I’ve used QwikLabs several times now. AWS Training uses it for hands-on exercises and the Bootcamps at Re:Invent. I’ve used some of their free introductory labs on AWS services which are worth investigating and some of the paid labs as preparation for AWS certifications. When you use QwikLabs, you are given an account number and credentials allowing you to login.
Amazon announced AWS Organizations back on November 29th 2016 (https://aws.amazon.com/about-aws/whats-new/2016/11/announcing-aws-organizations-now-in-preview/). AWS Organizations provides a way to create AWS Accounts with a simple API call. Before that time, AWS Account creations was a tedious manual process.
QwikLabs was working long before AWS Organizations were available though. There were a few ideas about how it worked.
Was QwikLabs doing Screen Scraping?
The manual process for creating AWS Accounts basically consisted of filling out some web pages and responding to an email. With some programming to simulate a web browser and monitoring an email account, the manual process could be automated.
This idea was soon discarded because first, that whole process takes a while, and QwikLabs provides these accounts quite quickly, and second, techniques like captchas are used to prevent automation.
Was QwikLabs using a secret API?
There wasn’t a public interface to create AWS Accounts, but maybe there was a secret API. Amazon may have given QwikLabs a way to create AWS Accounts programmatically that was not generally available.
Knowing what we do now about AWS Organizations, there almost certainly was a secret API available for some customers before the general announcement. This wasn’t how QwikLabs worked though.
So how does QwikLabs Provision Accounts?
During one of the AWS Training labs, I tried to find out how account was setup. I checked CloudFormation to check for deployed templates, but no CloudFormation templates were visible. I then changed the options to display deleted CloudFormation templates.
Not only did the CloudFormation template for the current lab appear in the list, but many, many other templates also appeared. These deleted templates were used in the past to create lots of other labs.
It appears that QwikLabs had a pool of pre-defined accounts. CloudFormation built out the necessary resources for the lab, then cleaned up the resources afterwards.
This technique is largely irrelevant now with the AWS Organizations API. Although a simple API call now creates real accounts from scratch, it was interesting to learn how to do it without using AWS Organizations.