ANS-C01 Exam Cram: Automating and Configuring Network Infrastructure

This guide focuses on Domain 2.4: Automate and configure network infrastructure for the AWS Certified Advanced Networking - Specialty (ANS-C01) exam. It covers Infrastructure as Code (IaC), event-driven automation, and centralized configuration management.

Topic Weighting

[!IMPORTANT] Domain 2 as a whole accounts for 26% of the exam. Task 2.4 is critical because it bridges design (Domain 1) and operations (Domain 3).

Key Concepts Summary

• Infrastructure as Code (IaC): Defining infrastructure using configuration files. Key benefits include idempotency, repeatability, and version control.
• CloudFormation (CFN): Declarative service using JSON/YAML.
  • Stacks: Unit of deployment.
  • StackSets: Deploy stacks across multiple accounts/regions.
• AWS CDK: Imperative framework using familiar languages (Python, TypeScript) to generate CFN templates.
• Systems Manager (SSM) Automation: Simplifies common maintenance and deployment tasks of AWS resources (e.g., updating routing tables across multiple VPCs).
• Event-Driven Networking: Using EventBridge or CloudWatch Alarms to trigger Lambda functions for automated remediation (e.g., shutting down a rogue VPC peering connection).
• CI/CD for Networking: Using AWS CodePipeline and CodeDeploy to test network changes in a staging VPC before pushing to production.

Network Automation Architecture

Common Pitfalls

• Hardcoded Resource IDs: Never hardcode Subnet IDs or VPC IDs. Use Parameters or Dynamic References (SSM Parameter Store).
• Circular Dependencies: Occurs when Resource A depends on B, and B depends on A (e.g., security group self-references). Use separate AWS::EC2::SecurityGroupIngress resources to break the loop.
• Ignoring Drift: Manual changes in the console cause "Drift." Always use CloudFormation Drift Detection to verify if the physical environment matches the template.
• Deletion Policy Neglect: Forgetting to set DeletionPolicy: Retain on critical resources like S3 buckets (containing flow logs) or specific DB instances.
• Export Name Collisions: Using Fn::Export requires unique names within a region. If you use a generic name like "SubnetID," other stacks in the same account will fail to deploy.

Mnemonics / Memory Triggers

• D-I-R-E (IaC Benefits):
  • Detect Drift
  • Idempotency (Same input = Same result)
  • Repeatability
  • Efficiency (Reduced human error)
• The "S" Team for Scaling:
  • StackSets = Multi-account/Multi-region scale.
  • Systems Manager = Operational scale.
  • SNS = Notification scale.

Formula / Equation Sheet

Essential Intrinsic Functions

Worked Examples

Example 1: Event-Driven Security Group Cleanup

Scenario: An organization wants to ensure that no Security Group ever allows 0.0.0.0/0 on port 22 (SSH).

1. Detection: AWS Config Rule restricted-common-ports monitors SG changes.
2. Trigger: An "Insecure" compliance change triggers an EventBridge Event.
3. Action: EventBridge targets an AWS Lambda function.
4. Remediation: The Lambda function uses the Python SDK (boto3) to call revoke_security_group_ingress and remove the rule.

Example 2: TikZ Visualization of a VPC Deployment Flow

\begin{tikzpicture}[node distance=2cm] \draw[thick, blue] (0,0) rectangle (6,4) node[pos=0.1] {VPC Stack}; \draw[thick, orange] (0.5,0.5) rectangle (2.5,2.5) node[midway] {Subnet A}; \draw[thick, orange] (3.5,0.5) rectangle (5.5,2.5) node[midway] {Subnet B}; \draw[->, thick] (1.5,4.5) -- (1.5,4) node[midway, left] {Parameters (CIDR)}; \draw[<->, dashed] (2.5,1.5) -- (3.5,1.5) node[midway, above] {Peering/TGW}; \end{tikzpicture}

Practice Set

1. Question: You need to deploy a standardized set of Network ACLs across 50 AWS accounts in the same Organization. Which tool is most efficient?
   • Answer: CloudFormation StackSets.
2. Question: A network change was made via a CFN stack, but someone manually modified a Route Table in the console. How do you identify exactly what changed?
   • Answer: Run Drift Detection on the CloudFormation stack.
3. Question: You want to use the same CloudFormation template for Dev and Prod, but they need different CIDR blocks. How is this achieved?
   • Answer: Use the Parameters section in the template and pass different values via Parameter Files or the CLI.
4. Question: Which service is best suited for automating the patching of virtual appliances (e.g., third-party firewalls) on EC2?
   • Answer: AWS Systems Manager (SSM) Automation.
5. Question: You are using CDK. What command transforms your TypeScript code into a CloudFormation template?
   • Answer: cdk synth.

Fact Recall Blanks

1. CloudFormation templates can be written in __________ or __________. (Answer: JSON, YAML)
2. To share a resource ID from a producer stack to a consumer stack, you must use the __________ keyword in the Outputs section. (Answer: Export)
3. The __________ service is the primary hub for routing events from AWS services to automated targets. (Answer: EventBridge)
4. __________ is the AWS service used to programmatically define infrastructure using high-level programming languages. (Answer: AWS CDK)
5. If a CloudFormation stack update fails, it defaults to a __________ to maintain the last known good state. (Answer: Rollback)