Welcome to another episode of: 'Back To Basics'.
Hi, I'm Clare, and I'm a senior solutions architect
here at Amazon Web Services.
In this episode,
I'm going to talk to you about how you can
utilize AWS Conformance Packs and AWS Config
in order to insure that your database is optimized
and resilient for your production workloads.
So, before we dive deep into the architecture,
why don't we take a look about how we can have resiliency
defined at the data tier level.
We found customers always want to ensure their data is highly available.
They can accommodate this by establishing various disaster recovery procedures.
Mechanisms for instance protection.
Managing version control.
As well as monitoring and analytics.
This is applicable to whether you have a relational,
or NoSQL database for your workloads.
Let's continue by understanding
what AWS Config and Conformance Packs are,
and how they can actually help you.
When you migrate your database into the cloud,
there are so many services and resources that are available to you,
to ensure that your database is secure and highly available.
One service that can help achieve this,
is by utilizing AWS Config and Conformance Packs.
AWS Config
is a service that lets you assess and audit your AWS infrastructure
by monitoring and recording your resource configurations.
This service lets you create managed rules,
which are predefined, customizable rules
that AWS Config uses to evaluate whether your AWS resources comply
with common best practices.
You can also create your own custom rules.
Any findings will result in either a compliant,
or non-compliant result.
Another great feature of AWS Config, are the Conformance Packs.
This gives you the ability to bundle numerous rules together as a pack.
This can be, actually, deployed as a single entity.
The cool thing with these,
are that these are defined as a .yaml template.
They're a group of config rules that are immutable.
And users cannot make changes to the rules
unless there's an update to the Conformance Pack.
With Conformance Packs,
you can incorporate both managed config rules and custom config rules.
It is also best practice to incorporate remediation actions
for any of those rules that end up being non-compliant.
Let's take a look at and end-to-end architecture
that is leveraging both AWS Config and Conformance Packs.
We can see the end user has configured the AWS Config rules.
And in addition,
they are adding specific Conformance Pack rules from the .yaml file,
that are applicable to the Amazon Aurora database workload.
We'll deep-dive into a few selections for optimizing your database.
From an architectural best practice perspective,
it is recommended to enable rds-multi-az-support.
By configuring this parameter,
it will allow high availability for your workloads.
If your primary database goes down,
or if there's any maintenance that occurs,
your work rules will not be impacted.
And you can continue your business as usual.
Another great architectural patern,
is ensuring you have enabled
rds-storage-encrypted and rds-snapshot-encrypted.
The following parameters will ensure you are
compliant with any compliance regulations.
You are encrypting your data at rest,
so no one will be able to access your data.
So, whether this is actually your data,
or your database back-ups,
these parameters will ensure that your data is encrypted.
To continue on the lines of best practices,
we will want to ensure rds-enhanced-monitoring is enabled.
You can setup notifications if high thresholds are reached,
such as CPU utilization.
It will also allow you to dive deeper into understanding
what processes, or threads are utilizing that CPU.
You will also be able to identify an IO contention
and total memory being utilized by any processes.
Now that you have identified what rules are non-compliant,
you have options on remediation.
You could actually have Lambda functions call various API calls, or scripts
to execute options on your AWS resources.
You can also leverage AWS Systems Manager Automation Document,
to apply remediations on non-compliant resources.
From there,
you can have email notifications sent to you or your teams,
as well as any third-party workplace communication tools,
using web hooks such as, Slack, or Teams.
As a result, you now have an AWS environment,
that is governed by well architected best practices.
Today, you learned best architectural practices
on utilizing both AWS Config,
and Conformance Packs to ensure that your database
is resilient and optimized for those production workloads.
As well as, various techniques on remediating those non-compliant resources.
For more information,
please check out the links below.
Thanks for watching, 'BackToBasics'.
See you next time.