I approached this simple task with the idea of shoshin, a Japanese term describing the deliberate lack of preconceptions often brought by experts. The idea is to approach the subject openly or with “beginner’s mind”. In the words of Shunryu Suzuki, “In the beginner’s mind there are many possibilities, but in the expert’s there are few.”. The spirit of this article is not to provide definitive and “correct” answers but to open up possibilities.

CloudTrail records events in AWS with the idea of auditability. Who deleted the database? Who changed the WAF rules? How was a Lambda invoked? Unfortunately, CloudTrail doesn’t tell us why! It is up to the organization to investigate and hopefully find the cause with a spirit of psychological safety. CloudTrail must be combined with other services to automate alerting when an event does happen. This article explores some solutions. The accompanying Terraform scripts do not produce complete, production-ready solutions but will give you ideas.

In this article, I work with the notion of a Security Group in AWS. These can be attached to network interfaces to provide stateful traffic protection. Security Group settings are important security details. How will we know if somebody changes a rule within the Security Group? CloudTrail will capture the event. How can we broadcast it? Most of the ideas in this article involve CloudTrail combined with other services. I even put forth one solution that does not involve CloudTrail at all. First, I will start with the simplest solutions and move towards the more complex. The Terraform scripts accompanying each example will set up the solution. All you need to do is make some Security Group changes! Throughout the article, I link to examples of messages and templates.

SIMPLE EVENTBRIDGE (Terraform)

The above diagram shows perhaps the simplest solution possible for alerting. I show several diagrams in this article. In each diagram, the person at the top left changes a Security Group rule. It doesn’t matter how they are doing it. Most of the time, the end will always be the “Security Center” concerned with maintaining Security Group settings.

Most solutions include EventBridge. It allows us to react to events, filter, transform, and send the result to a target. In this article, we will see EventBridge doing all of this.

In this first solution, I have set up an EventBridge rule to listen for a specific event in CloudTrail, “ModifySecurityGroupRules”. The rule simply passes the corresponding CloudTrail log to SNS. From there, SNS emails the Security Center. A sample of an email message shows us what CloudTrail logged including who made the change, when, and the change itself.

Sounds perfect! But some things are potentially missing. First, we don’t see the original state of the Security Group rule. Hopefully, that was logged somewhere. Next, we only see individual occurrences of the incident and not aggregations. A Security Group rule change is not the best example of an event that could happen regularly and would be better to see in aggregation (maybe a Lambda invocation?). Finally, this solution does not include a remediating action. None of the solutions in this article went so far as automatically remediating the change. Nevertheless, I envision the EventBridge rule also targeting a Systems Manager Automation. Are there other possibilities?

In summary, this simple solution is not perfect. As you will see, none of the solutions in this article are perfect. But they all have strengths and could be combined. The strength of this solution is its simplicity. It got the job done and is also fast. The Security Center knows somebody/something changed the Security Group rule.

SIMPLE CONFIG (Terraform)

AWS Config monitors your infrastructure for compliance with standards and optionally remediates problems. In this example, I utilize Config’s ability to record infrastructure state and alert when a Security Group rules change. The architecture is below.

This looks like the first example with CloudTrail swapped out for Config. Config does not need CloudTrail to record infrastructure changes. EventBridge listens for a configuration change and passes Config’s message to SNS for email delivery to the Security Center.

How is this different from the first solution (Simple EventBridge)? Look at a sample email message delivered to the Security Center. The message contains the state of the Security Group rule both before and after the change. In the example, the CIDR on an inbound rule changed from 10.0.3.0/24 to 10.0.5.0/24. AWS Config records the history of resources to provide this information. Optionally, we could specify a Systems Manager Automation to remediate the Security Group rule.

However, there are a couple of drawbacks compared to the first solution. First, the notification can take up to a minute to be delivered to the Security Center compared to a few seconds for the first solution. Second, AWS Config incurs a monetary cost depending on how you use the service. I am not using a Config rule which helps with the cost. If your organization already uses AWS Config, additional costs would be negligible.

Note that at this time, you cannot tell Config to focus on a specific Security Group (like the Security Group created by Terraform) but to record all of them. I use the EventBridge rule to filter events down to our specific Security Group. Therefore, only changes to Terraform’s Security Group are reported to the Security Center.

The next two solutions return to CloudTrail and its ability to deliver logs to CloudWatch.

METRIC FILTER (Terraform)

CloudTrail can deliver logs to S3 or CloudWatch. The cost of storing logs in CloudWatch compares unfavorably to S3 (depending on retention). So the next two solutions would be more appropriate if your organization already uses CloudWatch to store CloudTrail logs. Let’s look at the first CloudWatch architecture.

After log delivery to CloudWatch, this example uses a metric filter to inspect logs for our event (ModifySecurityGroupRules) to trigger an alarm. The alarm in turn sends a message to SNS. SNS sends an email to the Security Center which can look at the logs for details.

Note the sample email message. The information focuses less on the CloudTrail log and more on the alarm itself. It does not present the Security Center with immediate information. The fact may or may not be important as they need to investigate regardless. In any event, this is certainly a step down from our previous solutions.

Moreover, it can take a few minutes after the event for the email to be delivered to the Security Center. The slow delivery of CloudTrail logs to CloudWatch is not ideal for situations when time is critical. Is CloudTrail log delivery to S3 a bit quicker? We will see later.

Finally, using metric filters is more appropriate for detecting events in aggregate. Again, the example of using Security Group rule changes may not be the best use case.

These drawbacks do not make this solution my favorite for this situation. But remember my intent of ‘beginner’s mind’. We can put this solution in our back pocket for a better fit in the future. Let’s take a look at the second CloudWatch solution.

LOG INSIGHTS (Terraform)

I experimented with CloudWatch Log Insights to expose any special characteristics to take advantage of. Let’s see how it worked.

The idea behind this solution is to use CloudWatch Log Insights to extract information from the CloudTrail logs. With Log Insights, I could query only the information I needed. I realized this would be a ‘pull-based’ solution. Something should execute the Log Insights query regularly to fulfill any need for time-sensitive updates. I created a Lambda function to initiate the query and retrieve the results. What did I find?

This solution is incomplete as I am not delivering a message to a Security Center. I needed more automation. This fact causes this solution to become a bit more brittle and monetarily expensive. The Lambda, written in Python, sends a query to Log Insights. The response from the query is technically JSON but not optimally designed for further processing. Moreover, I want the query to print JSON objects, not just individual field values. This would make the results more adaptable to specific situations. Log Insights appears not to provide this possibility (please let me know if I’m wrong). In conclusion, Log Insights is more appropriate for ad hoc use.

This solution initially showed potential but suffers from issues. Let’s move away from CloudWatch.

ATHENA AND QUICKSIGHT (Terraform)

This solution introduces the possibility of visual reporting as an alternative (or complement) to email for the Security Center. It takes advantage of Amazon QuickSight and it’s native integration to Amazon Athena.

The Terraform script sets up this solution, however, you need to sign up for QuickSight which is not free after the initial trial month. The README in the GitHub Terraform repository contains more details on the cost and additional setup.

The architecture results in a Quicksight table on a dashboard that can be refreshed on a schedule. The dashboard looks like below.

I chose to display a few fields: the time of the event, the name of the event, the IAM user who made the change, and details of the Security Group state. I instruct Quicksight to filter for our familiar event, ModifySecurityGroupRules. The information is extracted from CloudTrail logs delivered to S3 by Amazon Athena. Quicksight uses Athena as a data source. When the dashboard is refreshed, Athena queries S3. We can do more with Quicksight than create tabular data. I will leave that to others and their imaginations.

How does this compare to other solutions? CloudTrail takes a few minutes to deliver logs to S3 making it the slow link in the data flow. As with the metric filter solution, this solution alone may only be appropriate for aggregate information. Finally, Quicksight incurs an additional monetary cost. Nevertheless, this complements another quicker solution (Simple Config?). If your organization already uses Quicksight the extra cost is negligible. The solution is highly customizable.

SYSTEMS MANAGER OPSCENTER (Terraform)

OpsCenter in Systems Manager is a newer AWS service built for an organization’s Operations team to monitor and remediate specific infrastructure issues. OpsCenter ingests OpItems created by various means. This solution creates an OpsItem and sends an email to the Security Center.

Operations personnel can view OpsItems on the console and generate reports. In addition, they can set up automated remediations. OpsCenter will even recommend remediations. I didn’t go as far as to trigger a remediation.

This solution uses EventBridge to generate the OpsItem and deliver a message to SNS. The first EventBridge rule shows off some of the service’s power by transforming a CloudTrail log into an OpsItem. The content of files sample_eventbridge_event_message.json, sample_eventbridge_input_path.json, and sample_eventbridge_input_path.json in the Terraform GitHub repository is involved with transformation. The first file is the Cloudtrail log, the second is a mapping between fields in the CloudTrail log and the placeholders in the third file which defines the structure of the OpsItem. EventBridge delivers the OpsItem to OpsCenter.

The second EventBridge rule listens for an OpsItem Create event and publishes a message to SNS. SNS sends an email to the Security Center. A sample of the email shows a message geared towards the OpsItem Create event itself but is configurable to some extent to contain information from the original CloudTrail log.

The speed of event delivery to the Security Center is comparable to the Simple EventBridge solution, a few seconds. Similarly, this solution is geared towards individual occurrences of events. The monetary cost primarily consists of running OpsCenter. Again, if you already use OpsCenter the extra cost is minimal.

CONCLUSION

In this article, I expanded on a simple premise, “How do we monitor an event reported by CloudTrail”? AWS offers many possibilities and this article is by no means exhaustive. Is this an advantage or should AWS be more explicit about what you can do? I tend to favor the former. I compare the characteristics of several approaches. The comparisons show trade-offs. We can decide for ourselves which direction(s) to choose. This comes at the expense of a steeper learning curve.

Most importantly, I wanted to share my spirit for exploration and experimentation. With its sheer breadth, AWS affords many opportunities for anybody choosing to partake and discover. Thank you for taking the journey with me!

Picking up from Learning Quantum Computing, I continue chronicling my learning journey through quantum computing.

This post serves two purposes. First, I had a personal a-ha moment while manually working through the math to find the resulting statevector of a simple circuit. Namely, how to correctly and consistently compute tensor products of unitary matrices. Second, in association with that moment, I investigated the ramifications of how one may order the qubits in a circuit.

In this post, I will be working with the two similar but slightly different circuits shown here:

The difference resides in the order of the qubits. The first qubit, q0, is on top in the first diagram and on bottom in the second. Why is this important? In all of my learning resources, except one, the first qubit is on top. The exception insisted on putting it at the bottom. As a beginner, the situation bothered me. How could I reconcile this in my mind? Stay tuned.

First Circuit

Let's start by examining the first circuit. The circuit has no special significance (that I know of). It is simple enough to demonstrate what I learned.

As stated, it is the qubit order I see in most learning resources and diagramming tools: top to bottom. In this diagram, q0 is the first qubit, q1 is the second, and q2 is the third. I want to find the resulting statevector of this circuit. The correct answer depends on correctly defining the intermediate unitary operations.

I placed a barrier down the middle of the diagram to cleanly separate the operations. The operations before the barrier may be considered to be executed simultaneously. They consist of a Pauli-Z gate on q0, a Hadamard gate in q1, and no operation on q2. The "no operation" can be represented mathematically by an identity gate. To consider the effect of these simultaneous operations on the circuit we need to take a tensor (Kronecker) product of including Z, H, and I (the identity operation). One might go ahead and do this:

This will eventually lead to the wrong statevector. The correct product is:

How do we keep this straight? Remember that the system's initial state is |000> where the rightmost digit represents the first qubit (q0). The order of arguments in the tensor product is the same from right to left. This was my a-ha moment.

How about the effective operator to the right of the barrier? This time we have a multi-qubit operation, the CNOT gate. The operation on that side of the barrier is:

Based on the previous IHZ operation this seems to make sense, the operation on q0 is the identity matrix and it is the righthand argument. Following the math through from the initial state, we get a final statevector of:

This is the correct result. The result makes intuitive sense with the only possible states being |000> and |110>. Qubit q0 only had a phase flip and qubits q1 and q2 are entangled in a Bell state. All we had to do was remember the correct ordering of the operators.

Second Circuit

Things get interesting when we reverse the numbered order of the qubits:

Now q0 is on the bottom. Again we start from the initial |000> state. Let's look at the resulting statevector first before we look at the math that gets us there:

There might be momentary shock due to the different result but again it is easy to see why this makes sense. The possible states of the system are |000> and |011. The first two qubits, q0 and q1, are in a Bell state while the third qubit q2 only experienced a phase flip. The result is different from the first circuit but consistent.

Evaluating the circuit, we start to the left of the barrier just as we did previously. This time, the ZHI tensor product is the correct operator:

Following the principle according to the ordering of qubits I discovered, we should expect the effective operator after the barrier to be:

This looks good but wait, that isn't the same CNOT matrix we used in the first circuit. Here are the two CNOT matrices used in the first and second circuits, respectively:

How am I going to remember which to use? The rule of thumb states that if the first qubit in CNOT is the control, use the first matrix. Otherwise, if the first qubit is the target, use the second matrix. Yuk. I wasn't satisfied. A formal mathematical derivation would be better. Moreover, what about the following situation?

The CNOT operator to be applied after the barrier now involves all three qubits! There is no tensor product to express the operator. Of course, we may imagine more complex situations with more qubits involved.

To answer my questions, I found the following Stack Exchange threads to be helpful:

https://quantumcomputing.stackexchange.com/questions/5179/how-to-construct-matrix-of-regular-and-flipped-2-qubit-cnot

https://quantumcomputing.stackexchange.com/questions/4252/how-to-derive-the-cnot-matrix-for-a-3-qubit-system-where-the-control-target-qu

Memorizing multi-qubit matrices will lead me astray. I need to formulate the correct matrix based on the situation.

Conclusion

Strictly speaking, a practitioner may rely on simulators to derive statevectors and the operators needed to achieve them. I always want to know why something works so doing the math is valuable. I hope this post was thought-provoking.

Quantum computing technology is poised to revolutionize the way we solve complex problems beyond the grasp of traditional computers. The technology grows daily as computers become larger and quantum algorithms more sophisticated. Quantum computers will profoundly influence Artificial Intelligence, cryptography, and optimizations and aid scientific discovery such as predicting how a protein will fold.

Recently I began a journey to learn the basics of quantum computing. Along the way, I evaluated many educational resources. I want to share my findings so far.

Learning quantum computing is a challenge in part because it is different from current, traditional computing. No matter how big or small, today's computing devices all operate on electrical circuits. Quantum computers at their core do not. They exploit the principles of quantum physics such as superposition and entanglement to provide much more efficient computations. Quantum computers will not replace today's computers but complement them with their ability to solve complex problems relatively quickly.

In this article, I outline the main areas one may study to get started designing quantum algorithms along with resources containing information I found useful. No single source of information is exhaustive. Moreover, different resources offer varied perspectives. The different angles complement one another and fortunately, rarely contradict.

Areas of Study

I broke down this article into the following areas of study for the beginner:

• Overview of quantum physics

• Necessary Math

• Explanation of qubits and gates

• Programming languages and libraries

• Running on simulators and quantum hardware

I will cover more advanced topics such as algorithms, machine learning, and quantum cryptography in later articles. I found it essential to become comfortable with these concepts before I paused to write an article.

Overview of quantum physics

The word 'quantum' has grown in popularity. It is used as an adjective for many ideas and products. Of course, not everything on the market has an association to the physics. Quantum computing has certainly earned the privilege to use the word as the computational model is based on quantum physics.

I came into my study of quantum computing with a layman's understanding of the physics. I have read many popular books on the subject and am intrigued by the philosophical implications. I have a science background insofar as I have an engineering degree. So I felt comfortable with the concepts.

Many physical concepts in quantum physics have no everyday counterpart to help explain their behavior. They make no sense on the surface yet they predict the behavior of the natural world brilliantly. Most resources I digested give a brief overview of superposition and entanglement but assume you are comfortable moving ahead.

I want to single out one particular resource that dedicates much time to introducing the physics. Udemy offers a course entitled QC101 Quantum Computing & Intro to Quantum Machine Learning that gently introduces superposition and quantum measurements using photon polarization. They even encourage the reader to purchase inexpensive equipment as an aid to observing the strangeness of quantum physics firsthand. It's a great introduction to prepare you without getting into the weeds. The video course was one of the first sources I used to learn quantum computing and I will mention it again later.

Wait though, do you need to understand these physical concepts to do quantum computing? I believe the answer is a definite yes. Even if the concepts defy common sense, they need to be accepted by the student as they drive to the very heart of understanding quantum computing.

Necessary math

It is impossible to do anything useful in quantum computing without having the mathematical background for support. Luckily, there are many resources out there to teach you the required concepts. As you move deeper into quantum computing more advanced math is necessary.

This might sound dreadful for many readers. But there is no way around it. However, I believe anybody who had an aptitude for math in high school can do well with a little patience. Before starting, I hadn't done any math since college and most of the required math for quantum computing was new to me. With exposure to the same ideas from different resources, the importance of the concepts gels. I also find the math beautiful.

The essential math requirements to start are linear algebra, Boolean algebra, probability, and complex numbers. All of these areas intersect at quantum computing. Emphasize linear algebra. It goes far beyond anything learned in high school.

Just as the resources I digested varied on the depth of quantum physics's basics, they also greatly vary on what they assume you already know about the math. Consequently, some resources were more useful to me at the very beginning. Then I started to become comfortable with other resources that picked up the pace. Therefore, I will introduce sources based on points on the learning curve.

The aforementioned Udemy course QC101 Quantum Computing & Intro to Quantum Machine Learning should be near the beginning for people learning the required math. The author patiently and gently introduces all the essential requirements listed above. Take good notes as the information grows over time. The points learned here will be reinforced by other sources.

I found a wonderful book called Essential Mathematics for Quantum Computing: A beginner's guide to just the math you need without needless complexities by Leonard Spencer Woody III. It leans in a little deeper. Among the subjects are: vector spaces, linear independence and transformations, linear basis, orthonormality, matrices, complex numbers, Eigenvectors and Eigenvalues, types of operators (Hermitian/Unitary among others), Bra-ket notation, and matrix decomposition. Explaining all these concepts in a book is daunting but the author manages it well. I understood most of it but had to reread many sections to let it sink in.

From there, other resources I used assumed a bit of prior knowledge. Armed with knowledge from the previous resources, these reinforced what I had already learned and led me even deeper. IBM is a great resource for everything quantum computing. They provide a comprehensive educational track. I want to point out their introductory course Basics of quantum information that presents quantum computing concepts with a heavy emphasis on math. The math is more challenging than other resources but worth every second. The instructor punctuates concepts with interesting mathematical proofs. Again, it assumes some prior math knowledge but you should have it by this point.

Personally, the math required for quantum computing is the most challenging aspect of learning. I still struggle with some concepts. I believe they will eventually come to me over time. I find it helpful that many resources of learning tend to repeat many of the same concepts.

Explanation of qubits and gates

The basic unit of information in common (classical) computing is the bit. In quantum computing, qubits hold information. Gates manipulate bits in classical computing to produce desired outcomes. Gates (in gate-based quantum computers) are also used in quantum computing to manipulate qubits. However, they are vastly different. The most common type of quantum computers are gate-based thus almost all sources of information relate to that paradigm.

At the least, most resources I encountered and studied explain the basics of quantum gates. Again, resources vary in depth of explanation. Some are more suitable for beginners than others. I found an impressive introduction to qubits and gates in the LinkedIn Learning course Understanding Quantum Computing. The instructors seem to anticipate any difficulties users might have in understanding the concepts. The Bloch Sphere is a powerful tool to understand the state of a qubit. But it can be difficult to explain. The authors take a novel approach to teaching the Bloch Sphere by using decorated beach balls. They proceed to use the balls to introduce how each gate affects a qubit. It is compelling and worth beyond the price of the platform.

I experienced some very artful and nuanced ways of explaining quantum gates. For instance, check out the website Quantum Country, a must-have resource for all beginners. The website contains a series of articles, the first being 'Quantum computing for the very curious'. The article gradually builds up the reader's knowledge of gates by presenting them within the context of related quantum concepts. The articles are extremely well-written and employ a learning technique called 'spaced-repetition' to embed concepts in the reader's mind.

A successful quantum developer knows how to use quantum gates to build up 'circuits'. Similar to classical computing, these circuits run algorithms to obtain desired results. Resources for learning algorithm design are beyond the scope of this article, however, I will cover them in the future. I still have more to learn!

Programming languages and libraries

In this article up to now, my audience (probably mostly software professionals) has learned subjects in which they may not be too familiar. Let's take a moment to talk about something we all love, programming.

How do mere mortals instruct quantum computers what to do? After all, we know in essence they do not use electrical circuits for computations. Therefore, can we use traditional programming languages? The answer is yes. Quantum circuits can be coded in a variety of popular languages and platforms.

The code we write requires transpilation to an assembly language understood by quantum computers. A popular open standard assembly language understood by many quantum platforms is OpenQASM. Fortunately, established libraries will transpile for you.

Among the popular higher-level languages are Python and Q#. Python users can choose between a few libraries but the most popular is QIskit from IBM. Most sources I reviewed provide code examples using Qiskit. Another option for Python is Cirq from Google. For those who want to develop against the Azure Quantum Development Kit, Q# will be the language of choice. A couple of sources I encountered provide introductory tutelage in Q#, the often mentioned QC101 Quantum Computing & Intro to Quantum Machine Learning and a Pluralsight course Quantum Computing: Getting Started with Q#.

Amazon Braket is a service in the Amazon Web Services cloud allowing access to a variety of quantum vendors. We will talk about Braket later. For now, I want to mention the service has its own Python library Amazon Braket Python SDK. The beauty of this library is that it will transpile to the necessary assembly languages required by the devices Braket supports. AWS maintains a library to convert Qiskit to the Amazon Braket Python SDK.

Up to now, I have used Qiskit for creating quantum circuits (I did dabble in the Amazon Braket Python SDK, too). Most educational sources use Qiskit so it has been a natural choice. Another incredibly useful tool for me is Jupyter Notebooks. They allow Python users to create inline visualizations of quantum circuits, Bloch Spheres, histograms, and statevectors.

Running on simulators and quantum hardware

The prospect of executing on actual quantum hardware helped spur me to keep learning. When I started my studies, I believed renting time on an actual device would only be possible for researchers or people with money to burn. It turns out, anybody can execute quantum circuits on real hardware for no cost or little cost.

However, quality tends to correlate with price. Qubits are highly sensitive to external disturbance, therefore, all executions deal with noise that shows up in results. More expensive quantum processing often has more sophisticated noise-reducing technology.

Furthermore, if one needs to develop a probability distribution they will need to repeat the circuit over and over (the increase of 'shots'). This also contributes to processing costs.

Libraries and platforms provide quantum simulators to test circuits before execution on actual physical devices. For learning, this is perfect as initial experimentation usually involves a low number of qubits. If you are using many qubits, say 50, a simulator will not help as such a circuit will be too compute intensive.

I perform most of my live executions on IBM quantum computers. They provide a generous amount of free processing time (10 minutes per month) on a subset of their fleet of hardware. Again, great for learning. Go to the IBM Quantum Platform to sign up. The documentation will show you how to run your circuit. In my experience, most submitted jobs will run within an hour. As I already mentioned, IBM also provides educational resources in the form of video courses. All of this is tough to beat.

Earlier I mentioned Amazon Braket as a service allowing access to a variety of quantum computers. The list of available vendors and devices changes periodically. This makes it a great way to experiment with different architectures. Whether or not you use Braket, I encourage readers to pick up Quantum Computing Experimentation with Amazon Braket: Explore Amazon Braket quantum computing to solve combinatorial optimization problems by Alex Khan. While the examples are specific to Braket, the author touches on the general types of quantum computers such as gate-based, annealing-based, and neutral atom-based. He provides a chapter exclusively on quantum annealing. Most valuable to me are the nuggets of wisdom for dealing with the idiosyncracies of individual devices. It is good general information. I will continue to use this book in my further studies as it is rich in information.

Running circuits on real quantum hardware is thrilling even if the circuits are only learning examples. So far, I have picked valuable information that can only be earned by actually doing. As time passes, devices are getting bigger (more qubits) and more reliable (less noise). Hopefully, it will lead to more economical processing.

Conclusion

I hope this article provides direction to those eager to learn quantum computing. Subsequent articles will document my journey. Each day, the material continues to become more challenging. My achievements will be harder earned. In the big picture, I am a novice and that's perfect for now.