Previous post we demonstrated how distributing and securely deploying the website to global end users. The authentication and authorization are always mandatory features of web application. Amazon Cognito is a managed AWS serverless service helping the applications to implement AuthN and AuthZ, with Cognito the …

It's a well known pattern to distribute the website via CDN globally, it reduces the latency of the site and improve the availibity and security leveraging the infrastructure of cloud provider. Using CDN service CloudFront and simple storage S3 on AWS hosts the static website. It well fits the SPA(single page …

Most web applications are using Restful APIs to interactive with the backend services. In the TODO application, it's the straight forward to get, update and delete the items from backend database. Amazon DynamoDB is a key-value database, it fits for this scenario with scalability and optimized pay-as-you-go cost. Also …

Building web application is a common use case, leveraging cloud services could accelerate the builders to develop and deploy the services. With AWS serverless services, the application can easily get the capabilities like security, highly availability, scalability, resiliency and cost optimized. This is a series posts …

AWS CDK is a great abstract to accelerate managing the cloud infrastructure as code. The journey will be enjoyful with leveraging the Construct Hub to use the high level contributions from AWS partners and commnunity. Use Case AWS CloudFormation is one of the underly technologies of AWS CDK to manage the cloud …

As a builder in cloud, you might feel confused about which resources cost mostly in your account. In AWS, you can quickly find out which services even functionality cost a lot via AWS Billing or AWS Cost Explorer. However sometimes it sucks on finding out which functions cost mostly if you have hundreds of Lambda …

Though you're administrator of your AWS account, you probably see below warnings when viewing your cluster in EKS console. Your current user or role does not have access to Kubernetes objects on this EKS cluster. It's caused by the Kuberentes has itself RBAC authorization. And AWS uses IAM to grant permissions to …

近期在一个 Webinar 分享了如何在 AWS 上服务去中心化研发团队构建共享服务平台，核心观点总结如下， 这里的去中心化团队是同理想的完全化的 DevOps 团队(负责设计、开发、测试、运维以及运营等所有环节)相对立的。 在较大型的组织中，账户管理、网络规划、服务审计等模块会由平台，基础设施或安全团队所负责， 多个研发团队会负责各个业务系统的开发、测试、运维等。 如今组织的健康运营对安全性合规性要求越来越高，通常基础设施团队外加安全团队负责承担安全、合规需求的整体策略规划及实施。 但是满足安全、合规需求通常是同业务交付速度期望是相悖的。一方面，平台、安全团队要为应用上线或变更进行安全性与合规性审查， 而研发团队需要投入更多的资源 …

AWS架构的完善(AWS Well-Architected)框架涉及了五大支柱， 其中可靠性支柱要求侧重于确保工作负载在预期的时间内正确、一致地执行其预期功能。 这要求应用程序系统具备弹性设计，可从故障中快速恢复，以便满足业务和客户需求。 然而设计、开发、且验证具备弹性设计的应用程序，对经验和实践能力都有很高的要求。 利用成熟的经验和良好的工具将加快构建符合预期的弹性应用程序。 Application Resilience Workshop是一套课程和动手实践学习如何进行实验来观察系统的行为， 例如，极端系统负载和网络中断情况下，使用不同的软件模式来减轻这些实验对系统稳态的影响。 整个实验也是分为假设、方法、观测和缓解等步骤，同混沌 …

混沌工程是一种帮助系统满足弹性需求的技术，它起源于Netflix的工程实践，著名的猴子军团。 AWS一直提倡架构的完善(AWS Well-Architected)，混沌工程正是卓越运营和可靠性支柱的实践。 因此在 re:Invent 2020 AWS发布了Fault Injection Simulator服务来简化开发者在AWS上的混动工程实践。 AWS FIS作为AWS上原生的混沌工程服务，目前已同EC2，ECS，EKS，RDS，CloudWatch，甚至是IAM Role API集成，可以触发这些服务中资源的变更来假设故障， 例如，重启或终止EC2实例，重启RDS实例等。 Chaos Engineering on AWS是一份非 …