Accelerating Your AWS Journey: (Open Source) Tools for getting teams up to speed

Embarking on an AWS journey can be both thrilling and overwhelming for teams. There are a lot of concepts to grasp when starting out with AWS. In this talk I’ll share some of the open source tools and libraries I’ve used over the last years while trying get enterprise teams up to speed and flatten the team’s learning curve. These tools help teams benefit from battle-tested solutions, invaluable insights, and time-saving best practices. Tools involved will help with applying best practices, hardening security and compliance, and reduce boilerplate code. After this talks you should have some additional tools on your belt that can help new and existing teams improve their efficiency.

Transcript

1. (Open-Source) Tools for getting teams up to speed Accelerating Your AWS Journey: 🚀 Jeroen Reijn
2. Jeroen Reijn @jreijn jeroenreijn jreijn
3. Photo by Annie Spratt on Unsplash
5. What they hope it’s like What it’s actually like….
6. Learning AWS • AWS Courses / Certification • AWS Workshops • Game Days • Documentation • Tutorials • Blogs • Etc… Learn by doing!
7. Personal Observations • Design: What service(s) should I use to run my application? • Infrastructure as Code • Networking – VPCs, Security Groups, etc. • IAM (Identity & Access Management) • Local development
8. Source: https://www.lastweekinaws.com/blog/the-17-ways-to-run-containers-on-aws/ 🤯
9. 🤔
10. Image by Sasha Kasper: https://sascha-kasper.com/the-bumpy-learning-curve/
12. Engineering productivity
13. Infrastructure as Code Infrastructure as Code Cloudformation
14. Infrastructure as Code Infrastructure as Code
15. Reasoning • Language Flexibility: TypeScript, Python, Java, C#, etc • Type Safety • Documentation while coding • High-Level Abstractions • Customization and Reusability • Rich Ecosystem of Constructs • Integrated Deployment • AWS CDK Patterns
16. AWS CDK + Higher level abstractions
17. Example Code
18. AWS CDK + AWS Solution Constructs “AWS Solutions Constructs is an open-source extension on top of AWS CDK that provides multi-service, well-architected patterns for quickly defining solutions in code to create predictable and repeatable infrastructure. The goal is to accelerate the experience for developers to build solutions of any size using pattern-based definitions for their architecture.” https://github.com/awslabs/aws-solutions-constructs
22. Local development Testcontainers + = 🚀
23. Testcontainers • On-demand isolated infrastructure provisioning • Consistent experience on both local and CI environments • Reliable test setup using wait strategies • Automatic clean up • Support for Java, Python, NodeJs, Go, etc.
24. Localstack • Local cloud sandbox for development, testing, and experimentation • Emulates 60+ AWS cloud services • Get productive with cloud dev from day 1 • Avoid the slow and tedious deploy- test-redeploy cycles for your cloud- based apps
28. Amazon CodeWhisperer • AI Coding assistant • (Near) Real-time code suggestions • Optimized for use with AWS services • Support for popular programming languages and IDEs
30. OpenAI / ChatGPT 🤖
31. Security & Compliance
32. Shift Left Shift Left
33. CDK NAG • Checks CDK applications for best practices using a combination of available rule packs: • AWS Solutions • HIPAA Security • NIST 800-53 rev 4 • NIST 800-53 rev 5 • PCI DSS 3.2.1 • Inspired by https://github.com/stelligent/cfn_nag • https://github.com/cdklabs/cdk-nag
36. CDK-NAG output with AwsSolutionsChecks
37. [Error at /AwsCdkNagDemoStack/demo-queue/Resource] AwsSolutions-SQS4: The SQS queue does not require requests to use SSL. Without HTTPS (TLS), a network-based attacker can eavesdrop on network traffic or manipulate it, using an attack such as man-in-the- middle. Allow only encrypted connections over HTTPS (TLS) using the aws:SecureTransport condition in the queue policy to force requests to use SSL.
38. CDK-NAG output with HIPAASecurityChecks
39. CDK-NAG output with HIPAASecurityChecks [Error at /AwsCdkNagDemoStack/demo-function/Resource] HIPAA.Security- LambdaConcurrency: The Lambda function is not configured with function-level concurrent execution limits - (Control ID: 164.312(b)). Ensure that a Lambda function's concurrency high and low limits are established. This can assist in baselining the number of requests that your function is serving at any given time. [Error at /AwsCdkNagDemoStack/demo-function/Resource] HIPAA.Security- LambdaDLQ: The Lambda function is not configured with a dead-letter configuration - (Control ID: 164.312(b)). Notify the appropriate personnel through Amazon Simple Queue Service (Amazon SQS) or Amazon Simple Notification Service (Amazon SNS) when a function has failed.
40. Alternatives • cfn_nag • General-purpose policy-as-code evaluation tool • https://github.com/stelligent/cfn_nag • cfn_guard • Leverages Control Tower proactive controls • Also available as a cdk (validatorplugin) plugin • https://github.com/aws-cloudformation/cloudformation-guard
41. KICS - Keeping Infrastructure as Code Secure • Finds security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code. • Works with Cloudformation • Also supports Docker, Helm, Kubernetes, Pulumi, Terraform • https://github.com/Checkmarx/kics
42. Categories • Access Control • Availability • Backup • Best Practices • Build Process • Encryption • Insecure Configurations • Insecure Defaults • Networking and Firewall • Observability • Resource Management • Secret Management • Structure and Semantics • Supply-Chain Reporting options • JSON • SARIF • Gitlab SAST • JUnit • SonarQube • HTML • PDF • CycloneDX • ASFF • CSV • Code Climate • CLI Report
45. Prowler • Open-Source Security tool for AWS (Azure/GCP) • Cloud Security best practices assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness • Integrates with AWS Security Hub • https://github.com/prowler-cloud/prowler
47. Pacu • Open-source AWS exploitation framework • Allows penetration testers to exploit configuration flaws within an AWS account • Supports a range of attacks: • user privilege escalation • backdooring of IAM users • attacking vulnerable Lambda functions • https://github.com/RhinoSecurityLabs/pacu
49. Cost Management & Observability
50. Infracost.io • Integrates directly with VS Code • Calculates Cloud Costs based on Terraform (IaC) • Catch costly typos • https://github.com/infracost/infracost
52. Infracost.io CI/CD • Direct integration into source control systems or CI/CD • Review cost impact with the team alongside security and code quality • Shows the cost impact of the specific change
53. CDK Monitoring Constructs • Easy-to-use CDK constructs for monitoring your AWS infrastructure • Supports a variety of different services • Easily define dashboards, widget and alarms for important metrics https://github.com/cdklabs/cdk-monitoring-constructs
58. (Open-Source) tools for getting teams up to speed Accelerating Your AWS Journey: 🚀 Jeroen Reijn @jreijn jeroenreijn jreijn Thanks for joining! Questions?
59. Thank you!