Dev/Test Environment Provisioning and Management on AWS

Editor's Notes

• #30: Lots of projects that start and stop. Had ot reuse environments to get efficiencies for the investment in the hardware they run on. When you terminate an environment, you can persists the storage, but stop paying for compute. Differenent environment for every project, and get started immediately. No lead time. Repurpose dev environment for a new project. Change, re-gear - pay for the time for this to happen.
• #38: Build websites that sleep at night. Build machines only live when you need it. Supercomput erin the hands of every dev.
• #40: Customer Network on the upper right Internet on the upper left VPC below both of those Public Subnet and routing Private Subnet and Routing NAT to AWS APIs VPN Connection
• #41: Discuss lightly pros/cons of each. Elastic Beanstalk is easiest to start with, but offers less control. Opsworks gives you more tools, with a bit more work on your part. CloudFormation is a template driven tool with its own language, so a bit of a learning curve, but very very powerful. Lastly you could do all this manually, but at scale its nearly impossible without a huge team.
• #43: How does CloudFormation work? Let’s take a look at a system built in AWS. This entire system is considered the stack.
• #44: CloudFormation is this stack distilled into a template file.
• #45: Segregate roles and responsibilities to a fine-grained level that is probably in excess of what you can do in a physical environment User A can change firewalls tagged ‘development’ only User B can snapshot database storage volumes, but cannot access those volumes All of this can be federated back to the existing enterprise directory – you do not need to setup a new directory within AWS. Your users sign into the existing directory (using existing authentication and MFA solutions), then are granted a temporary role within AWS to perform whatever duty they have been allocated. This role exists for a configurable period of time. One even more awesome feature is that your EC2 instances themselves can have roles within identity and access management, to restrict what AWS APIs the instance can call. Thus, an attacker cannot use an EC2 instance to upload data to S3, if the role assigned to the instance does not include S3 API permissions. AWS IAM also includes full multi-factor authentication for users, using either hardware Gemalto tokens, or soft tokens running on all three major phone platforms.
• #46: Segregate roles and responsibilities to a fine-grained level that is probably in excess of what you can do in a physical environment User A can change firewalls tagged ‘development’ only User B can snapshot database storage volumes, but cannot access those volumes All of this can be federated back to the existing enterprise directory – you do not need to setup a new directory within AWS. Your users sign into the existing directory (using existing authentication and MFA solutions), then are granted a temporary role within AWS to perform whatever duty they have been allocated. This role exists for a configurable period of time. One even more awesome feature is that your EC2 instances themselves can have roles within identity and access management, to restrict what AWS APIs the instance can call. Thus, an attacker cannot use an EC2 instance to upload data to S3, if the role assigned to the instance does not include S3 API permissions. AWS IAM also includes full multi-factor authentication for users, using either hardware Gemalto tokens, or soft tokens running on all three major phone platforms.
• #47: Extension: SQS for queued builds
• #49: Full deve ennv with source control and devel workstations.
• #61: Vertical scaling on commodity hardware. Perfect for Hadoop.
• #62: Vertical scaling on commodity hardware. Perfect for Hadoop. 100 instances in Syd for 1 hour is $10. Dexact copy of production, performance regression testing.
• #63: Each autoscaling group uses a different set of AMI AMI-B contains the test code.
• #68: Enterprises segregate important duties to reduce risk of accidental or malicious changes AWS allows fine-grained segregation across virtually all aspects of the service For example, you can segregate Who can change network configuration Who can change firewalls Who can change how the VPC connects to the Internet or back to your corporate premises Who can start and stop servers Who can snapshot and restore storage volumes AWS IAM offers a programatic level of control and granularity that would not be possible to implement in traditional on-premise environments
• #69: CloudTrail is your eyes behind the scenes at AWS. It gives you insight into all of the API calls made which are associated with your account(s). It lets you understand the who did what from where, when. Just a few weeks ago, we added the ability for CloudTrail to record both successful and unsuccessful console logins from your AWS IAM accounts as well.