Terraform - Provisioning Infrastructure level Security in AWS

A year ago I have created an article showing how to create infrastructure-level security in AWS step by step. Now its time to automate the provisioning process using Octopus and terrafrom.

We have done it manually from AWS Management console.

Here is the link for the earlier article. 

Here are the components we intend to create using terrafrom.

We will be creating VPC, Public and Private Subnets, RoutTables, Security Groups, Inbound / Outbound rules for communication channels on each of the security groups.

IaC - Terraform Automation using Octopus Deploy

Octopus is a enterprise mainstream release management tool, but now its avilable for developers via cloud under tha name of "Octopus Cloud". 

We don't need a "build server" as its is hosted by Octopus cloud and we utilize its resources for our deployments.

In this article we will learn how to deploy our "Infrastructure as Code" using Terraform and Octopus deploy. Beofre that, if you need to familiarize with terrafroms basics, go to earlier article.

I need to highlight couple of features we look, for considering this combination of Terraform and Octopus deploy.

#1. Configuration Management Vs Provisioning: 

We are not looking for Configuration management, as Chef and Puppet does better in that department. We want Provisioning tool which creates Infrastructure in the same state no matter what order the resources were mentioned and no matter how many times the tools was deployed.

#2. Idempotent:

This feature is the ability to create the infrasturcture in exact same state even after multiple runs. Terraform doesnt suffers from "Configuration Drift" unlike Cheff and Puppet.

#3. Economic: 

We are dealing with what a single developer can do on his dev machine. So unlike Cheff and Puuppet we dont need a "MasterServer" to save the state or to run the centralized updates. We can either use a shared location or in our case an S3 bucket for saving the state.

IaC "Infrastructure as Code" using Terraform - Basics

Infrastucture as Code became a critical part of Devops. Some of the Infrastructure management tools that we know are CloudFormation famous for AWS, ARM for Azure, CDM for Google cloud platforms.

Terraform is a IaC tool which can translate HCL (Hasi Corp Language) to API calls which can be interpreted by various cloud platforms. Ths making it cloud-agnostic tool.

Another reason for using Terraform is it has a planning step when compared to other IaC tools. We will look at that feature in this article further down.

CloudFormation(AWS), ARM(Azure) and CDM(Google) are firstparty IaC tools, this means they will handle all infrastructure management tasks specific to that cloud platform. But these tools are not suitable for most of the thirt party service integration. Terraform addresses this issue with cloud-agnostic and better support for thirdparty service integration.

For more details please visit https://www.terraform.io/

Power Apps - Test Studio - Automation Testing

At last we got feature of automated testing, improving "Application Life Cycle Management" for Power Apps. (Watch in Full Screen)

In this post we will learn how we will use Test Studio for Power Apps.

PowerApps - Beyond 500 item limit and Delegation Warning. The "XXXXX" part of this formula might not work on large datasets.

This is the most common warning which is overlooked by the Power app developers as its just "Warning".

We see the function work and fetch the results, and thus ignore the warning. I have seen  many of the powerapps that were productionized have these warnings.

Please make a note:

"That is not just a technical warning, its a future functional error". 

AWS Certification Pre-Exam Knowledge Refresh- Part 4

Here is the link for part 3

EC2 Auto-Scaling happens Horizontally(Adding more instances) and DB scaling happens vertically(Adding more space on existing instance).

AWS Certification Pre-Exam Knowledge Refresh- Part 3

Here is the link for Part 2

Amazon Redshift is a fully managed, petabyte-scale data warehouse service in the cloud. You can start with just a few hundred gigabytes of data and scale to a petabyte or more. 

Just like S3, Amazon redshift cluster is HA with in a region. For HA across regions, you need to enable cross-region replication.

AWS Certification Pre-Exam Knowledge Refresh- Part 2

Here is the link for Part 1

AWS Elastic File System EFS: Fully managed by AWS, designed only for Linux workloads. Supports petabytes(massive amount of storage), across multiple Azs.

Amazon Elastic File System (Amazon EFS) provides simple, scalable file storage for use with more than one Amazon EC2 instances in the AWS Cloud.

AWS Storage Gateway is a hybrid storage service that enables your on-premises applications to seamlessly use AWS cloud storage.

AWS Elastic Load Balancer  - Routes to various services/applications based on the request url/data. Can add multiple instances supporting application. Routing to those instances can be taken care by LB.

3 types of ELB 1. Application LB 2. Network LB 3. Classic LB

AWS Lambda - Runs set function/application/code based on triggers. SO you don't need to worry about Infrastructure or patching. Purely pay the compute time used by your code.

Max timeout for lambda execution is 15 mins or 900  seconds.

AWS Certification Pre-Exam Knowledge Refresh- Part 1

First let me begin by saying, i would not recommend doing certifications just by using some practice tests or by reading some material.

Get the free-tier subscription. Practice, experiment, do some proof of concepts.

I know you cannot implement al the concepts specially where you need large datasets to test certain concepts.

Most of the information is shared out of my notse and observations during the trainings, self-study, experimenting in my free tier subscription and some from practice tests.

The intent of sharing this information is to have a last check before you leave for an exam. 

Here is the first of a few articles i am going to share for people going to take certificaton exam. I did cleared both CP and CSAA with only 90% , so if i am misinterpreting anything, please do correct me.

AWS VPC Basics - How To Configure Security Using Subnets

In this article i will explain whats a "VPC", its uses and demonstrate how we can handle the networking & security using various components like VPCs, Subnets, Route tables.

Please know that i will spend little time on theory as it was better explained in AWS Documentation. We will go deep in implementing in a step-by-step manner.

We will :
1. Define AWS Components like VPC, Subnet, Route table, EC2 instance, S3.
2. Configure VPC
3. Configure Subnets
4. Setting Rout Tables
5. Creating EC2 instances in various subnets
6. Testing security we setup.
7. Talk little bit about VPC endpoints.

Let me start with a design of what we will be creating.