Posted on

AWS: Integrating OpenAPI With the Amazon API Gateway and Lambda Functions

API Gateway is the AWS service that allows interfacing an application's back-end with its front-end. The figure below shows an example of such an application, consisting of a web/mobile-based front-end and a back-end residing in a REST API, implemented as a set of serverless Lambda functions, as well as a number of legacy services.

The figure above illustrates the so-called design pattern Legacy API Proxy, as described by Peter Sbarski, Yan Cui, and Ajay Nair in their excellent book Serverless Architectures on AWS (Manning, 2022). This pattern refers to a use case where Amazon API Gateway and Lambda are employed together, in order to create a new API layer over legacy APIs and services, such that to adapt and reuse them. In this design, the API Gateway exposes a REST interface invoking Lambda functions which, in turn, modify the requests and the responses or transform data to legacy-specific formats. This way, legacy services may be consumed by modern clients that don't support older protocols.

Posted on

Required Knowledge To Pass AWS Certified Solutions Architect — Professional Exam

Disclaimer: All the views and opinions expressed in the blog belong solely to the author and not necessarily to the author's employer or any other group or individual. This article is not a promotion for any course or training platform. The sole objective of this article is to help the AWS community to successfully pass this difficult exam. Also, this article is based on my exam experience, which may differ from any other individual's exam experience.

I am a certified AWS Professional Architect, and with this article, I would like to share my experience and the preparations I took to pass this certification exam. I don't want to share the details that you can get from the AWS Professional Architect Certification page; rather, I would share the topics that you would need to know to pass the exam and the type of questions that you can expect during the exam.

Posted on

AWS Multi-Account Strategy and Landing Zone

AWS multi-account strategy is a powerful method of managing multiple AWS accounts within an organization. It is designed to help organizations scale and manage their cloud infrastructure more effectively while maintaining security and compliance. In this article, we will explore the key components of an AWS multi-account strategy and how it can be implemented to achieve better control and efficiency in managing cloud resources.

Why Multiple Accounts?

  • Security controls: Each application could have different security controls, like within same organization, PCI-DSS will have different security controls than other applications. 
  • Isolation: Isolation is crucial to prevent potential risks and security threats that may arise from having multiple applications in the same account.
  • Many teams: Using multiple accounts prevents team interference, as teams with different responsibilities and resource needs are separated.
  • Data Isolation: Isolating data stores to an account limits access and management of data to a select few, reducing the risk of unauthorized exposure of sensitive information. 
  • Business process: Individual accounts can be created to cater to specific business needs since business units or products often have different purposes and processes. 
  • Billing: The multi-account approach allows for the creation of distinct billable items across business units, functional teams, or individual users.
  • Quota allocation: Each account, including projects, has a well-defined and individual quota since AWS quotas are established on a per-account basis.

Design OU Structure

An organizational unit (OU) is a logical grouping of accounts in your organization, created using AWS organizations. OUs enable you to organize your accounts into a hierarchy and make it easier for you to apply management controls. AWS organizations policies are what you use to apply such controls. A Service Control Policy (SCP) is a policy that defines the AWS service actions.

Posted on

Hybrid File Integration on AWS, Technical Debt, and Solution Approach

Introduction

As we move/migrate applications from on-prem to the cloud, some of the key architecture decisions regarding hybrid integration are with reference to FileShare between the cloud and on-prem systems/users.

When a part of the ecosystem goes to the cloud, it's important to have the file sharing seamless, efficient, and performant yet cost-effective — driven by a cloud-native solution approach.

Posted on

Deploy a Nodejs App to AWS in an EC2 Server

There are multiple ways you can deploy your Nodejs app, be it On-Cloud or On-Premises. However, it is not just about deploying your application, but deploying it correctly. Security is also an important aspect that must not be ignored, and if you do so, the application won’t stand long, meaning there is a high chance of it getting compromised. Hence, here we are to help you with the steps to deploy a Nodejs app to AWS. We will show you exactly how to deploy a Nodejs app to the server using Docker containers, RDS Amazon Aurora, Nginx with HTTPS, and access it using the Domain Name.

Tool Stack To Deploy a Nodejs App to AWS

  • Nodejs sample app: A sample Nodejs app with three APIs viz, status, insert, and list. These APIs will be used to check the status of the app, insert data in the database and fetch and display the data from the database.
  • AWS EC2 instance: An Ubuntu 20.04 LTS Amazon Elastic Compute Cloud (Amazon EC2) instance will be used to deploy the containerized Nodejs App. We will install Docker in this instance on top of which the containers will be created. We will also install a MySQL Client on the instance. A MySQL client is required to connect to the Aurora instance to create a required table.
  • AWS RDS Amazon Aurora: Our data will be stored in AWS RDS Amazon Aurora. We will store simple fields like username, email-id, and age will be stored in the AWS RDS Amazon Aurora instance.
    Amazon Aurora is a MySQL and PostgreSQL-compatible relational database available on AWS.
  • Docker: Docker is a containerization platform to build Docker Images and deploy them using containers. We will deploy a Nodejs app to the server, Nginx, and Certbot as Docker containers.
  • Docker-Compose: To spin up the Nodejs, Nginx, and Certbot containers, we will use Docker-Compose. Docker-Compose helps reduce container deployment and management time.
  • Nginx: This will be used to enable HTTPS for the sample Nodejs app and redirect all user requests to the Nodejs app. It will act as a reverse proxy to redirect user requests to the application and help secure the connection by providing the configuration to enable SSL/HTTPS.
  • Certbot: This will enable us to automatically use “Let’s Encrypt” for Domain Validation and issuing SSL certificates.
  • Domain: At the end of the doc, you will be able to access the sample Nodejs Application using your domain name over HTTPS, i.e., your sample Nodejs will be secured over the internet.
  • PostMan: We will use PostMan to test our APIs, i.e., to check status, insert data, and list data from the database.

As I said, we will “deploy a Nodejs app to the server using Docker containers, RDS Amazon Aurora, Nginx with HTTPS, and access it using the Domain Name.” Let’s first understand the architecture before we get our hands dirty.

Posted on

Automate and Manage AWS Outposts Capacity Across Multi-Account AWS Setup [Video]

This is a recording of the breakout session led by AWS Hero Margaret Valtierra at AWS re:Invent 2022, Las Vegas. Posted with permission.


Curious how, for mere dollars a month and minimal upkeep, you can centrally track and manage Outposts capacity across multiple AWS accounts? In this session, we’ll show a unique solution implemented at Morningstar by the Cloud Services team to do just that. We'll walk through how we arrived at the architecture of the solution that uses lambdas, DynamoDB, CloudWatch, S3, and a custom API to track capacity and block users from overspending their quota.

Posted on

Multi-Tenant Architecture for a SaaS Application on AWS

SaaS applications are the new normal nowadays, and software providers are looking to transform their applications into a Software As a Service application. For this, the only solution is to build a multi-tenant architecture SaaS application. Have you ever wondered how Slack, Salesforce, AWS (Amazon Web Services), and Zendesk can serve multiple organizations? Does each one have its unique and custom cloud software per customer? For example, have you ever noticed that, on Slack, you have your own URL “yourcompanyname.slack.com?”

Most people think that, in the background, they created a particular environment for each organization—application or codebase—and believe that Slack customers have their own server/app environment. If this is you, you might have assumed they have a repeatable process to run thousands of apps across all their customers. Well, no. The real solution is a multi-tenant architecture on AWS for a SaaS application.

Posted on

Required Knowledge To Pass AWS Certified Data Analytics Specialty Exam

Disclaimer: All the views and opinions expressed in the blog belong solely to the author and not necessarily to the author's employer or any other group or individual. This article is not a promotion for any course or training platform. The sole objective of this article is to help the AWS community to successfully pass this difficult exam. Also, this article is based on my exam experience, which may differ from any other individual's exam experience.

I passed the AWS Certified Data Analytics – Specialty exam in October 2022. With this article, I would like to share my experience and the preparations I took to pass this certification exam. I don't want to share the details that you can get from the AWS certification page; rather, I would share the topics that you would need to know to pass the exam and the type of questions that you can expect during the exam.

Posted on

Exploring the Benefits of Cloud Computing: From IaaS, PaaS, SaaS to Google Cloud, AWS, and Microsoft

Cloud computing is a revolutionary technology that has transformed the way businesses operate today. It is a model of delivering computing services — including servers, storage, databases, networking, software, analytics, and intelligence — over the internet ("the cloud") to offer faster innovation, flexible resources, and economies of scale.

Cloud computing is built on the concept of virtualized resources, which can be accessed over the internet. A cloud server is a virtualized version of a physical server, which can be accessed remotely. This means that businesses no longer need to invest in expensive hardware or software to run their operations. Instead, they can simply access the resources they need from a cloud provider.

Posted on

Required Skills/Knowledge To Pass AWS Machine Learning Specialty Certification

Disclaimer: All the views and opinions expressed in the blog belong solely to the author and not necessarily to the author's employer or any other group or individual. This article is not a promotion for any course or training platform. The sole objective of this article is to help the AWS community to successfully pass this difficult exam. Also, this article is based on my exam experience, which may differ from any other individual's exam experience.

I passed the AWS Certified Machine Learning — Specialty exam in November 2022. With this article, I would like to share my experience and the preparations I took to pass this certification exam. I don't want to share the details that you can get from the AWS certification page. Rather, I would share the topics that you would need to know to pass the exam and the type of questions that you can expect during the exam.

Posted on

Design and Create VPC in AWS

This article describes the design and creation of Amazon Virtual Private Network (VPC) using the VPC Designer tool and Cloud Formation templates. It also provides details of VPC Components such as Subnets, Route tables, Security Groups, Internet Gateway, NAT Gateway, VPC endpoints, Network Interfaces,  Network Access Control Lists (ACLs), and VPC Peering. 

Amazon Virtual Private Cloud (VPC) enables you to create your own dedicated, logically isolated virtual private network in your AWS account. This virtual network closely resembles a traditional network that you operate in your own data center (on-premises).  It provides the ability to define and have full control over the virtual network environment, including security, connectivity, and resource deployment. VPC spans multiple availability zones in an AWS Region. 

Posted on

AWS re:Invent 2022 — Join Us for the BuildOn.AWS Track

AWS re:Invent 2022 is right around the corner, and as always, it will offer plenty of learning opportunities for developers, engineers, and others who want to build new and innovative things on AWS. First held in 2012, AWS re:Invent is the company’s annual learning conference for the global cloud computing community. Scheduled to take place in Las Vegas, Nevada, from Monday, November 28, to Friday, December 2, it will feature over 1500 sessions. 

If you are joining us at AWS re:Invent 2022, then the BuildOn.AWS (BOA) track is definitely something to look out for! The sessions on this track are specially curated for builders with a focus on how to build real-world solutions, deep dive into the architecture and code.

Posted on

Data Migration from AWS DocumentDB to Atlas on AWS

AWS Database Migration Service (DMS) provides heterogeneous migrations between different database platforms. The source database remains fully operational during the migration, minimizing downtime to applications that rely on the database. Currently, DMS can use AWS DocumentDB as a database source or target; however, DMS only supports MongoDB as a source endpoint for data replication. 

Following are the steps to replicate data from DocumentDB to Atlas using the DMS. Please be aware that the twisted configuration may not be supported by AWS.

Posted on

Automating Microservices on AWS

Organizations are rapidly moving towards cloud adoption. They are also looking at microservices and an agile way of development, deployment, and testing. With such rapid adoption, large organizations are facing many challenges. In large organizations, generally, there are multiple projects running simultaneously. All these projects would typically have a large number of microservices. This results in hundreds of microservices being under development and a number of individuals and teams with varying degrees of skills, expertise, and experience working on those.

The first thing that companies complain about is the lack of proper tagging. With so many microservices being developed, it becomes impossible to trace them without proper tagging. Allocating costs to different projects is also done with the help of tags. Project names, application names, and environment names like DEV, QA, etc., among others, go a long way in managing resources on the cloud better.

Posted on

AWS, Azure, and GCP: Find the Right Platform

The cloud computing market is one of the most dynamic and attractive industries in the world. It's also incredibly complex, and it can be hard to know where to start if you're looking for a cloud platform to support your business. The cloud is growing at a rapid pace, and it's helping to democratize technology. 

Businesses with nascent cloud infrastructure are struggling to ensure business stability and continuity. Start-ups and enterprises that adopted cloud technology prior to the COVID-19 pandemic, on the other hand, benefit from the current situation. But we can't forget that not every company needs the same level of flexibility or scalability as others. So how do you choose the best platform for your business? Know here: 

Posted on

AWS, Azure, and GCP: The Ultimate IAM Comparison

IAM (Identity and Access Management) is one of the most important yet complicated layers of cloud security. To add insult to injury, each major cloud provider (AWS, Azure, GCP) handles IAM differently, requiring cloud security professionals to learn different capabilities, restrictions, and terminology when managing IAM in a given environment. With infrastructure cloudification growing in depth and breadth, cloud security professionals – even if they’re not currently working in a multi-cloud environment – will want to, and should, gain proficiency in the IAM of different CSPs.

Where to begin? In this post, we provide the ultimate cloud IAM overview, comparing AWS, Azure, and GCP. After reading the blog post, you will have a foundational understanding of the IAM cloud security of the major providers. 

Posted on

Access Undenied on AWS

Access Undenied on AWS is an open source CLI tool that analyzes AWS CloudTrail AccessDenied events, scans the environment to identify and explain the reasons for the events, and offers actionable least-privilege remediation suggestions. Basically, you give the tool a CloudTrail event with an Access Denied outcome, and the tool will tell you how to fix it!

Access Undenied for AWS

What’s the Problem?

It’s a beautiful day. You’re building a lambda function, and everything is going exactly as planned. The code looks great. Then you give it a test and…

Posted on

AWS IAM Security Best Practices

While this blog post refers to AWS services, in particular, the best practices are mostly the same for any other IAM framework.

"Security is job zero."

When it comes to security in AWS, this is the de facto culture and standard.