Documentation

Requirements in this category relate to the documentation provided for each customer example.

Architecture diagrams

The root user is managed by the client. All the users have their own individual IAM users created.

Managed by the client side.

Operational Excellence

Requirements in this category relate to the ability of the APN Partner and the customer to run and monitor systems to delivery business value and to continually improve supporting processes and procedures.

CloudWatch default and custom metrics are used to determine the health of components of the workload.

CloudWatch dashboards and alarms are created to collect and analyze workload health metrics.

Dashboards

Alarms

Documents are created on Confluence to convey the operational processes.

Scenarios such as infrastructure management and monitoring, application monitoring, backups & restore, troubleshooting feed server, deployment prcess are covered

Testing is conducted by the QA team in QA environment and then in staging environment.

Builds are deployed using Jenkins.

BitBucket

CloudWatch logs, default metrics and custom metrics are used for infrastructure monitoring.

SumoLogic is used for applicatio logs.

Security – Identity and Access Management

Requirements in this category focus on best practices around AWS Identity and Access Management (IAM) and other identity and access management systems owned by the APN Partner.

IAM roles and users are used for access management.

IAM roles are assigned least privileges

IAM roles are created and attached with EC2s.

And with Lambdas

1. Each IAM user uses thier own AWS credentials.
2. MFA is mandatory.

Security – Networking

Requirements in this category focus on security best practices for Virtual Private Cloud (Amazon VPC) and other network security considerations.

All security groups allow traffic on only the required ports by only the required source.

1. ALB traffic is encrypted using SSL.

2. SSL certificates are imported into the AWS Certificate Manager.

All the data stores are in the private subnets

Security – IT Operations

Requirements in this category focus on IT security operations best practices including logging, monitoring, incident response, and data classification.

1. Traffic to load balancer is encrypted.

2. SSL certificates are imported into the AWS Certificate Manager.

AWS API Integration

Requirements in this category deal with best practices around calling AWS APIs.

.Net SDK is used on application servers

Python library Boto3 is being used to call AWS APIs from Lambda functions.

Reliability
Requirements in this section focus on the ability of the APN Partner solution to prevent, and quickly recover from failures to meet business and customer demand.

Infrastructure is provisinoed using CloudFormation templates.

CICD is implemented using Jenkins, CodeBuild and CodeDeploy

RTO and RPO are 1 hour each.

RDS database is Multi-AZ.

AutoScaling is implemented for application servers.

Autoscaling is used to meet the increase in demand.

Cost Optimization
Requirements in this category relate to the APN Partner’s ability to help customers run systems that deliver business value at the lowest price point.

AWS pricing calculator were used to estimate the cost of major components.
Also got help from price charts for EC2s and RDS and other services to built the estimates.

Summary of estimates includes mainly the cost of EC2 instances, EBS, RDS, S3, Load Balancers, and VPC.

List of AWS services used to calculate infrastructure cost.