DevOpsDays Austin 2013

9 AWS Hacks

Transcript

1. 9 AWS Infrastructure Hacks Ideas Victor Trac Cloud Architect Bazaarvoice
2. #1: CloudFormation All The Things
3. { "AWSTemplateFormatVersion" : "2010-09-09", "Description" : "A text description for the template usage", "Parameters": { // A set of inputs used to customize the template per deployment }, "Mappings": { // Mappings match a key to a corresponding set of named values }, "Resources" : { // The set of AWS resources and relationships between them }, "Outputs" : { // A set of values to be made visible to the stack creator } }
4. CloudFormation Instance Example { "AWSTemplateFormatVersion" : "2010-09-09", "Description" : "Create an EC2 instance running the Amazon Linux 32 bit AMI.”, "Parameters" : { "KeyPair" : { "Description" : "The EC2 Key Pair to allow SSH access to the instance", "Type" : "String" } }, "Resources" : { "Ec2Instance" : { "Type" : "AWS::EC2::Instance", "Properties" : { "KeyName" : { "Ref" : "KeyPair" }, "ImageId" : "ami-75g0061f", "InstanceType" : "m1.small" } } }, "Outputs" : { "InstanceId" : { "Description" : "The InstanceId of the newly created EC2 instance", "Value" : { "Ref" : "Ec2Instance" } } } }
5. #2: VPC Across 3 AZs VPC allows us to choose our internal IP space. Default Route for All Subnets to IGW • Let's call these subnets all "Public" • Requires all instances to have EIPs before talking to the internet • EIPs are a limited resource Public: Default route via IGW Private: Default route via instance(s) in Public Subnets Advantage: Most instances in the private subnet can talk to the internet without dealing with an EIP.
7. VPC + CFN = Multiple Envs in Minutes
8. Good at AWS means Multi-AZ & Multi-Region
9. VPC + CFN = Multiple Envs in Multiple Regions in Tens of Minutes
10. #3: CFN + IAM + MFA = Win Sign-on Credentials • IAM Console login ◦ Username, Password, and MFA Time token Access Credentials • AWS has three API types: REST, Query, & SOAP. • Each API uses one or more Access Credentials ◦ Access Keys for REST and Query APIs ◦ x.509 Certificates for SOAP API ◦ EC2 KeyPairs for instance SSH authentication
11. #4: Security Groups Over ACLs
12. "TeamASecurityGroup": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "Allows Team A to go anywhere", "VpcId": { "Ref" : "VPCId" }, "SecurityGroupIngress": [{ "IpProtocol": "tcp", "FromPort": "22", "ToPort": "22", "SourceSecurityGroupId": { "Ref": "TeamASecurityGroup"} }], "SecurityGroupEgress": [{ "IpProtocol": "-1", "FromPort": "1", "ToPort": "65536", "CidrIp": "0.0.0.0/0" }] } }
13. #5: bas·tion (*/ˈbas-chən/*)
14. #6: AutoScale Everything By everything, I mean all instances, including singletons. CloudFormation + AutoScale = Win
15. #7: Elastic Network Interfaces ENIs for static internal IPs
16. #8: Run Your Own Internal DNS AWS VPC allows for custom DHCP Options
17. But use Route53 for External DNS CloudFormation + Route53 = Win
18. #9: Conformity through Tags Required Tags: bv:nexus:vpc : The name of VPC. e.g. "qa", "dev", "prod” bv:nexus:team : Email of a team in R&D with a budget. E.g. "my- team@bazaarvoice.com" Tags required following AWS resources: • EC2 Instances • AMIs • EBS Volumes • EBS Snapshots • Elastic Network Interfaces • S3 Volumes KILL NON-CONFORMING RESOURCES
19. Conformity -> Efficiency
20. come help us build stuff http://bazaarvoice.com/jobs Email: victor@bazaarvoice.com Twitter: @victortrac