►
From YouTube: Accelerating cloud native deployment with GitHub Actions and AWS - GitHub Satellite 2020
Description
Presented by Christian Weber, Amazon AWS
For many developers, deploying to the cloud is a challenging journey: Selecting the 'right' tools, writing deployment scripts, and choosing a cloud provider can be a daunting task for developers looking to go Cloud Native for their application, and their organization. GitHub Actions and AWS can make developers' lives easier. But how do you get started? How can a developer deliver an idea and deploy it to the cloud without friction?
In this talk, Christian Weber will cover the best practices of using GitHub Actions and AWS, including writing agnostic deployment scripts with GitHub Actions to share across teams; commonly overlooked security risks when deploying via an AWS Pipeline; and how to use GitHub Actions and AWS for A/B and Blue/Green deployment techniques.
GitHub Satellite: A community connected by code
On May 6th, we threw a free virtual event featuring developers working together on the world’s software, announcements from the GitHub team, and inspiring performances by artists who code.
More information: https://githubsatellite.com
Schedule: https://githubsatellite.com/schedule/
A
Thank
you.
Thank
you,
chado,
thank
you
and
emoji
for
that
introduction.
I'm
really
excited
to
be
here
and,
first
of
all,
I
just
wanted
to
thank
github
for
the
opportunity
to
come
speak
at
github
satellite
today.
This
is
the
first
time
that
I'm
presenting
at
a
conference
from
the
comfort
of
my
own
home.
So
it's
pretty
nice
to
be
here
in
chicago
while
reaching
everyone
around
the
world.
So
thank
you
for
that
and
then
also
I'd
like
to
thank
aws
for
allowing
me
to
present
at
this
conference
as
well.
A
So,
as
jado
said,
my
name
is
christian
weber.
I
am
a
developer
advocate
at
aws
and
what
I'm
focused
on
is
developer
user
experience
and
tooling,
and
all
of
the
dev
tools
that
aws
has
on
our
platform.
So
if
you've
ever
used
tools
like
code,
build
code,
commit
cloud9,
the
aws
cdks,
the
cloud
development
kit
and
so
on
and
so
forth.
A
Just
some
quick
housekeeping
aws
is
still
hiring
like
crazy.
So
during
this
time,
if
you
are
looking
for
work
or
need
help,
navigating
applying
for
aws
feel
free
to
reach
out
to
me
on
twitter.
That
is
my
twitter
handle
and
it
will
be
available
throughout.
I'm
really
looking
forward
to
talking
with
all
of
you
today,
so
to
jump
into
this
first.
I
want
to
start
with
why
this
is
important
to
me
and
why
I
think
this
is
really
important.
A
So
before
I
join
aws
and
before
I
join
the
technology
sector,
I
spent
about
seven
years
working
in
financial
services
from
the
operations
side
of
the
house.
So
if
you
can
think
of
something
to
do
in
operations
chances
are
I
served
that
role.
I
did
level
one
support
level
two
support
level.
Three
support.
I
even
wrote:
release
automation
pipelines.
I
helped
manage
those
pipelines.
A
I
pretty
much
did
it
all
and
as
I
transitioned
out
of
financial
services
and
moved
into
the
tech
sector
about
five
years
ago,
I
started
noticing,
when
talking
to
new
customers
in
contemporary
industries,
that
other
organizations
and
other
industries
were
moving
a
lot
faster
than
organizations
that
have
a
lot
of
constraints
around
security,
compliance
and
auditing,
and
so
that
experience
that
I
had.
I
wanted
to
take
that
perspective
and
think
about
that
lens
of
experience.
As
I
began
my
career
in
technology.
A
So
when
I
started
putting
together
this
talk,
what
I
really
wanted
to
cover
was:
what
does
that
organization
look
like?
That
is
beginning
their
cloud
cloud
journey.
You
know.
A
lot
of
organizations
are
adopting
cloud
native
technology
and
cloud-native
application
development,
but
a
lot
of
times
they
struggle
with
existing
methodologies
or
they
try
a
lift
and
shift
sort
of
methodology
in
terms
of
how
they're
delivering
software
and
they
struggle
to
deliver
as
fast
as
some
of
their
competitors,
and
so
really.
A
A
So
to
meet
these
groups
and
who
they
are:
let's
put
them
into
two
categories:
let's
put
them
into
application
development
and
our
production
team,
our
operations
team,
so
team.
Sarah
is
responsible
for
development
and
testing.
Our
application
set
and
team
gen
is
delivering
this
application
to
production
while
they
collaborate
the
organization
that
they
work
for
is
still
constrained
by
their
security
and
compliance
requirements,
and
that
sarah's
team
does
not
have
access
to
the
production
environment
in
which
they're
deploying
code.
So
how
can
we
help?
A
In
the
industry
that
they
work
in,
it's
oftentimes,
very
stressful
for
their
end
users
and
their
customers,
meaning
that
money
can
be
lost
very
quickly
or
money
can
be
made
very
quickly,
but
either
way
it
is
a
very
high
impact
and
high
stressful
environment.
So
they
worked
together
and
they
delivered
an
application.
That
is
absolutely
mission,
critical
to
the
delivery
to
the
to
the
business
value,
to
the
value
of
their
business
and
what
this
mission
critical
application
does
is.
A
When
a
user
is
under
periods
of
extreme
stress
and
duress,
they
can
go
to
an
internal
web
application
or
an
internal
website
that
is
hosted
by
a
very
cute
dog
that
gives
them
their
favorite
or
random,
dad
joke
they
can
go
here
at
any
time
of
the
day.
Click
on
it
and
now
they've
got
a
brand
new
joke.
So
this
is
very
important
for
those
users.
They
need
to
have
this
website
up
and
running
at
any
given
moment.
They
need
to
scale
and,
most
importantly,
they
need
those.
A
In
addition
to
that,
they
decided
that
they
wanted
all
of
their
application
infrastructure,
which
they
were
treating
as
code
to
live
right
next
to
the
code
base
as
well.
So
when
they
got
to
delivery,
they
wouldn't
have
to
navigate
very
far
and
they
could
experiment
and
use
it
as
they
would
their
regular
application
code
next
once
they
decided
on
that.
The
next
thing
that
they
had
to
think
about
and
make
a
decision
on
was
the
application
architecture,
where
exactly
amounts
of
software,
and
how
am
I
going
to
host
it?
A
Am
I
going
to
use
a
traditional
server?
Am
I
going
to
use
a
regular
ec2
instance?
Am
I
going
to
manage
all
of
the
security
updates
and
the
patches,
and
as
sarah
and
jen
talked
about
it,
what
they
realized
they
needed
was
an
ability
to
deliver
code
quickly
and
move
on
to
the
next
feature,
so
their
developers
could
focus
on
new
tasks
as
they
came
in
so
as
they
looked
at
all
the
options.
The
platform
that
fit
best
for
that
organization
was
elastic
bean
stock
and
for
them
the
benefits
were
obvious
for
them.
A
They
wanted
to
move
quickly,
but,
more
importantly,
they
wanted
to
maintain
infrastructure.
They
needed
to
maintain
their
infrastructure
in
a
streamlined
fashion.
They
didn't
want
to
have
to
manually
spin
up
and
connect
resources
and
they
wanted
to
be
able
to
again
deploy
code
and
move
on
to
the
next
feature.
So
when
they
looked
at
how
elastic
beanstalk
could
solve
their
issue,
they
saw
that
all
of
it
was
deployed
automatically
and
they
could
focus
on
the
change
sets
at
hand.
A
No
worry,
no
worrying
about
security
groups,
setting
up
their
own
elastic
load,
balancers
or
setting
up
their
own
within
an
availability
zone,
no
having
to
worry
about
auto
scaling
and
so
forth,
and
then
for
their
database
layer.
They
chose
amazon,
rds,
a
managed,
managed
database
service
for
their
mysql
backend.
A
So
this
is
great,
but
now
the
next
thing
happens
a
feature
change
a
feature
request
comes
in.
So
if
you
remember
the
website
that
I
posted
here
a
few
slides
ago,
sarah
and
jen
are
responsible
for
a
website
that
has
a
very
important
need
in
the
business
right
to
help
developers
relieve
stress
and
they
recently
got
feedback
from
a
team.
A
That
is
relying
on
this
application
and
let
them
know
that,
while
the
application
was
great,
the
background
color
was
a
little
bit
straining
on
the
eyes
and
when
they
were
going
there
to
help
them
feel
better
throughout
the
day,
they
think
it
would
be
a
little
bit
nicer.
If
maybe
that
background
color
was
just
a
little
bit
easier
on
the
eyes.
It
doesn't
have
to
be
a
lot,
but
what
could
they
do
about
that?
A
So
in
this
new
way,
in
this
new
model
of
delivering
software?
What
does
that
look
like
for
the
individual
developer?
How
can
they
deliver
a
change?
Well
for
the
individual
developer?
Nothing!
Nothing
much
has
to
change
unless
they
need
it
to
so.
In
this
case,
a
developer
would
clone
a
repository
locally.
They
would
get
it
up
and
running
as
per
a
development
environment,
so
they
would
use
the
internal
flask
web
server
or
internal
flask
development
server
to
make
a
change.
They
would
go
into
a
css
document.
A
They
would
edit
the
body
tag
in
there
to
be
a
little
bit
softer
color,
so
in
this
case
a
little
bit
slightly
more
yellow
to
be
easier
on
the
eyes
and
go
ahead
and
make
that
change
and
be
okay
with
it.
Now
in
the
traditional
world
of
application
delivery,
where
this
organization
was
before
this
change
was
a
little
bit
hard
to
get
feedback
on,
and
it
was
difficult
for
a
developer
to
push
this
out
to
another
environment.
A
What
they
would
have
to
do
is
package
up
that
software
package
up
all
the
dependencies
send
that
over
to
another
team,
either
through
email
or
some
sort
of
drop,
and
then
they
would
have
to
hope
that
that
they
had
provided
enough
instructions
and
have
that
to
be
delivered.
Now.
Sarah
and
jen
knew
that
they
didn't
want
to
repeat
this
kind
of
process
and
they
took
a
look
at
the
tools
that
they
had
and
they
knew
that
git
and
github
were
two
important
tools.
A
They
were
using
with
this
and
they
figured
that
there
had
to
be
a
better
way
to
help
get
feedback
very
quickly,
so
that
what
they
decided
on
was
that
they
were
going
to
decide
that
they
for
their
test
environments
and
for
their
development
environments.
The
pull
request
was
going
to
be.
The
change
set
was
going
to
be
the
entire
scope
of
change
for
their
developer.
A
A
We
have
a
change
because
that's
the
constraint
within
our
organization,
so
that
brings
up
quite
a
challenge
for
sarah
and
and
jen,
because
they
have
all
these
constraints
and
how
can
they
work
together
and
collaborate
to
understand
how
each
other
is
working?
Well,
that's
exactly
what
they
did.
They
had
to
collaborate
and
understand
each
other's
changes
and
how
people
were
applying
changes.
A
So,
in
our
case,
how
would
sarah's
application
development
team
test
a
change?
Well,
sarah
and
jen
worked
together
quite
a
bit
and
they
came
up
with
a
solution
around
actions
and
github
actions
and
what
they
decided
on
was
that
the
pull
request
would
represent
their
development
environment
and
in
github.
There
is
a
very
handy
feature
on
the
back
end.
That
says,
for
every
time
an
event
like
a
pull
request
is
open.
A
This
allowed
this
team
to
get
a
production
like
environment
without
long-running
infrastructure.
Sarah
and
jenna
talked
about
this,
because
long-running
infrastructure
in
their
organization
caused
a
lot
of
prior
pain
in
that
servers
that
were
running
for
a
long
time,
tended
to
have
dependency
drift
and
tended
to
become
very
unique
and
very
hard
to
maintain.
So
when
a
test
was
going
through
a
server
like
this,
it
was
very
often
hard
to
understand
whether
or
not
it
would
stay
the
same
and
deploy
just
the
same
in
production.
A
So
what
happened
here
is
actions
was
able
to
facilitate
all
of
this,
and
I
know
what
you're
thinking
right
now.
This
is
a
lot
of
information
to
take
in
and
by
the
way,
it
kind
of
sounds
magical
in
a
way.
How
is
all
of
this
possible?
What
is
the
magic
trick?
What
is
the
secret
sauce
and
I'm
sorry
to
inform
you?
There
really
is
no
magic
trick
for
this.
A
A
They
created
a
build
environment
with
the
elastic
beanstalk
cli,
showing
that
they
could
just
download
the
the
cli
application
they
could
run
it
install
all
of
its
necessary
dependencies
and
then
once
that
was
done,
they
could
then
go
into
their
testing,
whether
that
was
linting
with
flake8
or
running
their
own
unit
test
and
pi
test.
They
could
execute
all
of
those
tests
before
it
was
delivered
to
their
test
environment,
to
make
sure
that
there
wouldn't
be
any
gotchas.
A
A
So
what
this
did
for
the
individual
stakeholder
is
it
created
a
brand
new
website
that
anybody
in
that
organization
could
go
to,
and
it
was
based
on
the
name
of
the
repository,
the
repository
owner
and
the
pr
number.
So,
for
somebody
managing
all
this
infrastructure,
they
could
easily
go
into
a
console
or
make
an
api
call
to
see
exactly
how
many
environments
they
have
running
at
any
given
time
and
to
see
what
exactly
is
running.
A
They
decided
that
they
needed
this
infrastructure
to
live
as
long
as
they
needed
it.
So
if
they
needed
more
stakeholder
feedback
on
bigger
changes,
they
could
let
it
live
as
long
as
they
needed
it.
So
no
automated,
deleting
or
anything
like
that
and
at
the
same
time,
because
it
was
scoped
to
a
pull
request.
A
A
So
perfect
world
we've
got
a
brand
new
change
right.
Sarah
and
jen
have
done
a
great
job
at
up
until
this
point
and
now
we're
at
a
little
bit
of
a
crossroads
here.
How
do
we
end
up
deploying
this
change
to
production,
because,
even
though
we've
gotten
all
the
way
to
this
point,
we
still
have
that
issue
of
well.
Sarah's
team
cannot
deliver
this
to
production.
Jen's
team
has
to
do
that.
A
A
So
that's
where
this
handoff
comes
into
play.
How
can
we
actually
get
this
delivered
to
production
and
that's
where
code
pipeline
plays
a
pivotal
role
here
again
it
triggers
on
that
big
green
button
and
it
allows
the
developer
to
separate
their
responsibility
to
their
operations.
Team
and
now
team
gen
can
safely
deliver
this
production
elastic,
beanstalk
environment
without
additional
intervention.
A
Again
we
talked
about
what
the
requirements
were
for
this
organization.
They
needed
to
be
able
to
deploy
this
in
a
blue-green
fashion.
So
how
are
they
going
to
be
able
to
do
that?
Do
they
do
that
with
code
pipeline?
Well,
it
becomes
a
par.
It
becomes
a
simple
part
of
their
process
where,
in
addition
to
code
pipeline
they're
going
to
use
aws
route
fee
with
weighted
routing
policies
that
directs
traffic
based
on
the
rules
that
they
set.
So
what
they've
done
here
is
created.
Two
record
sets
for
their
website.
A
What
that
allows
them
to
do
is
observation
and
testing,
so
they
can
release
to
production
to
a
small
set
of
users.
So
if
they
have
a
hundred
active
users,
only
10
users
will
see
this
change
until
they
decide
to
route
all
the
traffic
to
the
new
environment
to
the
to
the
merged
environment.
So
now
we
can
do
things
like
capture
telemetry.
A
A
They
can
simply
delete
the
old
environment
and
promote
the
green
environment
to
blue
and
route
all
of
the
traffic
through
there,
and
this
allows
them
to
really
lock
things
down,
and
this
is
all
driven
by
code
pipeline.
So
again
we
talked
about
the
what
the
requirements
were,
and
this
is
what
code
pipeline
looks
like
in
action.
I
will
say
that
this
is
a
very
simple
for
jen
and
sarah.
This
is
a
very
simple
deployment,
but
these
can
be
as
complex
as
an
organization
requires.
A
So
if
you
have
a
situation
where,
in
the
past,
you've
been
bitten
by
issues
where
people
are
deploying
ahead
of
you
or
deploying
while
you're
testing
your
functional
test,
which
causes
your
production
environment
to
break
code
pipeline,
is
helping
not
only
a
senate.
Sarah
and
jen
mitigate
that,
but
would
also
help
you
mitigate
that
as
well.
A
So
what
that
means
is
that
everything
is
queuing
up
for
your
for
your
deployment
pipeline
and
in
this
case,
how
we
design
this
is
that,
every
time
a
source
check-in
comes
in,
it
will
automatically
require
an
additional
layer
of
approval
from
your
approval
team.
Now
that
approval
team
is
defined
as
an
I
within
an
iam
policy
as
a
subset
of
users
that
you
yourself
can
define.
A
So
what
this
gives.
You
is
the
ability
to
have
traceability
and
auditability,
as
well
as
gating
all
of
your
deployments.
None
of
these
deployments
will
occur
in
this
scenario
until
somebody
has
approved
it
now.
That
brings
up
a
really
interesting
question:
what
happens
when
a
developer
pushes
a
new
change
and
they
want
to
leapfrog?
A
Well,
in
this
case,
we
don't
allow
leapfrogging.
We
only
allow
approvals
for
changes
as
they
come
in
sequentially,
because
when
sarah
and
jen
were
looking
at
this
organization,
they
understood
that
this
was
the
best
way
for
the
this
team
in
this
organization
to
deliver
software.
But
it
can
be
absolutely
configured.
So
if
you
have
an
example
of
maybe
needing
to
run
a
database
migration
because
you
a
developer,
cannot
run
a
database
migration
themselves
or
an
operations.
Vault
cannot
do
that.
A
A
The
most
important
thing
for
highly
regulated
industries
that
are
delivering
software
is
to
have
that
traceability
and
that
auditability
and
to
be
able
to
understand
that
if
a
bug
does
get
delivered
to
production,
it's
certainly
not
the
end
of
the
world.
But
we
do
need
to
to
understand
where
that
was
introduced
and
when
we
start
deploying
code
within
a
subset
of
a
pull
request.
We
can
then
see
and
keep
that
grouped
to
our
code
pipeline
deployments
as
well.
A
You'll
see,
on
the
left
hand,
side
that
there's
a
column
for
source
revisions
and
you'll
see
the
shock
commit
right
there
and
code
pipeline
with
the
native
github
integration
will
automatically
go
back
to
that,
commit
to
show
you
that
point
in
history
of
when
that
change
was
introduced.
You
also
get
source
artifacts
that
are
automatically
created.
A
So
if
you
have
a
situation
where
maybe
your
organization
is
being
audited
six
months
from
now
and
you
need
to
be
able
to
go
back
well
now,
you
have
a
copy
at
a
point
in
time
at
that,
commit
that
you
can
provide
to
that
auditor
or
if
you
have
an
external
contractor,
that
needs
access
to
source
code.
But
you
have
a
very
stringent
security
policy
around
who
gets
access
to
a
repository.
A
A
The
only
way
that
teams
are
going
to
be
able
to
move
faster
is
by
developing
processes
and
mechanisms
that
each
other's
teams
can
use
to
help
and
from
there
you'll
start
building
a
culture
of
transparency
and
trust,
which
I
think
is
probably
more
important
than
just
about
anything.
I've
talked
about
today,
but
I
wanted
to
thank
you
for
taking
the
time
to
listen
today
and
I
hope
you're
staying
safe,
safe
and,
I
hope
you're
staying
healthy.