DEV Community: Raymond

Enhancing AWS Learning with Amazon Q Developer and Bedrock Nova: A Certification Practice App Journey

Raymond — Wed, 07 May 2025 07:44:36 +0000

AWS Certification Practice App with AI-Enhanced Explanations

This is a submission for the Amazon Q Developer "Quack The Code" Challenge: That's Entertainment!

What I Built

I built an interactive AWS Certification Practice App that makes studying for AWS exams both educational and entertaining. The application features over 100 practice questions for various AWS certification exams, but what makes it truly engaging is the AI-enhanced explanations powered by Amazon Bedrock.

Traditional certification practice apps can be dry and uninspiring, but this app transforms the learning experience by providing:

Detailed AI-generated explanations that break down complex AWS concepts in an approachable way
Interactive quiz interface with immediate feedback and score tracking
Automatic detection of relevant AWS services in questions with direct links to official documentation
Visual indicators showing your progress and knowledge gaps

The entertainment factor comes from turning a typically stressful certification preparation process into an engaging, game-like experience where users can challenge themselves, track improvements, and receive personalized AI assistance that feels like having a knowledgeable AWS expert by your side.

Demo

This is Amazon Q generated diagram with awslabsaws_diagram_mcp_server

Import your question bank - Just upload your question.json file with AWS certification questions
Start practicing - Hit that "Start Practice" button and the quiz begins!
Test your AWS knowledge - Select what you think is the right answer
Check your understanding - Submit your answer
Level up with AI - Need more details? Click "Get AI-Enhanced Explanation" for a comprehensive breakdown powered by Amazon Bedrock

Key features demonstrated:
The interactive quiz interface with multiple-choice questions
Real-time scoring and feedback
AI-enhanced explanations from Amazon Bedrock
Automatic AWS documentation linking

Code Repository

GitHub Repository: AWS Certification Practice App

How I Used Amazon Q Developer

Amazon Q Developer was my coding companion throughout this project, helping me tackle challenges I wouldn't have solved efficiently on my own:

1. Infrastructure as Code Development

When building the Terraform configuration, I asked Amazon Q Developer to help me set up the proper IAM permissions for Lambda to access Bedrock. It not only provided the exact policy statements needed but also explained why each permission was necessary:

resource "aws_iam_policy" "lambda_bedrock_policy" {
  name        = "lambda_bedrock_policy"
  description = "Policy for Lambda to access Bedrock"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "bedrock:InvokeModel",
          "bedrock:ListFoundationModels"
        ]
        Effect   = "Allow"
        Resource = "*"
      },
      {
        Action = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents"
        ]
        Effect   = "Allow"
        Resource = "arn:aws:logs:*:*:*"
      }
    ]
  })
}

2. Debugging CORS Issues

When I encountered CORS errors with API Gateway, Amazon Q Developer quickly identified the issue and suggested the exact configuration needed:

resource "aws_api_gateway_gateway_response" "cors" {
  rest_api_id   = aws_api_gateway_rest_api.bedrock_api.id
  response_type = "DEFAULT_4XX"

  response_parameters = {
    "gatewayresponse.header.Access-Control-Allow-Origin" = "'*'"
    "gatewayresponse.header.Access-Control-Allow-Headers" = "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
    "gatewayresponse.header.Access-Control-Allow-Methods" = "'GET,POST,OPTIONS'"
  }
}

This saved me hours of troubleshooting and research.

3. Prompt Engineering for Bedrock

I asked Amazon Q Developer to help me craft an effective prompt for the Bedrock model. It suggested a structured approach that dramatically improved the quality of AI explanations:

function createPrompt(questionData) {
  const { question, options, correctAnswerIndex, explanation } = questionData;
  const correctAnswer = options[correctAnswerIndex];

  return `You are an AWS Certified expert. Provide a detailed explanation for the following AWS exam question:

QUESTION:
${question}

OPTIONS:
${options.join('\n')}

CORRECT ANSWER:
${correctAnswer}

BASIC EXPLANATION:
${explanation}

Please provide:
1. Why this answer is correct (with technical details)
2. Why each of the other options is incorrect (be specific)
3. Key AWS concepts to understand related to this question
4. Any relevant AWS service limitations or best practices
5. Real-world application of this knowledge

Format your response with clear headings and bullet points where appropriate.`;
}

4. Data Analysis and Pattern Recognition

The most impressive contribution was when Amazon Q Developer analyzed my question data and discovered systematic discrepancies between the marked correct answers and the explanations. It identified patterns in the explanations (like "Option B is correct") and suggested code to automatically correct the indices:

function extractCorrectAnswerFromExplanation(explanation) {
  // Look for patterns like "Option B is correct" or "B (100%)"
  const optionPattern = /Option ([A-D]) is correct|([A-D]) \(100%\)/i;
  const match = explanation.match(optionPattern);

  if (match) {
    const letter = match[1] || match[2];
    // Convert letter to index (A=0, B=1, etc.)
    return letter.charCodeAt(0) - 'A'.charCodeAt(0);
  }

  return null;
}

5. Frontend JavaScript Optimization

Amazon Q Developer helped me optimize the frontend JavaScript code, particularly with the dynamic rendering of AI explanations and documentation links. It suggested using template literals and DOM manipulation techniques that made the code more maintainable and performant.

Tips for Using Amazon Q Developer

Be specific with your requests: The more details you provide, the better the response. For example, instead of asking "How do I fix CORS?", ask "How do I configure CORS headers in API Gateway using Terraform?"
Use it for code analysis: Amazon Q Developer excels at analyzing existing code and identifying patterns or issues.
Ask for explanations: When Amazon Q Developer provides code, ask it to explain why certain approaches were taken. This helps you learn and make better decisions.
Iterate on solutions: If the first suggestion doesn't fully solve your problem, provide feedback and ask for refinements.
Use it for documentation: Amazon Q Developer can help generate clear, comprehensive documentation for your projects.

Amazon Q Developer transformed my development process, allowing me to focus on creating an entertaining learning experience rather than getting bogged down in technical details and debugging.

Vault Secret as an External Secret

Raymond — Wed, 03 Jul 2024 00:34:11 +0000

This guide to help people who are new to Vault create a Kubernetes Secret through Vault

There are two ways to use Vault Secret:

Adding the annotations
Use External Secret Operator

Source: external-secrets.io

I used the second step in this article because I used ArgoCD before and wanted to visualize all the resources I created.

Walkthrough

Create a Secret for the Vault token

kubectl create secret generic vault-token --from-literal=token=<token>

echo -n "token" | base64

apiVersion: v1
data:
  token: <Encoded Vault Token>
kind: Secret
metadata:
  name: vault-token
type: Opaque

Install External Secrets using Helm

helm repo add external-secrets <https://charts.external-secrets.io>
helm install external-secrets external-secrets/external-secrets

SecretStore

Create secret-store.yaml file

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: secret-store
spec:
  provider:
    vault:
      server: http://<serverAddresss>:<port>
      path: <path> ----- see the picture above
      version: "<version>" ---- See the version near the path above
      auth:
        tokenSecretRef:
          name: vault-token
          key: token

ExternalService

Create external-secret.yaml file

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: external-secret
spec:
  refreshInterval: 5m  ------ Time for fetching new values
  secretStoreRef:
    name: secret-store  ------- Secret Store Name 
    kind: SecretStore
  target:
    name: secret-to-be-created   --------- Secret Name
    creationPolicy: Owner
  dataFrom:
  - extract:
      key: "<key>"  ------- See the picture above

It will automatically get all values from Vault Secret and create a new secret if it does not exist.

Preferences

HashiCorp Vault

English is not my first language, and I am not good at it, but I want to improve and enhance my English every day. Writing a blog is the best way I have chosen. Please let me know if there is anything confusing because of my English.

Basic CICD with GitHub Action

Raymond — Sat, 22 Jun 2024 12:47:24 +0000

Prerequisites

Virtual Machine with Public IP
Docker, Docker Compose installed

Diagram

When the developer pushes a commit to the repository, GitHub Action (GA) triggers the pipeline that builds the docker image and pushes it to GitHub Container Registry (ghcr.io). Then, the next job is to connect to the server by SSH, pull the latest Docker image, and restart Docker Compose.

Walkthrough

Step 1: Create a docker-compose file

services:
  web:
    image: ghcr.io/yourusername/your-web-app:latest
    ports:
      - "8080:8080"
    environment:
      - DATABASE_HOST=db
      - DATABASE_PORT=5432
    depends_on:
      - db
  db:
    image: ghcr.io/yourusername/your-database:latest
    ports:
      - "5432:5432"
    environment:
      - POSTGRES_DB=mydatabase
      - POSTGRES_USER=myuser
      - POSTGRES_PASSWORD=mypassword
    volumes:
      - db-data:/var/lib/postgresql/data
volumes:
  db-data:

Create a directory that contains the docker-compose file. Save it as DIRECTORY variable.

Step 2: Create Repository Secrets

Go to Settings → Secrets and variables → Repository secrets → New repository secret.

Step 3: Create a Github Workflow

Create .github/workflows/deploy.yaml file

name: Deploy to VPS
on:
  push:
    branches:
      - main
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set SHA-COMMIT
        id: vars
        run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
      - name: Build and push image
        uses: docker/build-push-action@v5
        with:
          context: . 
          platforms: linux/amd64
          push: true
          tags: |
            ghcr.io/yourusername/your-web-app:latest
            ghcr.io/yourusername/your-web-app:${{ steps.vars.outputs.sha_short }
  deploy:
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Deploy
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.EC2_HOST }}
          username: ${{ secrets.EC2_USERNAME }}
          key: ${{ secrets.KEY }}
          port: ${{ secrets.PORT }}
          command_timeout: 30m
          script: |
            cd ${{ vars.DIRECTORY }}
            docker compose pull
            docker compose up -d

Note: Build and push image job contains context. If you include multiple projects in 1 repository, please specify the correct context

Follow my repository here:

https://github.com/tinhtq/devops-exercise.git

Step 4: Test it

Push a commit to this repository and see the result.

Telnet multiple hosts with telnetlib3

Raymond — Sat, 22 Jun 2024 12:38:43 +0000

Why did I create this script?

When you set up the new environment, you need to check whether all hosts and ports are reachable or not but you don’t want to execute telnet host port multiple times. It is a boring step that sometimes you may make a mistake here so I need to create a script to telnet multiple hosts with telnetlib3 library.

(telnetlib will be deprecated in the new version)

Requirements

Python > 3.7

Setup

Step 1: Install telnetlib3

pip install telnetlib3

Step 2: Create a main.py file

import asyncio
import telnetlib3
import io

async def telnet_welcome_message(telnet_host, telnet_port):
    telnet_connection = True
    try:
        await asyncio.wait_for(telnetlib3.open_connection(telnet_host, telnet_port), 5)
    except (asyncio.exceptions.TimeoutError, OSError) as e:
        telnet_connection = False
        print(e)
    return telnet_connection

failed_connection = []

with open("server.txt", "r") as file:
    lines = file.readlines()
    for line in lines:
        info = line.split(",")
        host = info[0]
        port = int(info[1])
        connection = asyncio.run(telnet_welcome_message(host, port))
        if not connection:
            failed_connection.append({"host": host, "port": port})

print(failed_connection)

This script states that the hosts and ports are reachable for 5 minutes, if a timeout or denied, it returns the failed connections.

Step 3: Create a server.txt file that contains the host and port like this

192.168.1.1,8080
192.168.10.1,8191

Step 4: Execute the below command to see which IP and port are not reached

python main.py

Preferences

https://telnetlib3.readthedocs.io/en/latest/intro.html

Configuring Access to Prometheus and Grafana via Sub-paths

Raymond — Tue, 18 Jun 2024 00:41:30 +0000

1. Introduction

Grafana and Prometheus stand as integral tools for monitoring infrastructures across various industry sectors. This document aims to illustrate the process of redirecting Grafana and Prometheus to operate under the same domain while utilizing distinct paths.

2. How does the story begin?

As a seasoned DevOps engineer, my commitment lies in sharing knowledge with a broader audience. My pursuit involves identifying tools conducive to enhancing the monitoring capabilities of both general users and fellow DevOps Engineers.

3. Prerequisites

Functioning Kubernetes Cluster
Proficiency in Kubernetes Management
Helm Installation
Optional: K9s for Kubernetes Cluster Observation (GitHub link)

4. Goals & Objectives

After researching, I found a lack of available information on this topic despite numerous related questions online. Hence, I’m writing a guide to fill this gap.

5. Step-by-Step Guide

Step 1: Installing Kube-prometheus-stack

Create a values.yml file to configure the Helm chart values for both Prometheus and Grafana.

grafana:
  env:
    GF_SERVER_SERVE_FROM_SUB_PATH: true
grafana.ini:
  server:
    domain: "<domain>"
    root_url: "<protocol>:<domain>/<path>/"
prometheus:
  prometheusSpec:
    externalUrl: "<protocol>:<domain>/<path>/"
    routePrefix: /path`

For instance

grafana:
  env:
    GF_SERVER_SERVE_FROM_SUB_PATH: true
  grafana.ini:
    server:
      domain: "example.com"
      root_url: "https://example.com/grafana/"
prometheus:
  prometheusSpec:
    externalUrl: "https://example.com/prometheus/"
    routePrefix: /prometheus

helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update
helm install <relase-name> prometheus-community/kube-prometheus-stack -n <namespace> -f values.yml

Step 2. Create Ingress for mapping domain

There are two methods to accomplish this task:

Define in the values.yml file for automatic creation.
Another approach involves manually creating a YAML file for the ingress. I opted for this method because it allows centralized management, facilitating easy problem identification if any issues arise.
Create ingress.yml file

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: prometheus
  namespace: monitoring
  annotations:
    kubernetes.io/ingressClassName: "traefik"
spec:
  rules:
    - host: ""
      http:
        paths:
          - path: /prometheus
            pathType: Prefix
            backend:
              service:
                name: <helm-release-name>-kube-prometheus-prometheus
                port:
                  number: 9090
          - path: /grafana
            pathType: Prefix
            backend:
              service:
                name: <helm-release-name>-grafana
                port:
                  number: 80

Execute the following command to apply the changes:

kubectl apply -f ingress.yml

The result is shown below

6. Conclusion

As I venture into writing for Medium, I acknowledge potential errors in this documentation. I invite feedback and further inquiries from readers to improve the accuracy and comprehensiveness of this guide. Thank you for your attention and engagement.