Architecting Python Microservices in AWS with ECS & App Mesh

Microservices are small, autonomous units built around business capabilities and deployed via automated pipelines. They rely on bounded contexts, domain-focused design, strict contracts, and decoupled configuration, with telemetry for operations.

Explore domain driven design to drive out requirements for a microservice architecture, using ubiquitous language and bounded contexts to model business domain data and behavior.

Define bounded context as isolating related behaviors within a narrow sub domain, where the term order has different meanings across finance and shipping contexts, guided by ubiquitous language.

Explore the domain model in contexts: design and analysis using ubiquitous language to model domains, and software implementations built from nouns and verbs with technology-agnostic domain logic that supports testing.

Define aggregates as top-level structures in a bounded context that encapsulate data; use KCRWs to build write and read models for an order aggregate referencing customer, products, and shipping events.

See how domain events represent what already happened to a domain aggregate and publish enriched messages to queues and brokers. Observe order events like created, packaged, and shipped with metadata.

Explore hexagonal architecture, aka onion architecture or ports and adapters, with domain-centered layers, ports for interfaces, adapters for technology, and inward dependencies that guide rest and Kafka interactions.

Adopt the command query responsibility segregation pattern to separate write and read models, using a write-focused event store and a read-optimized database for independent scaling and efficient queries.

Explore the geographic infrastructure of cloud, detailing regions and availability zones, how regions host multiple data centers for performance and regulatory needs, and how zones ensure redundancy for high availability.

Show how to diagram geographic architecture by depicting regions and availability zones within an outer bounding box, using the US east region Ohio as an example and labeling zones.

Explore VPC design with public and private subnets, internet gateways, and NAT or Transit gateways. Learn how network ACLs, security groups, and elastic load balancers secure and scale AWS microservices.

Diagram the network architecture with a region and a VPC spanning two availability zones, four subnets (public, private) linked by route tables, NAT gateways, and a load balancer.

Explore the cloud development kit, an AWS abstraction over CloudFormation that lets you define infrastructure in familiar languages like Python, JavaScript, and Go, reducing context switching.

Install and bootstrap cdk, create a project, and deploy infrastructure with the cdk cli; build a hello api demo with fastapi and uvicorn, featuring a name endpoint and health check.

Clean up after deploying the hello api cdk app by running 'cdcc destroy all' to remove infrastructure and minimize charges, then take a short break as the next lecture begins.

Define continuous integration and continuous delivery, highlighting frequent code merges into a repository with automated tests to improve observability, and automated production releases to reduce human errors and speed delivery.

Launch a hands-on integration of GitHub with AWS CodePipeline, creating a private repository, connecting it to AWS developer tools, and wiring a feature branch and PR to deploy.

integrate GitHub with an AWS code pipeline by updating your local Python project, applying a Python gitignore, setting main, pushing to origin, and creating an initial setup feature branch.

Explore image management with Elastic Container Registry, define Docker concepts, and learn to build, tag, push, fetch images from ACR, and run containers for the Hello API demo.

Explore how a Docker file defines the runtime environment, builds immutable container images from a base image, runs containers via an OCI-compliant runtime, and uses registries with security scanning.

Learn essential docker commands to build, tag, run, and push images, including re-tagging as aliasing. See a live Hello API example: build, run on port 8000, and test via HTTP.

CDK automates building a Docker image from a directory with a Dockerfile, pushes it to ACR, and binds the image to the ECS task definition for a Fargate service.

Explore container orchestration to manage lifecycle, configuration, networking, scheduling, deployments, and scaling, with automatic replacement of unhealthy containers. Grasp the control plane and data plane.

Explore AWS Fargate, a serverless compute engine that runs containerized workloads with automatic scaling and pay-as-you-go pricing, eliminating the need to manage EC2 infrastructure and the container orchestration control plane.

Introduce a FastAPI based add numbers rest API that sums a list of numbers via /add, with health check, configurable settings, and unit tests.

Understand how the CDK context json caches metadata for lookups like VPC and the application load balancer, and how refreshing the context fixes deployment errors after stack changes.

Deploy a custom CDK microservice construct for the add nums service, refresh context, and deploy in a single-stage microservices architecture with an ALB endpoint. Test with POST /add.

Learn the core AWS App Mesh components, including virtual nodes, virtual services, and virtual routers, and how Envoy sidecar proxies enable ingress via a virtual gateway and route traffic east-west.

Deploy the AWS distro of OpenTelemetry for Python and enable auto instrumentation to emit traces and metrics, using Envoy and hotel collector sidecars for full observability.

Learn core authentication concepts, including OAuth, tokens, and authorization flows, with JWTs, client credentials, and resource servers in a practical AWS microservices context.

Explore amazon cognito for authentication, authorization, and user management in apps. Sign in with username and password or third-party providers; use user pools, tokens, and client applications.

Discover how Amazon Cognito acts as the authorization server for a microservice, issuing ID, access, and refresh tokens to a Postman client and enabling token validation with Cognito's public keys.

Walk through provisioning a Cognito user pool with CDK, plus an app client and hosted domain for sign-up and sign-in, and enable microservices to validate JWTs via the issuer URL.

Troubleshoot Cognito domain issues, validate JWT tokens, and configure OAuth 2.0 authentication for microservices by wiring Cognito user pools, app clients, and resource servers.

Learn to deploy Cognito authentication for microservices and test it with Postman, obtaining access and ID tokens via OAuth 2.0 and validating JWTs against resource servers.