Mastering Infrastructure As Code For Real-World Use Cases

1. CloudFormation Dark Arts
Chase Douglas, CTO, stackery.io
chase@stackery.io
@txase
MASTERING INFRASTRUCTURE AS CODE FOR REAL-WORLD USE CASES

4. My Background
• Brought Multi-Touch Input Support To
The Linux Desktop
• Technical Architect of New Relic
Browser
• CTO and Co-founder of Stackery

5. What I’ve Seen
• Business Impeded Because Infrastructure/
Processes Couldn’t Scale
• Engineering Orgs That Don’t Know What
Has Been Deployed Where
• Spent Years Figuring Out Serverless Best
Practices

6. Most Of You Have Built A Serverless App

7. Some Of You Have Deployed An App In
Production

8. If Your Team Made It To Production,
You’ve Probably Learned A Few Things

9. What’s The Biggest
Stumbling Block For New
Serverless Devs?

10. Infrastructure-as-
Code (IaC)

11. I can point and
click!

13. No more
clicky-click for
you

14. Today, we’re going
to solve the hardest
real-world IaC
challenges!

15. Agenda For Mastering Serverless
• PSA: Permission Scoping
• Namespacing Resources
• Parameterization
• Custom Resources
• Using Existing Resources

16. Aside: We’ll be using AWS
SAM/CloudFormation
The same principles
work elsewhere

17. Definitions
Stack: An instance of an app deployed
from an IaC template
Resource: A component of an app (e.g.
function, NoSQL table, PubSub topic)
specified in an IaC template

19. PSA: Use Scoped
Permissions!
(I’m also using this to level-set on referencing
resources in SAM/CloudFormation templates)

20. Access And Permission Management
HTTPS: //GITHUB.COM/SERVERLESS/EXAMPLES/BLOB/MASTER/AWS-NODE-UPLOAD-TO-S3-AND-POSTPROCESS/SERVERLESS.YML
Access To Do Anything In
Every S3 Bucket In AWS
Account!

21. Access And Permission Management
Need To Scope Access To Specific Actions
Need To Scope Access To Specific
Resources

22. Access And Permission Management

24. Namespacing
Resources

25. But What Is Our
Topic Name?
mystack-mytopic-jshdfkjhf8sd8f8
Random

26. Goal: Understand Three Things From
The Resource Name
Application
Environment
Resource

27. Stack Name: Application-Environment
+
=
backend-prod-notifications

28. Application
Environment
Resource
backend-prod-notifications

30. Parameterization
(Or, How To Not Put Your DB
Password In Your Template)

39. But Where Do I Store
All These Passwords?

44. Custom Resources

45. 1. Provision an API
2. Update a DNS record
Custom Resource Example: DNS Record

46. Custom Resource Example: DNS Record

47. Custom Resource Example: DB Migrations
On every deploy,
migrate the database

48. Custom Resource Example: DB Migrations

50. Using Existing
Resources

51. World’s Simplest Serverless App

52. I can easily deploy different
environments for dev/test

54. But What If I Need To Use
An Existing Table In Prod?

56. But Now I Can’t Easily
Provision Tables For Dev/
Test…

58. What If I Need Multiple
Attributes Of The Resource?

60. This Could Get
Tedious…

61. What About Our Custom
Resource Friends?

64. Agenda For Mastering Serverless
• PSA: Permission Scoping
• Namespacing Resources
• Parameterization
• Custom Resources
• Using Existing Resources

67. High Performance Serverless Teams
CONFIGURATION MANAGEMENT COLLABORATION CONSISTENCY

68. Use Software That Does It For You

70. Thank you!
Chase Douglas, CTO @ Stackery.io
chase@stackery.io
@txase