ArchView: AWS Immutable Infrastructure Lifecycle | Aws Cloud Native Architecture Diagram

Introduction to AWS Immutable Infrastructure Lifecycle

The AWS Immutable Infrastructure Lifecycle outlines a robust process for creating and replacing **EC2 instances** or **containers** using **Amazon Machine Images (AMIs)** or **container image tags**. Managed via **EC2 Image Builder** for AMIs and **CloudFormation** for deployments, this approach ensures consistency, security, and repeatability. Automation with **CodePipeline** and **CodeBuild**, observability via **CloudWatch** and **CloudTrail**, and security through **IAM**, **KMS**, and **Secrets Manager** enable a scalable, zero-downtime infrastructure lifecycle for applications like web servers, microservices, or batch processing.

Immutable infrastructure ensures predictable deployments with automated pipelines and enhanced security.

Immutable Infrastructure Lifecycle Diagram

The vertical diagram illustrates the immutable infrastructure lifecycle: **Developers** push code to **CodeCommit**, triggering **CodePipeline**. **EC2 Image Builder** creates AMIs, or **ECR** stores container images. **CloudFormation** deploys new **EC2 instances** or **ECS services** via **ASG** or **ECS Cluster**. **CloudWatch** and **CloudTrail** provide observability, while **IAM**, **KMS**, and **VPC** enforce security. Arrows are color-coded: yellow (dashed) for developer actions, orange-red for build processes, blue for deployment flows, purple for observability, and green for security.

graph TD %% Styling for nodes classDef developer fill:#ffeb3b,stroke:#ffeb3b,stroke-width:2px,rx:10,ry:10; classDef cicd fill:#ff9800,stroke:#ffffff,stroke-width:2px,color:#ffffff,rx:5,ry:5; classDef build fill:#f44336,stroke:#ffffff,stroke-width:2px,color:#ffffff,rx:5,ry:5; classDef deploy fill:#2196f3,stroke:#ffffff,stroke-width:2px,color:#ffffff,rx:5,ry:5; classDef compute fill:#4caf50,stroke:#ffffff,stroke-width:2px,color:#ffffff; classDef observability fill:#9c27b0,stroke:#ffffff,stroke-width:2px,color:#ffffff,rx:2,ry:2; classDef security fill:#673ab7,stroke:#ffffff,stroke-width:2px,color:#ffffff; %% Vertical Flow A[Developer] A -->|Pushes Code| B[CodeCommit] B -->|Triggers| C[CodePipeline] C -->|Builds| D[CodeBuild] subgraph CI/CD Pipeline D -->|Creates AMI| E[EC2 Image Builder] D -->|Builds Image| F[ECR] end E -->|Stores| G[(AMI Repository)] F -->|Stores| H[(Container Images)] G -->|Deploys| I[CloudFormation] H -->|Deploys| I I -->|Provisions| J[Auto Scaling Group] I -->|Provisions| K[ECS Cluster] J -->|Launches| L[EC2 Instances] K -->|Runs| M[ECS Services] L -->|Monitors| N[(CloudWatch)] M -->|Monitors| N I -->|Audits| O[(CloudTrail)] L -->|Secures| P[(VPC)] M -->|Secures| P E -->|Encrypts| Q[(KMS)] F -->|Encrypts| Q I -->|Authenticates| R[(IAM)] I -->|Accesses| S[(Secrets Manager)] %% Apply styles class A developer; class B,C,D cicd; class E,F build; class G,H,I,J,K deploy; class L,M compute; class N,O observability; class P,Q,R,S security; %% Annotations linkStyle 0 stroke:#ffeb3b,stroke-width:2.5px,stroke-dasharray:6,6 linkStyle 1,2 stroke:#ff9800,stroke-width:2.5px linkStyle 3,4 stroke:#f44336,stroke-width:2.5px linkStyle 5,6,7,8 stroke:#2196f3,stroke-width:2.5px linkStyle 9,10 stroke:#4caf50,stroke-width:2.5px linkStyle 11,12 stroke:#9c27b0,stroke-width:2.5px linkStyle 13 stroke:#9c27b0,stroke-width:2.5px,stroke-dasharray:4,4 linkStyle 14,15 stroke:#673ab7,stroke-width:2.5px linkStyle 16,17 stroke:#673ab7,stroke-width:2.5px linkStyle 18,19 stroke:#673ab7,stroke-width:2.5px

A vertical lifecycle with **EC2 Image Builder** and **CloudFormation** ensures consistent, secure deployments.

Key Components

The immutable infrastructure lifecycle relies on the following AWS components:

CodeCommit: Source control repository for application code and infrastructure templates.
CodePipeline: Orchestrates CI/CD workflows for building and deploying images.
CodeBuild: Builds AMIs or container images with custom scripts and dependencies.
EC2 Image Builder: Automates AMI creation with standardized configurations.
ECR: Stores and manages container images with versioning.
CloudFormation: Deploys infrastructure as code for EC2 or ECS resources.
Auto Scaling Group (ASG): Manages EC2 instance replacements for zero-downtime updates.
ECS Cluster: Runs containerized services with immutable image tags.
CloudWatch: Monitors metrics, logs, and alarms for infrastructure health.
CloudTrail: Audits API calls for compliance and security tracking.
IAM: Enforces least-privilege access for pipeline and compute resources.
VPC: Isolates compute resources with subnets and security groups.
KMS: Encrypts AMIs, container images, and sensitive data.
Secrets Manager: Securely stores credentials for build and deployment processes.

Benefits of AWS Immutable Infrastructure Lifecycle

This lifecycle offers significant advantages for modern infrastructure management:

Consistency: AMIs and image tags ensure identical environments across deployments.
Zero-Downtime Updates: ASG and ECS enable rolling or blue-green deployments.
Security: Immutable resources reduce attack surfaces and simplify patching.
Automation: CodePipeline and Image Builder streamline image creation and deployment.
Observability: CloudWatch and CloudTrail provide real-time monitoring and auditability.
Scalability: ASG and ECS scale infrastructure based on demand.
Compliance: KMS encryption and CloudTrail audits support regulatory requirements.

Implementation Considerations

Implementing this immutable infrastructure lifecycle requires addressing key considerations:

Security Hardening: Enforce KMS encryption, rotate Secrets Manager credentials, and restrict IAM roles.
Pipeline Optimization: Minimize build times in CodeBuild and cache dependencies in ECR.
Cost Management: Use spot instances in ASG and monitor pipeline costs with Cost Explorer.
Image Management: Automate AMI cleanup with Image Builder and tag images for versioning.
Observability Setup: Configure CloudWatch dashboards and CloudTrail log analysis for insights.
Deployment Strategy: Use canary or blue-green deployments to validate new AMIs or images.
Compliance Requirements: Enable CloudTrail for audits and encrypt data for GDPR/SOC compliance.
Testing Approach: Validate AMIs and images in staging environments before production rollout.

Automation, security, and observability are critical for a reliable immutable infrastructure lifecycle.

Example Configuration: EC2 Image Builder Pipeline

Below is a CloudFormation template for an EC2 Image Builder pipeline to create AMIs.

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  ImageBuilderRecipe:
    Type: AWS::ImageBuilder::ImageRecipe
    Properties:
      Name: MyWebServerRecipe
      Version: '1.0.0'
      ParentImage: 'arn:aws:imagebuilder:us-west-2:aws:image/amazon-linux-2-x86/2023.0.20230614'
      Components:
        - ComponentArn: 'arn:aws:imagebuilder:us-west-2:aws:component/amazon-linux-2-hardening/1.0.0'
        - ComponentArn: 'arn:aws:imagebuilder:us-west-2:aws:component/install-httpd/1.0.0'
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeSize: 8
            VolumeType: gp3
            Encrypted: true
            KmsKeyId: !Ref KMSKey

  ImageBuilderPipeline:
    Type: AWS::ImageBuilder::ImagePipeline
    Properties:
      Name: MyWebServerPipeline
      ImageRecipeArn: !Ref ImageBuilderRecipe
      InfrastructureConfigurationArn: !Ref InfrastructureConfiguration
      Schedule:
        ScheduleExpression: 'cron(0 0 1 * ? *)'
        PipelineExecutionStartCondition: EXPRESSION_MATCH_AND_DEPENDENCY_UPDATES_AVAILABLE
      ImageTestsConfiguration:
        ImageTestsEnabled: true
        TimeoutMinutes: 60

  InfrastructureConfiguration:
    Type: AWS::ImageBuilder::InfrastructureConfiguration
    Properties:
      Name: MyWebServerInfraConfig
      InstanceProfileName: !Ref InstanceProfile
      SecurityGroupIds:
        - sg-1234567890abcdef0
      SubnetId: subnet-12345678
      TerminateInstanceOnFailure: true

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref ImageBuilderRole

  ImageBuilderRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: ImageBuilderPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - imagebuilder:*
                  - ssm:*
                  - ec2:*
                  - logs:*
                Resource: '*'

  KMSKey:
    Type: AWS::KMS::Key
    Properties:
      Description: KMS key for AMI encryption
      KeyPolicy:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
            Action: kms:*
            Resource: '*'

This template configures an EC2 Image Builder pipeline for automated AMI creation with encryption.

Example Configuration: CloudFormation for ASG Deployment

Below is a CloudFormation template for deploying an Auto Scaling Group with a new AMI.

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  AutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier:
        - subnet-12345678
        - subnet-87654321
      LaunchTemplate:
        LaunchTemplateId: !Ref LaunchTemplate
        Version: !GetAtt LaunchTemplate.LatestVersionNumber
      MinSize: '2'
      MaxSize: '10'
      DesiredCapacity: '2'
      TargetGroupARNs:
        - !Ref ALBTargetGroup
      HealthCheckType: ELB
      HealthCheckGracePeriod: 300
      Tags:
        - Key: Environment
          Value: production
          PropagateAtLaunch: true

  LaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateName: ImmutableWebServer
      LaunchTemplateData:
        ImageId: ami-1234567890abcdef0
        InstanceType: t3.micro
        SecurityGroupIds:
          - sg-1234567890abcdef0
        IamInstanceProfile:
          Arn: !GetAtt InstanceProfile.Arn
        UserData:
          Fn::Base64: |
            #!/bin/bash
            yum update -y
            systemctl start httpd
            systemctl enable httpd

  ALBTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      VpcId: vpc-1234567890abcdef0
      Port: 80
      Protocol: HTTP
      HealthCheckPath: /
      TargetType: instance

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref EC2Role

  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: EC2Policy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:*
                  - ssm:*
                Resource: '*'

This template deploys an ASG with a new AMI for immutable EC2 instances, ensuring zero-downtime updates.

Example Configuration: CloudWatch Alarms for Monitoring

Below is a CloudFormation template for CloudWatch alarms to monitor infrastructure health.

Resources:
  HighCPUMetricAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: HighCPUUsage
      AlarmDescription: Triggers when EC2 CPU usage exceeds 80%
      MetricName: CPUUtilization
      Namespace: AWS/EC2
      Statistic: Average
      Period: 300
      EvaluationPeriods: 2
      Threshold: 80
      ComparisonOperator: GreaterThanThreshold
      Dimensions:
        - Name: AutoScalingGroupName
          Value: !Ref AutoScalingGroup
      AlarmActions:
        - !Ref SNSTopic
      TreatMissingData: notBreaching

  SNSTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: ImmutableInfraAlerts

This template sets up a CloudWatch alarm for high CPU usage in the EC2 Auto Scaling Group.