(DVO303) Scaling Infrastructure Operations with AWS
-
Upload
amazon-web-services -
Category
Technology
-
view
4.197 -
download
0
Transcript of (DVO303) Scaling Infrastructure Operations with AWS
© 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Prashant Prahlad, Product Manager
Abhishek Lal, Product Manager
October 2015
DVO303
Scaling Infrastructure Operationswith AWS Service Catalog, AWS Config, and AWS CloudTrail
What to Expect from the Session
Scale infrastructure administration using standardization
Codify your business policies to promote compliance
Improve security, ops posture without sacrificing developer
productivity
Troubleshoot issues in a timely manner
Growth is good
2 devsFew instances
1 app100s of API
actions
3 devsTens of instances
Few services100s of API actions
10s of devsSeveral apps and
services1000s API actions10s of customers
Several teams of devs10s of apps/services100,000 API actions100s of customers
Experimenting Product launch 6 months 12 months
Growth is good…
Enable new users to
experiment and
make mistakes
Various devices
access or use the
cloud
Self-service access
to infrastructure
Global workforce
…..but make good investments early to scale well
Growth is also challenging
Several new developers (some new to AWS)
Mistakes can be very expensive
Keeping developers productive becomes harder
Operating and troubleshooting numerous flavors
Noisy #slack channel
Traditional options
Decentralize and hope:
• Self serve, experiment,
innovate
• Promote agility
• Well-intentioned, but
dangerous
• Compliance subject to
interpretation by new users
Lock down and approve:
• Full control, reduced
experimentation
• Reduced agility
• Scales to number of
approvers
• Unappealing to developers
Or self serve, self govern at scale…..
Goals
• Agility
• Innovation
• Compliance
• Risk mitigation
• Cost control
Culture
• DevOps culture
• Continuous deployments
• Automation
• Measurement
• Sharing
Tooling
• Infrastructure-as-code
• Self service
• Auditing
• Change tracking
Browse and launch
AWS ConfigAWS CloudTrail
Use and modify
Users Admin
Using AWS management services
AWS Service Catalog
Provision with Tags
API calls Configuration checks
Troubleshoot and Audit
What is AWS Service Catalog?
AWS Service Catalog allows organizations to create and manage
catalogs of IT services. It enables users to quickly deploy the approved
IT services they need in a self-service manner.
Organizations Developers
Control
Standardization
Governance
Agility
Self-service
Time to market
Creates portfolio
Adds constraints
and grant access
1
4
5
AdministratorPortfolio
Users
Browse Products
6Launch ProductsAWS CloudFormation
template
Creates
product3Authors template2ProductX ProductY ProductZ
7Deploys
stacks
EventsEvents
88
Service Catalog flow
Create custom
services
and grant access
Use a
personalized
portal to find and
launch services
Demo: AWS Service Catalog
Self-service provisioning and standardization
• Increase agility with self-
service provisioning
• Promote standardization
and compliance
• Tag resources for cost
tracking and chargeback
AWS Service Catalog
AWS CloudTrailStore/ Archive
Troubleshoot
Monitor & Alarm
You are making API
calls...
On a growing set of AWS
services around the world..
CloudTrail is continuously
recording API calls
Use cases enabled by CloudTrail
Security analysis
Track API calls to AWS resources
Troubleshoot operational issues
Demonstrate compliance
Look up API calls
Look up by user, resource type, API, or resource name
Track user activity and API usage
AWS CloudTrail• Complete log of API
actions
• Answer Who, What,
When, Where quickly
• Enables faster resolution
of issues
• Set up alerts on APIs
AWS Config
• Get inventory of AWS resources
• Create Rules to check recorded configurations
• Audit historical configurations
• Notifies you when configurations change
NormalizeRecordChanging
Resources
AWS Config & Config Rules
Deliver
Stream
Snapshot (ex. 2014-11-05)
AWS Config
APIs
Store
History
Rules
Component Description Contains
Metadata Information about this configuration item
Version ID, Configuration item ID,Time when the configuration item was captured, State ID indicating the ordering of the configuration items of a resource, MD5Hash, etc.
Common Attributes Resource attributes Resource ID, tags, Resource type. Amazon Resource Name (ARN)Availability Zone, etc.
Relationships How the resource is related to other resources associated with the account
EBS volume vol-1234567 is attached to an EC2 instance i-a1b2c3d4
Current Configuration Information returned through a call to the Describe or List API of the resource
e.g. for EBS VolumeState of DeleteOnTermination flagType of volume. For example, gp2, io1, or standard
Related Events The AWS CloudTrail events that are related to the current configuration of the resource
AWS CloudTrail event ID
Configuration Item
Sample Config Item
"configurationItemVersion": "1.0",
"configurationItemCaptureTime": "2014…",
"configurationStateID": “….",
"configurationItemStatus": "OK",
"resourceId": "vol-ce676ccc",
"arn": "arn:aws:us-west-………",
"accountId": "12345678910",
"availibilityZone": "us-west-2b",
"resourceType": "AWS::EC2::Volume",
"resourceCreationTime": "2014-02..",
"tags": {},
"relatedEvents": [
"06c12a39-eb35-11de-ae07-db69edbb1e4",
],
"relationships": [
{
"resourceId": "i-344c463d",
"resourceType": "AWS::EC2::Instance",
"name": "Attached to Instance"
}
],
"configuration": {
"volumeId": "vol-ce676ccc",
"size": 1,
"snapshotId": "",
"availabilityZone": "us-west-2b",
"state": "in-use",
"createTime": "2014-02-……",
"attachments": [
{
"volumeId": "vol-ce676ccc",
"instanceId": "i-344c463d",
"device": "/dev/sdf",
"state": "attached",
"attachTime": "2014-03-",
"deleteOnTermination": false
}
],
"tags": [
{
"tagName": "environment",
"tagValue": "PROD"
},
{
"tagName": "name",
"tagValue": "DataVolume1"
}
],
"volumeType": "standard"
}
},
Config RuleA rule that will check the validity of configurations recorded
• AWS Managed Config RulesRules defined by AWS and require minimal (or no) configuration to enable. Rules
are managed by AWS
• Customer Managed Config RulesRules created in your account, and require authoring or reusing AWS Lambda
functions. Rules execute in your account.
Report evaluation of {Rule, ResourceType, ResourceID} directly from the rule itself
Why track change events using Config?
Security Analysis: Am I safe?
Audit Compliance: Where is the evidence?
Change Management: What will this change affect?
Troubleshooting: What has changed?
Discovery: What resources exist?
Demo: Set up and use Config
Rules
Track resource inventory and changes
AWS Config
• Continuous compliance
with Config Rules
• Set up Config Rules for
ideal configurations
• Record Configuration
changes
• Stream change
notifications
Browse and launch
AWS ConfigAWS CloudTrail
Use and modify
Users Admin
Using AWS management services
AWS Service Catalog
Provision with Tags
API calls Configuration checks
Troubleshoot and Audit
Try the AWS management services
AWS Service Catalog
Self-service
Standardization
Control
AWS Config
Config Rules PREVIEW
Record Changes
Stream notificationsSign up:
https://aws.amazon.com/config/preview
AWS CloudTrail
Track user activity
Audit log of API calls
Troubleshoot issues
Thank you!
Prashant Prahlad, Product Manager
Abhishek Lal, Product Manager
Remember to complete
your evaluations!