AWS Cloud Path Week 9 - Permissions and Autoscaling in AWS CDK

Welcome back, cloud builders! 🚀 This week, we tackled Permissions and Autoscaling in AWS CDK. These are essential for ensuring that our infrastructure remains secure and scalable. But, as with any real-world deployment, we ran into some issues. Keep reading to see how we fixed them ;)

---

Week 9 Highlights

Permissions are the backbone of AWS security. We explored how AWS CDK integrates with IAM (Identity and Access Management) to define fine-grained access controls for our resources, then set up autoscaling as opposed to our single instance setup. Specifically, we:

✅ Spent some time learning about IAM permissions in the beginning
✅ Defined IAM roles and policies in our CDK stack
✅ Used managed policies to simplify permission management
✅ Added an Auto Scaling Group (ASG) to our EC2 instances

Debugging and Fixing Our App Deployment

After deploying our infrastructure, we encountered an issue where our web app won't load because targets were unhealthy. Here’s what went wrong and how we fixed it:

1. 🚨 Issue 1: Our userdata script (which runs on instance creation to download files and start the web server) wasn’t executing correctly. This downloads all the necessary files and sets up our webserver, if our webserver is not started properly on the instance our health check will always fail.
   ✅ Fix: Removing the empty line at the beginning of the userdata script resolved this issue and the userdata executes as planned.

2. 🚨 Issue 2: Our servers were placed in PRIVATE_ISOLATED subnets, which prevented them from downloading required files from the internet via the NAT Gateway.
   ✅ Fix: Changing the subnet type to PRIVATE_WITH_EGRESS allowed outbound internet access while keeping our instances private.

---

Missed the session? Catch up here:

1. 💻 GitHub Repo: AWS 101 CDK Project (week-9 branch!)
2. 📺 Session Recording:

---

References for this week:

📖 Policies and Permissions in AWS IAM
📖 Permissions and AWS CDK

Prepare for Next Week:

Next week, we shift focus to Amazon VPC (Virtual Private Cloud) as we start to explore the networking layer of AWS. To get ahead, check out these resources:

🔹 How Amazon VPC works
🔹 Infrastructure Security in Amazon VPC
🔹 Security Best Practices for your VPC

Stay updated! Join our WhatsApp community for updates.

See you next week!