Tutorial / Cram Notes
AWS Systems Manager is a management service that helps you automatically apply configurations to your instances and manage your AWS resources at scale. One key feature of Systems Manager is State Manager, which ensures that your instances are in a defined state and compliant with the desired configuration.
For example, you can create a State Manager association to install or update an agent or run a script at a scheduled interval:
– name: Ensure the latest version of the Amazon CloudWatch agent is installed
hosts: all
become: yes
tasks:
– name: Create an association to install/update CloudWatch agent
community.aws.ssm_association:
name: UpdateCloudWatchAgent
document: AWS-ConfigureAWSPackage
parameters:
action: Install
name: AmazonCloudWatchAgent
targets:
– Key: tag:Role
Values: WebServer
schedule_expression: “rate(30 minutes)”
In this example, any EC2 instance with the tag Role: WebServer will have the CloudWatch agent installed or updated every 30 minutes.
AWS CodeDeploy
AWS CodeDeploy is a deployment service that automates the deployment of applications to EC2 instances, AWS Lambda, or Amazon ECS services. It enables you to rapidly release new features, avoid downtime, and handle complex updates.
A typical CodeDeploy appspec.yml file for an EC2/On-Premises deployment could look like this:
version: 0.0
os: linux
files:
– source: /BuildOutput/myapp.zip
destination: /var/www/html
hooks:
BeforeInstall:
– location: scripts/cleanup.sh
timeout: 180
AfterInstall:
– location: scripts/setup.sh
timeout: 180
ApplicationStart:
– location: scripts/start_server.sh
timeout: 180
The above file specifies the source and destination for the deployment package, along with lifecycle event hooks to run scripts at various stages of the deployment process.
AWS Elastic Beanstalk
AWS Elastic Beanstalk is an orchestration service that abstracts the underlying infrastructure, providing an environment to deploy and scale web applications and services.
With Elastic Beanstalk, configuration changes can be made in the console, through configuration files .ebextensions, or using the EB CLI:
eb setenv DATABASE_URL=database-endpoint.com -e my-env
The above command sets an environment variable for the my-env environment.
AWS CloudFormation
AWS CloudFormation allows you to manage your AWS infrastructure by defining templates as code. When updates are made to the CloudFormation template, it can incrementally apply changes to resources without re-creating them.
Here is an example of a CloudFormation resource definition that changes instance type:
Resources:
EC2Instance:
Type: AWS::EC2::Instance
Properties:
InstanceType: t2.large
If the template previously had t2.small as InstanceType, updating the stack with this template will change the instance type to t2.large.
AWS OpsWorks
AWS OpsWorks is a configuration management service that helps manage Chef and Puppet instances, which automate infrastructure and application configuration.
For example, to change the Apache service configuration in OpsWorks you could have a Chef recipe like:
service ‘apache2’ do
supports :status => true
action [:enable, :start]
end
template ‘/etc/apache2/apache2.conf’ do
source ‘apache2.conf.erb’
owner ‘root’
group ‘root’
mode ‘0644’
notifies :restart, ‘service[apache2]’, :immediately
end
The above recipe ensures that the Apache service is running and sets its configuration file from a template, restarting the service if the configuration changes.
Comparison and Best Practices
| Tool | Use Case | Best For |
|---|---|---|
| Systems Manager | Infrastructure management and automation | Large fleets of instances, patch management |
| CodeDeploy | Application deployment | Automated, consistent deployment workflows |
| Elastic Beanstalk | Application orchestration | Quick deployment, management of web apps |
| CloudFormation | Infrastructure as Code | Reproducible infrastructure, versioning |
| OpsWorks | Configuration management | Customized Chef/Puppet instances |
Best practices for applying configuration changes involve:
- Automation: Automate the configuration management process to reduce human error and improve consistency.
- Version Control: Keep all configuration files in version control to track changes and roll back if necessary.
- Immutable Infrastructure: Whenever possible, use immutable components that are replaced rather than changed to maintain reliability.
- Testing: Implement testing stages in your CI/CD pipeline to ensure changes do not introduce unexpected behaviors.
- Monitoring and Logging: Set up monitoring and logging to track the impact of changes and respond quickly to any issues.
Understanding these tools and practices is key for those seeking the AWS Certified DevOps Engineer – Professional certification, as it demonstrates the ability to manage and deploy configurations in complex AWS environments.
Practice Test with Explanation
When applying configuration changes using AWS Systems Manager (SSM), it’s not necessary to stop your instances. (True/False)
Answer: True
Explanation: AWS Systems Manager can apply configuration changes to running instances without the need to stop them. It allows you to automate the process of managing your AWS resources.
Which AWS service can be used to automate the deployment of infrastructure and applications?
- A) AWS CodeDeploy
- B) AWS CloudFormation
- C) AWS OpsWorks
- D) All of the above
Answer: D) All of the above
Explanation: AWS CodeDeploy automates application deployments; AWS CloudFormation automates infrastructure provisioning; and AWS OpsWorks automates both infrastructure and application deployment through Chef and Puppet.
Using AWS Config, you can continuously monitor and record your AWS resource configurations to ensure compliance with your defined guidelines. (True/False)
Answer: True
Explanation: AWS Config provides a detailed inventory of your AWS resources and their current configuration, allowing continuous monitoring and governance.
AWS Elastic Beanstalk can help you manage the deployment and scaling of applications but does not provide any health monitoring features. (True/False)
Answer: False
Explanation: AWS Elastic Beanstalk is an orchestration service that provides deployment, scaling, and health monitoring for web applications.
Which AWS service is a fully managed deployment service that automates software deployments to various compute services such as Amazon EC2, AWS Fargate, AWS Lambda, and your on-premises servers?
- A) AWS CodeBuild
- B) AWS CodeDeploy
- C) AWS CodePipeline
- D) AWS CodeCommit
Answer: B) AWS CodeDeploy
Explanation: AWS CodeDeploy automates the deployment of applications to Amazon EC2 instances, AWS Fargate, AWS Lambda, and on-premises servers.
Blue/Green deployment is a strategy that can be used with AWS CodeDeploy to minimize downtime and risk by running two identical production environments. (True/False)
Answer: True
Explanation: Blue/Green deployment involves deploying a new version of your application alongside the old version and then switching traffic to the new version once it’s fully tested and ready to go live.
Which feature of AWS CodePipeline can be used to trigger actions based on changes in source code?
- A) Deployment Providers
- B) Custom Actions
- C) Action Groups
- D) Source Triggers
Answer: D) Source Triggers
Explanation: Source Triggers in AWS CodePipeline can be configured to automatically start your pipeline when a change occurs in the source code repository.
Before applying changes to production systems using AWS, it is best practice to test changes in a staging environment. (True/False)
Answer: True
Explanation: Testing in a staging environment before applying changes to production is a best practice because it helps to identify and rectify potential issues without impacting production workloads.
What is the main purpose of AWS CloudFormation Drift Detection?
- A) To automatically correct configuration drift
- B) To monitor and report on resource drift from the stack template configuration
- C) To deploy updates across multiple stacks
- D) To manage user permissions and access to CloudFormation stacks
Answer: B) To monitor and report on resource drift from the stack template configuration
Explanation: AWS CloudFormation Drift Detection helps to identify and report on resources that have drifted from their expected configuration as defined in the CloudFormation stack template.
AWS OpsWorks provides managed instances of which configuration management tools? (Select two)
- A) Puppet
- B) Chef
- C) Ansible
- D) SaltStack
Answer: A) Puppet, B) Chef
Explanation: AWS OpsWorks for Chef Automate and AWS OpsWorks for Puppet Enterprise provide managed instances of Chef and Puppet, respectively.
Can AWS Systems Manager Parameter Store be used to manage secrets for applications?
- A) Yes, but only for non-sensitive data
- B) No, it is only for managing server configurations
- C) Yes, it can manage secrets and is integrated with AWS Secrets Manager for enhanced security
- D) No, AWS Systems Manager Parameter Store is not designed to manage any kind of application data
Answer: C) Yes, it can manage secrets and is integrated with AWS Secrets Manager for enhanced security
Explanation: AWS Systems Manager Parameter Store can be used to manage secrets, configuration data, and secure string parameters. It can also be integrated with AWS Secrets Manager to provide fine-grained access control and auditing.
When configuring IAM roles for systems operations with AWS, it is recommended to follow the principle of least privilege. (True/False)
Answer: True
Explanation: In AWS, as in other systems, the principle of least privilege stipulates that permissions should be granted at the minimum level required for users to perform their tasks. This reduces the risk of unauthorized access or actions.
Interview Questions
How would you apply a configuration change to an Auto Scaling group in AWS without causing downtime?
To apply a configuration change to an Auto Scaling group without causing downtime, you would usually update the launch configuration or launch template associated with the group to specify the new desired configuration. Then, you would gradually replace the existing instances with new instances that use the updated configuration by using either a rolling update or setting up a new Auto Scaling group and shifting traffic gradually to the new instances using Elastic Load Balancing.
What AWS service would you use to automate the deployment and lifecycle of resources across multiple AWS accounts and regions?
AWS CloudFormation is the service that can be used to automate the deployment and management of resources across multiple AWS accounts and regions. With AWS CloudFormation StackSets, you can manage a common set of AWS resources across several accounts and regions with a single operation.
When applying an AMI update across multiple EC2 instances managed by AWS Systems Manager (SSM), which feature would you use?
When applying an AMI update across multiple EC2 instances managed by AWS Systems Manager, you would use the AWS Systems Manager (SSM) Automation feature. This feature assists in the safe deployment of instances from a golden AMI and performing orchestrated tasks across your AWS resources.
How can you ensure that your EC2 instances are configured according to your company’s compliance standards?
You can ensure that EC2 instances are configured according to compliance standards by using AWS Config rules to assess, audit, and evaluate the configurations of your AWS resources. Additionally, AWS Systems Manager can be used to view and control your infrastructure on AWS and can be integrated with AWS Config for a unified approach.
Can you describe how to manage configuration changes to AWS Lambda functions?
To manage configuration changes to AWS Lambda functions, you would typically modify the function configuration using the AWS Management Console, AWS CLI, or AWS SDKs. For version control and blue/green deployment strategies, you can publish a new version of your Lambda function and then gradually shift traffic to the new version using aliases.
Describe how you would roll back a failed configuration change in AWS.
To roll back a failed configuration change, you can use AWS CloudFormation if resources are provisioned with it. CloudFormation allows you to revert to the previous stack state (rollback) if the stack update fails. For manual changes or changes made outside of CloudFormation, you would need to identify the failed change and manually apply the reverse of that change or apply a previous successful configuration.
What mechanisms does AWS provide to automate configuration changes on your EC2 instances?
AWS provides AWS Systems Manager State Manager and AWS Systems Manager Automation to automate configuration changes on your EC2 instances. State Manager helps to ensure that your instances maintain a defined state consistently, while Automation enables you to script common administrative tasks and perform actions on your AWS resources.
How would you monitor for unauthorized configuration changes in an AWS environment?
You can monitor for unauthorized configuration changes using AWS Config, which records and evaluates the configurations of your AWS resources. Additionally, you can set up Amazon CloudWatch alarms for unexpected changes reported by AWS Config and send notifications via Amazon SNS when such changes are detected.
Can AWS Elastic Beanstalk help in applying configuration changes to an environment? If so, how?
AWS Elastic Beanstalk simplifies the process of deploying and scaling web applications and services. You can apply configuration changes to an Elastic Beanstalk environment using the management console, EB CLI, or configuration files (.ebextensions). Elastic Beanstalk applies these changes to the environment while maintaining application availability.
How would you handle secrets and sensitive data when applying configuration changes to systems in AWS?
To handle secrets and sensitive data, you should use AWS Secrets Manager or AWS Systems Manager Parameter Store to manage, retrieve, and rotate credentials securely. During configuration changes, your automation scripts or applications can fetch these details on-the-fly without hardcoding them into the configuration files or scripts.
What are some best practices you would follow when applying configuration changes to a production system in AWS?
Best practices include thoroughly testing changes in a staging environment, using version control systems for all configurations, applying changes through CI/CD pipelines, using blue/green or canary deployment strategies to minimize risk, and ensuring all changes are reviewed and approved before applying them to production. It’s also essential to monitor the production system closely after changes have been made and be ready to roll back if necessary.
What role does AWS CodeDeploy play in managing configuration changes?
AWS CodeDeploy automates code deployments to any instance, including EC2 instances and on-premises servers. It can handle the deployment of configuration files and application updates, enabling consistent deployments and the ability to quickly roll back to a previous version if necessary. CodeDeploy supports a variety of deployment strategies and integrates with AWS services to simplify the end-to-end software release process.
This blog post is incredibly helpful! Thanks for sharing!
Can anyone tell me the best practices for applying configuration changes to instances in a rolling update?
How do you handle configuration drift when making changes?
Does anyone have experience with automating configuration changes using CloudFormation?
What are the common pitfalls to avoid when updating configurations in a production environment?
Thanks for the post! Learned a lot.
I found this post quite basic. It would be great to have more advanced tips included.
When using AWS CodeDeploy, how do you handle deployment failures?