Amazon Web Services Platform & DevOps - Automation and Monitoring

Continuing from my previous blog on Amazon Web Services Platform & DevOps: Automation and Monitoring

Monitoring

• With AWS platform, feedback is provided by two services - Amazon CloudWatch and AWS CloudTrail
• They provide monitoring, alerting, and auditing infrastructure
• Amazon CloudWatch:
• Is a monitoring service for AWS cloud resources and applications that we run on AWS
• CloudWatch can monitor the log files for any production incidents
• CloudWatch allows to set alarm and automatically react to any changes to AWS resources (Amazon DynamoDB tables, Amazon RDS DB, etc)
•  It provides visibility of application performance and operational health ensuring your application is running smoothly
• AWS CloudTrail:
• It’s important to understand who is making modifications to your infrastructure
• All AWS interactions are handled through AWS API calls that are monitored and logged by AWS CloudTrail
• With CloudTrail, you can get history of AWS API calls for your account
• All generated log files are stored in an Amazon S3 bucket
• Log files are encrypted using Amazon S3
• The AWS API call history produced by CloudTrail enables security analysis, tracking of resource change, & compliance auditing

Security

• In DevOps environment the focus on security is vital
• Identity and Access Management (IAM): IAM is part of the AWS security infrastructure
• IAM allows you to centrally manage users and security credentials viz passwords, access keys, & permissions that control which AWS services and resources users can access
• IAM can be used to create roles
• IAM role you can define a set of permissions to access the resources that a user or service needs. But instead of attaching the permissions to a specific user or group, you attach them to a named role
• Resources can be associated with roles and services