June 2022 Summaries

The Hashicorp Configuration Language (HCL) used by Terraform includes several built-in functions that can manipulate and transform values within an expression. Two such functions are join and split, which work with strings. Join produces a string by concatenating elements of a list using a specified delimiter, while split separates a single string into a list using a given delimiter. These functions can be useful in various scenarios, including working with configuration files for devices or appliances, extracting parts from URLs, and more.

DevOps is a set of best practices around the software development lifecycle that aims to improve efficiency and value creation. Key aspects include collaboration between developers and operations teams, continuous integration and delivery (CI/CD), automated testing, observability, and automation. Some common anti-patterns to avoid are creating separate DevOps teams, relying on a single "DevOps hero," attempting to automate everything at once, chasing new tools without proper analysis, sacrificing quality for speed, neglecting continuous improvement, and overlooking documentation and information sharing.

In this article, we explore the AWS Identity and Access Management (IAM) service, focusing on IAM policies. We define terminology for essential components and discuss different types of policies, including identity-based policies, resource-based policies, permissions boundaries, access control lists, and session policies. We also cover policy document structure, creating an IAM policy using the AWS console or Terraform, validating and testing IAM policies, versioning IAM policies, and best practices for managing IAM policies. The article highlights the importance of securely accessing cloud resources and provides valuable insights into effective access management controls on AWS.

The author discusses their experience migrating a significant part of their workload from long-running processes to AWS Lambda. They detail the architecture of their backend, which includes a server and a drain for handling asynchronous jobs. They also explain how they changed their codebase for Lambda without requiring huge modifications or multiple binaries. Furthermore, they describe their approach to local development using SQS queues and handling secrets with environment variables. The author dispels misconceptions about container images in Lambda and explains the function lifecycle and limitations of asynchronous Goroutines. They also discuss the Lambda SQS connector's shortcomings and how to reset a Lambda. Lastly, they highlight the benefits of using Lambda for cost-effectiveness, scalability, and operational simplicity.

The `terraform apply` command is used to deploy infrastructure as described in configuration files. It executes the actions proposed in a `terraform plan`. Typically, `apply` should be run after `terraform init` and `terraform plan`. If run without options, it generates a plan, asks for confirmation, and then applies changes. The command can also use a previously generated planfile or pass in variable values. It is safe to run multiple times if there are no changes in the configuration files. In automation, `terraform apply` can be used with the plan output file or with the `-auto-approve` option for CI/CD pipelines. Spacelift offers a more robust way of automating infrastructure provisioning lifecycle and managing Terraform state.

Ansible roles provide a well-defined framework and structure for setting tasks, variables, handlers, metadata, templates, and other files. They enable reuse and sharing of Ansible code efficiently, improving collaboration and velocity as different users can work on separate roles in parallel without modifying the same playbooks simultaneously. The standard role directory structure includes defaults, files, handlers, meta, tasks, templates, tests, vars, and library directories. Roles can be created by refactoring Ansible playbooks into a role or generated from scratch using the ansible-galaxy init command. They can be used in plays with the roles option at the play level or at the task level with include_role dynamically and import_role statically. Sharing roles is possible through Ansible Galaxy, an online open-source public repository of Ansible content.

Infrastructure as Code (IaC) is a method to manage infrastructure through code, which can be versioned and integrated with CI/CD platforms. However, drift occurs when there's a difference between the desired state of infrastructure defined in IaC source code and its actual state. Manual changes are often the primary cause of drift, but overlapping or conflicting IaC code can also contribute to it. To avoid drift, implementing strict access control practices is crucial. Drift detection tools like Terraform, CloudFormation, Pulumi, and Spacelift can help identify drift and revert it back to the desired state.

A CI/CD pipeline automates software or infrastructure-as-code delivery from source code to production. It consists of build, test, delivery, and deployment stages. Continuous Integration (CI) covers the build and test stages, while Continuous Delivery / Deployment (CD) refers to the automatic release to a repository after the CI stage and the automatic deployment of the artifact that has been delivered. A good pipeline should be reliable, accurate, and fast. Key benefits of using CI/CD pipelines include reduced costs, reduced time to deployment, enabling continuous feedback, improving team collaboration, and audit trails.