AWS solutions documentation change
Summary
Updated architecture diagram and completely revised process flow with new deployment options (CloudFront+S3, ALB+ECS Fargate, headless), enhanced authentication via Cognito, EventBridge scheduling, and detailed test execution workflow.
Security assessment
Added documentation about Cognito user management and authentication mechanisms for web console/REST API/CLI access, but no evidence of addressing a specific security vulnerability. Enhanced security documentation through explicit authentication flow descriptions.
Diff
diff --git a/solutions/latest/distributed-load-testing-on-aws/architecture-overview.md b/solutions/latest/distributed-load-testing-on-aws/architecture-overview.md index 8cfbbdba8..5d2e9cedd 100644 --- a//solutions/latest/distributed-load-testing-on-aws/architecture-overview.md +++ b//solutions/latest/distributed-load-testing-on-aws/architecture-overview.md @@ -15 +15 @@ Deploying this solution with the default parameters deploys the following compon -**Distributed Load Testing on AWS architecture on AWS** +**Distributed Load Testing on AWS architecture** @@ -17 +17 @@ Deploying this solution with the default parameters deploys the following compon - + @@ -25 +25 @@ The high-level process flow for the solution components deployed with the AWS Cl - 1. A distributed load tester API leverages [Amazon API Gateway](https://aws.amazon.com/api-gateway) to invoke the solution’s microservices ([AWS Lambda](https://aws.amazon.com/lambda) functions). + 1. _(CloudFront + S3 hosting deployment option)_ The Console User accesses the web console through [Amazon CloudFront](https://aws.amazon.com/cloudfront), which serves the [AWS Amplify](https://aws.amazon.com/amplify) application hosted in an [Amazon Simple Storage Service](https://aws.amazon.com/s3) (Amazon S3) bucket. @@ -27 +27 @@ The high-level process flow for the solution components deployed with the AWS Cl - 2. The microservices provide the business logic to manage test data and run the tests. + 2. _(ALB + ECS Fargate hosting deployment option)_ The Console User accesses the web console through an [Application Load Balancer](https://aws.amazon.com/elasticloadbalancing/application-load-balancer/), which routes traffic to the AWS Amplify application running on [Amazon Elastic Container Service](https://aws.amazon.com/ecs) (Amazon ECS) on [AWS Fargate](https://aws.amazon.com/fargate) inside an [Amazon Virtual Private Cloud](https://aws.amazon.com/vpc) (Amazon VPC). @@ -29 +29 @@ The high-level process flow for the solution components deployed with the AWS Cl - 3. These microservices interact with [Amazon Simple Storage Service](https://aws.amazon.com/s3) (Amazon S3), [Amazon DynamoDB](https://aws.amazon.com/dynamodb), and [AWS Step Functions](https://aws.amazon.com/step-functions) to store test scenario details and results and to orchestrate test execution. + 3. _(Headless deployment option)_ No public front end is deployed. The solution provides the web console as a downloadable ZIP in a private Amazon S3 bucket. The Console User can access the console from a self-hosted web server. @@ -31 +31 @@ The high-level process flow for the solution components deployed with the AWS Cl - 4. An [Amazon Virtual Private Cloud](https://aws.amazon.com/vpc) (Amazon VPC) network topology deploys containing the solution’s [Amazon Elastic Container Service](https://aws.amazon.com/ecs) (Amazon ECS) containers running on [AWS Fargate](https://aws.amazon.com/fargate). + 4. During initial configuration, the solution creates a default administrator user in the [Amazon Cognito](https://aws.amazon.com/cognito) user pool and sends an account creation email to the email address you provide. The Cognito user pool manages user access to the web console, the REST API, the CLI, and the MCP Server. @@ -33 +33 @@ The high-level process flow for the solution components deployed with the AWS Cl - 5. The containers use an [Amazon Linux 2023](https://aws.amazon.com/linux/amazon-linux-2023/) base image with the [Taurus](https://gettaurus.org/) load testing framework installed. Taurus is an open-source test automation framework that supports JMeter, K6, Locust, and other testing tools. The container image is [Open Container Initiative](https://opencontainers.org/) (OCI) compliant and hosted by AWS in an [Amazon Elastic Container Registry](https://aws.amazon.com/ecr) (Amazon ECR) public repository. For more information, refer to [Container image customization](https://docs.aws.amazon.com/solutions/latest/distributed-load-testing-on-aws/container-image.html). + 5. [Amazon API Gateway](https://aws.amazon.com/api-gateway) invokes [AWS Lambda](https://aws.amazon.com/lambda) microservices that provide the business logic to manage test data and run the tests. @@ -35 +35 @@ The high-level process flow for the solution components deployed with the AWS Cl - 6. A web console powered by [AWS Amplify](https://aws.amazon.com/amplify) deploys into an S3 bucket configured for static web hosting. + 6. The microservices interact with Amazon S3, [Amazon DynamoDB](https://aws.amazon.com/dynamodb), and [Amazon EventBridge](https://aws.amazon.com/eventbridge) to store test scenario details and manage test schedules. When you schedule a test to run at a future time or on a recurring interval, the microservices create an EventBridge Scheduler schedule that invokes the microservice at the scheduled time. @@ -37 +37 @@ The high-level process flow for the solution components deployed with the AWS Cl - 7. [Amazon CloudFront](https://aws.amazon.com/cloudfront) provides secure, public access to the solution’s website bucket contents. + 7. To run a test, the microservices invoke [AWS Step Functions](https://aws.amazon.com/step-functions), which orchestrates the test execution. @@ -39 +39 @@ The high-level process flow for the solution components deployed with the AWS Cl - 8. During initial configuration, the solution creates a default administrator role (IAM role) and sends an access invite to a customer-specified user email address. + 8. EventBridge rules route Amazon ECS task and Step Functions failure events to a failure handler Lambda function. @@ -41 +41 @@ The high-level process flow for the solution components deployed with the AWS Cl - 9. An [Amazon Cognito](https://aws.amazon.com/cognito) user pool manages user access to the console, the distributed load tester API, and the MCP Server. + 9. Step Functions launches [Amazon Elastic Container Service](https://aws.amazon.com/ecs) (Amazon ECS) tasks on [AWS Fargate](https://aws.amazon.com/fargate) in each AWS Region you selected. @@ -43 +43 @@ The high-level process flow for the solution components deployed with the AWS Cl - 10. After you deploy this solution, you can use the web console or APIs to create and run test scenarios that define a series of tasks. + 10. Each task runs within an [Amazon Virtual Private Cloud](https://aws.amazon.com/vpc) (Amazon VPC) in the selected Region. @@ -45 +45 @@ The high-level process flow for the solution components deployed with the AWS Cl - 11. The microservices use this test scenario to run ECS tasks on Fargate in the specified Regions. + 11. Load testing container uses an [Amazon Linux 2023](https://aws.amazon.com/linux/amazon-linux-2023/) base image with the [Taurus](https://gettaurus.org/) test automation framework installed. Taurus executes your JMeter, K6, Locust, or Single HTTP Endpoint test. For details on how each test framework is provisioned, refer to [Testing framework provisioning](./back-end.html#framework-provisioning). The ALB + ECS option will use the web host container. The container images are hosted by AWS in an [Amazon Elastic Container Registry](https://aws.amazon.com/ecr) (Amazon ECR) public repository. @@ -47 +47 @@ The high-level process flow for the solution components deployed with the AWS Cl - 12. When the test completes, the solution stores results in S3 and DynamoDB and logs output in [Amazon CloudWatch](https://aws.amazon.com/cloudwatch). + 12. Each Fargate task writes its per-Region test results to Amazon S3 and emits logs to [Amazon CloudWatch](https://aws.amazon.com/cloudwatch). When all Regions complete, the microservices aggregate the results in DynamoDB. @@ -49 +49 @@ The high-level process flow for the solution components deployed with the AWS Cl - 13. If you enable the live data option, the solution sends CloudWatch logs from the Fargate tasks to a Lambda function during the test for each Region where the test runs. + 13. If you enable the live data option, a Lambda function receives CloudWatch logs from Fargate tasks during the test. @@ -51 +51,3 @@ The high-level process flow for the solution components deployed with the AWS Cl - 14. The Lambda function publishes the data to the corresponding topic in [AWS IoT Core](https://aws.amazon.com/iot-core) in the Region where the main stack was deployed. The web console subscribes to the topic and displays real-time data while the test runs. + 14. The Lambda function publishes the logs to a topic in [AWS IoT Core](https://aws.amazon.com/iot-core) in the Region where the main stack is deployed. The web console subscribes to the topic to display real-time metrics while the test runs. + + 15. _(Optional CLI access)_ Users can install the DLT command-line interface (CLI) locally to interact with the solution from their terminal. The CLI authenticates through Cognito and calls the REST API directly, enabling scripted automation and CI/CD integration. @@ -57 +59 @@ The following steps describe the optional MCP Server integration for AI-assisted - 15. An MCP client (AI development tool) connects to the [AWS AgentCore Gateway](https://aws.amazon.com/bedrock/agentcore/) endpoint to access the Distributed Load Testing solution’s data through the Model Context Protocol. AgentCore Gateway validates the user’s Cognito authentication token to ensure authorized access to the MCP server. + 16. An MCP client (AI development tool) connects to the [Amazon Bedrock AgentCore Gateway](https://aws.amazon.com/bedrock/agentcore/) endpoint to access the Distributed Load Testing solution’s data through the Model Context Protocol. AgentCore Gateway validates the user’s Cognito authentication token to ensure authorized access to the MCP Server. @@ -59 +61 @@ The following steps describe the optional MCP Server integration for AI-assisted - 16. Upon successful authentication, AgentCore Gateway forwards the MCP tool request to the DLT MCP Server Lambda function. The Lambda function returns the structured data to AgentCore Gateway, which sends it back to the MCP client for AI-assisted analysis and insights. + 17. Upon successful authentication, AgentCore Gateway forwards the MCP tool request to the DLT MCP Server Lambda function. The Lambda function returns the structured data to AgentCore Gateway, which sends it back to the MCP client for AI-assisted analysis and insights. @@ -61 +63 @@ The following steps describe the optional MCP Server integration for AI-assisted - 17. The Lambda function processes the request and queries the appropriate AWS resources (DynamoDB tables, S3 buckets, or CloudWatch logs) to retrieve the requested load testing data. + 18. The Lambda function processes the request and queries the appropriate AWS resources (DynamoDB tables, S3 buckets, or CloudWatch logs) to retrieve the requested load testing data.