Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Accelerating Your AWS Journey: (Open Source) Tools for getting teams up to speed

Jeroen Reijn
January 12, 2024
19

Accelerating Your AWS Journey: (Open Source) Tools for getting teams up to speed

Embarking on an AWS journey can be both thrilling and overwhelming for teams. There are a lot of concepts to grasp when starting out with AWS. In this talk I’ll share some of the open source tools and libraries I’ve used over the last years while trying get enterprise teams up to speed and flatten the team’s learning curve. These tools help teams benefit from battle-tested solutions, invaluable insights, and time-saving best practices. Tools involved will help with applying best practices, hardening security and compliance, and reduce boilerplate code. After this talks you should have some additional tools on your belt that can help new and existing teams improve their efficiency.

Jeroen Reijn

January 12, 2024
Tweet

Transcript

  1. Learning AWS • AWS Courses / Certification • AWS Workshops

    • Game Days • Documentation • Tutorials • Blogs • Etc… Learn by doing!
  2. Personal Observations • Design: What service(s) should I use to

    run my application? • Infrastructure as Code • Networking – VPCs, Security Groups, etc. • IAM (Identity & Access Management) • Local development
  3. Reasoning • Language Flexibility: TypeScript, Python, Java, C#, etc •

    Type Safety • Documentation while coding • High-Level Abstractions • Customization and Reusability • Rich Ecosystem of Constructs • Integrated Deployment • AWS CDK Patterns
  4. AWS CDK + AWS Solution Constructs “AWS Solutions Constructs is

    an open-source extension on top of AWS CDK that provides multi-service, well-architected patterns for quickly defining solutions in code to create predictable and repeatable infrastructure. The goal is to accelerate the experience for developers to build solutions of any size using pattern-based definitions for their architecture.” https://github.com/awslabs/aws-solutions-constructs
  5. Testcontainers • On-demand isolated infrastructure provisioning • Consistent experience on

    both local and CI environments • Reliable test setup using wait strategies • Automatic clean up • Support for Java, Python, NodeJs, Go, etc.
  6. Localstack • Local cloud sandbox for development, testing, and experimentation

    • Emulates 60+ AWS cloud services • Get productive with cloud dev from day 1 • Avoid the slow and tedious deploy- test-redeploy cycles for your cloud- based apps
  7. Amazon CodeWhisperer • AI Coding assistant • (Near) Real-time code

    suggestions • Optimized for use with AWS services • Support for popular programming languages and IDEs
  8. CDK NAG • Checks CDK applications for best practices using

    a combination of available rule packs: • AWS Solutions • HIPAA Security • NIST 800-53 rev 4 • NIST 800-53 rev 5 • PCI DSS 3.2.1 • Inspired by https://github.com/stelligent/cfn_nag • https://github.com/cdklabs/cdk-nag
  9. [Error at /AwsCdkNagDemoStack/demo-queue/Resource] AwsSolutions-SQS4: The SQS queue does not require

    requests to use SSL. Without HTTPS (TLS), a network-based attacker can eavesdrop on network traffic or manipulate it, using an attack such as man-in-the- middle. Allow only encrypted connections over HTTPS (TLS) using the aws:SecureTransport condition in the queue policy to force requests to use SSL.
  10. CDK-NAG output with HIPAASecurityChecks [Error at /AwsCdkNagDemoStack/demo-function/Resource] HIPAA.Security- LambdaConcurrency: The

    Lambda function is not configured with function-level concurrent execution limits - (Control ID: 164.312(b)). Ensure that a Lambda function's concurrency high and low limits are established. This can assist in baselining the number of requests that your function is serving at any given time. [Error at /AwsCdkNagDemoStack/demo-function/Resource] HIPAA.Security- LambdaDLQ: The Lambda function is not configured with a dead-letter configuration - (Control ID: 164.312(b)). Notify the appropriate personnel through Amazon Simple Queue Service (Amazon SQS) or Amazon Simple Notification Service (Amazon SNS) when a function has failed.
  11. Alternatives • cfn_nag • General-purpose policy-as-code evaluation tool • https://github.com/stelligent/cfn_nag

    • cfn_guard • Leverages Control Tower proactive controls • Also available as a cdk (validatorplugin) plugin • https://github.com/aws-cloudformation/cloudformation-guard
  12. KICS - Keeping Infrastructure as Code Secure • Finds security

    vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code. • Works with Cloudformation • Also supports Docker, Helm, Kubernetes, Pulumi, Terraform • https://github.com/Checkmarx/kics
  13. Categories • Access Control • Availability • Backup • Best

    Practices • Build Process • Encryption • Insecure Configurations • Insecure Defaults • Networking and Firewall • Observability • Resource Management • Secret Management • Structure and Semantics • Supply-Chain Reporting options • JSON • SARIF • Gitlab SAST • JUnit • SonarQube • HTML • PDF • CycloneDX • ASFF • CSV • Code Climate • CLI Report
  14. Prowler • Open-Source Security tool for AWS (Azure/GCP) • Cloud

    Security best practices assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness • Integrates with AWS Security Hub • https://github.com/prowler-cloud/prowler
  15. Pacu • Open-source AWS exploitation framework • Allows penetration testers

    to exploit configuration flaws within an AWS account • Supports a range of attacks: • user privilege escalation • backdooring of IAM users • attacking vulnerable Lambda functions • https://github.com/RhinoSecurityLabs/pacu
  16. Infracost.io • Integrates directly with VS Code • Calculates Cloud

    Costs based on Terraform (IaC) • Catch costly typos • https://github.com/infracost/infracost
  17. Infracost.io CI/CD • Direct integration into source control systems or

    CI/CD • Review cost impact with the team alongside security and code quality • Shows the cost impact of the specific change
  18. CDK Monitoring Constructs • Easy-to-use CDK constructs for monitoring your

    AWS infrastructure • Supports a variety of different services • Easily define dashboards, widget and alarms for important metrics https://github.com/cdklabs/cdk-monitoring-constructs
  19. (Open-Source) tools for getting teams up to speed Accelerating Your

    AWS Journey: 🚀 Jeroen Reijn @jreijn jeroenreijn jreijn Thanks for joining! Questions?