All about Cloud, mostly about Amazon Web Services (AWS)

How does Qwiklabs Provision Accounts?

 2017-05-08 /  431 words /  3 minutes

I’ve used QwikLabs several times now. AWS Training uses it for hands-on exercises and the Bootcamps at Re:Invent. I’ve used some of their free introductory labs on AWS services which are worth investigating and some of the paid labs as preparation for AWS certifications. When you use QwikLabs, you are given an account number and credentials allowing you to login to an account but how do they do that? This post explains one approach.

Amazon announced AWS Organizations back on November 29th 2016 (https://aws.amazon.com/about-aws/whats-new/2016/11/announcing-aws-organizations-now-in-preview/). AWS Organizations provides a way to create AWS Accounts with a simple API call. Before that time, AWS Account creations was a tedious manual process.

QwikLabs was working long before AWS Organizations were available though, and there is no way to delete accounts using the AWS Organizations API. AWS Accounts must still be deleted manually. There were a few ideas about how it worked.

Was QwikLabs doing Screen Scraping?

The manual process for creating AWS Accounts basically consisted of filling out some web pages and responding to an email. With some programming to simulate a web browser and monitoring an email account, the manual process could be automated.

This idea was soon discarded because first, that whole process takes a while, and QwikLabs provides these accounts quite quickly, and second, techniques like captchas are used to prevent automation.

Was QwikLabs using a secret API?

There wasn’t a public interface to create AWS Accounts, but maybe there was a secret API. Amazon may have given QwikLabs a way to create AWS Accounts programmatically that was not generally available.

Knowing what we do now about AWS Organizations, there almost certainly was a secret API available for some customers before the general announcement. This wasn’t how QwikLabs worked though.

So how does QwikLabs Provision Accounts?

During one of the AWS Training labs, I tried to find out how account was setup. I checked CloudFormation to check for deployed templates, but no CloudFormation templates were visible. I then changed the options to display deleted CloudFormation templates.

Not only did the CloudFormation template for the current lab appear in the list, but many, many other templates also appeared. These deleted templates were used in the past to create lots of other labs.

It appears that QwikLabs had a pool of pre-defined accounts. CloudFormation built out the necessary resources for the lab, then cleaned up the resources afterwards.

This technique is largely irrelevant now with the AWS Organizations API. Although a simple API call now creates real accounts from scratch, it was interesting to learn how to do it without using AWS Organizations.


Tags:  AWS  Amazon DynamoDB  Go  AWS Console
Categories:  AWS  Amazon DynamoDB

See Also

 Top Ten Tags

AWS (43)   Kinesis (9)   Streams (8)   AWS Console (5)   Go (5)   Analytics (4)   Data (4)   database (4)   Amazon DynamoDB (3)   Amazon Elastic Compute Cloud (EC2) (3)  


All Tags (173)

Disclaimer

All data and information provided on this site is for informational purposes only. cloudninja.cloud makes no representations as to accuracy, completeness, currentness, suitability, or validity of any information on this site and will not be liable for any errors, omissions, or delays in this information or any losses, injuries, or damages arising from its display or use. All information is provided on an as-is basis.

This is a personal weblog. The opinions expressed here represent my own and not those of my employer. My opinions may change over time.