AWS
Here we list the main services that we use on AWS and which one(s) product engineer should familiarize with.
Note that product engineers can request changes to web AWS accounts via our tvlk-web-terraform-aws repository, so it is recommended that you know how to work with Terraform.
Product team MUST know
ECS
| Service | Web Infra PIC | What it is / what to do |
|---|---|---|
| ECS | Ferdinand | Platform to run and scale containerized application on AWS |
| Configure task definition — which ECR image to use, with what environment variables | ||
| Configure task autoscaling — configure scaling criteria, min/max task count | ||
Product team SHOULD know
| Service | Web Infra PIC | What it is / what to do |
|---|---|---|
| Cloudfront | Adrian | Web CDN: Caches our web resources on multiple geolocation so they are closer to our users. |
| Configure caching behavior — manage cache policies (how and when to cache the resources), triggers captcha invalidation | ||
| Configure per-path behavior — how to add special headers, which ALB/origin to hit, do we need to use lambda functions when handling the request | ||
| Attach WAF protection | ||
| WAF | Hansen | Helps deny unwanted access to our services via rate-limiting, bot detection, silent/CAPTCHA challenges, etc. |
| Manage IP sets — for whitelisting (e.g. to limit staging access) and blacklisting | ||
| Modify ACL rules and rulegroups | ||
Maintained by web-infra
| Service | Web Infra PIC | What it is / what to do |
|---|---|---|
| EC2 | Ferdinand, Adrian | Cloud computing platform (e.g. run machines on the cloud), plus some networking building blocks |
| Manage EC2 instances (used for EKS cluster for our CI) | ||
| Manage security groups, load balancers (ALB), and target groups | ||
| Lambda | — | Serverless functions on AWS |
| Change or modify the functions' code or bundle (ZIP) | ||
| Attach the function to an API Gateway (so it can acts like an API) | ||
| DynamoDB | — | Database: Simple key-value store for any scale |
| Create and manage tables | ||
| ECR | — | Stores built docker images |
| Configure scripts to login, tag images, and upload to ECR | ||
| Configure image retention policy | ||
| Route53 | — | DNS on AWS |
| Configure DNS rules — e.g. which target to hit (which can be an alias to a Cloudfront/ALB) | ||
| IAM | Ferdinand | Permission management on AWS |
| Modify IAM roles — assumed by machines/instances to get certain access on our AWS account | ||
| Modify IAM permission (what is allowed/denied) and trust policy (who can assume that role) | ||
| EKS | Adrian | Platform to run Kubernetes on AWS |
| Configure eksctl config — this interfaces AWS objects with kubernetes objects | ||
| Configure helmfile config — adds predefined modules (and their config) to a Kubernetes cluter | ||