AWS 2015 Developer Summit in Taipei

BIG BIG thumbs-up to Markku Lepisto for his wonderful speech.

Many interesting topics covered especially AWS Lambda, Container service and IOT live demo of building an earthquake sensor with AWS arduino SDK. 

Using AWS SDK in arduino IDE is easy, just include the library and headers. 

In the demo, Markku is using SDK from device to send sensing data to Kinesis for analysis.

If gravity changes more than 5g, send an alarm to phone through AWS SNS.

No EC2 instance is required in building such an application, that is powerful.

Sincere suggestions for developers:

• A/B Testing with the same code but disable several features from flags.
• Store everything from Day 1 & understand your customers better by analyzing logs. Then you can drop some log.
• key = faster iteration cycle
• Build, Test, Fix cycles faster and faster
• Use TrustedAdvisor to lower your costs.
• Use 1,000 Spot instances to simulate client workloads. ($3 for 1 hour)
• Understanding Continuous integration (CI) related new features from AWS last year:
• • CodeCommit = Source control (private GitHub)
  • CodePipeline = Continuous Delivery
  • CodeDeploy = Deployment
• Container is good, but when container grows, how to manage them? AWS Container service or ECS in short (i personally think it easily confused with EC2)
• Container service manages status, batch and schedules.
• • Some containers shall be in the same server (for super fast dat exchange)
  • Some containers shall be placed in different AZ for HA
• Decompose your service to smaller micro service running in containers and put simple functions to Lambda.

Sadly i cannot split myself in half to attend both tracks in the afternoon. I think most people attend the IOT session, which also indicates how hot the topic is in recent years.

AWS certified solutions architect - associate level 準備筆記

最近剛考過AWS認證架構師, 分享一些準備心得:

 
架構
架構師的題目其中60%是如何達到Fault-tolerant, high availability, cost-effective. 這裡是重點中的重點, 詳細各領域的比重請看Blueprint.

AWS的題目會一直進化, 有Beta test機制讓志願者測試新題目, 之後再放入正式題庫中.
有些實作題有遇過的人一定知道答案並且會心一笑, 沒有經驗的只能抓抓頭.
出題目的人非常有實務經驗, 不是考死背, 是當你的公司要推出新服務、全球化實際會面臨的困難與挑戰, 這也正是架構師的目標.

考試之前閱讀大量的FAQ和whitepapers. 我會建議有空就盡量讀, 安排好考試時間之後下班就盡量唸whitepaper, 只有好處沒壞處. 同時可以檢討自己在工作實務面上的缺失,非常有幫助.

請務必要放下工程師的牛脾氣, 明明XXX服務比較好用我們公司也這樣用, white paper怎麼建議要改架構?
Sorry 請不要跟自己過不去, AWS的考試當然都希望盡量偏向使用AWS的服務當作Best practice. 請放下執念, 先清空自己再來吸收white papers比較讀得下書.

我的筆記
AWS Instance store
AWS Security
AWS VPC
AWS IAM Role

進入考場
考試地點在台北的資策會考試中心,

考試時間總長80分鐘, 開始前15分鐘要報到並且清空口袋, 一旦入場可以直接開始.
題目目前有英文/簡體版(是的目前只有簡體), 建議辛苦一點選英文版, 因為考前在準備資料幾乎都是英文版, 考試要再轉換很累.

參加認證的人都必須要同意NDA (Non-disclosure agreement)不得公開考試內容.
可以確定的是只上3天輔導課一定不夠的, 一定要有實作經驗.

應答
題目分成單選題(multiple choice)和複選題(multiple response) 因為按鈕樣式不同有防呆,
不用擔心是否複選題你卻只選一個答案的情形發生.

因為英文題目加上情境題, 所以要整個閱讀完就蠻吃力的, 時間不太夠.
尤其複選題通常至少浪費1分鐘, 最好要配速100%確定的單選先答, 不確定的就標記起來之後回來答.

結束之後填寫問卷, 然後馬上知道結果(相當殘酷阿).

AWS Instance store

Instance store 速度超強 

測試數據：
https://gist.github.com/ktheory/3c3616fca42a3716346b

Instance-store is over 5x faster than EBS-SSD for uncached reads.Instance-store and EBS-SSD are equivalent for cached reads.Instance-store is over 10x faster than EBS-SSD for writes.

不是每種機器等級都有支援：

Some instance families, such as T2 and T1, do not support instance store volumes at all.

資料揮發時機：

重開機沒事兒, 不用自己嚇自己, 只有stop, crash會讓資料消失.

Ephemeral storage or instance-store DOES persist across reboots of an instance! It does not persist across a stop/start, nor a termination, nor some instance hardware failures. 

AWS Security

超詳細的解說AWS各個服務用到的安全技術,

如果沒有時間一一試驗AWS的服務, 

可以從這份white paper當中快速了解各服務的目的以及底層仰賴的技術。

http://awsmedia.s3.amazonaws.com/pdf/aws_security_whitepaper.pdf

AWS VPC

Security group是作用在instance 等級 (只管理允許)

Security group 與 instance 是多對1, 一台instance可以同時屬於多個security group方便套用規則, 讓每個security group規則盡量簡單.

     Security Group of EC2-Classic只能管進, VPC內可管進出.

Network ACL是作用在subnet等級的虛擬防火牆 (可以管理進出), 按照順序, 第一個符合即決斷.

Security Group	Network ACL
Operates at the instance level (first layer of defense)	Operates at the subnet level (second layer of defense)
Supports allow rules only	Supports allow rules and deny rules
Is stateful: Return traffic is auwtomatically allowed, regardless of any rules	Is stateless: Return traffic must be explicitly allowed by rules
We evaluate all rules before deciding whether to allow traffic	We process rules in number order when deciding whether to allow traffic
Applies to an instance only if someone specifies the security group when launching the instance, or associates the security group with the instance later on	Automatically applies to all instances in the subnets it's associated with (backup layer of defense, so you don't have to rely on someone specifying the security group)

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Security.html#VPC_Security_Comparison

非常清楚的示意圖:

可以開一個IAM Role用來管理 VPC, 根據Policy最小可以鎖到Resource level,

幾乎VPC相關的所有action都能夠鎖, 例如只允許開機器在某一個subnet.

切割出一個dev/test subnet並且提供dev account和 test account不同的權限.

AWS IAM Role

IAM是root account可以管理User和Group和權限關係, 接近原來Linux的管理概念.

Role是在AWS背端整合好的特殊User, 一樣可設定權限, 

access key 和 secret key不需要被揭露, 

開新的instance可以用IAM Role來啟動, 就不需要設定access key.

提高自動化以及降低了機密外洩的風險.

IAM roles. A role is an entity that has its own set of permissions, but that isn't a user or group. Roles also don't have their own permanent set of credentials the way IAM users do.

IAM Role讓AWS在背端替你餵Access key給 instances.

IAM Best practice:

http://docs.aws.amazon.com/IAM/latest/UserGuide/IAMBestPractices.html

影片：

Docker 123

介紹如何在Mac上安裝與使用Docker, 以及一些基本觀念。

Docker 123 from WeiChih Ting

Container comics