DVA-C02 Preparation Material 4 - Network & CICD

Network

VPC

• Create a gateway endpoint for S3 and DynamoDB in the custom VPC route table.
• VPC Endpoints include interface endpoint and gateway endpoint.
• Interface endpoint (ENI) goes through the Internet - private IP
• Register the gateway endpoint routing table directly
• Public subnets are primarily designed for deploying resources that need to communicate directly with the Internet (e.g. web servers, NAT gateways, ALBs, etc.)
• Requires adding a route for Internet Gateway connection to the Route Table
• VPC Flow Logs
• Ability to capture information about incoming and outgoing IP traffic on VPC network interfaces.

###API Gateway

• API Gateway API Stage
• Update the stage variable value from test's stage name to prod's stage name.
• A stage is a logical reference to the lifecycle state of the API (e.g. dev, prod, beta, v2)
• Can be distributed without disturbing existing customers
• Whenever you update your API, you need to redeploy it to an existing stage or a new stage.
• Canary release deployment converts a percentage of traffic to the new version (Canary release deployment option)
• User groups may move to new version
• API Gateway API integration types
• AWS: API exposes AWS service operations, requiring integrated request/response mapping.
• AWS_PROXY: Flexible and simplified setup for Lambda function invocation tasks; No need to configure integrated request/response.
• HTTP: Opens the backend HTTP endpoint and requires integrated request/response settings.
• HTTP_PROXY: Access HTTP endpoints with simplified setup; No need to configure integrated request/response.
• MOCK: Return response without backend, useful for API testing and CORS testing.
• Set up simulation of various components
• Public app function API using usage plan
• Enable API caching to improve performance
• Provides reliable connectivity to Amazon S3 and DynamoDB without requiring an internet gateway or NAT device in your VPC
• Mapping template can be set to return query results for specific API calls
• Support for authentication
• Cognito User pool, Lambda Authorizer, IAM

WebSocket API

• Build secure, real-time communications applications without the need to provision or manage servers to manage connections or large-scale data exchanges.

Security Group vs. NACL

• Security groups are stateful security tools, so if you only allow one direction, traffic in the opposite direction is automatically allowed.
• Network ACL (NACL) is stateless, outbound traffic also needs to be allowed.
• ELB adds the port range 1024-65535 to the NACL rule to allow outbound traffic.

ELB

• Timeout error - EC2 firewall blocking
• Connection failure error - Server down
• Reasons why the instance is abnormal
• health-check path is incorrect
• The EC2 instance security group does not allow ALB security group traffic.
• Separate public and private traffic
• High availability system setup
• Communicate with EC2 instances using private IP
• Horizontal expansion possible by connecting ASG
• Cross zone load balancing
• All instances receive traffic equally

ALB

• Acts as a proxy between client and server
• Dockerization and multi-port support using ECS and ALB (dynamic port mapping)
• Cannot specify a publicly routable IP address
• If the destination type is IP, specify IP addresses only in specific CIDR blocks
• There are three possible target types: instance, IP, and lambda.
• ALB access log
• Information such as the time the request was received, the client's IP address, latency, request path, and server response
• Error type
• HTTP load balancer error types
• 500 - Error when executing ACL rule, user claim size exceeds 11KB
• 503 - There are no registered targets in the load balancer's target group, or all registered targets are in the unused state.
• Reasons for not uniform dispersion
• Sticky Session, instances not evenly distributed across availability zones
• Even after disabling an availability zone, the targets in that availability zone remain registered with the load balancer.
• The load balancer does not route traffic even if it remains registered.
• Requests between client and server are relayed by proxy, so add X-Forwarded-For to forward the client's original IP address.

NLB

• Operates at the fourth layer of the Open Systems Interconnection (OSI) model
• Incoming connections are not modified, so application software does not need to support X-Forwarded-For
• X-Forwarded-For is information added to the HTTP header to identify the client's original IP address.
• X-Forwarded-For: <Client-IP>, <Proxy1-IP>, <Proxy2-IP>

###Route53

• CNAME records
• Map DNS queries to another domain or subdomain
• A record
• Connect domain to IP address
• Geolocation routing support allows you to select which resource serves traffic based on where the DNS query originates

---

CICD

ElasticBeanstalk

• You can focus on writing your application code without worrying about server provisioning, configuration, and deployment.
• Without infrastructure knowledge
• Distribution method
• To handle instances that fail rolling deployments, replace them with instances running the most recently successfully deployed application version.
• Using additional rolling deployment increases deployment time but prevents decreased availability.
• Minimize impact by performing a new deployment on a new instance through immutable deployment
• When deploying quickly and not considering downtime
• Because it supports multiple environments, it is recommended to connect ALB to separate the development/test environment and load test environment.
• Create two environments in Elastic Beanstalk
• dev-environment (development and testing environment)
• loadtest-environment (load test environment)
• ALB settings
• dev.example.com -> dev-environment
• loadtest.example.com -> loadtest-environment
• Provision resources using CloudFormation
• .ebextensions/
• ElastiCache Definition
• Configuration file .ebextensions/<mysettings>.config
• All resources created as part of the Elastic Beanstalk template are deleted when the .ebextensions environment is terminated.
• Change configuration files without redistribution using SSM parameters
• When dividing by parameters, it is not suitable for environmental separation testing as it is configured on the same instance.
• Not related to CD
• worker environments
• If your application performs a task or workflow that takes a long time to complete, offload that task to a dedicated worker environment.
• Anything that significantly increases the time it takes to complete a request, such as processing images or video, sending emails, or creating a ZIP archive.

CloudFormation

• You cannot create apps with CloudFormation, but rather a tool for defining and managing AWS resources.
• Helps model and set up AWS resources
• Does not provide automation for application deployment or management
• Exported Output Values must have a unique name in a single region.
• Provides SAM, ElasticBeanstalk resource provisioning
• Deploy resources in various regions
• Create a stack set in desired region using the create-stack-set command
• Upload AWS Lambda functions and AWS CloudFormation templates to AWS
• cloudformation package, cloudformation deploy
• Provisioned stack deletion order
• Delete from the stack created by reference > Delete the referenced stack
• The cluster name parameter needs to be updated in the /etc/ecs/ecs.config file during bootstrapping.

#!/bin/bash
echo "ECS_CLUSTER=MyCluster" >> /etc/ecs/ecs.config

• Conditions in the Conditions section?
• Resources, Conditions, Outputs
• The Parameters section has no direct relationship with Condition and mainly serves to define variables used in the template.
• virtual parameters
• Predefined parameters in CloudFormation
• Value: !Ref "AWS::Region"
• !FindInMap [MappingName, TopLevelKey, SecondLevelKey]
• Used to look up mapping values and used when setting up the AMI ((Amazon Machine Image)) of an EC2 instance as follows:
• MappingName: RegionMap
• TopLevelKey: us-east-1 or us-west-1
• SecondLevelKey: AMI

Mappings:
RegionMap:
us-east-1:
AMI: ami-0abcdef1234567890
us-west-1:
AMI: ami-0fedcba9876543210

• Parameter types cannot be dependent parameter types, and all parameters are independent of each other.
• Defines acceptable EC2 types

Parameters:
ParameterLogicalID:
Description: Information about the parameter
Type: DataType
Default: value
AllowedValues:
- value1
- value2

###CDK

• Order of creating an application with AWS CDK
• Create an app from a template provided by AWS CDK - cdk init -> Add code to your app to create resources within the stack -> Build the app (optional) -> Composite one or more stacks in your app -> Deploy stack to AWS account - cdk deploy
• Used when trying to define infrastructure in a familiar language
• Python, .NET and Javascript
• cdk synth and sam local invoke
• If you want to develop a CDK project or do local testing
• Create a CloudFormation stack, and install AWS Serverless Application Model (AWS SAM) and AWS CDK locally on the workstation.

###SAM

• If you prefer defining your serverless infrastructure with concise, declarative templates.
• Not suitable for web services that need to be deployed on EC2
• Provides Python, Node.js, Java
• Define resources with YAML and deploy with sam deploy
• Serverless and can use Amazon API Gateway, Amazon DynamoDB, and AWS Lambda
• Resources available for support
• AWS::Serverless::API
• AWS::Serverless::Application
• AWS::Serverless::Function
• AWS::Serverless::HttpApi
• AWS::Serverless::LayerVersion
• AWS::Serverless::SimpleTable
• AWS::Serverless::State Machine
• If there is a section, Transform indicates that it is a SAM template.
• Convert and scale with compatible AWS CloudFormation templates
• sam sync incremental change
• SAM is suitable for lightweight application deployment
• EKS, ECS, and Elastic BeanStalk incur excessive overhead and costs

CodeCommit

• AWS Access Key -SSH Key
• Use Git credentials generated by IAM
• CodeCommit repositories are Git-based and support Git's native features, such as Git credentials.
• IAM username and password are not supported
• Storage is automatically encrypted when saved

CodeBuild

• Time-out builds can be deleted from the queue.
• buildspec.yml in root directory
• CloudWatch Logs > S3 > Athena analysis
• When analysis using queries is required, simply event processing is not enough.
• Automatically scales so organizations don’t have to do anything to scale or build in parallel
• Leverage S3 cache dependencies to resolve external repo dependencies
• PullRequestSourceBranchUpdated, PullRequestCreated

###CodeDepoly

• In-Placement Deployment, Blue/Green Deployment
• Rolling deployments are only available on Elastic Beanstalk
• Suitable for continuous deployment, requirements, and deployment process automation
• appspec.yml in root directory
• Retrieves a list of scripts to be executed when an event is found in the hooks section.
• ApplicationStop > BeforeInstall > Install > AfterInstall > ApplicationStart > ValidateService
• ValidateService - Verifies whether deployment completed successfully
• You can archive up to two application revisions using CodeDepoly Agent.
• CodeDeployDefault.ECSCanary10Percent15Minutes
• ECS deployment
• Only 10% of live traffic exposed to new version
• After the next 15 minutes, the company routes all remaining live traffic to the new version of the deployed application.

CodePipeline

• Create one CodePipeline for the entire flow and add a manual approval step

AWS Amplify

• Cloud-based development platform for mobile and web application development
• AWS Amplify Hosting enables end-to-end testing of your application by adding test steps for your application to your amplify.yml build settings.