Deploying & Managing Infrastructure at Scale

Creating resources by hand in the console does not survive contact with a real organisation. This chapter covers the AWS answers: describing infrastructure as code (CloudFormation, CDK), letting AWS assemble the stack for you (Elastic Beanstalk), automating the path from source to production (the Code* services), and operating fleets of servers at scale (Systems Manager).

1. What is CloudFormation

CloudFormation is a declarative way of outlining your AWS infrastructure, for any resources (most of them are supported).

For example, within a CloudFormation template you say:

• I want a security group
• I want two EC2 instances using this security group
• I want an S3 bucket
• I want a load balancer (ELB) in front of these machines

Then CloudFormation creates those for you, in the right order, with the exact configuration that you specify.

Benefits

Infrastructure as code

• No resources are manually created, which is excellent for control
• Changes to the infrastructure are reviewed through code

Cost

• Each resource within the stack is tagged with an identifier, so you can easily see how much a stack costs you
• You can estimate the costs of your resources using the CloudFormation template
• Savings strategy: in Dev, you could automate deletion of templates at 5 PM and recreate them at 8 AM, safely

Productivity

• Ability to destroy and re-create an infrastructure on the cloud on the fly
• Automated generation of diagrams for your templates
• Declarative programming — no need to figure out ordering and orchestration

Don’t re-invent the wheel

• Leverage existing templates on the web
• Leverage the documentation
• Supports (almost) all AWS resources; you can use “custom resources” for resources that are not supported

CloudFormation + Infrastructure Composer

Pairing CloudFormation with Infrastructure Composer gives you a visual view of a stack — the deck’s example is a WordPress CloudFormation stack where you can see all the resources and the relations between the components.

Real-world example

The “delete the Dev stack at 5 PM, recreate it at 8 AM” trick only works because the stack is code: you can throw the whole environment away knowing an identical one comes back tomorrow morning for the price of a template run.

2. AWS Cloud Development Kit (CDK)

The CDK lets you define your cloud infrastructure using a familiar programming language: JavaScript/TypeScript, Python, Java, and .NET.

• The code is “compiled” into a CloudFormation template (JSON/YAML)
• You can therefore deploy infrastructure and application runtime code together
• Great for Lambda functions
• Great for Docker containers in ECS / EKS

The flow is: CDK application in a programming language → CDK CLI → CloudFormation template → CloudFormation deploys it.

Exam tip

The CDK is not a replacement for CloudFormation — it generates CloudFormation. If a question asks “which service actually provisions the resources”, the answer is still CloudFormation.

3. Typical architecture and the developer’s problem

The typical web app is a 3-tier, Multi-AZ architecture: an ELB in front of an Auto Scaling group spread over three Availability Zones, ElastiCache to store/retrieve session data plus cached data, and Amazon RDS for reading and writing data.

That leaves developers with a familiar list of problems:

• Managing infrastructure
• Deploying code
• Configuring all the databases, load balancers, etc.
• Scaling concerns

Most web apps have the same architecture (ALB + ASG). All the developers want is for their code to run, possibly consistently across different applications and environments. That is what Elastic Beanstalk is for.

4. AWS Elastic Beanstalk

Elastic Beanstalk is a developer centric view of deploying an application on AWS.

• It uses all the components seen before: EC2, ASG, ELB, RDS, etc.
• But it is all in one view that is easy to make sense of
• You still have full control over the configuration
• Beanstalk = Platform as a Service (PaaS)
• Beanstalk is free but you pay for the underlying instances

What Beanstalk manages

It is a managed service:

• Instance configuration / OS is handled by Beanstalk
• Deployment strategy is configurable but performed by Elastic Beanstalk
• Capacity provisioning
• Load balancing & auto-scaling
• Application health-monitoring & responsiveness

Just the application code is the responsibility of the developer.

Three architecture models

• Single Instance deployment — good for dev
• LB + ASG — great for production or pre-production web applications
• ASG only — great for non-web apps in production (workers, etc.)

Supported platforms

Go · Java SE · Java with Tomcat · .NET on Windows Server with IIS · Node.js · PHP · Python · Ruby · Packer Builder · Single Container Docker · Multi-Container Docker · Preconfigured Docker

Health monitoring

A health agent pushes metrics to CloudWatch, checks for app health, and publishes health events.

Exam tip

Beanstalk is AWS only and limited to certain programming languages or Docker. When a question wants a known architecture (ALB + EC2 + RDS) deployed consistently with minimum developer effort, that is Beanstalk; when it wants arbitrary resources described precisely, that is CloudFormation.

5. AWS CodeDeploy

CodeDeploy deploys your application automatically.

• Works with EC2 instances
• Works with on-premises servers
• It is a hybrid service
• Servers / instances must be provisioned and configured ahead of time with the CodeDeploy Agent

The picture on the slide is a fleet of v1 instances being upgraded to v2, on both EC2 and on-premises servers.

6. The developer services

CodeCommit — important deprecation note

On July 25th 2024, AWS abruptly discontinued CodeCommit. New customers cannot use the service, and AWS recommends migrating to an external Git solution (a third party).

For this course: CodeCommit might still appear at the exam (for now), and every time CodeCommit is mentioned, assume there is a GitHub integration.

AWS CodeCommit

Before pushing the application code to servers, it needs to be stored somewhere. Developers usually store code in a repository, using Git. A famous public offering is GitHub; AWS’s competing product is CodeCommit.

• Source-control service that hosts Git-based repositories
• Makes it easy to collaborate with others on code
• Code changes are automatically versioned
• Benefits: fully managed, scalable & highly available, private, secured, integrated with AWS

AWS CodeBuild

A code building service in the cloud. It compiles source code, runs tests, and produces packages that are ready to be deployed (by CodeDeploy, for example).

• Fully managed, serverless
• Continuously scalable & highly available
• Secure
• Pay-as-you-go pricing — you only pay for the build time

AWS CodePipeline

CodePipeline orchestrates the different steps to have the code automatically pushed to production: Code → Build → Test → Provision → Deploy. It is the basis for CICD (Continuous Integration & Continuous Delivery).

• Fully managed, compatible with CodeCommit, CodeBuild, CodeDeploy, Elastic Beanstalk, CloudFormation, GitHub, third-party services and custom plugins
• Fast delivery & rapid updates

CodePipeline is the orchestration layer sitting above CodeCommit, CodeBuild, CodeDeploy and Elastic Beanstalk.

AWS CodeArtifact

Software packages depend on each other to be built (code dependencies), and new ones are created constantly. Storing and retrieving these dependencies is called artifact management, and traditionally you had to set up your own artifact management system.

• CodeArtifact is a secure, scalable, and cost-effective artifact management service for software development
• Works with common dependency management tools: Maven, Gradle, npm, yarn, twine, pip, and NuGet
• Developers and CodeBuild can retrieve dependencies straight from CodeArtifact

Real-world example

A build that pulls npm packages from the public registry on every run is at the mercy of an outage or a yanked package. Pointing CodeBuild at CodeArtifact gives the pipeline a private, cached copy of every dependency it needs.

7. AWS Systems Manager (SSM)

Systems Manager helps you manage your EC2 and on-premises systems at scale — another hybrid AWS service.

• Get operational insights about the state of your infrastructure
• A suite of 10+ products
• Most important features:
  • Patching automation for enhanced compliance
  • Run commands across an entire fleet of servers
  • Store parameter configuration with the SSM Parameter Store
• Works for Linux, Windows, MacOS, and Raspberry Pi OS (Raspbian)

How Systems Manager works

You need to install the SSM agent onto the systems you control. It is installed by default on the Amazon Linux AMI and some Ubuntu AMIs.

Exam tip

Straight from the slide: if an instance can’t be controlled with SSM, it’s probably an issue with the SSM agent. That is the expected troubleshooting answer.

Thanks to the SSM agent, you can run commands, patch and configure your servers — EC2 instances and on-premises VMs alike.

SSM Session Manager

Session Manager allows you to start a secure shell on your EC2 and on-premises servers.

• No SSH access, no bastion hosts, no SSH keys needed
• No port 22 needed (better security)
• Supports Linux, macOS, and Windows
• Send session log data to S3 or CloudWatch Logs

Access is controlled by IAM permissions.

SSM Parameter Store

Secure storage for configuration and secrets — API keys, passwords, configurations.

• Serverless, scalable, durable, easy SDK
• Control access permissions using IAM
• Version tracking & encryption (optional) — encryption is done with AWS KMS

Applications read plaintext configuration directly, and encrypted configuration is decrypted through KMS.

Real-world example

Replacing SSH keys with Session Manager means port 22 can be closed on every security group in the fleet, and every shell session is logged to CloudWatch Logs for audit — two security wins from one change.

Quick recap

Concept	What to remember for the exam
CloudFormation	AWS only — Infrastructure as Code, declarative, works with almost all AWS resources, repeatable across Regions & Accounts
CloudFormation benefits	No manual resources, per-stack cost tagging, destroy/recreate on the fly, automated diagrams
Infrastructure Composer	Visualises a CloudFormation stack’s resources and their relations
AWS CDK	Define infrastructure in TypeScript/Python/Java/.NET; compiles into a CloudFormation template
Elastic Beanstalk	AWS only — PaaS, limited to certain languages or Docker, deploys a known architecture (ALB + EC2 + RDS); free, you pay for the instances
Beanstalk models	Single instance (dev), LB + ASG (web production), ASG only (workers)
CodeDeploy	Hybrid — deploy & upgrade applications onto EC2 and on-premises servers; requires the CodeDeploy Agent
CodeCommit	Private Git repository, version controlled; discontinued for new customers July 2024, may still appear at the exam
CodeBuild	Build & test code — fully managed, serverless, pay for build time only
CodePipeline	Orchestration of the pipeline from code to build to deploy (CICD)
CodeArtifact	Store software packages / dependencies; Maven, Gradle, npm, yarn, twine, pip, NuGet
Systems Manager	Hybrid — patch, configure and run commands at scale; needs the SSM agent
Session Manager	Secure shell with no SSH, no bastion, no port 22; logs to S3 / CloudWatch Logs
Parameter Store	Serverless storage for configuration and secrets, IAM-controlled, optional KMS encryption