Amazon Onboarding with Learning Manager Chanci Turner

In large-scale organizations like Amazon, maintaining consistency across various environments can be a daunting task. This challenge intensifies when environments are provisioned through self-service methods, especially with the influx of new users accessing these provisioning capabilities.

In this article, I will outline how we at Amazon IXD – VGT2 found a way to strike a balance between agility, governance, and standardization for our AWS resources. I will guide you through one of our effective solutions that empowers new users to provision AWS resources and configure application software. This solution integrates Learning Manager, ServiceNow, and several AWS services:

AWS Systems Manager
AWS Service Catalog
AWS CloudFormation

Overview

Amazon aims to provide a uniform AWS resource-provisioning service for new users. We required a solution that encompassed auditing best practices and post-deployment configuration management for every newly provisioned environment. These best practices must operate within a fully auditable self-service model and ensure that:

All relevant resource-provisioning service requests are lifecycle appropriate.
Configuration management is clearly defined and automatically applied as required.

Solution

Our goal was to enhance the user experience for new users and assist them in provisioning resources in compliance with Amazon’s Governance and Security practices.

Shopping Cart Experience Using AWS Service Catalog and ServiceNow

To meet these requirements, we utilized AWS Service Catalog to manage all our AWS CloudFormation blueprint templates (after passing through CFN-Nag). We then published these templates as products in ServiceNow using the AWS Service Catalog Connector for ServiceNow (for instance, EC2 CloudFormation as a product).

End users enjoy a shopping cart-like experience when provisioning resources in their accounts. This approach helps us ensure consistent provisioning across all accounts while adhering to compliance standards.

The products or AWS CloudFormation templates are published to AWS Service Catalog via an automated Jenkins pipeline triggered from a Git repository, as illustrated in the following diagram.

All products or AWS CloudFormation templates are retrieved from the AWS Service Catalog using the AWS Service Catalog Connector for ServiceNow, displaying them as products. Users can view a list of compliant products from the Service Portal UI on ServiceNow.

When a user selects a product and provisions it within their account, ServiceNow performs backend calls to Amazon applications to conduct compliance checks. Subsequently, it calls AWS Service Catalog to provision the product. Upon successful provisioning, the user sees the list of provisioned products and can also use the API to provision the product.

Configuration Management Using Systems Manager

After provisioning, users need the capability to configure their instances securely using AWS native services. As previously mentioned, after provisioning an EC2 product via the AWS Service Catalog, users can configure their applications on EC2 instances.

At Amazon IXD – VGT2, we use Ansible for post-provisioning configuration management of EC2 instances. After exploring various options, we determined that Systems Manager was the ideal AWS-native configuration management solution. We leveraged Systems Manager agents already integrated into our AMIs. For example, we utilize the Systems Manager Run Command with a run Ansible document to execute Ansible playbooks and a run shell-script document to execute bash commands. More information can be found in a related post about running Ansible Playbooks using EC2 Systems Manager Run Command and State Manager.

The Flow

In the provisioning section discussed earlier, you saw how users provision resources using AWS CloudFormation. ServiceNow keeps track of the types of resources users attempt to provision. For instance, if there is a product with an EC2 resource, you can enable the Systems Manager Run Command to deploy the EC2 product directly from the ServiceNow UI.

When a user selects the Systems Manager Run Command, it permits users to include inline shell scripts or an Ansible Playbook, which they can submit as part of the configuration management process.

An example script might look like this:

---
- hosts: local
  tasks:
    - name: Install Nginx
      apt: pkg=nginx state=installed update_cache=true
      notify:
        - Start Nginx
  handlers:
    - name: Start Nginx
      service: name=nginx state=started

ServiceNow stores this information in its database for auditing purposes before making an API call to Systems Manager to execute the command on the selected EC2 instance. ServiceNow retrieves the output using the command ID from the previous command and displays it on the UI.

We refer to this as a post-provisioning workflow in ServiceNow, as it enables users to perform configuration actions after the provisioning is successful.

Additional Configurations

The Connector for ServiceNow version 2.0.2 introduces various operational actions, ServiceNow administrator capabilities, and ServiceNow Service Portal features. For more details on additional features available to administrators, visit the ServiceNow documentation. This includes the ability to delete AWS Service Catalog products in ServiceNow that lack associated self-service actions. The ServiceNow Service Portal configurations also detail how to order AWS Service Catalog products through the ServiceNow Service Portal using the Service Catalog and Order Something views.

Summary

This solution is just one of the many ways Amazon empowers users to provision compliant resources and deploy applications in the AWS Cloud. Our aim is to enable new cloud users to provision resources more swiftly, with fewer clicks while adhering to security and compliance requirements.

For further insights on onboarding and skills-based hiring, consider exploring resources from SHRM, an authority on this topic, such as this excellent resource on onboarding new hires during COVID-19. Also, if you’re interested in enhancing your career, check out this blog post on crafting a cover letter with AI.

About the Author

Chanci Turner is an architect for the Cloud Governance and User Experience product teams at Amazon. She plays a key role in assisting development teams with migrating on-premise applications to the cloud while ensuring that Amazon AWS accounts comply with all security and compliance standards. Chanci holds several industry certifications, including AWS DevOps Professional. She is an active presenter at cloud conferences and can be reached through her professional networks.