules across multiple accounts and resources. You can use AWS Firewall Manager to create and manage AWS WAF policies that apply to your AWS resources.

🔒 Amazon GuardDuty Overview

Amazon GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity. You can use Amazon GuardDuty to detect and respond to threats in real time.

🔄 Integrating GuardDuty with CloudFormation

You can use AWS CloudFormation to create and manage Amazon GuardDuty resources. You can use CloudFormation to create and manage GuardDuty detectors, member accounts, and publishing destinations.

🕵️ Amazon Detective Overview

Amazon Detective is a security service that makes it easy to analyze, investigate, and identify the root cause of security issues in your AWS resources. You can use Amazon Detective to visualize and analyze data from AWS CloudTrail, Amazon VPC Flow Logs, and Amazon GuardDuty.

🕵️ Amazon Inspector Overview

Amazon Inspector is an automated security assessment service that helps improve the security and compliance of your applications deployed on AWS. You can use Amazon Inspector to identify security issues and vulnerabilities in your applications and infrastructure.

🔄 Setting Up Amazon Inspector with EC2

You can use Amazon Inspector to assess the security and compliance of your Amazon EC2 instances. You can use Inspector to identify security issues and vulnerabilities in your EC2 instances and receive detailed reports with remediation steps.

🔄 EC2 Instance Migrations Using AMIs

You can use Amazon Machine Images (AMIs) to migrate your Amazon EC2 instances to different regions or accounts. You can create an AMI of your EC2 instance and then copy the AMI to the destination region or account.

🔐 AWS Trusted Advisor Overview

AWS Trusted Advisor is an online tool that provides recommendations to help you optimize your AWS resources for performance, security, and cost. You can use Trusted Advisor to identify opportunities to save money, improve system performance, and increase security.

🌐 AWS Trusted Advisor Architectures

AWS Trusted Advisor provides recommendations for optimizing your AWS resources across five categories: cost optimization, performance, security, fault tolerance, and service limits. You can use Trusted Advisor to identify opportunities to reduce costs, improve performance, and increase security across your AWS resources.

🔐 AWS Secrets Manager Overview

AWS Secrets Manager is a service that enables you to store and retrieve secrets such as database credentials, API keys, and other sensitive data. You can use Secrets Manager to manage secrets for your applications and services.

🔍 AWS Tag Editor Overview

AWS Tag Editor is a service that enables you to manage tags for your AWS resources. You can use Tag Editor to add, edit, or delete tags for your AWS resources.

📊 AWS QuickSight Overview

AWS QuickSight is a business intelligence service that enables you to create interactive dashboards and visualizations from your data. You can use QuickSight to analyze data from a variety of sources, including AWS services, third-party applications, and on-premises databases.

📊 AWS Glue Overview

AWS Glue is a fully managed extract, transform, and load (ETL) service that makes it easy to move data between data stores. You can use Glue to automate the process of discovering, cataloging, and preparing your data for analysis.

As I bid farewell to this transformative AWS DevOps journey, today marks a significant milestone as I prepare to embark on the certification exam. Each day of learning has brought new challenges and discoveries, deepening my understanding of AWS DevOps principles, thanks to the guidance from Stéphane Maarek's Udemy course.

To the community and mentors who have supported and shared in this learning adventure, your insights and engagement have been invaluable. As I face the exam, your good wishes and positive vibes are sincerely appreciated. Here's to showcasing the culmination of dedicated learning and facing the challenge head-on.

In the future, should I emerge triumphant, I'll share my exam experience and the strategies that contributed to my success. Stay tuned for blogs detailing how I navigated the exam process, the resources I found most beneficial, and the approach that worked for me.

While this particular journey may be reaching its conclusion, the spirit of learning remains alive and well. Continuous improvement and staying abreast of the ever-evolving tech landscape will always be at the forefront. As the journey transitions, I invite you to stay connected for future updates. Whether it's new certifications, project implementations, or insights into emerging technologies, the learning adventure continues.

Here's to new horizons and the exciting road ahead! 🌟✨

If you have any doubts or suggestions or any questions let's connect on LinkedIn or Twitter(X).

💡 Course Progress - Day 9: Navigating AWS Event Bridge, S3 Event Notifications, Health Dashboard, and More!

As we delve into AWS services, let's explore the diverse topics covered and gain valuable insights for seamless orchestration, monitoring, and alerting in the cloud.

🔍 Key Learnings

🌐 What is AWS Event Bridge?

Amazon EventBridge is a serverless event bus service that makes it easy to connect your applications with data from a variety of sources. You can use EventBridge to build event-driven architectures, decouple your applications, and simplify your infrastructure.

🔍 Event Bridge Content Filtering

Amazon EventBridge supports declarative content filtering using event patterns. With content filtering, you can write complex event patterns that only match events under very specific conditions. For example, you can create an event pattern that matches an event when a field of the event is within a specific numeric range, or when the event comes from a specific IP address.

🔄 Event Bridge Input Transformation

Amazon EventBridge input transformation enables you to customize the text from an event before EventBridge passes the information to the target of a rule. Using the input transformer in the console or the API, you define variables that use JSON path to reference values in the original event source. The transformed event is sent to a target instead of the original event.

💾 S3 Event Notification

Amazon S3 Event Notifications feature enables you to receive notifications when certain events happen in your S3 bucket. To enable notifications, add a notification configuration that identifies the events that you want Amazon S3 to publish. Make sure that it also identifies the destinations where you want Amazon S3 to send the notifications.

🛡️ S3 Object Integrity

Amazon S3 uses checksum values to verify the integrity of data that you upload to or download from Amazon S3. In addition, you can request that another checksum value be calculated for any object that you store in Amazon S3. You can select from one of several checksum algorithms to use when uploading or copying your data.

🌐 AWS Health Dashboard Overview

AWS Health Dashboard provides alerts and guidance for AWS events that might affect your environment. While the Service Health Dashboard shows the general status of AWS services, the Personal Health Dashboard provides proactive and transparent notifications about your specific AWS environment.

🚨 AWS Health Dashboard Events and Notifications

AWS Health Dashboard provides a personalized view of events that affect your AWS account or organization. You can view the current and historical status of all AWS services and get a personalized view of events that affect your AWS account or organization.

🔄 EC2 Status Check

Amazon EC2 provides status checks to help you identify hardware and software issues with your instances. You can view the status check results for your instances using the Amazon EC2 console, the AWS CLI, or the Amazon EC2 API.

📄 CloudTrail Overview

AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. With CloudTrail, you can log, continuously monitor and retain account activity related to actions across your AWS infrastructure.

🔄 Integrating CloudTrail with Event Bridge

You can use Amazon EventBridge to receive CloudTrail events and route them to targets such as AWS Lambda functions, Amazon SNS topics, and Amazon SQS queues. You can use EventBridge to filter and transform CloudTrail events before they are sent to targets.

📬 SQS Dead Letter Queue

Amazon Simple Queue Service (SQS) dead-letter queues let you set aside and isolate messages that can’t be processed correctly to determine why their processing didn’t succeed. Dead-letter queues are useful for debugging your application or messaging system because they enable you to isolate problematic messages.

🔄 SNS Redrive Policy

Amazon SNS provides a dead-letter queue (DLQ) feature that lets you set up a separate SQS queue to receive messages that can’t be delivered to their intended recipients. You can use an SNS redrive policy to specify the DLQ to which Amazon SNS should send undeliverable messages.

🌐 AWS X-Ray Overview

AWS X-Ray is a service that enables you to trace requests made to your application. You can use X-Ray to analyze and debug production, distributed applications, such as those built using a microservices architecture.

🔄 Integrating X-Ray with Beanstalk

You can use AWS Elastic Beanstalk to deploy and manage applications in the AWS Cloud. You can use X-Ray to trace requests made to your Elastic Beanstalk environment and analyze and debug your application.

🌐 AWS Distro for OpenTelemetry

AWS Distro for OpenTelemetry is a secure, production-ready distribution of the OpenTelemetry project. It provides a single distribution of the libraries, agents, and other components that you need to collect telemetry data from your applications and services.

✨ The Journey Continues: As Day 9 wraps up, I'm excited about the depth of understanding gained and the practical skills acquired. Stay tuned for more updates as my AWS DevOps journey continues to unfold!

If you have any doubts or suggestions or any questions let's connect onLinkedInorTwitter(X).

💡 Course Progress - Day 8: Exploring CloudWatch, Amazon Lookout, CloudWatch Logs, Alarms, and More!

As we navigate through AWS CloudWatch and related services, let's dive into the diverse topics covered and gain valuable insights for effective monitoring and analytics in the cloud.

🔍 Key Learnings

📊 What are CloudWatch Metrics?

Amazon CloudWatch is a monitoring service for AWS resources and the applications you run on them. CloudWatch provides data and actionable insights to monitor applications, respond to system-wide performance changes, optimize resource utilization, and get a unified view of operational health. CloudWatch Metrics are the fundamental concept of CloudWatch. They are time-ordered sets of data points that represent the values of a metric over time. Metrics are used to monitor various resources such as EC2 instances, RDS DB instances, and custom metrics.

📊 CloudWatch Custom Metrics

CloudWatch Custom Metrics are metrics that you define and send to CloudWatch. You can use custom metrics to collect and analyze your own application-specific data. You can publish custom metrics from any application or service that sends data to CloudWatch.

📈 CloudWatch Anomaly Detection

Amazon CloudWatch Anomaly Detection is a feature that enables you to monitor your metrics for unusual behavior. It uses machine learning algorithms to continuously analyze your metrics and detect anomalies. When an anomaly is detected, CloudWatch sends an alert to notify you of the issue.

🔍 Amazon Lookout for Metrics

Amazon Lookout for Metrics is a machine learning service that detects anomalies in your metrics. It uses machine learning to automatically identify anomalies in your metrics and provide you with insights into the root cause of the issue.

📄 CloudWatch Logs

Amazon CloudWatch Logs is a managed service that makes it easy to centralize logs from all your systems, applications, and AWS services in one place. You can use CloudWatch Logs to monitor, store, and access your log files from Amazon EC2 instances, AWS CloudTrail, and other AWS services.

📊 CloudWatch Logs Live Tail

CloudWatch Logs Live Tail is a feature that enables you to view real-time log data from your CloudWatch Logs in a web browser. You can use Live Tail to monitor your logs and troubleshoot issues in real-time.

🔍 CloudWatch Logs Metric Filter

CloudWatch Logs Metric Filter is a feature that enables you to extract metric data from your log data. You can use Metric Filters to search for specific terms, phrases, or values in your log data and create metrics based on that data.

📊 CloudWatch Agent and CloudWatch Log Agent

CloudWatch Agent and CloudWatch Log Agent are two agents that you can use to collect and send log data to CloudWatch. CloudWatch Agent is used to collect system-level metrics and logs from Amazon EC2 instances and on-premises servers. CloudWatch Log Agent is used to collect and send log data from Amazon EC2 instances and on-premises servers.

📈 CloudWatch Alarms

CloudWatch Alarms enable you to monitor metrics over a specified time period and perform one or more actions based on the value of the metric relative to a threshold over time. You can use CloudWatch Alarms to monitor any metric that CloudWatch supports.

🔍 CloudWatch Synthetics

Amazon CloudWatch Synthetics is a service that enables you to monitor your endpoints and APIs. You can use CloudWatch Synthetics to create canaries, which are scripts that run on a schedule to simulate user interactions with your endpoints and APIs.

📊 Amazon Athena

Amazon Athena is an interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL. Athena is serverless, so there is no infrastructure to manage, and you pay only for the queries that you run.

✨ The Journey Continues: As Day 8 wraps up, I'm excited about the depth of understanding gained and the practical skills acquired. Stay tuned for more updates as my AWS DevOps journey continues to unfold!

If you have any doubts or suggestions or any questions let's connect onLinkedInorTwitter(X).

💡 Course Progress - Day 7: Unveiling AWS Auto Scaling, ALB Rules, Multi-AZ Architectures, and More!

As we navigate through AWS intricacies, let's delve into the diverse topics covered and gain valuable insights for our cloud endeavors.

🔍 Key Learnings

🌐 AWS Auto Scaling Groups

AWS Auto Scaling Groups is a service that automatically adjusts the number of Amazon EC2 instances in a group based on the demand for the application. Auto Scaling Groups can be used to maintain application availability and scale capacity up or down based on the application’s needs.

🔄 Auto Scaling Policies

Auto Scaling Policies are rules that define how Auto Scaling should adjust the number of instances in a group based on changes in demand. Auto Scaling Policies can be used to scale up or down the number of instances in a group based on metrics such as CPU utilization, network traffic, or other custom metrics.

🔄 Lifecycle Hooks in Auto Scaling Groups

Auto Scaling Lifecycle Hooks are a way to perform custom actions when instances are launched or terminated in an Auto Scaling Group. Lifecycle Hooks can be used to perform tasks such as installing software, configuring instances, or performing other custom actions.

🌐 Event Notification in Auto Scaling Group

Event Notification in Auto Scaling Group is a feature that allows you to receive notifications when certain events occur in your Auto Scaling Group. You can use Amazon SNS or Amazon EventBridge to receive notifications when instances are launched or terminated, or when other events occur in your Auto Scaling Group.

🔄 Termination Policies in Auto Scaling Group

Termination Policies in Auto Scaling Group are rules that determine which instances should be terminated when scaling in. Termination Policies can be used to control which instances are terminated first when scaling in, based on criteria such as instance age, launch configuration, or other custom criteria.

🌐 Warm Pools in Auto Scaling Group

Warm Pools in Auto Scaling Group is a feature that allows you to maintain a pool of pre-warmed instances that can be used to quickly scale up your application. Warm Pools can be used to reduce the time it takes to launch new instances when scaling up, by keeping a pool of pre-warmed instances ready to use.

🌐 Application Auto Scaling

Application Auto Scaling is a service that lets you automatically scale resources in response to demand for your applications. Application Auto Scaling can be used to scale Amazon EC2 instances, Amazon ECS tasks, Amazon DynamoDB tables, and other AWS resources.

🌐 Elastic Load Balancer ALB Rules

Elastic Load Balancer ALB Rules are a way to route traffic to different target groups based on the content of the request. ALB Rules can be used to route traffic based on the URL path, host header, HTTP header, or query string parameters.

🔒 NAT Gateway

NAT Gateway is a service that allows you to provide outbound internet connectivity to resources in a private subnet. NAT Gateway can be used to allow resources in a private subnet to access the internet, while still maintaining a secure environment.

🔄 Multi-AZ Architectures in AWS

Multi-AZ Architectures in AWS are architectures that span multiple Availability Zones in a region. Multi-AZ Architectures can be used to provide high availability and fault tolerance for applications, by ensuring that resources are available even if an entire Availability Zone becomes unavailable.

🔄 Blue-Green Architecture

Blue-Green Architecture is a deployment strategy that involves running two identical environments, one active and one inactive. Blue-Green Architecture can be used to minimize downtime during deployments, by switching traffic from the inactive environment to the active environment once the deployment is complete.

🌐 Multi-Region Architecture in AWS

Multi-Region Architecture in AWS is an architecture that spans multiple regions. Multi-Region Architectures can be used to provide high availability and disaster recovery for applications, by ensuring that resources are available even if an entire region becomes unavailable.

🚨 AWS Disaster Recovery

AWS Disaster Recovery is a set of tools and services that can be used to recover from disasters such as natural disasters, cyber-attacks, or other events that can cause data loss or downtime. AWS Disaster Recovery can be used to replicate data across regions, automate failover, and provide other disaster recovery capabilities.

🕐 RTO (Recovery Time Objective) and RPO (Recovery Point Objective)

RTO (Recovery Time Objective) and RPO (Recovery Point Objective) are two key parameters for disaster recovery planning. RTO is the maximum amount of time it should take to restore normal operations following an outage or data loss. RPO is the maximum amount of data the organization can tolerate losing. This parameter is measured in time: from the moment a failure occurs to your last valid data backup.

For example, if a company has an RTO of 4 hours and an RPO of 1 hour, it means that the company can tolerate losing up to 1 hour of data and it should take no more than 4 hours to restore normal operations following an outage or data loss.

✨ The Journey Continues: As Day 7 wraps up, I'm excited about the depth of understanding gained and the practical skills acquired. Stay tuned for more updates as my AWS DevOps journey continues to unfold!

If you have any doubts or suggestions or any questions let's connect onLinkedInorTwitter(X).

💡 Course Progress - Day 6: Unveiling Amazon Kinesis, Route 53, Amazon RDS, Aurora, Elasticache, DynamoDB, AWS DMS, S3, and Storage Gateway!

As we continue our exploration of AWS services, let's delve into the diverse topics covered and gain insights for our cloud endeavors.

🔍 Key Learnings

🌊 Amazon Kinesis

Amazon Kinesis is a fully managed service that ingests, buffers, and processes streaming data in real-time. With Kinesis, you can ingest real-time data, such as video, audio, application logs, website clickstreams, and IoT telemetry data, for machine learning (ML), analytics, and other applications. Kinesis Data Streams, Kinesis Data Firehose, and Kinesis Data Analytics are the three services that make up the Kinesis streaming data platform.

🌊 Kinesis Data Streams

Amazon Kinesis Data Streams is a serverless streaming data service that simplifies the capture, processing, and storage of data streams at any scale. Kinesis Data Streams enables you to collect and process large streams of data records in real-time. You can create data-processing applications, known as Kinesis Data Streams applications, that use the Kinesis Client Library and run on Amazon EC2 instances.

🌊 Kinesis Data Stream Consumer Scaling

To scale your Kinesis Data Stream consumers, you can use the enhanced fan-out feature. Enhanced fan-out allows multiple consumers to read data from the same stream in parallel, without contending for read throughput with other consumers. When a consumer uses enhanced fan-out, it gets its own 2 MB/sec allotment of read throughput, allowing multiple consumers to read data from the same stream in parallel.

🔥 Kinesis Data Firehose

Amazon Kinesis Data Firehose is an extract, transform, and load (ETL) service that reliably captures, transforms, and delivers streaming data to data lakes, data stores, and analytics services. Kinesis Data Firehose is a fully managed service that makes it easy to capture, transform, and load massive volumes of streaming data from hundreds of thousands of sources into Amazon S3, Amazon Redshift, Amazon OpenSearch Service, Kinesis Data Analytics, generic HTTP endpoints, and service providers like Datadog, New Relic, MongoDB, and Splunk.

📊 Kinesis Data Analytics

Amazon Kinesis Data Analytics is a fully managed service that enables you to process and analyze streaming data using standard SQL. With Kinesis Data Analytics, you can construct applications that transform and provide insights into your data. You can use Kinesis Data Analytics to generate time-series analytics, feed real-time dashboards, and create real-time metrics.

🤖 Kinesis Data Analytics Using Machine Learning

You can use Amazon Kinesis Data Analytics for SQL Applications to perform machine learning (ML) on your streaming data. Kinesis Data Analytics supports the use of user-defined functions (UDFs) to perform custom transformations on your data. You can use UDFs to perform ML operations on your data, such as training models and making predictions.

🌐 Route 53

Amazon Route 53 is a highly available and scalable cloud Domain Name System (DNS) web service that translates domain names to IP addresses. Route 53 can be used to route users to Internet applications by translating human-readable names like www.example.com into the numeric IP addresses like 192.0.2.1 that computers use to connect to each other.

🌐 Routing Policies

1. Weighted Routing Policy: Weighted Routing Policy is a DNS routing policy that allows you to distribute traffic across multiple resources in proportions that you specify.

2. Latency Routing Policy: Latency Routing Policy is a DNS routing policy that allows you to route traffic based on the lowest network latency for your end user.

3. Failover in Routing Policy: Failover routing policy is a DNS routing policy that allows you to route traffic to a resource when the resource is healthy or to a different resource when the first resource is unhealthy. The primary and secondary records can route traffic to anything from an Amazon S3 bucket that is configured as a website to a complex tree of records. You can use failover routing policy for records in a private hosted zone.

💽 Amazon RDS

Amazon Relational Database Service (Amazon RDS) is a fully managed relational database service that makes it easy to set up, operate, and scale a relational database in the cloud. Amazon RDS provides cost-efficient and resizable capacity while automating time-consuming administration tasks such as hardware provisioning, database setup, patching, and backups.

🔄 Read Replicas in RDS

Amazon RDS Read Replicas are a way to scale reads in an RDS Database by creating multiple read-only, database instances of the primary database. RDS supports up to 15 read replicas per database instance and the read replicas can be located in the same availability zones, in different availability zones, or even in other regions. Every read replica can be promoted to its databases. However, the major limitation of read replicas is that it only supports select clause queries, which means all the database instances except the primary database instance will only support read operations. When data is written to the primary database instance it gets replicated to its read replicas by using asynchronous mode of replication.

🔒 RDS Multi-AZ

Amazon RDS Multi-AZ deployments provide enhanced availability and durability for database instances within a single region. With Multi-AZ, Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of a planned or unplanned outage of your primary instance, Amazon RDS automatically switches to the standby replica.

🔍 Key Difference between Real Replicas and RDS Multi-AZ

The key difference between Read Replicas and Multi-AZ is that Read Replicas are used to scale reads, while Multi-AZ is used to provide enhanced availability and durability for database instances.

💎 Amazon Aurora

Amazon Aurora is a MySQL and PostgreSQL-compatible relational database built for the cloud. Aurora combines the performance and availability of traditional enterprise databases with the simplicity and cost-effectiveness of open-source databases. Aurora is fully managed by Amazon Relational Database Service (RDS), which automates time-consuming administration tasks such as hardware provisioning, database setup, patching, and backups.

🚀 Amazon ElastiCache

Amazon ElastiCache is a fully managed in-memory data store and cache service that makes it easy to deploy, operate, and scale popular open source compatible in-memory data stores in the cloud. ElastiCache supports two open-source in-memory caching engines: Memcached and Redis.

🔄 ElastiCache Cluster Mode

ElastiCache Cluster Mode is a feature that allows you to partition your data across multiple Redis shards. With Cluster Mode enabled, you can scale your Redis workloads beyond the memory and I/O limits of a single node.

When Cluster Mode is disabled, ElastiCache runs Redis in a single-node configuration. The key difference between Cluster Mode enabled and disabled is that with Cluster Mode enabled, you can scale your Redis workloads beyond the memory and I/O limits of a single node.

🌐 Amazon DynamoDB

Amazon DynamoDB is a fully managed NoSQL database service that provides fast and predictable performance with seamless scalability. DynamoDB is designed to scale horizontally across multiple servers and geographic regions.

Advanced features of Amazon DynamoDB include:

• DynamoDB Streams: A feature that captures a time-ordered sequence of item-level modifications in any DynamoDB table.

• DynamoDB Global Tables: A feature that enables you to replicate DynamoDB tables across AWS Regions.

• DynamoDB Accelerator (DAX): A fully managed, highly available, in-memory cache for DynamoDB that delivers up to a 10x performance improvement.

🔍 AWS DMS

AWS Database Migration Service (AWS DMS) is a fully managed service that makes it easy to migrate relational databases, data warehouses, and NoSQL databases to AWS. You can use AWS DMS to migrate your data to and from the most widely used commercial and open-source databases.

📊 Monitoring AWS DMS

You can monitor AWS DMS using Amazon CloudWatch. CloudWatch provides metrics and alarms for monitoring the replication status, latency, and throughput of your AWS DMS tasks.

🌐 Amazon S3

Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. S3 provides developers and IT teams with secure, durable, and highly scalable object storage. With S3, you can store and retrieve any amount of data from anywhere on the web.

🔄 S3 Replication and How to Do It

Amazon S3 Replication is a feature that enables you to replicate objects across buckets in different AWS Regions. S3 Replication can be used to replicate objects between buckets in the same account or between buckets in different accounts. To set up S3 Replication, you can use the Amazon S3 Management Console or the AWS CLI. To set up S3 Replication using AWS Management Console you can follow these steps:

1. Create an Amazon S3 bucket in the source region.

2. Create an Amazon S3 bucket in the destination region.

3. Enable versioning on both the source and destination buckets.

4. Create an IAM role that Amazon S3 can assume to replicate objects on your behalf.

5. Add a replication configuration to your source bucket that specifies the destination bucket and the IAM role.

6. Configure the replication rule to replicate all objects or a subset of objects in the source bucket.

7. Monitor the replication progress using Amazon S3 metrics and CloudWatch alarms.

💾 AWS Storage Gateway

AWS Storage Gateway is a hybrid cloud storage service that enables your on-premises applications to seamlessly use AWS cloud storage. Storage Gateway provides three types of gateways: File Gateway, Volume Gateway, and Tape Gateway. Each gateway type provides a different way to connect your on-premises applications to AWS cloud storage.

🔄 File Gateway Cache Refresh

File Gateway Cache Refresh is a feature that enables you to refresh the cache for your Amazon S3 bucket. As your NFS or SMB client performs file system operations, your gateway maintains an inventory of the objects in the Amazon S3 object cache associated with your file share. Your gateway uses this cached inventory to reduce the latency and frequency of Amazon S3 requests. To refresh the S3 bucket object cache for your file share, you can use the Storage Gateway console or the Storage Gateway API.

✨ The Journey Continues: As Day 6 wraps up, I'm excited about the depth of understanding gained and the practical skills acquired. Stay tuned for more updates as my AWS DevOps journey continues to unfold!

If you have any doubts or suggestions or any questions let's connect on LinkedIn or Twitter(X).

💡 Course Progress - Day 5: Delving into OpsWorks, Lambda, API Gateway, ECS, ECR, and EKS!

As we navigate through diverse AWS services, let's dive into the wealth of insights acquired and the hands-on experiences gained.

🔍 Key Learnings

🛠 Overview of OpsWorks

AWS OpsWorks is a configuration management service that provides managed instances of Chef and Puppet. OpsWorks lets you use Chef and Puppet to automate how servers are configured, deployed, and managed across your Amazon EC2 instances or on-premises compute environments.

🔄 OpsWorks Lifecycle Events

AWS OpsWorks Stacks provides a set of lifecycle events that you can use to customize the deployment and configuration of your instances. Each layer has a set of five lifecycle events, each of which has an associated set of recipes that are specific to the layer. When an event occurs on a layer’s instance, AWS OpsWorks Stacks automatically runs the appropriate set of recipes. Here are the five lifecycle events:

1. Setup: This event occurs after a started instance has finished booting. AWS OpsWorks Stacks runs recipes that set the instance up according to its layer. For example, if the instance is a member of the Rails App Server layer, the Setup recipes install Apache, Ruby Enterprise Edition, Passenger, and Ruby on Rails.

2. Configure: This event occurs on all of the stack’s instances when one of the following occurs: an instance enters or leaves the online state, you associate an Elastic IP address with an instance or disassociate one from an instance, or you attach an Elastic Load Balancing load balancer to a layer, or detach one from a layer. AWS OpsWorks Stacks responds to the Configure event by running each layer’s Configure recipes, which update the instances’ configuration to reflect the current set of online instances.

3. Deploy: This event occurs when you run a Deploy command, typically to deploy an application to a set of application server instances. The instances run recipes that deploy the application and any related files from its repository to the layer’s instances.

4. Undeploy: This event occurs when you run an Undeploy command, typically to remove an application from a set of application server instances. The instances run recipes that remove the application and any related files from its repository from the layer’s instances.

5. Shutdown: This event corresponds to the Shutdown lifecycle event, which runs the instance’s Shutdown recipes. These recipes perform tasks such as shutting down services, but they do not stop the instance.

Note: According to the AWS, OpsWorks will get discontinued after May 26, 2024. If you have any more questions regarding to the end of life of OpsWorks you can click here.

📊 OpsWorks CloudWatch Event Integration

AWS OpsWorks Stacks supports Amazon CloudWatch Logs to simplify the process of monitoring logs on multiple instances. You enable CloudWatch Logs at the layer level in AWS OpsWorks Stacks. CloudWatch Logs integration works with Chef 11.10 and Chef 12 Linux-based stacks.

🧹 Cleanup of OpsWorks

To prevent incurring additional charges to your AWS account, you can delete the AWS resources that were used for this walkthrough. These AWS resources include the AWS OpsWorks Stacks stack and the stack’s components. To delete the stack, you can use the AWS Management Console or the AWS CLI.

🌐 Lambda Function Fundamentals

AWS Lambda is a serverless compute service that lets you run code without provisioning or managing servers. Lambda runs your code only when needed and scales automatically, from a few requests per day to thousands per second. You pay only for the compute time that you consume - there is no charge when your code is not running.

🔄 Versioning and Aliasing in Lambda Functions

You can create aliases for your Lambda function. A Lambda alias is a pointer to a function version that you can update. The function’s users can access the function version using the alias Amazon Resource Name (ARN). When you deploy a new version, you can update the alias to use the new version, or split traffic between two versions.

🔐 Working with Environment Variables in Lambda Functions

You can use environment variables to store secrets and configuration values for your Lambda function. Environment variables are key-value pairs that you can dynamically pass to your function code at runtime. You can use environment variables to store sensitive information such as database passwords or API keys.

📈 Lambda Concurrency

AWS Lambda automatically scales your application in response to incoming requests. Concurrency is the number of requests that your function is serving at any given time. AWS Lambda automatically provisions enough capacity to handle the request volume, so that your function can scale without requiring you to manage any infrastructure.

📂 Mounting File System in Lambda

You can mount an Amazon Elastic File System (Amazon EFS) file system to your AWS Lambda function. This enables your function to read and write data to the file system. To mount an Amazon EFS file system to your Lambda function, you can use the amazon-efs-utils package.

🌐 Cross-Account File System Mounting

To mount an Amazon EFS file system from another AWS account, you can use AWS Resource Access Manager (RAM). RAM enables you to share your Amazon EFS file systems across AWS accounts. You can use RAM to create a resource share that grants access to your Amazon EFS file system to another AWS account.

🚀 Introduction to API Gateway

Amazon API Gateway is a fully managed service that makes it easy for developers to create, publish, maintain, monitor, and secure APIs at any scale. With API Gateway, you can create RESTful APIs that enable real-time two-way communication applications.

📊 Stages and Deployment in API Gateway

API Gateway enables you to create multiple stages for your APIs, such as development, test, and production. Each stage is a snapshot of your API that you can manage independently. You can deploy your API to a stage by creating a deployment.

📄 OpenAPI Integration with AWS API Gateway

OpenAPI is a specification for building APIs. To learn more about OpenAPI click here. You can use OpenAPI to define your API Gateway APIs. To import an OpenAPI definition file into API Gateway, you can use the AWS::ApiGateway::RestApi resource type in your AWS CloudFormation template 1. You can then use the AWS::ApiGateway::Deployment resource type to deploy the API.

📈 API Gateway Caching

API Gateway caching is a technique that involves storing the responses from API calls in a cache and serving them directly from the cache instead of making repeated requests to the backend services. This caching mechanism can greatly reduce the response time and alleviate the load on your backend systems.

🚦 Canary Deployment in API Gateway

Canary deployment is a software development strategy in which a new version of an API is deployed for testing purposes, and the base version remains deployed as a production release for normal operations on the same stage. In a canary release deployment, total API traffic is separated at random into a production release and a canary release with a pre-configured ratio. The updated API features are only visible to API traffic through the canary.

📊 API Gateway Monitoring, Logging, and Tracing

Monitoring is an important part of maintaining the reliability, availability, and performance of API Gateway and your AWS solutions. You should collect monitoring data from all of the parts of your AWS solution so that you can more easily debug a multi-point failure if one occurs. AWS provides several tools for monitoring your API Gateway resources and responding to potential incidents, such as Amazon CloudWatch Logs, Amazon CloudWatch Alarms, Access Logging to Kinesis Data Firehose, AWS CloudTrail, AWS X-Ray, and AWS Config.

🌐 Introduction to AWS ECS

Amazon Elastic Container Service (Amazon ECS) is a fully managed container orchestration service that helps you easily deploy, manage, and scale containerized applications. As a fully managed service, Amazon ECS comes with AWS configuration and operational best practices built-in. You can run and scale your container workloads across AWS Regions in the cloud, and on-premises, without the complexity of managing a control plane.

🔄 Types of ECS

There are two types of Amazon ECS launch types: Amazon ECS on EC2 and AWS Fargate. Amazon ECS on EC2 allows you to manage your own EC2 instances to run containers, providing maximum control and flexibility. AWS Fargate, on the other hand, abstracts the underlying infrastructure, making it a serverless option ideal for simplified deployments.

📈 ECS Auto Scaling

Amazon ECS Auto Scaling is a service that automatically scales your Amazon ECS tasks based on the demand of your applications. You can use Amazon ECS Auto Scaling to automatically adjust the number of tasks in your service based on the metrics and thresholds that you specify.

Note: This is different from EC2 Auto Scaling. This is based on TASKS not EC2 INSTANCE.

📊 Logging in ECS

You can use Amazon CloudWatch Logs to monitor, store, and access your log files from Amazon ECS. To enable logging for your Amazon ECS tasks, you can use the awslogs log driver in your task definition. You can then use CloudWatch Logs to view and analyze your log data.

🌐 Introduction to AWS ECR

Amazon Elastic Container Registry (Amazon ECR) is a fully-managed Docker container registry that makes it easy for developers to store, manage, and deploy Docker container images. Amazon ECR eliminates the need to operate your own container repositories or worry about scaling the underlying infrastructure.

🌐 Introduction to AWS EKS

Amazon Elastic Kubernetes Service (Amazon EKS) is a fully managed Kubernetes service that makes it easy to deploy, manage, and scale containerized applications using Kubernetes on AWS. Amazon EKS runs the Kubernetes management infrastructure for you across multiple AWS availability zones to eliminate a single point of failure.

📊 Logging in EKS

You can use Amazon CloudWatch Logs to monitor, store, and access your log files from Amazon EKS. To enable logging for your Amazon EKS cluster, you can use the awslogs log driver in your Kubernetes pod definition. You can then use CloudWatch Logs to view and analyze your log data.

✨ The Journey Continues: As Day 5 wraps up, I'm excited about the depth of understanding gained and the practical skills acquired. Stay tuned for more updates as my AWS DevOps journey continues to unfold!

If you have any doubts or suggestion or any questions let's connect on LinkedIn or Twitter(X).

💻 Course Progress - Day 4: Navigating AWS Service Catalog, Elastic Beanstalk, SAM, CDK, Step Functions, AppConfig, and SSM!

Continuing our journey, today's focus extended to a variety of AWS services, each playing a crucial role in cloud development and operations.

🔍 Overview of Service Catalog

AWS Service Catalog enables organizations to create and manage catalogs of IT services that are approved for use on AWS. With Service Catalog, you can centrally manage commonly deployed AWS resources, and make them available for users to deploy through a self-service portal.

AWS Service Catalog took center stage, revealing its significance in streamlining service delivery within organizations. It's a game-changer for managing and provisioning cloud resources efficiently.

💨 Elastic Beanstalk

AWS Elastic Beanstalk is a fully managed service that makes it easy to deploy and run applications in multiple languages, including Java, .NET, PHP, Node.js, Python, Ruby, and Go. Elastic Beanstalk automatically handles the deployment, capacity provisioning, load balancing, and scaling of your application.

Elastic Beanstalk, a powerhouse for simplifying application deployment, showcased its prowess. From creating highly available environments to exploring different deployment modes, it's a go-to solution for developers.

How to make a Highly available environment in Elastic Beanstalk

To make a highly available environment in Elastic Beanstalk, you can use Elastic Beanstalk’s High Availability configuration option. This option automatically provisions resources across multiple Availability Zones to ensure that your application is highly available and fault tolerant.

What are the Elastic Beanstalk deployment modes?

Elastic Beanstalk supports two deployment modes: web server environment and worker environment. In a web server environment, Elastic Beanstalk deploys your application to a web server environment that can serve HTTP requests. In a worker environment, Elastic Beanstalk deploys your application to a worker environment that can process background tasks.

📦 Serverless Application Model (SAM)

AWS Serverless Application Model (SAM) is an open-source framework for building serverless applications. SAM provides a simplified way of defining the Amazon API Gateway APIs, AWS Lambda functions, and Amazon DynamoDB tables needed by your serverless application.

The Serverless Application Model (SAM) caught my attention, offering a fantastic framework for building serverless applications. Integrating SAM with CodeDeploy, the deployment process became even more seamless. You can use AWS CodeDeploy with SAM to deploy your serverless applications. CodeDeploy automates the deployment of your application to Amazon S3, AWS Lambda, and Amazon EC2 instances.

🌐 Cloud Development Kit (CDK)

AWS Cloud Development Kit (CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. CDK provides a high-level object-oriented abstraction on top of AWS CloudFormation

AWS CDK, a tool for defining cloud infrastructure as code using familiar programming languages, provided a fresh perspective. This modern approach to infrastructure management empowers developers with flexibility.

🔄 Step Functions

AWS Step Functions is a fully managed service that makes it easy to coordinate the components of distributed applications and microservices using visual workflows. You can use Step Functions to build applications from individual building blocks, each of which performs a discrete function.

AWS Step Functions stepped into the limelight, enabling the creation of serverless workflows for coordinating application components. Invoking Lambda functions through Step Functions added a layer of efficiency to the workflow.

How to invoke lambda using step functions

To invoke a Lambda function using Step Functions, you can use the AWS::Lambda::Function resource type in your AWS CloudFormation template. You can then use the AWS::StepFunctions::Task resource type to define a task that invokes the Lambda function.

🚀 AppConfig

AWS AppConfig is a service that enables you to quickly deploy application configurations across your applications. You can use AppConfig to manage configurations for any application running on any environment.

AppConfig took the stage, offering a comprehensive solution for managing application configurations. The insights gained will undoubtedly streamline configuration management in future projects.

💡 SSM

AWS Systems Manager (SSM) is a management service that enables you to manage your EC2 instances, on-premises servers, and virtual machines (VMs) through a single interface. You can use SSM to automate common administrative tasks, such as patch management, configuration management, and instance inventory.

How to start an EC2 instance with an SSM agent?

To start an EC2 instance with an SSM agent, you can use the AWS::EC2::Instance resource type in your AWS CloudFormation template. You can then use the AWS::SSM::Association resource type to associate the instance with an SSM document that installs the SSM agent.

Diving deep into AWS Systems Manager (SSM), I explored starting EC2 instances with SSM agents, understanding the importance of tags, leveraging SSM documents, and run commands for efficient automation.

Tags and SSM Resources

You can use tags to organize and categorize your SSM resources. You can add tags to your SSM resources when you create them, or you can add tags to existing resources.

SSM Documents and SSM Run commands

SSM documents are scripts that you can use to automate common administrative tasks on your instances. You can use SSM Run Command to execute SSM documents on your instances.

🤖 Automation

SSM documents are scripts that you can use to automate common administrative tasks on your instances. You can use SSM Run Command to execute SSM documents on your instances.

How can we Automate things with SSM?

AWS Systems Manager (SSM) provides a variety of capabilities to automate common administrative tasks on your instances and resources. Here are some ways you can automate things with SSM:

• Automation: Use Automation to simplify creating Amazon Machine Images (AMIs) from the AWS Marketplace or custom AMIs, using public Systems Manager documents (SSM documents) or by authoring your own workflows.

• Compliance: Use Compliance to monitor the compliance of your instances and resources against predefined policies and to generate compliance reports.

• Parameter Store: Use Parameter Store to centrally manage global configuration settings.

• Patch Manager: Use Patch Manager to roll out patches at scale and increase fleet compliance visibility across your nodes.

• Session Manager: Use Session Manager to troubleshoot issues on your instances, run commands on your instances, and perform administrative tasks on your instances.

• Hybrid Environments: Use SSM Hybrid Environments to manage your on-premises servers and VMs.

• IoT Greengrass: Use SSM with IoT Greengrass to manage your IoT Greengrass devices and to automate common administrative tasks.

• Default Host Management Configuration: Use Default Host Management Configuration to automatically track Amazon EC2 instances using Fleet Manager, use Run Command on remote instances, and securely connect to the instances using Session Manager.

The day unfolded with a deep dive into SSM automation, exploring its varied use cases. From dynamic host management configuration to SSM Compliance, it's clear that automation is at the heart of AWS operational excellence.

✨ The Journey Continues: As Day 4 wraps up, I'm excited about the depth of understanding gained and the practical skills acquired. Stay tuned for more updates as my AWS DevOps journey continues to unfold!

📚 Course Progress - Day 3: AWS CloudFormation Deep Dive! 💻🌐

Continuing my AWS DevOps certification journey with the invaluable guidance of Stéphane Maarek's Udemy course, Day 3 marked an in-depth exploration into the powerful realm of AWS CloudFormation.

💡 AWS CloudFormation Overview:

• Unveiled the fundamental concepts behind AWS CloudFormation, understanding its role in orchestrating and managing AWS resources.

AWS CloudFormation is a service that helps you model and set up your Amazon Web Services resources so that you can spend less time managing those resources and more time focusing on your applications that run in AWS. You create a template that describes all the AWS resources that you want, and AWS CloudFormation takes care of provisioning and configuring those resources for you. You don’t need to individually create and configure AWS resources and figure out what’s dependent on what; AWS CloudFormation handles all of that for you.

🛠️ Creating CloudFormation Stack:

• Explored the step-by-step process of creating a CloudFormation stack, laying the foundation for automated resource provisioning.

To create a stack, you run the aws cloudformation create-stack command. You must provide the stack name, the location of a valid template, and any input parameters. Parameters are separated with a space and the key names are case sensitive. If you mistype a parameter key name when you run aws cloudformation create-stack, AWS CloudFormation doesn’t create the stack and reports that the template doesn’t contain that parameter. You can use your own bucket and manage its permissions by manually uploading templates to either Amazon S3 or AWS Systems Manager. Then whenever you create or update a stack, specify the Amazon S3 or AWS Systems Manager of a template file. By default, aws cloudformation describe-stacks returns parameter values. To prevent sensitive parameter values such as passwords from being returned, include a NoEcho property set to TRUE in your AWS CloudFormation template.

🚫 Deleting and Updating Stacks:

• Learned the intricacies of deleting and updating CloudFormation stacks, ensuring a smooth management process.

To delete a stack, you run the aws cloudformation delete-stack command. You must provide the stack name. To update a stack, you run the aws cloudformation update-stack command. You must provide the stack name, the location of a valid template, and any input parameters. Parameters are separated with a space and the key names are case sensitive.

Note: You can also Create, Update & Delete Stacks via AWS Management Console.

📝 YAML Crash Course:

• Provided a YAML crash course with sample files, empowering readers to grasp the essentials of writing YAML for CloudFormation templates.

YAML is a human-readable data serialization format. It is often used for configuration files and data exchange between languages that are not natively compatible. Here is a sample YAML file that you can use to learn how to write YAML:

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  MyBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: my-bucket-name
      AccessControl: PublicRead

🧱 CloudFormation Resources:

• Explored the concept of resources in CloudFormation, understanding how they represent the building blocks of your infrastructure.

In AWS CloudFormation, a resource is an AWS entity that you can create, modify, or delete as a single unit in a CloudFormation stack. AWS CloudFormation provides a number of built-in resource types, such as Amazon EC2 instances, Amazon RDS database instances, and Amazon S3 buckets. You can also create custom resources.

Here is an example YAML file for learning CloudFormation Resources.

Parameters:
  S3BucketName:
    Type: String
    Description: "S3 bucket to create"
    AllowedPattern: "[a-zA-Z][a-zA-Z0-9_-]*"

Resources:
  SampleS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref S3BucketName
    DeletionPolicy: Delete

  S3CustomResource:
    Type: Custom::S3CustomResource
    Properties:
      ServiceToken: !GetAtt AWSLambdaFunction.Arn
      bucket_name: !Ref SampleS3Bucket    ## Additional parameter here

  AWSLambdaFunction:
     Type: AWS::Lambda::Function
     Properties:
       Description: "Empty an S3 bucket!"
       FunctionName: !Sub '${AWS::StackName}-${AWS::Region}-lambda'
       Handler: index.handler
       Role: !GetAtt AWSLambdaExecutionRole.Arn
       Timeout: 360
       Runtime: python3.8
       Code:
         ZipFile: |
          import boto3
          import cfnresponse
          ### cfnresponse module help in sending responses to CloudFormation
          ### instead of writing your own code

          def handler(event, context):
              # Get request type
              the_event = event['RequestType']        
              print("The event is: ", str(the_event))

              response_data = {}
              s3 = boto3.client('s3')

              # Retrieve parameters (bucket name)
              bucket_name = event['ResourceProperties']['bucket_name']

              try:
                  if the_event == 'Delete':
                      print("Deleting S3 content...")
                      b_operator = boto3.resource('s3')
                      b_operator.Bucket(str(bucket_name)).objects.all().delete()

                  # Everything OK... send the signal back
                  print("Execution succesfull!")
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, response_data)
              except Exception as e:
                  print("Execution failed...")
                  print(str(e))
                  response_data['Data'] = str(e)
                  cfnresponse.send(event, context, cfnresponse.FAILED, response_data)

  AWSLambdaExecutionRole:
     Type: AWS::IAM::Role
     Properties:
       AssumeRolePolicyDocument:
         Statement:
         - Action:
           - sts:AssumeRole
           Effect: Allow
           Principal:
             Service:
             - lambda.amazonaws.com
         Version: '2012-10-17'
       Path: "/"
       Policies:
       - PolicyDocument:
           Statement:
           - Action:
             - logs:CreateLogGroup
             - logs:CreateLogStream
             - logs:PutLogEvents
             Effect: Allow
             Resource: arn:aws:logs:*:*:*
           Version: '2012-10-17'
         PolicyName: !Sub ${AWS::StackName}-${AWS::Region}-AWSLambda-CW
       - PolicyDocument:
           Statement:
           - Action:
             - s3:PutObject
             - s3:DeleteObject
             - s3:List*
             Effect: Allow
             Resource:
             - !Sub arn:aws:s3:::${SampleS3Bucket}
             - !Sub arn:aws:s3:::${SampleS3Bucket}/*
           Version: '2012-10-17'
         PolicyName: !Sub ${AWS::StackName}-${AWS::Region}-AWSLambda-S3
       RoleName: !Sub ${AWS::StackName}-${AWS::Region}-AWSLambdaExecutionRole

🔄 CloudFormation Parameters:

• Dived into CloudFormation parameters, allowing for dynamic input and customization during stack creation.

AWS CloudFormation parameters enable you to pass values into your AWS CloudFormation stack at runtime. You can use parameters to customize your stack and make it more reusable.

🗺️ CloudFormation Mappings:

• Unpacked CloudFormation mappings, facilitating the association of key-value pairs based on input parameters.

AWS CloudFormation mappings enable you to create a lookup table of keys and associated values that you can use to specify conditional parameter values, resource property values, and output values.

💼 CloudFormation Outputs:

• Explored CloudFormation outputs, understanding their significance in exposing information from the stack.

AWS CloudFormation outputs enable you to export information about the resources in your stack to other stacks or to view them in the AWS Management Console.

🔍 CloudFormation Conditions:

• Delved into CloudFormation conditions, enabling the creation of conditional resources based on specific criteria.

AWS CloudFormation conditions enable you to control whether certain resources are created or whether certain resource properties are assigned a value during stack creation or update.

🔄 CloudFormation Intrinsic Functions:

• Explored CloudFormation intrinsic functions, offering dynamic and flexible options within templates.

AWS CloudFormation intrinsic functions enable you to assign values to properties that are not available until runtime, such as the Amazon EC2 instance ID or the Amazon S3 bucket name.

↩️ CloudFormation Rollback:

• Understood CloudFormation rollback mechanisms, ensuring reliable and controlled deployments.

AWS CloudFormation rollback enables you to automatically roll back to a previous version of your stack if the update fails.

🔄 CloudFormation Drift:

• Examined CloudFormation drift detection, allowing for the identification of resource configuration changes.

AWS CloudFormation drift detection enables you to detect whether the actual configuration of a stack differs, or has drifted, from its expected configuration.

📜 CloudFormation Stack Policies:

• Unveiled CloudFormation stack policies, providing granular control over updates to stack resources.

AWS CloudFormation stack policies enable you to prevent updates to specific resources in a stack.

🔄 Nested Stacks:

• Explored the concept of nested stacks, facilitating the modularization of complex infrastructure.

AWS CloudFormation nested stacks enable you to create stacks within stacks

🔄 CloudFormation Change Sets:

• Dived into CloudFormation change sets, enabling preview and execution of proposed changes before implementation.

AWS CloudFormation change sets enable you to preview the changes to your stack before you apply them.

🚫 Deletion Policy:

• Learned about CloudFormation deletion policies, managing resources during stack deletion.

AWS CloudFormation deletion policy enables you to specify how AWS CloudFormation handles the deletion of resources.

🛡️ Termination Protection:

• Explored CloudFormation termination protection, preventing accidental deletion of critical stacks.

AWS CloudFormation termination protection enables you to prevent a stack from being accidentally deleted.

🖥️ EC2 UserData in CloudFormation:

• Delved into EC2 UserData in CloudFormation, allowing for the customization of instances during launch.

AWS CloudFormation EC2 user data enables you to run scripts or commands on an Amazon EC2 instance during launch.

📜 Overview of CloudFormation CNF-init:

• Explored CloudFormation CNF-init, understanding its role in initializing and configuring instances.

You can use the cfn-init command to read template metadata from the AWS::CloudFormation::Init key and act accordingly to fetch and parse metadata from CloudFormation, install packages, write files to disk, enable/disable, and start/stop services. You can also use cfn-init to update an existing file, create a backup copy of the original file in the same directory with a .bak extension, and produce two files: the original file’s contents and the updated contents.

To check if all the stages of user data are completed or not, you can use the cfn-signal command. This command sends a signal to AWS CloudFormation that indicates whether the instance has been successfully configured. If the instance is successfully configured, the cfn-signal command returns a success signal. If the instance is not successfully configured, the cfn-signal command returns a failure signal.

Here are the four stages of AWS CloudFormation CNF-init:

• cfn-init: This command reads template metadata from the AWS::CloudFormation::Init key and acts accordingly to fetch and parse metadata from CloudFormation, install packages, write files to disk, enable/disable, and start/stop services. You can use CNF-init to run scripts or commands on an Amazon EC2 instance during launch.

• cfn-signal: This command sends a signal to AWS CloudFormation that indicates whether the instance has been successfully configured . If the instance is successfully configured, the cfn-signal command returns a success signal. If the instance is not successfully configured, the cfn-signal command returns a failure signal.

• cfn-hup: This command is used to detect changes to the metadata on an Amazon EC2 instance and to trigger actions based on those changes. You can use cfn-hup to monitor changes to the metadata and to perform actions such as updating configuration files or restarting services.

• cfn-get-metadata: A wrapper script making it easy to retrieve either all metadata defined for a resource or path to a specific key or subtree of resource metadata.

Here is an example YAML file for learning how it works.

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS CloudFormation Sample Template for CFN Init
Parameters:
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instances
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: must be the name of an existing EC2 KeyPair.

  SSHLocation:
    Description: The IP address range that can be used to SSH to the EC2 instances
    Type: String
    MinLength: '9'
    MaxLength: '18'
    Default: 0.0.0.0/0
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.

  MyS3BucketName:
    Description: Name of an existing bucket to download files from
    Type: String

  ImageId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2

Resources:
  WebServerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable HTTP access via port 80 and SSH access via port 22
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: 22
        ToPort: 22
        CidrIp: !Ref SSHLocation

  WebServerHost:
    Type: AWS::EC2::Instance
    Metadata:
      Comment: Install a simple PHP application
      AWS::CloudFormation::Init:
        config:
          packages:
            yum:
              httpd: []
              php: []
          groups:
            apache: {}
          users:
            "apache":
              groups:
                - "apache"
          sources:
            "/home/ec2-user/aws-cli": "https://github.com/aws/aws-cli/tarball/master"
          files:
            "/tmp/cwlogs/apacheaccess.conf":
              content: !Sub |
                [general]
                state_file= /var/awslogs/agent-state
                [/var/log/httpd/access_log]
                file = /var/log/httpd/access_log
                log_group_name = ${AWS::StackName}
                log_stream_name = {instance_id}/apache.log
                datetime_format = %d/%b/%Y:%H:%M:%S
              mode: '000400'
              owner: apache
              group: apache
            "/var/www/html/index.php":
              content: !Sub |
                <?php
                echo '<h1>AWS CloudFormation sample PHP application for ${AWS::StackName}</h1>';
                ?>
              mode: '000644'
              owner: apache
              group: apache
            "/etc/cfn/cfn-hup.conf":
              content: !Sub |
                [main]
                stack=${AWS::StackId}
                region=${AWS::Region}
              mode: "000400"
              owner: "root"
              group: "root"
            "/etc/cfn/hooks.d/cfn-auto-reloader.conf":
              content: !Sub |
                [cfn-auto-reloader-hook]
                triggers=post.update
                path=Resources.WebServerHost.Metadata.AWS::CloudFormation::Init
                action=/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource WebServerHost --region ${AWS::Region}
              mode: "000400"
              owner: "root"
              group: "root"
            # Fetch a webpage from a private S3 bucket
            "/var/www/html/webpage.html":
              source: !Sub "https://${MyS3BucketName}.s3.${AWS::Region}.amazonaws.com/webpage.html"
              mode: '000644'
              owner: apache
              group: apache
              authentication: S3AccessCreds
          commands:
            test:
              command: "echo \"$MAGIC\" > test.txt"
              env:
                MAGIC: "I come from the environment!"
              cwd: "~"
          services:
            sysvinit:
              httpd:
                enabled: 'true'
                ensureRunning: 'true'
              postfix:
                enabled: 'false'
                ensureRunning: 'false'
              cfn-hup:
                enable: 'true'
                ensureRunning: 'true'
                files:
                  - "/etc/cfn/cfn-hup.conf"
                  - "/etc/cfn/hooks.d/cfn-auto-reloader.conf"
      AWS::CloudFormation::Authentication:
        # Define S3 access credentials
        S3AccessCreds:
          type: S3
          buckets:
            - !Sub ${MyS3BucketName}
          roleName: !Ref InstanceRole
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M

    Properties:
      ImageId: !Ref ImageId
      KeyName: !Ref KeyName
      InstanceType: t2.micro
      IamInstanceProfile: !Ref InstanceProfile # Reference Instance Profile
      SecurityGroups:
      - !Ref WebServerSecurityGroup
      UserData:
        Fn::Base64:
          !Sub |
            #!/bin/bash -xe

            # Get the latest CloudFormation helper scripts
            yum install -y aws-cfn-bootstrap

            # Start cfn-init
            /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource WebServerHost --region ${AWS::Region}

            # cfn-init completed so signal success or not
            /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource WebServerHost --region ${AWS::Region}


  InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: 'sts:AssumeRole'
            Principal:
              Service: ec2.amazonaws.com
            Effect: Allow
            Sid: ''
      Policies:
        - PolicyName: AuthenticatedS3GetObjects
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Action:
                  - 's3:GetObject'
                Resource: !Sub 'arn:aws:s3:::${MyS3BucketName}/*'
                Effect: Allow

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref InstanceRole

Outputs:
  InstanceId:
    Description: The instance ID of the web server
    Value:
      !Ref WebServerHost
  WebsiteURL:
    Value:
      !Sub 'http://${WebServerHost.PublicDnsName}'
    Description: URL for newly created LAMP stack
  PublicIP:
    Description: Public IP address of the web server
    Value:
      !GetAtt WebServerHost.PublicIp

🔄 Continue Rollingback and Update:

• Understood the continuation of rollback and update processes in CloudFormation.

AWS CloudFormation continue rollback and update enables you to continue rolling back or updating a stack even if one or more resources in the stack fail to create or update. This feature enables you to recover from failed stack updates more easily and reduces the risk of downtime.

🔄 Custom Resources in CloudFormation:

• Explored the creation and utilization of custom resources, enhancing template flexibility.

AWS CloudFormation custom resources enable you to write custom provisioning logic in AWS Lambda functions and use them in your CloudFormation templates. You can use custom resources to create, modify, or delete resources that are not available as CloudFormation resource types.

🧑‍🔧 CloudFormation Service Role:

• Gained insights into CloudFormation service roles, defining the permissions required for stack operations.

AWS CloudFormation service role is an AWS Identity and Access Management (IAM) role that AWS CloudFormation assumes when it creates or updates resources in your stack. The service role enables AWS CloudFormation to perform actions on your behalf, such as creating or deleting Amazon S3 buckets or launching Amazon EC2 instances.

🔐 CloudFormation SSM Parameters:

• Understood the integration of AWS Systems Manager (SSM) parameters within CloudFormation.

AWS CloudFormation SSM parameters enable you to store and manage configuration data for your applications and services. You can use SSM parameters to store secrets, such as database passwords, and other configuration data, such as the IP addresses of your Amazon EC2 instances.

Here is an example YAML file to learn SSM Perameters.

Parameters:
  InstanceType:
    Description: WebServer EC2 instance type
    Type: AWS::SSM::Parameter::Value<String>
    Default: /dev/ec2/instanceType

  ImageId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2

Resources:
  MyEC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Ref InstanceType
      ImageId: !Ref ImageId

🔄 CloudFormation Dynamic Reference:

• Delved into CloudFormation dynamic references, enabling dynamic retrieval of parameter values.

AWS CloudFormation dynamic references enable you to reference values that are not available until runtime, such as the Amazon EC2 instance ID or the Amazon S3 bucket name.

Here is an example of how to use Dynamic Reference.

Parameters:
  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instances
  ImageId: # Public SSM Paramater
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2

Resources:
  MyEC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref ImageId
      KeyName: !Ref KeyName
      # ssm dynamic reference
      InstanceType: '{{resolve:ssm:/ec2/instanceType:1}}'

  MyIAMUser:
    Type: AWS::IAM::User
    Properties:
      UserName: 'sample-user'
      LoginProfile:
        # ssm-secure dynamic reference (latest version)
        Password: '{{resolve:ssm-secure:/iam/userPassword}}'

  MyDBInstance:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceClass: db.t2.micro
      Engine: mysql
      AllocatedStorage: "20"
      VPCSecurityGroups:
      - !GetAtt [DBEC2SecurityGroup, GroupId]
      # secretsmanager dynamic reference
      MasterUsername: '{{resolve:secretsmanager:MyRDSSecret:SecretString:username}}'
      MasterUserPassword: '{{resolve:secretsmanager:MyRDSSecret:SecretString:password}}'

  DBEC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: 'Allow access from anywhwere to database'
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 3306
        ToPort: 3306
        CidrIp: "0.0.0.0/0"

🌐 CloudFormation Stack Sets:

• Explored CloudFormation stack sets, simplifying the management of stacks across multiple accounts and regions.

AWS CloudFormation stack sets enable you to create, update, or delete stacks across multiple accounts and regions with a single CloudFormation template. Stack sets enable you to manage your infrastructure at scale and reduce the time and effort required to deploy changes across your organization.

🌐 How to create Stack Sets:

To create a stack set, you can use the AWS Management Console or the AWS CLI. Here are the high-level steps to create a stack set:

1. Create a CloudFormation template that you want to use to create stacks.

2. Specify the target accounts in which you want to create stacks.

3. Identify the AWS Regions in which you want to deploy stacks in your target accounts.

4. Create the stack set using the create-stack-set command in the AWS CLI.

   You can create a stack set with either self-managed or service-managed permissions. With self-managed permissions, you can deploy stack instances to specific AWS accounts in specific Regions. With service-managed permissions, you can deploy stack instances to any AWS account in which you have permission to create an IAM role.

🔄 Finding Stack Set Drifts:

• Learned how to detect drifts in CloudFormation stack sets, ensuring consistent configurations.

To find stack set drifts, you can use the describe-stack-set-operation command. This command returns information about the status of a stack set operation, including any drift detection results.

🚫 Deleting Stack Sets:

• Explored the process of deleting CloudFormation stack sets when they are no longer needed.

To delete a stack set, you can use the delete-stack-set command. This command deletes the specified stack set and all associated stack instances.

I am giving you 3 YAML files to learn Stack sets. Refer it and see how everything works.

1. This is Stack Set

AWSTemplateFormatVersion: 2010-09-09
Description: Enable AWS Config

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Recorder Configuration
        Parameters:
          - AllSupported
          - IncludeGlobalResourceTypes
          - ResourceTypes
      - Label:
          default: Delivery Channel Configuration
        Parameters:
          - DeliveryChannelName
          - Frequency
      - Label:
          default: Delivery Notifications
        Parameters:
          - TopicArn
          - NotificationEmail
    ParameterLabels:
      AllSupported:
        default: Support all resource types
      IncludeGlobalResourceTypes:
        default: Include global resource types
      ResourceTypes:
        default: List of resource types if not all supported
      DeliveryChannelName:
        default: Configuration delivery channel name
      Frequency:
        default: Snapshot delivery frequency
      TopicArn:
        default: SNS topic name
      NotificationEmail:
        default: Notification Email (optional)

Parameters:
  AllSupported:
    Type: String
    Default: True
    Description: Indicates whether to record all supported resource types.
    AllowedValues:
      - True
      - False

  IncludeGlobalResourceTypes:
    Type: String
    Default: True
    Description: Indicates whether AWS Config records all supported global resource types.
    AllowedValues:
      - True
      - False

  ResourceTypes:
    Type: List<String>
    Description: A list of valid AWS resource types to include in this recording group, such as AWS::EC2::Instance or AWS::CloudTrail::Trail.
    Default: <All>

  DeliveryChannelName:
    Type: String
    Default: <Generated>
    Description: The name of the delivery channel.

  Frequency:
    Type: String
    Default: 24hours
    Description: The frequency with which AWS Config delivers configuration snapshots.
    AllowedValues:
      - 1hour
      - 3hours
      - 6hours
      - 12hours
      - 24hours

  TopicArn:
    Type: String
    Default: <New Topic>
    Description: The Amazon Resource Name (ARN) of the Amazon Simple Notification Service (Amazon SNS) topic that AWS Config delivers notifications to.

  NotificationEmail:
    Type: String
    Default: <None>
    Description: Email address for AWS Config notifications (for new topics).

Conditions:
  IsAllSupported: !Equals
    - !Ref AllSupported
    - True
  IsGeneratedDeliveryChannelName: !Equals
    - !Ref DeliveryChannelName
    - <Generated>
  CreateTopic: !Equals
    - !Ref TopicArn
    - <New Topic>
  CreateSubscription: !And
    - !Condition CreateTopic
    - !Not
      - !Equals
        - !Ref NotificationEmail
        - <None>

Mappings:
  Settings:
    FrequencyMap:
      1hour   : One_Hour
      3hours  : Three_Hours
      6hours  : Six_Hours
      12hours : Twelve_Hours
      24hours : TwentyFour_Hours

Resources:

  ConfigBucket:
    DeletionPolicy: Retain
    Type: AWS::S3::Bucket

  ConfigBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ConfigBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AWSConfigBucketPermissionsCheck
            Effect: Allow
            Principal:
              Service:
                - config.amazonaws.com
            Action: s3:GetBucketAcl
            Resource:
              - !Sub "arn:${AWS::Partition}:s3:::${ConfigBucket}"
          - Sid: AWSConfigBucketDelivery
            Effect: Allow
            Principal:
              Service:
                - config.amazonaws.com
            Action: s3:PutObject
            Resource:
              - !Sub "arn:${AWS::Partition}:s3:::${ConfigBucket}/AWSLogs/${AWS::AccountId}/*"

  ConfigTopic:
    Condition: CreateTopic
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub "config-topic-${AWS::AccountId}"
      DisplayName: AWS Config Notification Topic

  ConfigTopicPolicy:
    Condition: CreateTopic
    Type: AWS::SNS::TopicPolicy
    Properties:
      Topics:
        - !Ref ConfigTopic
      PolicyDocument:
        Statement:
          - Sid: AWSConfigSNSPolicy
            Action:
              - sns:Publish
            Effect: Allow
            Resource: !Ref ConfigTopic
            Principal:
              Service:
                - config.amazonaws.com

  EmailNotification:
    Condition: CreateSubscription
    Type: AWS::SNS::Subscription
    Properties:
      Endpoint: !Ref NotificationEmail
      Protocol: email
      TopicArn: !Ref ConfigTopic

  ConfigRecorderRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - config.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWS_ConfigRole"

  ConfigRecorder:
    Type: AWS::Config::ConfigurationRecorder
    DependsOn:
      - ConfigBucketPolicy
    Properties:
      RoleARN: !GetAtt ConfigRecorderRole.Arn
      RecordingGroup:
        AllSupported: !Ref AllSupported
        IncludeGlobalResourceTypes: !Ref IncludeGlobalResourceTypes
        ResourceTypes: !If
          - IsAllSupported
          - !Ref AWS::NoValue
          - !Ref ResourceTypes

  ConfigDeliveryChannel:
    Type: AWS::Config::DeliveryChannel
    DependsOn:
      - ConfigBucketPolicy
    Properties:
      Name: !If
        - IsGeneratedDeliveryChannelName
        - !Ref AWS::NoValue
        - !Ref DeliveryChannelName
      ConfigSnapshotDeliveryProperties:
        DeliveryFrequency: !FindInMap
          - Settings
          - FrequencyMap
          - !Ref Frequency
      S3BucketName: !Ref ConfigBucket
      SnsTopicARN: !If
        - CreateTopic
        - !Ref ConfigTopic
        - !Ref TopicArn

1. This is to set the execution role.

AWSTemplateFormatVersion: 2010-09-09
Description: Configure the AWSCloudFormationStackSetExecutionRole to enable use of your account as a target account in AWS CloudFormation StackSets.

Parameters:
  AdministratorAccountId:
    Type: String
    Description: AWS Account Id of the administrator account (the account in which StackSets will be created).
    MaxLength: 12
    MinLength: 12

Resources:
  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: AWSCloudFormationStackSetExecutionRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - !Ref AdministratorAccountId
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess

1. To assume role.

AWSTemplateFormatVersion: 2010-09-09
Description: Configure the AWSCloudFormationStackSetAdministrationRole to enable use of AWS CloudFormation StackSets.

Resources:
  AdministrationRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: AWSCloudFormationStackSetAdministrationRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: AssumeRole-AWSCloudFormationStackSetExecutionRole
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource:
                  - "arn:*:iam::*:role/AWSCloudFormationStackSetExecutionRole"

This Day 3 journey was a comprehensive exploration of AWS CloudFormation, offering in-depth insights into its multitude of features and capabilities. Stay tuned for more as the AWS DevOps journey unfolds!

📚 Course Progress: Continuing with the fantastic Udemy course by Stéphane Maarek, today's focus was on AWS CodeBuild, AWS CodeDeploy, AWS CodeArtifact, AWS CodeGuru, EC2 Image Builder, and AWS Amplify.

💻 AWS CodeBuild:

• Introduction: Unpacked the fundamentals of AWS CodeBuild, a fully managed continuous integration service.

• Hands-on Basics: Got hands-on with basic CodeBuild tasks, understanding how it seamlessly compiles and tests code.

🛠️ Advanced CodeBuild Concepts:

• Build Specifications: Delved into advanced concepts, particularly build specifications, to fine-tune and customize the build process.

• Build Environments: Explored different build environments, optimizing for various project requirements.

AWS CodeBuild is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy. It eliminates the need to provision, manage, and scale your own build servers. CodeBuild scales continuously and processes multiple builds concurrently, so your builds are not left waiting in a queue. You can use CodeBuild to build applications for any language, including .NET, Java, Python, Ruby, Go, and more. You can also use CodeBuild to build Docker images. CodeBuild integrates with other AWS services such as AWS CodeCommit, AWS CodePipeline, and AWS CodeDeploy, making it easy to set up a complete continuous delivery and deployment pipeline.

🚀 Overview of AWS CodeDeploy:

• Deployment Automation: Explored AWS CodeDeploy, focusing on its role in automating application deployments.

• EC2 Deep Dive: Dived deep into CodeDeploy with a focus on EC2 instances, understanding deployment strategies and best practices.

• ECS Deep Dive: Extended the knowledge to ECS, exploring seamless deployments in containerized environments.

• Lambda Deep Dive: Delved into serverless deployments with AWS Lambda using CodeDeploy.

AWS CodeDeploy is a fully managed deployment service that automates software deployments to a variety of compute services such as Amazon EC2, AWS Fargate, AWS Lambda, and your on-premises servers. CodeDeploy makes it easier to rapidly release new features, helps you avoid downtime during application deployment, and handles the complexity of updating your applications. You can use CodeDeploy to deploy a nearly unlimited variety of application content, such as code, web and configuration files, executables, packages, scripts, multimedia files, and so on. CodeDeploy can deploy application content stored in Amazon S3 buckets, GitHub repositories, or Bitbucket repositories. CodeDeploy also provides a set of deployment strategies, such as rolling deployments, blue/green deployments, and canary deployments, to help you minimize downtime and reduce the risk of failed deployments.

🚀 EC2 Deep Dive on CodeDeploy

Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides resizable compute capacity in the cloud. It is designed to make web-scale cloud computing easier for developers. Amazon EC2’s simple web service interface allows you to obtain and configure capacity with minimal friction. It provides you with complete control of your computing resources and lets you run on Amazon’s proven computing environment. AWS CodeDeploy can deploy your applications to Amazon EC2 instances running Windows or Linux operating systems.

🚀 ECS Deep Dive on CodeDeploy

Amazon Elastic Container Service (Amazon ECS) is a fully managed container orchestration service that makes it easy to run, stop, and manage Docker containers on a cluster. You can use Amazon ECS to deploy a scalable and highly available containerized application. AWS CodeDeploy can deploy your applications to Amazon ECS clusters.

🚀 Lambda Deep Dive on CodeDeploy

AWS Lambda is a serverless compute service that lets you run code without provisioning or managing servers. You can use AWS Lambda to run your code in response to events, such as changes to data in an Amazon S3 bucket, or to run your code in response to HTTP requests using Amazon API Gateway. AWS CodeDeploy can deploy your Lambda functions.

🔍 CodeDeploy Rollbacks and Troubleshooting:

• Rollback Strategies: Explored strategies for rolling back deployments, ensuring system stability in case of issues.

• Troubleshooting Techniques: Learned effective troubleshooting techniques for CodeDeploy, ensuring smooth deployments.

AWS CodeDeploy provides a set of rollback and troubleshooting features to help you quickly recover from failed deployments. CodeDeploy can automatically roll back a deployment if errors occur during the deployment process. CodeDeploy also provides detailed deployment logs, which you can use to troubleshoot issues that arise during deployment.

📦 Overview of AWS CodeArtifact:

AWS CodeArtifact is a fully managed artifact repository service that makes it easy to store, publish, and share software packages. You can use CodeArtifact to store and manage artifacts such as Maven and Python packages, Docker images, and npm packages. CodeArtifact integrates with other AWS services such as AWS CodeBuild, AWS CodePipeline, and AWS CodeDeploy, making it easy to set up a complete continuous delivery and deployment pipeline.

🧠 Overview of AWS CodeGuru:

• Code Optimization: Gained insights into AWS CodeGuru, focusing on its capabilities in providing automated code reviews and performance recommendations.

AWS CodeGuru is a machine learning-based service that provides automated code reviews and application performance recommendations. CodeGuru uses machine learning algorithms to identify issues such as resource leaks, concurrency bugs, and incorrect handling of sensitive data. CodeGuru provides actionable recommendations to help you improve your code quality and application performance.

💻 EC2 Image Builder:

• Automated Image Creation: Explored EC2 Image Builder, automating the creation of Amazon Machine Images (AMIs) with pre-configured software.

EC2 Image Builder is a fully managed service that makes it easy to build and maintain secure and up-to-date Amazon Machine Images (AMIs). You can use EC2 Image Builder to automate the creation, management, and deployment of AMIs for your applications. EC2 Image Builder integrates with other AWS services such as AWS CodeCommit, AWS CodePipeline, and AWS CodeDeploy, making it easy to set up a complete continuous delivery and deployment pipeline.

🌐 Overview of AWS Amplify:

• Full-Stack App Development: Wrapped up the day with an overview of AWS Amplify, a powerful tool for full-stack app development with simplified workflows.

AWS Amplify is a development platform that makes it easy to develop and deploy cloud-powered mobile and web applications. With Amplify, you can build full-stack web and mobile apps in hours with a few lines of code. You can configure a backend, connect to data sources, add features like authentication, storage, and hosting, and scale to millions of users with AWS services and pricing.

Amplify provides frontend libraries, UI components, backend building, and frontend hosting for building full-stack cloud apps 1. It offers a declarative interface across different categories of operations to make common tasks easier to add into your application 2. Amplify provides a set of deployment strategies, such as rolling deployments, blue/green deployments, and canary deployments, to help you minimize downtime and reduce the risk of failed deployments.

Amplify also provides a set of features to help you build and deploy your applications quickly and easily. For example, you can use Amplify to build cloud-connected UIs with dozens of pre-built, themeable, and responsive cloud-connected React components 1. You can also use Amplify to build secure, real-time GraphQL APIs backed by AWS databases quickly and easily 1. Amplify provides a set of features to enable secure authentication flows with email/social sign-up and multi-factor auth 1. You can also store user-created content and application data in Amazon S3 buckets and enable file uploading and display with pre-built components.

In summary, AWS Amplify is a powerful development platform that provides a wide range of features and tools to help you build and deploy cloud-powered mobile and web applications quickly and easily. With Amplify, you can build full-stack cloud apps in hours with a few lines of code, and scale to millions of users with AWS services and pricing.

This Day 2 journey has been packed with technical depth and hands-on exploration. Stay tuned for more updates as I progress in this exciting AWS DevOps certification adventure! 🚀💻🌐

📚 Course Update: Embarked on this journey with an outstanding Udemy course led by the seasoned instructor Stéphane Maarek. The insights and hands-on experience gained have set the stage for what promises to be an enlightening and fulfilling learning experience.

💡 Today's Learnings: As a beginner in this space, Day 1 was packed with foundational concepts and practical experiences.

🔗 Concept of CI/CD:

• Explored the significance of Continuous Integration (CI) and Continuous Deployment (CD) in the DevOps lifecycle.

🛠️ Overview Of AWS CodeCommit:

• Dived into AWS CodeCommit, understanding its role as a fully managed source control service for secure and scalable Git repositories.

🖐️ Hands-on in CodeCommit:

• Applied version control principles through hands-on exercises, getting a feel for collaborative coding.

🚀 Advanced CodeCommit Concepts:

• Delved into advanced features, realizing the power of robust version control practices.

1. Concept of CI/CD:

   • Continuous Integration (CI): Explored the practice of regularly integrating code changes into a shared repository. This promotes early detection of integration issues, ensuring a more stable codebase.

   • Continuous Deployment (CD): Understood the concept of automating the deployment process to rapidly and reliably deliver software changes to production.

2. AWS CodeCommit:

   • Managed Source Control: AWS CodeCommit serves as a secure and scalable Git repository hosting service. It eliminates the need for managing infrastructure, allowing teams to focus on coding.

   • Collaboration Features: Explored collaboration features within CodeCommit, such as pull requests, branch management, and access control, fostering effective teamwork.

3. Hands-on in CodeCommit:

   • Version Control Practice: Engaged in hands-on exercises to practice version control, commit changes, and understand the collaboration workflow within a team setting.

   • Repository Management: Explored repository creation, branching, and merging, gaining practical experience in maintaining a clean and organized codebase.

4. Advanced CodeCommit Concepts:

   • Branch Policies: Explored advanced features like branch policies, ensuring code quality through automated checks before changes are merged into critical branches.

   • Triggers and Hooks: Delved into triggers and hooks for events like commits and push requests, automating workflows and enhancing overall efficiency.

🚧 Overview of AWS CodePipeline:

• Explored AWS CodePipeline, a key player in automating the deployment pipeline.

🔧 Hands-on in CodePipeline:

• Got hands-on with CodePipeline, witnessing the magic of automation in action.

🔗 Integrating CloudFormation into CodePipeline:

• Unpacked the seamless integration of AWS CloudFormation into CodePipeline, understanding its benefits.

🌟 Benefits of Integration:

• Realized the advantages of integrating CloudFormation into CodePipeline – a game-changer for scalable and repeatable deployments.

🚀 Advanced CodePipeline Concepts:

• Wrapped up Day 1 by diving into advanced CodePipeline concepts, setting the stage for a deeper understanding.

1. AWS CodePipeline:

   • Continuous Delivery Service: Understood the role of AWS CodePipeline in automating the build, test, and deployment phases of the release process.

   • Pipeline Structure: Explored the structure of CodePipeline, including stages, actions, and transitions, to create a streamlined deployment workflow.

2. Hands-on in CodePipeline:

   • Pipeline Configuration: Engaged in hands-on activities to configure pipelines, linking various stages to automate the flow from code changes to production deployment.

   • Artifact Management: Learned about artifact management within CodePipeline, ensuring the reliable storage and retrieval of build artifacts.

3. Integrating CloudFormation into CodePipeline:

   • Infrastructure as Code (IaC): Explored the concept of treating infrastructure as code using AWS CloudFormation, allowing for the automated provisioning and management of AWS resources.

   • Integration Benefits: Examined the benefits of integrating CloudFormation into CodePipeline, including repeatability, consistency, and scalability in infrastructure management.

4. Advanced CodePipeline Concepts:

   • Custom Actions: Delved into the creation of custom actions within CodePipeline, extending its capabilities to suit specific deployment needs.

   • Pipeline Orchestration: Explored advanced orchestration features, ensuring a flexible and adaptive deployment pipeline.

I'm ecstatic about the journey ahead and can't wait to share more insights as I progress. If you're on a similar journey or have tips to share, let's connect and learn together! 🚀🌐💡