Book Image

Accelerating DevSecOps on AWS

By : Nikit Swaraj
Book Image

Accelerating DevSecOps on AWS

By: Nikit Swaraj

Overview of this book

Continuous integration and continuous delivery (CI/CD) has never been simple, but these days the landscape is more bewildering than ever; its terrain riddled with blind alleys and pitfalls that seem almost designed to trap the less-experienced developer. If you’re determined enough to keep your balance on the cutting edge, this book will help you navigate the landscape with ease. This book will guide you through the most modern ways of building CI/CD pipelines with AWS, taking you step-by-step from the basics right through to the most advanced topics in this domain. The book starts by covering the basics of CI/CD with AWS. Once you’re well-versed with tools such as AWS Codestar, Proton, CodeGuru, App Mesh, SecurityHub, and CloudFormation, you’ll focus on chaos engineering, the latest trend in testing the fault tolerance of your system. Next, you’ll explore the advanced concepts of AIOps and DevSecOps, two highly sought-after skill sets for securing and optimizing your CI/CD systems. All along, you’ll cover the full range of AWS CI/CD features, gaining real-world expertise. By the end of this AWS book, you’ll have the confidence you need to create resilient, secure, and performant CI/CD pipelines using the best techniques and technologies that AWS has to offer.
Table of Contents (15 chapters)
1
Section 1:Basic CI/CD and Policy as Code
5
Section 2:Chaos Engineering and EKS Clusters
9
Section 3:DevSecOps and AIOps

Adding a production stage and environment

In this section, we will add a production stage to the existing pipeline and will also modify the CloudFormation template to spin up a separate production environment with two EC2 instances via an ASG under a load balancer.

Modifying the pipeline

Currently, our main pipeline looks like the one shown in Figure 1.26. The Elastic Beanstalk environment spun up by this pipeline is named northstarapp, and we need to change it to northstarappstaging. After that, we need to add a manual approval stage, and then a production deployment stage. In the production deployment stage, we will add a configuration parameter in CloudFormation to spin up a production environment with the name northstarappprod and deploy the application in this new environment.

To modify the pipeline, follow these next steps:

  1. Go to northstar-Pipeline CodePipeline project (see Figure 1.27) and click on Edit.
  2. Click on Edit stage in the Edit: Deploy screen, as illustrated in the following screenshot:
Figure 1.63 – Editing exiting deploy stage of pipeline

Figure 1.63 – Editing exiting deploy stage of pipeline

  1. Edit the GenerateChangeSet action group, go to Advanced | Parameter overrides, and add one key value in JSON format: "Stage":"Staging", as illustrated in the following screenshot. Also, copy and paste the entire JSON config into a separate note because we will be using that in the production parameter. Click on Done to save the configuration. Click on Done to save the Deploy stage:
Figure 1.64 – Modifying parameter to be used by CloudFormation stack

Figure 1.64 – Modifying parameter to be used by CloudFormation stack

  1. Add a new stage by clicking on Add stage. Give a stage name of Approval, as illustrated in the following screenshot:
Figure 1.65 – Adding approval stage to the pipeline

Figure 1.65 – Adding approval stage to the pipeline

  1. Click on Add action group, then enter ManualApproval under Action name and Manual approval under Action provider, as illustrated in the following screenshot. You can configure a Simple Notification Service (SNS) topic, but we are skipping this here. Click on Done to save the action group:
Figure 1.66 – Adding approval action group

Figure 1.66 – Adding approval action group

  1. Click on Add stage to add a production deploy stage. Name the stage ProdDeploy. Click on Add action group. Enter GenerateChangeSet under Action name, AWS CloudFormation under Action provider, and northstar-BuildArtifact under Input artifacts. Then, click on Create or replace a change set under Action mode and enter awscodestar-northstar-infrastructure-prod under Stack name, pipeline-changeset under Change set name, northstar-BuildArtifact under Template | Artifact name, and template-export.yml under File name. Select Use configuration file, then enter northstar-BuildArtifact under Template configuration | Artifact name, template-configuration.json under File name, CAPABILITY_NAMED_IAM under Capabilities, and CodeStarWorker-northstar-CloudFormation under Role name. Click on the Advanced section and paste the JSON content that we copied in Step 3. Set the last Stage value to Prod and click on Done.

The process is illustrated in the following screenshot:

Figure 1.67 – GenerateChangeSet action group configuration

Figure 1.67 – GenerateChangeSet action group configuration

  1. Click again on Add action group. For the action name, enter ExecuteChangeSet, and enter AWS CloudFormation under Action provider. Under Action mode, we need to select Execute a change set. Under Stack name, we need to enter awscodestar-northstar-infrastructure-prod. Under Change set name, we need to enter pipeline-changeset.

The process is illustrated in the following screenshot:

Figure 1.68 – ExecuteChangeSet action group configuration

Figure 1.68 – ExecuteChangeSet action group configuration

  1. Save the pipeline. Now, raise a PR from develop to master and merge the code to master, which will run the northstar-Pipeline pipeline. This pipeline will rename the existing environment from northstarapp to northstarappStaging and deploy the application. Then, we manually need to check the application. If the application is working fine, then we need to approve it to proceed to the ProdDeploy stage. In the ProdDeploy stage, CloudFormation will spin up a northstarappProd Elastic Beanstalk production environment then deploy the application in the northstarappProd production environment.

You can see the PR being raised in the following screenshot:

Figure 1.70 – Merging PR

Figure 1.69 – Raising PR

  1. Merge the PR from develop to the master branch, as illustrated in the following screenshot:

Figure 1.70 – Merging PR

  1. The pipeline will get triggered after the merge process, as illustrated in the following screenshot:
Figure 1.71 – Pipeline triggered the moment merge finishes

Figure 1.71 – Pipeline triggered the moment merge finishes

  1. The initially created northstarapp environment will be terminated and a new northstarappStaging environment will be created, as illustrated in the following screenshot:
Figure 1.72 – northstarapp is terminated and a new northstarappStaging environment is set up

Figure 1.72 – northstarapp is terminated and a new northstarappStaging environment is set up

  1. You can access the staging application by navigating to the northstarappStaging Elastic Beanstalk environment, as illustrated in the following screenshot:
Figure 1.73 – Application running in the staging environment

Figure 1.73 – Application running in the staging environment

  1. In the pipeline, it's waiting for approval. Approve it by entering a comment, as illustrated in the following screenshot:
Figure 1.74 – The first screen shows waiting for manual approval while the second screen shows the approval process

Figure 1.74 – The first screen shows waiting for manual approval while the second screen shows the approval process

Figure 1.74 – The first screen shows waiting for manual approval while the second screen shows the approval process

  1. Once the ProdDeploy stage is successful, you can go to Elastic Beanstalk and search for northstarappProd, as illustrated in the following screenshot:
Figure 1.75 – Elastic Beanstalk console showing production environment

Figure 1.75 – Elastic Beanstalk console showing production environment

  1. You can access the application by clicking the endpoint, as illustrated in the following screenshot:
Figure 1.76 – Application running in the production environment

Figure 1.76 – Application running in the production environment

  1. You can also go to Load balancer to check the new ELB with two EC2 instances attached to it, as illustrated in the following screenshot:
Figure 1.77 – Load balancer console showing the instances attached to it

Figure 1.77 – Load balancer console showing the instances attached to it

So, we just saw how to modify a pipeline and add a production stage. You can also make it more comprehensive by creating an SNS topic during the approval stage, and also by adding an ELB Domain Name System (DNS) in Route 53. You can make this change via a CloudFormation template.