February 2020 Summaries

Pulumi has embraced the Go programming language for its open-source pulumi/pulumi engine and SaaS backend, recognizing Go as the "language of the cloud" due to its widespread adoption in cloud-native infrastructure projects like Docker and Kubernetes. Pulumi 2.0 has introduced Go as a supported language for infrastructure as code, allowing developers to automate cloud resource management using familiar programming tools and techniques, such as declaring desired infrastructure states and leveraging modern cloud patterns like containers and serverless. This approach reduces manual configuration, enhances security and compliance through a policy engine, and supports the reuse of existing Go packages. Pulumi's asynchronous programming model, with its promise-like Inputs and Outputs, facilitates dependency management and parallelizes resource provisioning. Although Pulumi for Go is currently in "preview" status, it supports essential features of the Pulumi programming model, and the team is actively seeking user feedback to improve the Go experience. Additionally, Pulumi plans to enhance Kubernetes support and transition from Dep to Go Modules.

Scheduling tasks in the cloud has become an efficient way to automate operations, exemplified by using AWS CloudWatch and Pulumi to manage an S3 bucket akin to a Recycle Bin. The process involves creating a Lambda function that empties the bucket of discarded items every Friday at 6:00 pm EST. This is achieved by setting up a CloudWatch event with a cron expression, which runs the function at 11:00 pm UTC. The implementation requires defining an event handler that lists and deletes objects in the bucket, and is deployed using Pulumi, which simplifies the setup of serverless functions without extensive infrastructure configuration. Users can test the function by adding items to the bucket and observing their deletion, with options to adjust scheduling through cron expressions. The example highlights the potential of serverless architecture to streamline task automation, with further exploration suggested through additional serverless examples available in Pulumi's resources.

Pulumi has introduced Audit Logs for Enterprise organizations, providing a way to monitor and track user activities within an organization. These logs aim to answer questions about user actions, timing, and location by recording all user actions with details such as UNIX timestamps, user identity, event details, and source IP addresses. Available exclusively to organizations with an Enterprise subscription, the audit logs are immutable and offer a detailed account of user activities, ensuring that all member actions are attributable. Organization administrators can access these logs by navigating to the Audit Logs tab in the settings, where they can view and filter events by user. The feature is designed to enhance transparency and accountability within organizations using Pulumi.

Pulumi's CrossGuard tool provides a comprehensive framework for implementing Policy as Code, allowing users to define infrastructure policies using TypeScript or JavaScript, which facilitates automated testing, deployment, and version control. CrossGuard supports a wide array of cloud environments, including AWS, Azure, Google Cloud Platform, and Kubernetes, enabling users to enforce security, cost, and compliance best practices across various infrastructures. By leveraging Policy Packs, developers can bundle and apply custom policies to verify resources before deployment, ensuring adherence to organizational standards. The tool provides examples of policies such as controlling AWS costs by setting maximum spending limits, restricting Azure IoT service usage to enhance security, managing Google Cloud Platform access to prevent public exposure, and enforcing Kubernetes best practices like pinning container versions. This approach allows for more dynamic and scalable policy creation compared to traditional methods, offering the ability to integrate external data sources and apply consistent policies across different cloud providers.

AWS Step Functions allows users to build applications by connecting AWS services into cohesive workflows, using a state machine diagram to illustrate the connections between services. The text provides a detailed walkthrough of creating a simple application using AWS Step Functions, including setting up a Lambda function, IAM roles, and policies, and deploying the workflow using Pulumi. Initially, a "Hello World" function is created and executed, demonstrating the basic setup process. The guide then expands by adding an additional step with a new function that returns "Nice to meet you," showcasing how to update the state machine to include multiple steps. Pulumi's programming model is highlighted, particularly its handling of resource outputs and dependencies. The article serves as an introductory guide to AWS serverless workflows, with hints at further expansion possibilities using custom Lambda functions and additional AWS services, and mentions that the example is also available in TypeScript for those who prefer a different programming language.

Modern applications, while offering scalability and rapid updates, have introduced significant complexity, especially concerning infrastructure configuration and security. Even managed cloud services require additional setups to ensure security, with common breaches often stemming from misconfigured resources like AWS S3 Buckets and Elasticsearch instances. Policy as Code (PaC) tools, such as Pulumi's CrossGuard, can preemptively address these issues by verifying infrastructure configurations against best practices before deployment. CrossGuard, an SDK for writing policies, includes playbooks for cloud providers like AWS, Azure, and Google Cloud Platform, and can enforce policies to prevent common errors like public access to S3 buckets or unsecured Elasticsearch deployments. These practices are demonstrated through examples, using Pulumi to create and test policies that prevent public exposure and mandate encryption for Elasticsearch. As of Pulumi 2.0, CrossGuard is set to expand its features, including OPA integration, enhancing its capability to secure infrastructure proactively.

Google Cloud Run is a distinctive serverless compute service that stands out due to its use of Docker as a deployment package, allowing developers to utilize any language, runtime, framework, or library capable of responding to HTTP requests. It features automatic scaling, including the ability to scale to zero, which ensures cost-efficiency by charging only for consumption without fixed costs or management overhead. Cloud Run is optimized for stateless web applications, employing ephemeral containers with execution limited to 15 minutes. The service is compared to alternatives like Google Cloud Functions, AWS Fargate, and Azure Container Instances, highlighting its unique capabilities such as handling HTTP requests, absence of cluster management, and elastic scalability. Additionally, Cloud Run's pricing model is entirely consumption-based, offering potential cost advantages for concurrent request handling when compared to similar services. The text also includes a tutorial on deploying Cloud Run services using Pulumi, including steps for enabling the service, deploying a pre-built container image, and setting up a custom Ruby application.