The brief and the inventory

01The problem

This is the capstone of the Cloud & DevOps Engineer track. You'll take one platform through the whole job: inventory, an incident review, infrastructure as code, delivery, capacity, reliability, cost and a game day.

The company is Kasuwa, the online shop from the Data Scientist Capstone. Its biggest day is the November sale. Last year's sale went badly. Checkout failed for over an hour at the peak, and customers found out before the engineers did. The head of engineering has sent this:

"The sale is in eight weeks. Last year we lost the most valuable hour of the year. Since then the cloud bill has crept up, half the infrastructure was built by hand during the incident, and every deploy feels like a gamble. Tell me what's wrong, fix what matters, and tell me honestly whether we're ready."

02The concept

Start with an inventory

You can't secure, scale or cost what you don't know exists. List every resource, its environment, who owns it, how it's managed and what it costs.

Managed by Terraform, or by hand?

Resources created by hand (in the console or during an incident) aren't reviewed, aren't reproducible and drift silently. Anything that matters in production should be in Terraform.

Ownership and safety

Every resource needs an owner, a team that's answerable for it. And anything public or unencrypted needs a reason.

The plan for the eight weeks

03Example

The inventory, by environment and by how it's managed:

import pandas as pd

base = "https://academy.cloudtechanalytics.com/datasets/platform/"
resources = pd.read_csv(base + "resources.csv")
print(f"{len(resources)} resources, ${resources['monthly_cost_usd'].sum():,} a month\n")
resources.pivot_table(index="environment", columns="managed_by", values="monthly_cost_usd", aggfunc="sum", fill_value=0, margins=True)

31 resources, $9,840 a month

managed_by   manual  terraform   All
environment
development    1190       1120  2310
production     1600       3230  4830
staging        2400        300  2700
All            5190       4650  9840

Staging costs more than half as much as production, and much of the spend is managed by hand. What's risky in production:

prod = resources[resources["environment"] == "production"]
prod.loc[(prod["managed_by"] == "manual") | (prod["owner"].isna()) | (prod["encrypted"] == 0) | (prod["publicly_accessible"] == 1),
         ["name", "type", "managed_by", "publicly_accessible", "encrypted", "owner"]]

name               type managed_by  publicly_accessible  encrypted          owner
2           web-frontend   cdn distribution  terraform                    1          1       web-team
3   public-load-balancer      load balancer  terraform                    1          1  platform-team
5      orders-db-replica  postgres database     manual                    0          1  payments-team
7           order-worker  autoscaling group     manual                    0          1  payments-team
8         product-images     storage bucket  terraform                    1          1       web-team
9             db-backups     storage bucket     manual                    0          0            NaN
11               bastion    virtual machine     manual                    1          1            NaN

The database replica and the order worker were built by hand during last year's incident and never brought into Terraform. The backup bucket is unencrypted and has no owner, so the most sensitive copy of customer orders is the least protected thing in the account. The bastion is public, hand-built and unowned. The CDN, load balancer and product images are meant to be public.

04Walkthrough

1. Download the dataset below and run the cells.
2. List every resource with no owner. Who should own each?
3. Which manual production resources should be imported into Terraform first? Rank them by risk.
4. Look at the development resources. Which look abandoned?
5. Write the inventory findings (the task below).

05Practice

06Check your understanding