20201012 - Serverless Architecture Conference - Deploying serverless applications

© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark.
How to deploy a production ready
serverless application
Marcia Villalba
Developer Advocate AWS
@mavi888uy

About me
AWS Developer Advocate
Working with serverless since 2015
Host of FooBar YouTube Channel
https://youtube.com/foobar_codes
@mavi888uy

Agenda
• CI/CD for serverless applications
• Continuous integration/continuous deployment (CI/CD) foundations
• Infrastructure as code
• Continuous integration
• Continuous deployment

Development transformation at Amazon: 2001–2002
monolithic application
+ teams
2001
Lesson learned: decompose for agility
2002
microservices
+ 2 pizza teams

Full ownership
Full accountability
“DevOps”
Focused innovation
Two-pizza teams

Monolith development lifecycle
monitorreleasetestbuild
developers
delivery pipelines
services

Microservice development lifecycle
???
developers
delivery pipelines
services

Microservice development lifecycle
developers services
delivery pipelines

ListenIterate
Experiment
Innovation
Flywheel
Experiments power the engine of rapid innovation

What changes do you need to make to adopt these best
practices?
Serverless
No provisioning/management
Automatic scaling
Pay for value billing
Availability and resiliency
Microservices
Componentization
Business capabilities
Products not projects
Infrastructure automation
DevOps
Cultural philosophies
Cross-disciplinary teams
CI/CD
Automation tools
DEV OPS
Architectural
patterns
Operational
Model
Software
Delivery

Release process stages
Source Build Test Production

Stages of the software release process
Developers version,
review and commit
code changes

Build tasks and unit
testing
Developers version,
review and commit
code changes

Deploy to testing
environments and
run integration
tests
Developers version,
review and commit
code changes
testing

Deploy to
production
environment
Developers version,
review and commit
code changes
testing
Deploy to testing
environments and
run integration
tests

Approved deploy

Automated deploy
Approved deploy

Choosing the right tools

AWS CodePipeline
The orchestrator

AWS CodePipeline
• Continuous delivery service for fast and reliable
application updates
• Model and visualize your software release
process
• Builds, tests, and deploys your code every time
there is a code change
• Integrates with third-party tools and AWS
• https://aws.amazon.com/codepipeline/

Example of minimal developer’s pipeline
This pipeline:
• Three stages
• Builds code artifact
• One development environment
• Uses AWS SAM/AWS CloudFormation to deploy
artifact and other AWS resources
• Has Lambda custom actions for testing functions
MyBranch-Source
Source
CodeCommit i
Build
test-build-source
CodeBuild i
MyDev-Deploy
create-changeset
AWS CloudFormation i
execute-changeset
Run-stubs
Lambda i

Example of full pipeline
This pipeline:
• Five stages
• Three deployed to “environments”
• Uses AWS SAM/AWS CloudFormation to
deploy artifact and other AWS resources
• Has Lambda custom actions for testing
functions
• Integrates with a third-party tool/service
• Has a manual approval before deploying
to production
Source
Source
GitHub i
Build
test-build-source
CodeBuild i
Deploy-Testing
create-changeset
execute-changeset
Run-stubs
Lambda i
Deploy-Staging
Deploy-Prod
create-changeset
execute-changeset
Post-Deploy-Stack
Lambda i
create-changeset
execute-changeset
QA-Sign-Off
Manual approval i
Review
Run-API-test
Runscope i

Example of full pipeline
This pipeline:
• Five stages
• Three deployed to “environments”
• Uses AWS SAM/AWS CloudFormation to
deploy artifact and other AWS resources
• Has Lambda custom actions for testing
functions
• Integrates with a third-party tool/service
• Has a manual approval before deploying
to production
Source
Source
GitHub i
Build
test-build-source
CodeBuild i
Deploy-Testing
create-changeset
execute-changeset
Run-stubs
Lambda i
Deploy-Staging
Deploy-Prod
create-changeset
execute-changeset
Post-Deploy-Stack
Lambda i
create-changeset
execute-changeset
QA-Sign-Off
Manual approval i
Review
Run-API-test
Runscope i
Dev account
Staging account
Production account

© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark.© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark.

AWS CodePipeline: Supported sources
Pick branch
AWS CodeCommit
GitHub
Pick object or folder
Amazon S3
Automatically kick off release and pull latest source code
Amazon CloudWatch Events
Scheduled (nightly release)

Code
Infrastructure

Infrastructure as code goals
1. Make infrastructure changes repeatable and predictable
2. Release infrastructure changes using the same tools as code changes
3. Replicate production environment in a staging environment to enable
continuous testing

AWS CloudFormation
• Infrastructure as code (IaC)
• Provides a common language for you to
describe and provision all the infrastructure
resources in your cloud environment
• Build and rebuild your infrastructure and
applications, without having to perform
manual actions or write custom scripts
https://aws.amazon.com/cloudformation/

Model function environments with AWS Serverless
Application Model (SAM)
• Open source framework for building serverless
applications on AWS
• Shorthand syntax to express functions, APIs,
databases, and event source mappings
• Transforms and expands SAM syntax into AWS
CloudFormation syntax on deployment
• Supports all AWS CloudFormation resource types
https://aws.amazon.com/serverless/sam/

SAM template
AWSTemplateFormatVersion: '2010-09-09’
Transform: AWS::Serverless-2016-10-31
Resources:
MySimpleTableFunction:
Type: AWS::Serverless::Function
Properties:
Handler: mySimpleTableFunction.handler
Runtime: nodejs12.x
CodeUri: ./functions
Policies:
- DynamoDBReadPolicy:
TableName: !Ref MySimpleTable
Events:
MySimpleFunctionApi:
Type: Api
Properties:
Path: /simpleTable
Method: GET
MySimpleTable:
Type: AWS::Serverless::SimpleTable

SAM template
Resources:
Properties:
Runtime: nodejs12.x
Policies:
Events:
Type: Api
Properties:
Path: /simpleTable
Method: GET
MySimpleTable:
AWS Cloud
Amazon API Gateway
Lambda function
Table Role
===
To become
this
Allowing
this

SAM template
Resources:
Properties:
Runtime: nodejs12.x
Policies:
Events:
Type: Api
Properties:
Path: /simpleTable
Method: GET
MySimpleTable:
Tells AWS CloudFormation this is a SAM template it
needs to “transform”

SAM template
Resources:
Properties:
Runtime: nodejs12.x
Policies:
Events:
Type: Api
Properties:
Path: /simpleTable
Method: GET
MySimpleTable:
Just 20 lines to create:
• Lambda function
• IAM role
• API Gateway

SAM template
Resources:
Properties:
Runtime: nodejs12.x
Policies:
Events:
Type: Api
Properties:
Path: /simpleTable
Method: GET
MySimpleTable:
Function configuration

SAM template
Resources:
Properties:
Runtime: nodejs12.x
Policies:
Events:
Type: Api
Properties:
Path: /simpleTable
Method: GET
MySimpleTable:
Permissions for the
function

AWS SAM Policy Templates
Resources:
Properties:
Runtime: nodejs12.x
Policies:
Events:
Type: Api
Properties:
Path: /simpleTable
Method: GET
MySimpleTable:
Policies:
- CloudWatchPutMetricPolicy: {}
Policies:

AWS SAM Policy Templates
Resources:
Properties:
Runtime: nodejs12.x
Policies:
Events:
Type: Api
Properties:
Path: /simpleTable
Method: GET
MySimpleTable:
All the available policies can
be found in this link
http://bit.ly/sam-policy-
template

SAM template
Resources:
Properties:
Runtime: nodejs12.x
Policies:
Events:
Type: Api
Properties:
Path: /simpleTable
Method: GET
MySimpleTable:
API Gateway

SAM template
Resources:
Properties:
Runtime: nodejs12.x
Policies:
Events:
Type: Api
Properties:
Path: /simpleTable
Method: GET
MySimpleTable:
Creates a Amazon DynamoDB table with 5
Read & Write units

Use SAM CLI to package and deploy SAM templates
pip install --user aws-sam-cli
sam logs
sam validate
sam local
sam init
sam build
sam package
sam deploy
sam publish

Use SAM CLI to package and deploy SAM templates
pip install --user aws-sam-cli
sam logs
sam validate
sam local
sam init
sam build
sam package
sam deploy
sam publish
sam deploy –guided
When you want to get things set up easily in
your computer

# Global information for all the functions
Globals:
Function:
Runtime: nodejs12.x
MemorySize: 256
Timeout: 100
Tracing: Active
Resources:
MySimpleFunction:
Type: 'AWS::Serverless::Function’
Properties:
Handler: mySimpleFunction.handler
Events:
MySimpleFunctionAPI:
Type: Api
Properties:
Path: /simple
Method: GET
# A function that uses a Simple table function
Properties:
Policies:
- DynamoDBCrudPolicy:
Environment:
Variables:
TABLE_NAME: !Ref MySimpleTable
Events:
Type: Api
Properties:
Path: /simpletable
Method: GET
MySimpleTable:
AWS SAM Globals

AWS Lambda Environment Variables
• Key-value pairs that you can dynamically pass to your function
• Available via standard environment variable APIs such as
process.env for Node.js or os.environ for Python
• Can optionally be encrypted via AWS Key Management Service
(KMS)
• Useful for creating environments per stage (i.e. dev, testing,
production)

In AWS SAM template
MySimpleFunction:
Type: "AWS::Serverless::Function"
Properties:
Policies:
TableName: !Ref MyDynamoDBTable
Environment:
Variables:
TABLE_NAME: !Ref MyDynamoDBTable
Events:
Type: Api
Properties:
RestApiId: !Ref MyApi
Path: /simple
Method: GET

In the handler of the function
MySimpleFunction:
Properties:
Policies:
TableName: !Ref MyDynamoDBTable
Environment:
Variables:
TABLE_NAME: !Ref MyDynamoDBTable
Events:
Type: Api
Properties:
RestApiId: !Ref MyApi
Path: /simple
Method: GET
'use strict';
const TABLE_NAME = process.env.TABLE_NAME;
module.exports.getItem = async (propertyId, sortKey) => {
console.log('getItem');
...

Different resources names for different stages
DEV STAGE PROD

In AWS SAM template
Parameters:
MyEnvironment:
Type: String
Default: dev
AllowedValues:
- dev
- staging
- prod
Mappings:
ResourcesName:
dev:
tableName: MyDynamoDBTable-dev
staging:
tableName: MyDynamoDBTable-staging
prod:
tableName: MyDynamoDBTable-prod
Resources:
MyDynamoDBTable:
Type: "AWS::DynamoDB::Table"
Properties:
. . .
TableName: !FindInMap [ResourcesName, !Ref MyEnvironment, tableName]

We need to pass the stage name as a
parameter when we create the AWS
Cloudformation change set
In AWS CodePipeline

AWS CodeCommit
• Fully managed source-control service that
hosts secure Git-based repositories
• Allows teams to collaborate on code in a
secure and highly scalable ecosystem
• Automatically encrypts your files in transit
and at rest
• Integrated with AWS Identity and Access
Management (IAM)
• https://aws.amazon.com/codecommit/

Third-party code repositories
private repo
Integrates with AWS
CodeBuild and AWS
CodePipeline
Integrates with AWS
CodeBuild

Continuous integration goals
1. Automatically kick off a new release when new code is checked in
2. Build and test code in a consistent, repeatable environment
3. Continually have an artifact ready for deployment
4. Continually close feedback loop when build fails

AWS CodeBuild
• Fully managed build service that can compile
source code, run tests, and produce software
packages
• Scales continuously and processes multiple
builds concurrently
• Can consume environment variables from
AWS Systems Manager Parameter Store
• No build servers to manage
• Supports dependency caching
• https://aws.amazon.com/codebuild/

phases:
install:
commands:
- pip install --upgrade pip
- pip install pipenv –user
- pipenv install awscli aws-sam-cli
- npm install
pre_build:
commands:
- eslint *.js
- npm test
build:
commands:
- sam build
post_build:
commands:
- sam package –template-file template.yaml –s3-bucket $BUCKET_NAME –output-template
packaged.yaml
artifacts:
type: zip
files:
- packaged.yaml
AWS CodeBuild: Lambda buildspec using SAM CLI

phases:
install:
commands:
- npm install
pre_build:
commands:
- eslint *.js
- npm test
build:
commands:
- sam build
post_build:
commands:
packaged.yaml
artifacts:
type: zip
files:
- packaged.yaml
Use install phase to install packages or any pre-
reqs you may need throughout the build

phases:
install:
commands:
- npm install
pre_build:
commands:
- eslint *.js
- npm test
build:
commands:
- sam build
post_build:
commands:
packaged.yaml
artifacts:
type: zip
files:
- packaged.yaml
Use pre-build phase to run unit tests

phases:
install:
commands:
- npm install
pre_build:
commands:
- eslint *.js
- npm test
build:
commands:
- sam build
post_build:
commands:
packaged.yaml
artifacts:
type: zip
files:
- packaged.yaml
In the build phase, we build the project using AWS SAM

phases:
install:
commands:
- npm install
pre_build:
commands:
- eslint *.js
- npm test
build:
commands:
- sam build
post_build:
commands:
packaged.yaml
artifacts:
type: zip
files:
- packaged.yaml
Use post-build for creating the package of the artifact

phases:
install:
commands:
- npm install
pre_build:
commands:
- eslint *.js
- npm test
build:
commands:
- sam build
post_build:
commands:
packaged.yaml
artifacts:
type: zip
files:
- packaged.yaml
Where AWS CodeBuild can find the output artifacts

Where and what to test
• Code review via pull
request
• Lint/syntax check
• Unit test pass
• Code successfully
compiles
• Application deploys
successfully
• Mocked/stubbed
integration tests
• Application deploys
successfully
• Test against real services
(potentially against
production dependencies)
• Run pre-traffic Lambda tests
• Deploy canaries
• Complete wait period
successfully
• Deploy 100%
• Run post-traffic Lambda
tests
Source
Source
CodeCommit i
Build
test-build-source
CodeBuild i
Deploy-Testing
create-changeset
execute-changeset
Run-stubs
Lambda i
Deploy-Staging
Deploy-Prod
create-changeset
execute-changeset
Post-Deploy-Stack
Lambda i
create-changeset
execute-changeset
QA-Sign-Off
Manual approval i
Review
Run-API-test
Runscope i

Different ways to make sure everything is ok
AWS Lambda functions
Third party services
Manual QA
Safe deployments

Using AWS Lambda to perform integration tests…
exports.handler = async (event, context) => {
let jobId = event["CodePipeline.job"].id;
// DO SOME INTEGRATION TESTS
if (testsPassed) {
let params = {
jobId: jobId
};
return codepipeline.putJobSuccessResult(params).promise(data => {
context.succeed('Test passed');
}).catch(error => {
context.fail(error);
});
} else {
let params = {
jobId: jobId,
failureDetails: {
message: JSON.stringify('Test failed’),
type: 'JobFailed’,
externalExecutionId: context.invokeid
}
};
return codepipeline.putJobFailureResult(params).promise(data => {
context.fail(message);
});
}
};

if (testsPassed) {
let params = {
jobId: jobId
};
}).catch(error => {
});
} else {
let params = {
jobId: jobId,
failureDetails: {
}
};
});
}
};
Write some integration tests

if (testsPassed) {
let params = {
jobId: jobId
};
}).catch(error => {
});
} else {
let params = {
jobId: jobId,
failureDetails: {
}
};
});
}
};
Needs to call the
putJobSuccessuResult

if (testsPassed) {
let params = {
jobId: jobId
};
}).catch(error => {
});
} else {
let params = {
jobId: jobId,
failureDetails: {
}
};
});
}
};
Needs to call the
putJobFailureResult

if (testsPassed) {
let params = {
jobId: jobId
};
}).catch(error => {
});
} else {
let params = {
jobId: jobId,
failureDetails: {
}
};
});
}
};
More information on how to configure this
https://amzn.to/2SVWZlW

Using 3rd party service to test
For adding tests there are lots of
3rd party tools supported.
Find more information on how
to configure them with AWS
CodePipeline here:
https://amzn.to/2SV0iK3

Manual approvals

AWS CodeDeploy
• Automates code deployments to any instance and
Lambda
• Handles the complexity of updating your applications
• Avoid downtime during application deployment
• Roll back automatically if failure detected
• Deploy to Amazon EC2, Lambda, Fargate, EC2, or on-
premises servers

Safe Deployment
Canary10Percent30Minutes
Linear10PercentEvery10Minutes
Linear10PercentEvery1Minute
AllAtOnce
BeforeAllowTraffic
AfterAllowTraffic
AllowTraffic
Deployment Preference

Versions are immutable snapshots of
a function – code + configuration
An Alias is a pointer to a version
Lambda Version and aliases
v1
v2
v3
Alias: prod
Alias: dev

CodeDeploy – Lambda canary deployment
API
Gateway
Lambda
function
weighted
alias “live”
v1 Lambda
function
code
100%

API
Gateway
Lambda
function
weighted
alias “live”
v1 code100%
Run PreTraffic hook against v2 code before it receives traffic
v2 code0%

API
Gateway
Lambda
function
weighted
alias “live”
v1 code90%
Wait for 10 minutes, roll back in case of alarm
v2 code10%

API
Gateway
Lambda
function
weighted
alias “live”
v1 code0%
Run PostTraffic hook and complete deployment
v2 code100%

Testing using safe deployments
HelloFunction:
Properties:
Handler: handler.hello
Runtime: nodejs12.x
CodeUri: ./hello
AutoPublishAlias: live
DeploymentPreference:
Type: Linear10PercentEvery10Minutes
Alarms:
- !Ref AliasErrorMetricGreaterThanZeroAlarm
- !Ref LatestVersionErrorMetricGreaterThanZeroAlarm
Hooks:
PreTraffic: !Ref PreTrafficLambdaFunction
PostTraffic: !Ref PostTrafficLambdaFunction

HelloFunction:
Properties:
Runtime: nodejs12.x
CodeUri: ./hello
Alarms:
Hooks:
Instructs AWS SAM to publish a new
version of the function for each new
deployment and link it to the live alias

HelloFunction:
Properties:
Runtime: nodejs12.x
CodeUri: ./hello
Alarms:
Hooks:
Linear10PercentEvery1Minute
AllAtOnce

HelloFunction:
Properties:
Runtime: nodejs12.x
CodeUri: ./hello
Alarms:
Hooks:
A list of alarms that you want to monitor
You can specify a maximum of 10 alarms

HelloFunction:
Properties:
Runtime: nodejs12.x
CodeUri: ./hello
Alarms:
Hooks:
Validation Lambda functions that are run
before & after traffic shifting

Different strategies for different stages
DEV STAGE PROD
Lambda
function

Different strategies for different stages
Parameters:
MyEnvironment:
Type: String
Default: dev
AllowedValues:
- dev
- staging
- prod
Conditions:
IsProd: !Equals [!Ref MyEnvironment, prod]
MySafeDeployedFunction:
Properties:
Handler: mySafeDeployedFunction.handler
Type: !If [IsProd, Linear10PercentEvery1Minute, AllAtOnce]

Continuous deployment goals
1. Automatically deploy new changes to staging environments
for testing
2. Deploy to production safely without impacting customers
3. Deliver to customers faster: Increase deployment frequency,
and reduce change lead time and change failure rate

Monitoring and observability
Amazon CloudWatch
Collects monitoring
and operational data in
the form of logs,
metrics, and events
AWS X-Ray
Provides a trace or an
end-to-end view of
requests traveling
through your application

How to get started

Start working with a template pipeline
https://github.com/aws-samples/cookiecutter-aws-sam-pipeline

Code for the example pipeline
https://github.com/mavi888/demo-cicd-codepipeline

“Create application” experience
Create a serverless application
from a starter template
• AWS SAM template for IaC
• CI/CD pipeline
• Clone locally for development
with AWS SAM CLI

“Create application” experience

AWS developer tools
Source Build Test Deploy Monitor
AWS CodeBuild +
third party
Software release steps
AWS CodeCommit AWS CodeBuild AWS CodeDeploy
AWS CodePipeline
AWS
CodeStar
AWS X-Ray
Amazon
CloudWatch

Takeaways
1. Manage your infrastructure as code
2. Frequently build and integrate your code to get a first feedback
3. Continuously release in production using canary releases with monitoring and
automated rollbacks
4. Use canary releases to get both technical and business feedback

Thank you!Marcia Villalba
@mavi888uy
YouTube Channel: https://youtube.com/foobar_codes

20201012 - Serverless Architecture Conference - Deploying serverless applications

More Related Content

Similar to 20201012 - Serverless Architecture Conference - Deploying serverless applications

More from Marcia Villalba

Recently uploaded

20201012 - Serverless Architecture Conference - Deploying serverless applications