Preparation

Ready

One of the best resources that helped me is the AWS certifications subreddit. It contains plenty of advice and I found answers for almost every question I had. After searching for the most relevant courses, I quickly figured out that Stephane Maarek courses are one of the most useful regarding the architect exam. I bought the courses on Udemy but, later, reading an AMA from him, I realized it is better to go on his website (reason here).
It turned out that the course was very helpful for the exam. It covers the parts you need to know and helps you understand how to approach it. He took the time to create real-world use-cases to give an overview of how the services can be used together. I found it very interesting. He also included some tips for the exam itself, like the fact of having a 30 min bonus if you’re not a native English speaker. Go for it, it is available for less that 20$ and it is worth it.

Steady

I bought some practice exams too, Jon Bonso ones (I also bought them on Udemy). Same here, subreddit community says they are the closest to real exams. I think they were very helpful because they contained detailed answers and explanations for each question. However, I also felt they were not too close to the real exam questions but rather harder. Jon Bonso practice exams questions are often very long, with a lot of details and it could be annoying sometimes. I had the feeling of reading details that could be avoided, and when you have 65 questions to answer, it could be really boring. Despite this, I think it is worth it because of the detailed explanation he wrote, not to mention it is affordable.

GO !

These 2 resources and my experience were sufficient to pass the exam. I should warn you that even if you have more than 10-month experience you probably should go for a course. In my case, even though I had the opportunity to use a wide range of services on AWS, there were still some of them that I haven’t seen before or some configurations/options I didn’t know about. On top of that, you should also learn about services that you may not want to know about. I am a huge fan of Terraform, and I have almost never used CloudFormation but I needed to learn about it just for the exam…

These advice apply to the architect associate certification, they may not be relevant for other AWS certifications.

Online proctoring

You’ll be asked to prepare some stuff before the exam, here are the things I wish I had known before taking the exam. They will ask you to check system requirements. Basically nothing more than a computer (Mac or Windows, no Linux allowed …) with a webcam, a microphone and a good connection. You’ll install a software that will ensure you’re doing nothing else but answering exam questions. And before starting, proctor will ask you to video check your desktop, nothing is allowed at hand reach, not even a bottle of water. And of course you should be alone in the room (it will be video checked also) and you’re not allowed to leave the camera as the proctor will monitor throughout the whole exam duration.

If everything is OK, you’ll have 140 minutes to answer all 65 questions.

Being certified

After answering the 65 questions, you’ll have ~ 10 other questions about the online proctoring exam (to get your feelings and feedback), and you’ll know right away if you passed the exam with no more details. A few days later you’ll have your score and some details (but very few) about your results.

You will also have a certificate 👨‍🎓, a public badge and some assets and logos (along with some brand guidelines) that you could use on your mail/website/social network to show off.

Summarize

It cost me less than 200€

• course : Stephan Mareek one ~ 14€
• practices exams: Jon Bonso ones ~ 11€
• The exam itself : 162 €

and it took me a dozen of hours to prepare the exam (and of course my working experience on AWS).

I hope it can help and lead some of you to become an AWS certified Architect too 🙂

Disclaimer : I am not affiliated with the authors of the resources I have shared in this post and I have no interest, I just wanted to share my reads and methods that I found efficient.

Sources:
https://www.udemy.com
https://courses.datacumulus.com/
https://tutorialsdojo.com/courses/aws-certified-solutions-architect-associate-practice-exams/
https://www.reddit.com/r/AWSCertifications/comments/fsfe73/i_am_stephane_maarek_and_i_create_online_courses/
https://home.pearsonvue.com/

The post Tips and feedback about online proctored AWS certifications appeared first on Octase.

Managing infrastructure layers and dependencies

Building infrastructure that has dependencies imply to define some strong conventions that should not be modified. Your infrastructure will be referenced by others with Terraform Data Sources giving a name or an ID from your own infra, so they need to know what are the name of the resource they are referencing. It may also be filtered with tags or various pattern, a common usage is to find private subnets in a VPC, in which case your resource’s tags Names and Values should be present and well defined. Doing any change to these value, or conventions, will require you to synchronize with teams that have dependencies before redeploying any infrastructure and services. You may also want to have cost dashboard, per teams or per environment or any other groups that is relevant to you, usually using tags. These are examples, among others, of why it can be tedious to change even just a name of a resource in your infrastructure.

Testing your IaC …

We had many discussions about best practices, naming conventions, tagging strategies, security best practices etc but, you know, whatever we agreed on, we sometimes continue not to apply these rules. So, after facing some issues for not having these shared practices, we decided to gave a try to terraform-compliance to strengthen our Terraform scripts and enhance usage of our own conventions.

Terraform-compliance is an open source BDD test framework that allows testing terraform scripts in an easy way. It uses radish (which is Gherkin compatible) to write scenarios in feature files that enable you to check your IaC before being deployed, interesting isn’t it ! There are indeed other tools that do provide similar functionality like Sentinel, which is the official framework from HashiCorp, or Chef InSpec which is also open source. They seem to be really good products as well, but they may not to be as easy to integrate as terraform-compliance (claims: I could be wrong since I haven’t tested these tools, I would love to hear if you already gave them a try).

Well, we started by defining some simple naming conventions and tags validation scripts, directly inspired from their website examples :

  Scenario Outline: Naming Standard on all available resources
    Given I have <resource_name> defined
    When it contains <name_key>
    Then its value must match the "myproject-(prod|uat|dev)-someapplication-.*" regex

    Examples:
    | resource_name           | name_key |
    | AWS EC2 instance        | name     |
    | AWS ELB resource        | name     |
    | AWS RDS instance        | name     |
    | AWS S3 Bucket           | bucket   |
    | AWS EBS volume          | name     |
    | AWS Auto-Scaling Group  | name     |
    | aws_key_pair            | key_name |
    | aws_ecs_cluster         | name     |

For each resource in the above table, it will check for the name_key (which may be named differently depending on which terraform resource you want to check the name) to be present and to respect the given regex.
Then, it led us to a more consistent definition of our tags (mostly using tagging strategies from AWS documentation), besides adding security scenarios to our BDD tests. For instance, checking that we have no policy allowing to write on all our buckets :

Scenario: Reject if a policy allows to write to any bucket
    Given I have role_policy defined
    When it contains policy
    And it contains Statement
    And its Effect is Allow
    And its Action includes "s3:PutObject","s3:PutObjectAcl"
    And it contains resource
    Then its value must not match the "\*" regex

It was really quick to start with these examples, and simple to integrate in our pipelines, we did a kind of (I keep it short for readability) :

pip install terraform-compliance # get dependency
terraform plan -out plan.out # generate the plan to be tested
terraform-compliance -p plan.out -f dir # run your BDD tests

You may of course use a python virtualenv and a git repository with ‘git’ prefix to reference your features (after -f option) so you can easily share your BDDs among teams. It will give you an overview result :

And detailed information about which scenario(s) and resource(s) do not comply with your BDDs. Below, a tag is missing in iam role resource, and the value check cannot be done :

So you just have to fix it and you’re good to go.

… helps improving your infra overall

Using this tool helped us a lot to have better infrastructure standards shared across teams and had strengthened integration between various infrastructure layers and components. It also highly improved our Terraform scripts and resources qualities, as we now cannot misname our resources or forget to add important tags to it, for instance. We also felt that it really improved our infrastructure security, since we are removing bad pattern (like wildcard policies) as we add more BBDs.

Terraform-compliance is a really good option if you don’t have a dedicated team to manage your infrastructure or if you don’t use a big company managed cloud with already set rules and conventions. It allows you quickly and easily to set up your BDDs tests, the most important part should remain the definition of what tests are consistent with your context.

Sources :
Image by Susanne Jutzeler, suju-foto from Pixabay
Logo from terraform-compliance from github
https://terraform-compliance.com/
https://www.inspec.io/
https://www.hashicorp.com/sentinel/
http://radish-bdd.io/
https://aws.amazon.com/answers/account-management/aws-tagging-strategies/
https://docs.aws.amazon.com/fr_fr/AmazonS3/latest/dev/using-with-s3-actions.html

The post Improving your Terraform scripts with BDD appeared first on Octase.

I am very excited to start this blog as it is the beginning of my journey as a freelancer, in my new company, Octase. My goal is to help companies create best Cloud and Data services and architectures allowing them to create valuable tools for their business.

This post should be the first of a long series, mainly about programming, design architecture, cloud services, data engineering but also about devops, events that I may attend, or any topics that could help you to better understand what I’m interested in and what I can offer to your team. It is also for me the opportunity to deepen my knowledge by trying to explain my work. I may sometimes write in French, as this is my native language, it may help to express my ideas more precisely. By the way, I’m always open to discuss about any technical topics, so don’t hesitate to comment or contact me by mail or on my linkedin profil.

Let me briefly introduce myself, just a few lines. After my 3 years of apprenticeship as a R&D developper, creating security and cryptography tools for smart cards, I was graduated as an IT Engineer in Normandy, France. This is where I started playing with data and cloud. I worked almost 3 years as a Big Data Engineer in Société Générale Corporate and Investment Banking creating anti-fraud tools, big data analysis jobs and innovative web applications. After these 3 years, I worked for more than a year as a freelance helping teams in various companies creating big data services, designing data oriented architecture and defining data best practices, data governance and data management whether on cloud or on-premise infrastructure. I have learned a lot and I have met great people, sharing their knowledge with me and challenging my thoughts which definitely helped me built a strong data and cloud culture. It led me here, starting Octase and facing new challenges.

I think I’m done with the presentation, now it’s yours to tell me who you are 😉

If you think we can work together, please do not hesitate to contact me at contact@octase.com !

Francis

Sources :
Image by Arek Socha from Pixabay

The post Welcome to Octase Blog ! appeared first on Octase.