Deep Dive into IaC on AWS 深探 IaC (Infrastructure as Code, 基礎設施即程式碼 ) 在 AWS 上的應用 Level: 300, 中文演講 講師: Pahud Hsieh, Specialist Solutions Architect, AWS & Smalltown Tsai, Senior Site Reliability Engineer of Maicoin 採用 Public Cloud Provider 後，需要面對雲端資源的各種管理問題，而其變動頻率和規模都持續在成長中，如何 "降低維運成本"，"加快執行速度" 和 "降低變動風險" 成為重要課題，而 AWS 的所有資源都可以透過程式自動化控制，因此 Infrastructure as Code 概念便有了實作的著力點；本分享透過 AWS EKS 為範例，示範如何達成 IaC 的 CI/CD 用以降低人員管理雲端的時間成本，自動化雲端資源的修改動作，避免手動修改可能造成的人為錯誤或是資安問題。 聯繫銷售: https://aws.amazon.com/tw/contact-us/ 與銷售線上聊天: https://pages.awscloud.com/tw-hkt-sales-chat.html

1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.SUMMIT
Deep Dive into IaC on AWS
Pahud Hsieh
Specialist SA, Serverless
Amazon Web Services
smalltown
Senior Site Reliability Engineer
Maicoin

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.SUMMIT
Our infrastructure management journey

3. Manual
� Easy to get started
� Not reproducible
� Error prone
� Time consuming

4. Scripted
� What happens if an API call fails?
� How do I make updates?
� How do I know a resource is ready?
� How do I roll back?

5. Resource Provisioning Engines
AWS CloudFormation
template
(JSON/YAML)
HashiCorp
Configuration Language
(HCL)
Desired state configuration
� Easy to automate
� Reproducible
� Configuration syntax
� No abstraction, lots of details

6. Challenges
• Automated deployment and rollback
• Cross account management
• Cooperative development
• Integration with existing testing frameworks
• Integration with key management system
• Integration with Kubernetes or Amazon EKS

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.SUMMIT
Introducing smalltown

8. Hello!
I am smalltown
MaiCoin Site Reliability Engineer
Taipei HashiCorp User Group Organizer
AWS User Group Taiwan Staff

9. Angeda
IaC Introduction
Multiple Accounts Infrastructure
Testing IaC
EKS Example

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.SUMMIT
IaC Introduction

11. Infrastructure as Code in 201X...
YA! I can write code to
manage cloud resource
resource "aws_s3_bucket" "b" {
bucket = "my_tf_test_bucket"
acl = "private"
tags { Name = "My bucket" }
}

12. Infrastructure as Code in 201X...
• Record your cloud resource with infrastructure as code
tool, not document
Document:
- Easy Out of Date
- Hard to Maintain
AWS
CloudFormation

13. Terraform Overview
Allow 1 person manage
the same resource
Store the managed
resource state
Create, Modify,
Destroy Resource

14. The Benefit After Adopt IaC
• Automate your deployment and recovery process
• Rollback with the same tested processes
• Don’t repair, redeploy
• Focus on mean time to recovery
• Use testing tools to verify your infrastructure
• Hook your tests into your monitoring system

15. Problems Emerged After a While...
• Permission control problem
• Don’t follow DRY
• How to well testing
• How to collaborate within a team

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.SUMMIT
Multiple Accounts Infrastructure

17. Why Multiple AWS Accounts ?
• Why there are dev, alpha, beta, staging, production
environment for the application?
• Application need to be well tested, but not impact the real
users
• Production infrastructure don’t allow access at will
• Infrastructure becomes code now, hence, it need to be
treated as the same way

18. Multiple Accounts Infrastructure

19. Multiple Accounts Infrastructure
• IAM user can be central managed
• Permission separate as read,
write and robot roles in different
accounts
• The robot role is for Terraform
usage

20. Multiple Accounts Infrastructure
• The write role is for human
usage if necessary
• Production write and robot role
only can be permitted through
change management process

21. How to Manage Multiple Accounts
• About assume role, don’t
forget to enable MFA, and
setup expired time
• Recommend to use aws-
vault to manage multiple
roles in multiple accounts
[profile central]
output = json
region = us-east-1
mfa_serial =
arn:aws:iam::${CENTRAL_ACCOUNT_ID}:mfa/${IAM_USER}
[profile central_read]
role_arn =
arn:aws:iam::${CENTRAL_ACCOUNT_ID}:role/read
mfa_serial =
arn:aws:iam::${CENTRAL_ACCOUNT_ID}:mfa/${IAM_USER}
source_profile = central

22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.SUMMIT
Testing IaC

23. How to Achieve IaC CI/CD

24. What is Terratest?
• Terratest is a Go library that makes it easier to write
automated tests for your infrastructure code
• It provides a variety of helper functions and patterns for
common infrastructure testing tasks

25. How to Test IaC By Terratest
Setup
- Compose configuration
- Create resource
- Wait resource ready
Verification
- Leverage helper
function
- Write Golang
directly
Teardown
- Destroy resource
- Generate report

26. Rich Helper Function
• Testing Terraform code
• Testing Packer templates
• Testing Docker images
• Executing commands on servers over SSH
• Working with Cloud Provider APIs, e.g. AWS
• Working with Kubernetes APIs
• Testing Helm Charts
• Making HTTP requests
• Running shell commands

27. IaC Testing Tools Comparison
• XXX-Spec ←→ Terratest ←→ Pure programming language
• Learning curve is between XXX-Spec and Pure programming
language
• Not only check server properties, but also the service
functionality
• Testing scope include entire systems

28. Terraform Module Structure W/ Testing
tf-aws-iam
├── examples
│ ├── iam-roles
│ └── iam-users
├── modules
│ ├── roles
│ └── users
└── test
├── iam_roles_test.go
└── iam_users_test.go
• Modules: The Terraform to
create cloud resource
• Examples: Illustrate how to use
the module
• Test: Test the module by
executing examples

29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.SUMMIT
EKS Example - Vishwakarma

30. Vishwakarma
• Vishwakarma can be used to create a Kubernetes cluster in
AWS by leveraging HashiCorp Terraform and CoreOS

31. Terratest in Vishwakarma
• Create a EKS cluster with two worker groups (on-demand,
spot)
• Once the cluster is ready (node, core-dns), deploy Nginx
service
• Make a HTTP request to the Nginx service
• Destroy EKS cluster

32. Demo

33. Thank you!
SUMMIT © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.