A brief introduction to Amazon Web Services from a web developer's perspective. You'll find out what EC2, VPC and S3 stand for, you'll also learn the purpose of security groups, resource isolation and why it all matters for your application. This is a part of Mirumee Talks — an engineering meetup that is free for everyone to come and enjoy. We love sharing what we know and what we are currently up to our in the techy trenches. Talk. Share. Learn.

1. AWS for web
developers
Artur Smęt2018-04-19

2. About me
● Python Developer @ Mirumee Software
● DevOps enthusiast
● 4+ years of experience with AWS
● AWS Wrocław MeetUp Co-Organizer

3. Agenda
● Typical web application stack
● Classic and modern deployment approach
● What is AWS and how it works
● Useful services available on AWS
● Real life examples & Best practices

4. Chapter I
Typical web app stack

5. Internet store with custom mugs - epicmugs.com

6. Postgres
App
Redis
The app

7. Classic approach

8. Postgres
App
Redis
The app
epicmugs.com

9. Web server #1
App
Postgres
Redis
DB server
epicmugs.com

10. Web server #1
App
Web server #2
App
Postgres
Redis
DB server
epicmugs.com

11. Web server #1
App
Web server #2
App
Postgres
Redis
DB server
epicmugs.com
Load balancer

12. Web server #1
App
Web server #2
App
Postgres
Redis
DB server
Load balancer
epicmugs.com
Load balancer

14. Cloud based approach

15. Everything as a service

16. Delegate responsibility to the operator

17. Orchestrate infrastructure

18. How?

19. The story of AWS

21. Chapter II
AWS cloud architecture

22. Core AWS concepts
● Geographically distributed services
● Redundant network
● High availability by design

23. Existing AWS Region
Planned AWS Region

24. Availability
zone A
Availability
zone B
Availability
zone C
Region (eg. eu-west-1)

25. Shared responsibility model

27. Available services

30. Selected services for web developers

31. Service Used for
EC2 Deploy app servers
RDS Postgres database as a
service
Elasticache Storage for product images
Cloudfront Reduce load time of page
Route53 Register epicmugs.com
domain

33. Ok… but how do I build it?

34. AWS Web Console

37. Automation tools like Terraform or Ansible

38. Chapter III
HowTo & Best practices

39. Always deploy in VPC

40. VPC - Virtual Private Cloud

45. Set tight security groups

49. Security
group
Incoming Outgoing
App
LB group
DB group
0.0.0.0/0
Database App group 0.0.0.0/0
Load
balancer
0.0.0.0/0 0.0.0.0/0

50. Grant least privileges as possible

51. ● IAM - Identity and Access Management
● Manage users permissions
● Always set lowest possible privileges
● Use IAM roles when it’s possible to avoid credentials leak

52. Roles vs Static keys

53. AWS_ACCESS_KEY_ID = AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

55. IAM Policy

57. {
"Version":"2012-10-17",
"Statement":[
{
"Effect":"Allow",
"Action":[
"s3:PutObject",
"s3:GetObject",
"s3:GetObjectVersion",
"s3:DeleteObject",
"s3:DeleteObjectVersion"
],
"Resource":"arn:aws:s3:::my-bucket-name/"
}
]
}
Good policy

58. {
"Version":"2012-10-17",
"Statement":[
{
"Effect":"Allow",
"Action":[
"s3:*",
],
"Resource":"*"
}
]
}
Bad policy

59. Other worth mentioning services

60. Elasticache

61. ● Hosted Redis or Memcached
● Works in VPC

62. AWS Elastic Container Service (ECS)

63. ● Docker containers hosting
● Built-in container registry for private images

64. Questions?

65. SHARE. TALK. LEARN.
mirumee.com
/mirumeelabs