Cloud Infrastructure & Reusable IaC Components

This guide covers Task Statement 2.1 of the AWS DevOps Engineer Professional (DOP-C02) exam, focusing on defining, provisioning, and managing cloud infrastructure through code and reusable patterns.

Learning Objectives

After studying this guide, you should be able to:

• Select the appropriate AWS IaC tool (CloudFormation, SAM, or CDK) for specific workloads.
• Implement infrastructure reusability using CloudFormation Modules, Service Catalog, and CDK constructs.
• Manage infrastructure lifecycles across multiple accounts and regions using AWS CloudFormation StackSets.
• Govern infrastructure deployments using AWS Config and Service Catalog to ensure compliance.

Key Terms & Glossary

• Infrastructure as Code (IaC): The practice of managing and provisioning infrastructure through machine-readable definition files (JSON/YAML) or code, rather than manual hardware configuration.
• Drift Detection: A feature in CloudFormation that identifies whether a stack's actual configuration has deviated from its expected template configuration.
• Construct: The basic building block of AWS CDK applications; it represents a "cloud component" and can encapsulate one or many AWS resources.
• Change Set: A preview of how proposed changes to a CloudFormation stack might impact your running resources before you execute the update.
• StackSet: An extension of CloudFormation that allows you to create, update, or delete stacks across multiple AWS accounts and regions with a single operation.

The "Big Idea"

In a DevOps culture, Infrastructure is Software. By treating your environment as code, you gain the ability to version control your data centers, peer-review architecture changes, and achieve "immutability." Instead of patching a server, you deploy a new one from a tested template. This shift moves the focus from maintenance to automation, ensuring that the production environment is perfectly mirrored in test and staging environments.

Formula / Concept Box

Hierarchical Outline

1. Core IaC Tools
   • AWS CloudFormation: The engine for AWS provisioning. Supports Change Sets for safety and Rollback Triggers for automated recovery.
   • AWS SAM: Simplifies serverless. Uses a shorter syntax to define functions, APIs, and databases.
   • AWS CDK: High-level abstraction. Uses Constructs to define reusable components in familiar languages.
2. Reusability & Patterns
   • CloudFormation Modules: Encapsulate resource configurations for reuse across templates.
   • Service Catalog: Allows administrators to create and manage catalogs of IT services that are approved for use on AWS.
3. Lifecycle & Multi-Account Management
   • StackSets: Critical for multi-account governance. Integrates with AWS Organizations to target specific OUs (Organizational Units).
   • AWS Systems Manager (SSM): Manages the state of the OS/software after the infrastructure is provisioned.

Visual Anchors

IaC Deployment Lifecycle

Multi-Account Deployment with StackSets

Definition-Example Pairs

• Term: Reusable Construct
  • Definition: A pre-packaged set of infrastructure resources following a company's best practices.
  • Example: A CDK construct called SecureVPC that automatically includes a NAT Gateway, Flow Logs, and specific NACLs without the developer writing those lines manually.
• Term: Governance Control
  • Definition: Automated checks to ensure infrastructure complies with internal policies.
  • Example: Using AWS Config Rules to automatically delete any S3 bucket created via CloudFormation that doesn't have encryption enabled.

Worked Examples

Scenario: Deploying a Multi-Region Web App

Problem: You need to deploy a consistent web tier across three AWS regions while ensuring that any change to the master template updates all regions simultaneously.

Step-by-Step Solution:

1. Create Template: Author a CloudFormation template defining the Auto Scaling Group and Load Balancer.
2. Define StackSet: Navigate to the CloudFormation console in the administrator account. Create a StackSet using the template.
3. Specify Regions: Select us-east-1, us-west-2, and eu-central-1 as the deployment targets.
4. Deployment Options: Set Maximum Concurrent Accounts to 1 and Failure Tolerance to 0. This ensures a staggered, safe deployment.
5. Execute: CloudFormation creates a "Stack Instance" in each region. If the us-east-1 deployment fails, the entire StackSet operation stops, preventing a broken global state.

Checkpoint Questions

1. What is the primary advantage of using a Change Set before updating a production CloudFormation stack?
2. How does AWS SAM differ from standard CloudFormation when defining an AWS Lambda function?
3. Which service allows a central IT team to provide a "Self-Service" portal of pre-approved AWS resources for non-technical users?
4. What is the effect of Drift Detection on a running resource that has been modified manually?

Muddy Points & Cross-Refs

• SSM vs. CloudFormation: Learners often confuse these. Remember: CloudFormation builds the house (infrastructure). Systems Manager (SSM) paints the walls and fixes the plumbing (OS configuration/patching).
• CDK Synthesis: Remember that CDK code is NOT executed by AWS directly. It must be "synthesized" into a CloudFormation template first using the cdk synth command.
• Cross-Ref: For deeper multi-account strategy, see Unit 2: AWS Control Tower & Organizations.

Comparison Tables

[!TIP] When the exam asks about "Governance at Scale" or "Self-Service," look for AWS Service Catalog in the answer choices.