#announcements - November 2018

737 messages

This channel is for workspace-wide communication and announcements. All members are in this channel.
Archive: https://archive.sweetops.com

November 2018
G
GreetBotabout 8 years ago
hey everyone give a warm welcome to @solairerove! Good to have you here ☺️
Maarten van der Hoef
Maarten van der Hoefabout 8 years ago
hi @solairerove what brings you here?
G
GreetBotabout 8 years ago
hey everyone give a warm welcome to @inactive! Good to have you here ☺️
Maarten van der Hoef
Maarten van der Hoefabout 8 years ago
Hi @inactive, what are you working on ?
inactive
inactiveabout 8 years ago
Hi Maarten
inactive
inactiveabout 8 years ago
I am currently working with Terraform. I found one of your modules and one thing led to another and eventually got me to join your Slack channel
G
GreetBotabout 8 years ago
hey everyone give a warm welcome to @onzyone! Good to have you here ☺️
onzyone
onzyoneabout 8 years ago
hello everyone 👋
Maarten van der Hoef
Maarten van der Hoefabout 8 years ago(edited)
Ah there are a few who can help you out in case you get stuck, especially in PST working hours 🙂
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
welcome @solairerove @inactive @onzyone
G
GreetBotabout 8 years ago
hey everyone give a warm welcome to @andreveelken! Good to have you here ☺️
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
if you have questions or need help, just ask
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
hey @andreveelken
andreveelken
andreveelkenabout 8 years ago
hey
onzyone
onzyoneabout 8 years ago
I am looking for a simple module that I can use to create CNAMES for AWS resource endpoints
onzyone
onzyoneabout 8 years ago
I did notice that there is one, but it also creates a cert ...
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
that one is to request an SSL cert and validate using DNS
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
take a look at these:
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
terraform-aws-route53-alias is to create aliases to existing AWS resources
Maarten van der Hoef
Maarten van der Hoefabout 8 years ago
Aliases are the way to go 🙂 saves the requester another request.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
yes
onzyone
onzyoneabout 8 years ago
interesting ...
onzyone
onzyoneabout 8 years ago
I have always used cnames 😄
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
onzyone
onzyoneabout 8 years ago
but if there is a better way of doing it ... I am open to try
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
better way is not to use CNAMEs as @Maarten van der Hoef pointed out
onzyone
onzyoneabout 8 years ago
ya it is for a Postgres rds instance right now
onzyone
onzyoneabout 8 years ago
so the rds-cluster module will work well too 😄
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
if you have already AWS resources, you can always create an ALIAS or a new hostname in a diff DNZ zone to point to a resource
onzyone
onzyoneabout 8 years ago
this is perfect
onzyone
onzyoneabout 8 years ago
what is the recommended way for sending in the zone_id?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago(edited)
you only need CNAME in prob just one case: you have a domain name (e.g. <http://example.com|example.com>) in let’s say GoDaddy, and you want to point it to a diff domain let’s say <http://prod.example.net|prod.example.net> in Route53
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
zone_id you can find in Route53
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
or, if you create it in TF, you already have that ID as the output
onzyone
onzyoneabout 8 years ago
ya ... it is already in Route53, i can get it via cli too
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
and you are right you want to use a new hostname for an RDS instance. Because if you use just aws_db_instance.default.address and give it to the application, next time you recreate the instance, the endpoint will change (and the app crash)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
with a dedicated hostname (e.g. <http://postgres.example.net|postgres.example.net>), even if you recreate the instance, the hostname will be updated as well to point to the new instance
onzyone
onzyoneabout 8 years ago
ya that is what I was driving to 🙂 ...
onzyone
onzyoneabout 8 years ago
this is the first time that I have used TF ... but it is a great tool so far
onzyone
onzyoneabout 8 years ago(edited)
and cloudposse github is great too!!! 🙇
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
yea, everybody here loves it 🙂
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
let’s move to #terraform
G
GreetBotabout 8 years ago
hey everyone give a warm welcome to @dustinvb! Good to have you here ☺️
S
SweetOpsabout 8 years ago
Have you signed up for our Newsletter? It covers everything on our technology radar. Receive updates on what we're up to on GitHub as well as awesome new projects we discover.
G
GreetBotabout 8 years ago
hey everyone give a warm welcome to @btai! Good to have you here ☺️
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 8 years ago
hey @dustinvb! check out the #release-engineering channel - that's probably the most relevant
joshmyers
joshmyersabout 8 years ago
1.9billion valuation!? Welp
mmarseglia
mmarsegliaabout 8 years ago
has anyone worked on multi-region S3 website architecture in Terraform, similar to what's documented here https://read.iopipe.com/multi-region-s3-failover-w-route53-64ff2357aa30
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
@mmarseglia sounds interesting, but no, we did not work on that
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
sounds like you need to create a) buckets with cross--region replication; b) health checks for buckets and CloudFront; c) Failover policy in Route53
mmarseglia
mmarsegliaabout 8 years ago
i tried doing some of it but got stuck on the s3_bucket_policy
mmarseglia
mmarsegliaabout 8 years ago
i have a module that creates the buckets. to do that, i had to pass two providers each configured for a different region.
mmarseglia
mmarsegliaabout 8 years ago
but I got stuck on the policy because it doesn't accept provider as a parameter. so it tries to create a policy using the default provider, which is in a different region than the replica bucket
mmarseglia
mmarsegliaabout 8 years ago
i'd have to get some code available to fully illustrate, i guess.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago(edited)
looks like you need just one policy
mmarseglia
mmarsegliaabout 8 years ago
oh good!
mmarseglia
mmarsegliaabout 8 years ago
i think i see a way forward
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
Yea the policy should be for the same provider as the source bucket
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)about 8 years ago
Both source and destination buckets must have versioning enabled.

The source and destination buckets must be in different AWS Regions.

Amazon S3 must have permissions to replicate objects from the source bucket to the destination bucket on your behalf.
G
GreetBotabout 8 years ago
hey everyone give a warm welcome to @Kene Nnamani! Good to have you here ☺️
Kene Nnamani
Kene Nnamaniabout 8 years ago
I am so excited to be here
Kene Nnamani
Kene Nnamaniabout 8 years ago
Just a quick question. What could cause the Cloudfront loogging to S3 to abruptly stop? I have checked that the S3 has write permission enabled. Also, there were old logs from the cloud front in the S3 but not new ones.
Maarten van der Hoef
Maarten van der Hoefabout 8 years ago
Hi @Kene Nnamani
Maarten van der Hoef
Maarten van der Hoefabout 8 years ago
So the cloudfront logs are not flushed in real time, I forgot how what the timeframe is in which the logs will be flushed to s3. So if a particular endpoint is not receiving enough traffic it can take a while.
That could be one reason.
Maarten van der Hoef
Maarten van der Hoefabout 8 years ago
"Note, however, that some or all log file entries for a time period can sometimes be delayed by up to 24 hours. When log entries are delayed, CloudFront saves them in a log file for which the file name includes the date and time of the period in which the requests occurred, not the date and time when the file was delivered. "
Kene Nnamani
Kene Nnamaniabout 8 years ago
@Maarten van der Hoef thank you for your prompt response. The last logs from the cloudfront to the S3 buckets dates back to 2017 which makes me think that something is wrong.
Maarten van der Hoef
Maarten van der Hoefabout 8 years ago
haha, yes, that's not a normal delay 🙂
Maarten van der Hoef
Maarten van der Hoefabout 8 years ago
I'd use AWS Support for something like this, they can figure that out.
Maarten van der Hoef
Maarten van der Hoefabout 8 years ago
A few things you can do tho
Maarten van der Hoef
Maarten van der Hoefabout 8 years ago(edited)
Did logging stop or did traffic to the CF distribution stop
Maarten van der Hoef
Maarten van der Hoefabout 8 years ago
If you run apache bench against the cloudfront endpoint for a while you should see logs quite quickly normally
Kene Nnamani
Kene Nnamaniabout 8 years ago(edited)
Alright. I will go with your recommendations. But I do know that the traffic to the CF didn’t stop. However l, will run the Apache bench and also reach out to the AWS support.
Kene Nnamani
Kene Nnamaniabout 8 years ago
Thanks a lot
Maarten van der Hoef
Maarten van der Hoefabout 8 years ago
Sure, good luck!
G
GreetBotabout 8 years ago
hey everyone give a warm welcome to @tweetyix! Good to have you here ☺️
G
GreetBotabout 8 years ago
hey everyone give a warm welcome to @OScar! Good to have you here ☺️
OScar
OScarabout 8 years ago
@here I am trying to setup CloudTrail logs for several AWS accounts. I deployed the trail and bucket with my config using this terraform repo https://github.com/cloudposse/terraform-aws-cloudtrail-s3-bucket . Do I have to deploy via Terraform with each of the accounts? sorry, first time using CloudTrail...
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 8 years ago
Yes that’s accurate
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 8 years ago
If you check our root modules project on GitHub you’ll see some examples
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 8 years ago
Sorry - on phone so hard to link out
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Ramesh Kumar! Good to have you here ☺️
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Welcome Ramesh!
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @rolf! Good to have you here ☺️
U
Unknown Useralmost 8 years ago
There are no events this week
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
welcome @rolf 👍️
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
@OScar here are some examples for CloudTrail. We setup the bucket in a separate AWS audit account (so just a few people if any will have access to it)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
and then setup CloudTrail(s) for all other accounts (root, prod, staging, etc) https://github.com/cloudposse/terraform-root-modules/tree/master/aws/cloudtrail
OScar
OScaralmost 8 years ago
@Andriy Knysh (Cloud Posse) thank you, it looks like with the sample main.tf file on the root modules repo, we simply tell it to assume a role in order to deploy CloudTrail to that account as per your comment. Ok I will try this, thanks for your response!
OScar
OScaralmost 8 years ago
@Andriy Knysh (Cloud Posse) @Erik Osterman (Cloud Posse) One other question; I managed to see logs for multiple accounts in that same bucket! But the data logged is basic. It appears i need to further configure in order to see VPC logs, or other services and sending logs to the S3 bucket, is this done via CloudWatch SNS Topics? or am I way off?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago(edited)
use event_selector variable
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago

it looks like with the sample main.tf file on the root modules repo, we simply tell it to assume a role in order to deploy CloudTrail to that account
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
assuming roles is not a feature of the module nor CloudTrail. It’s how we login to AWS accounts using geodesic. You need to consider the root modules as examples of invocation (not using them verbatim)
OScar
OScaralmost 8 years ago
Thank you @Andriy Knysh (Cloud Posse) understood on not using root modules verbatim - i do appreciate the ability to assume a role since executing terraform under said role would help deploy the CloudTrail to that account…but totally understand your point. I am looking at the AWS:cloudtrail bucket events object now..
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
👍️
OScar
OScaralmost 8 years ago
@here whenever i use the variable kms_key_id from this location https://github.com/cloudposse/terraform-aws-cloudtrail/blob/master/variables.tf i get a terraform error.

Error: Error running plan: 3 error(s) occurred:

* module.cloudtrail.output.cloudtrail_id: Resource ‘aws_cloudtrail.default’ not found for variable ‘aws_cloudtrail.default.id’
* module.cloudtrail.output.cloudtrail_arn: Resource ‘aws_cloudtrail.default’ not found for variable ‘aws_cloudtrail.default.arn’
* module.cloudtrail.output.cloudtrail_home_region: Resource ‘aws_cloudtrail.default’ not found for variable ‘aws_cloudtrail.default.home_region’
OScar
OScaralmost 8 years ago
any thoughts?
catdevman
catdevmanalmost 8 years ago(edited)
Are you using this output immediately?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
sounds like a race condition
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
if you create the key in other module
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
you can test it by providing the key_id directly
OScar
OScaralmost 8 years ago
thank you @Andriy Knysh (Cloud Posse) let me try that now
OScar
OScaralmost 8 years ago
@Andriy Knysh (Cloud Posse) i think this is where the depends_on can be applied in terraform for cloudtrail module
OScar
OScaralmost 8 years ago
so that the key gets created first
OScar
OScaralmost 8 years ago
let me try that
catdevman
catdevmanalmost 8 years ago(edited)
If you have both the key creation in a module and this module you will need to use a depends on but you'll have to use a null_resource to do the connection (I believe until 0.12 is out and stable)
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Eric Gonzales! Good to have you here ☺️
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
hi @Eric Gonzales
OScar
OScaralmost 8 years ago
OScar
OScaralmost 8 years ago
@Andriy Knysh (Cloud Posse) checkout my entire code base here..
OScar
OScaralmost 8 years ago
I am still getting the error sadly
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
try terraform plan/apply -target=module.kms_key
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
to create the key first
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
if works, we’ll take a look at the race condition
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
and don’t use master for the module sources, pin to a release 🙂
OScar
OScaralmost 8 years ago
@Andriy Knysh (Cloud Posse) this worked! terraform apply -target=module.kms_key
OScar
OScaralmost 8 years ago
key is created
OScar
OScaralmost 8 years ago
i’ll do the other command now
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
👍️
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
(you need to update the description and alias for kms_key module)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
the other command could be just terraform apply (no need to use -target)
OScar
OScaralmost 8 years ago
Thanks @Andriy Knysh (Cloud Posse) to confirm, I created the CloudTrail and S3 Bucket successfully. The CloudTrail module does include the kms_key_id which I pasted prior to running terraform apply
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
👍️
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
you don’t need to paste anything though 🙂
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
terraform apply -target=module.kms_key will save the created resource into the state file
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
next, terraform apply will read the state file and see the created key and use the ID
OScar
OScaralmost 8 years ago
looks like my s3 bucket policy is not working…
OScar
OScaralmost 8 years ago
` module.cloudtrail_s3_bucket.module.s3_bucket.aws_s3_bucket.default: 1 error(s) occurred:

* aws_s3_bucket.default: Error putting S3 policy: MalformedPolicy: Policy has invalid resource
status code: 400, request id: B2B6570282B3F8D2`
OScar
OScaralmost 8 years ago
that is the message after i executed my last command
OScar
OScaralmost 8 years ago
MalformedPolicy is a new error that happened only after I used the kms_key_id in the cloudtrails module
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
so if you use kms_key_id = "", it works?
OScar
OScaralmost 8 years ago
actually if i omit the kms_key_id param for the cloudtrail module, the CloudTrail gets created
OScar
OScaralmost 8 years ago
if i use kms_key_id="" it does not throw and error
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
strange
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago(edited)
if you could not find why it does that, we’ll have to take a look and apply the code with the key
OScar
OScaralmost 8 years ago
so i also tried copying the key id from the web console and pasting it in the kms_key_id value, and that is when i got the policy error for the s3 bucket
OScar
OScaralmost 8 years ago
So for now, i’ll have to forgo using encryption 😞
OScar
OScaralmost 8 years ago
@Andriy Knysh (Cloud Posse) just to be clear, I am not using Chamber, just wanted to create the key in AWS to use for the cloudtrail module
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
yea I understand. We did not, at least recently, test the CloudTrail module with an external KMS key 😞 . I’ll have to apply your code and see what happens. Thanks for finding the issues @OScar
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
and let’s move to #terraform 🙂
Ramesh Kumar
Ramesh Kumaralmost 8 years ago
I am trying to create a codebuild project using bitbucket private repo using terraform, but when the project is created, on codebuild console, in source section, it shows the repo as public repo. However, I have used the private repo using Oauth
Ramesh Kumar
Ramesh Kumaralmost 8 years ago
#terraform anyone faced this issue before? or how to create the codebuild project for private repo using terraform..
Ramesh Kumar
Ramesh Kumaralmost 8 years ago
resource "aws_iam_role" "terraform" {
name = "terraform"

assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "codebuild.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
EOF
}

resource "aws_iam_role_policy" "terraform" {
role = "${aws_iam_role.terraform.name}"

policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Resource": [
"*"
],
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
]
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInterface",
"ec2:DescribeDhcpOptions",
"ec2:DescribeNetworkInterfaces",
"ec2:DeleteNetworkInterface",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups",
"ec2:DescribeVpcs"
],
"Resource": "*"
}
]
}
POLICY
}

resource "aws_codebuild_project" "terraform" {
name = "test-project"
description = "test_codebuild_project"
build_timeout = "5"
service_role = "${aws_iam_role.terraform.arn}"

artifacts {
type = "NO_ARTIFACTS"
}

environment {
compute_type = "BUILD_GENERAL1_SMALL"
image = "aws/codebuild/nodejs:6.3.1"
type = "LINUX_CONTAINER"

environment_variable {
"name" = "SOME_KEY1"
"value" = "SOME_VALUE1"
}

environment_variable {
"name" = "SOME_KEY2"
"value" = "SOME_VALUE2"
"type" = "PARAMETER_STORE"
}
}

source {
type = "BITBUCKET"
location = "https://rameshmimit@bitbucket.org/rameshmimit/puppet-module-puppet.git"
git_clone_depth = 1
auth {
type = "OAUTH"
}
}
}
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Nikola Velkovski! Good to have you here ☺️
Nikola Velkovski
Nikola Velkovskialmost 8 years ago
Hi everyone!
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Tee! Good to have you here ☺️
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
hey @Tee welcome
Tee
Teealmost 8 years ago
Thanks
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
@Ramesh Kumar we did not use bitbucket with CodeBuild, but here’s how we access private GitHub repos using CodePipeline/CodeBuild (by providing the OAuth token with permissions to access the private repos)
Ramesh Kumar
Ramesh Kumaralmost 8 years ago
@Andriy Knysh (Cloud Posse) thank you for replying. I have noticed, its not terraform issue. Its CodeBuild UI issue.
OScar
OScaralmost 8 years ago
@here this is more of a question around some best practices regarding deploying central logging for multi-account AWS environment. My question is: do I deploy a single bucket for all accounts? Or a bucket per environment?

So we have say:
Security_Test
Logging_Test

Security_Prod
Logging_Prod

What in your experience works best, if then all S3 bucket content needs to go into say Splunk anyway?
OScar
OScaralmost 8 years ago
this may be wrong, so I am looking to see how you’ve done it.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
that’s not a simple question @OScar, depends on many factors. How do you provision the resources for each account. How do you control security and access to the accounts. I would provision a bucker per account since it’s easier to deploy and destroy stuff in one account w/o affecting other accounts
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
on the other hand, CloudTrail logs feel like special 🙂 (security and audit reasons)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
so what we do with just CloudTrail logs, we use a separate audit account for the bucket (which only special people could access)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
we provision the bucket for CloudTrail logs in that audit account
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
and then provision CloudTrail(s) in the other accounts and point them to the bucket in audit
OScar
OScaralmost 8 years ago
@Andriy Knysh (Cloud Posse) good stuff, so the bucket would be created literally in its own account for that sole purpose it sounds like vs. say, in an existing “master” account?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
yes completely separate account
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
and you control what people can assume roles to access that account (admin or read-only)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
and here CloudTrail(s) for all other accounts pointing to the bucket in audit https://github.com/cloudposse/terraform-root-modules/blob/master/aws/cloudtrail/main.tf
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
and here how we control access to the account (add users to the groups) https://github.com/cloudposse/terraform-root-modules/blob/master/aws/iam/audit.tf
OScar
OScaralmost 8 years ago
@Andriy Knysh (Cloud Posse) awesome, I am going to follow these steps to specifically provision the audit account and its cloudtrail and s3 bucket
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Javier Moya! Good to have you here ☺️
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
welcome @Javier Moya!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago(edited)
We finally got some cloudposse stickers! PM me your mailing address if you want some 😃
Gonzalo Peci
Gonzalo Pecialmost 8 years ago
Welcome!
Gonzalo Peci
Gonzalo Pecialmost 8 years ago
@OScar we use a similar workflow to what @Andriy Knysh (Cloud Posse) explained, I believe its the "main" way for multi account
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Richard Pearce! Good to have you here ☺️
OScar
OScaralmost 8 years ago
@Gonzalo Peci thank you for confirming the approach, it is nice to know other folks agree!
OScar
OScaralmost 8 years ago
@Richard Pearce welcome to our group!
Richard Pearce
Richard Pearcealmost 8 years ago
thanks and greetings
Richard Pearce
Richard Pearcealmost 8 years ago
I was looking at https://github.com/cloudposse/terraform-null-smtp-mail do you have anything similar that can send slack messages ? 🙂
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @nian! Good to have you here ☺️
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
hi @Richard Pearce
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
for slack, I believe we don’t have anything for terraform
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
which we use in Docker containers to send Slack messages about build/deploy status from CI/CD pipelines
Richard Pearce
Richard Pearcealmost 8 years ago
thank you @Andriy Knysh (Cloud Posse) I will take a look.
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @RobH! Good to have you here ☺️
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
here is an example of a Codefresh pipeline step that sends a Slack message when the app gets deployed to staging
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
  send_slack_notification:
    title: Send notification to Slack channel
    stage: Deploy
    image: cloudposse/slack-notifier
    environment:
    - "SLACK_WEBHOOK_URL=${{SLACK_WEBHOOK_URL}}"
    - SLACK_USER_NAME=CodeFresh
    - "SLACK_ICON_EMOJI=:rocket:"
    - SLACK_FALLBACK=Deployed to Staging environment
    - SLACK_COLOR=good
    - SLACK_PRETEXT=${{CF_COMMIT_MESSAGE}}
    - SLACK_AUTHOR_NAME=Auto Deploy Robot
    - SLACK_AUTHOR_LINK=<https://cloudposse.com/>
    - SLACK_AUTHOR_ICON=<https://cloudposse.com/wp-content/uploads/sites/29/2018/02/small-cute-robot-square.png>
    - SLACK_TITLE=App Updated
    - SLACK_TITLE_LINK=${{CF_BUILD_URL}}
    - "SLACK_TEXT=The latest changes have been deployed to\n :point_right: https://${{APP_HOST}}"
    - SLACK_THUMB_URL=<https://cloudposse.com/wp-content/uploads/sites/29/2018/02/SquareLogo2.png>
    - SLACK_FOOTER=Helm Deployment
    - SLACK_FOOTER_ICON=<https://cloudposse.com/wp-content/uploads/sites/29/2018/02/kubernetes.png>
    - SLACK_FIELD1_TITLE=Environment
    - SLACK_FIELD1_VALUE=Staging
    - SLACK_FIELD1_SHORT=true
    - SLACK_FIELD2_TITLE=Repository
    - SLACK_FIELD2_VALUE=${{CF_REPO_OWNER}}/${{CF_REPO_NAME}}
    - SLACK_FIELD2_SHORT=true
    - SLACK_FIELD3_TITLE=Namespace
    - SLACK_FIELD3_VALUE=${{NAMESPACE}}
    - SLACK_FIELD3_SHORT=true
    - SLACK_FIELD4_TITLE=Branch/Tag
    - SLACK_FIELD4_VALUE=${{CF_BRANCH_TAG_NORMALIZED}}
    - SLACK_FIELD4_SHORT=true
    - SLACK_FIELD5_TITLE=Release
    - SLACK_FIELD5_VALUE=App
    - SLACK_FIELD5_SHORT=true
    - SLACK_FIELD6_TITLE=Commit
    - SLACK_FIELD6_VALUE=<${{CF_COMMIT_URL}}|${{CF_SHORT_REVISION}}>
    - SLACK_FIELD6_SHORT=true
    - SLACK_FIELD7_TITLE=Build Time
    - SLACK_FIELD7_VALUE=<!date^${{CF_BUILD_UNIX_TIMESTAMP}}^{date_num} {time_secs}|Time format failed!!!>
    - SLACK_FIELD7_SHORT=true
    - SLACK_FIELD8_TITLE=Commit Time
    - SLACK_FIELD8_VALUE=<!date^${{GIT_TIMESTAMP}}^{date_num} {time_secs}|Time format failed!!!>
    - SLACK_FIELD8_SHORT=true
    - SLACK_FIELD9_TITLE=Trigger
    - SLACK_FIELD9_VALUE=@${{CF_BUILD_TRIGGER}}
    - SLACK_FIELD9_SHORT=true
    - SLACK_FIELD10_TITLE=Commit Author
    - SLACK_FIELD10_VALUE=@${{CF_COMMIT_AUTHOR}}
    - SLACK_FIELD10_SHORT=true
    when:
      condition:
        all:
          executeForPullRequest: "'${{CF_PULL_REQUEST_NUMBER}}' != ''"
          executeForOpenPR: "'${{CF_PULL_REQUEST_ACTION}}' != 'closed'"
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
welcome @RobH
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
The same pattern we use for the smtp module can be extended to the slack notifier
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Since it consumes envs for everything ...
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
We do have a slack/sns module, but don’t think that’s what you are looking for
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @davidvasandani! Good to have you here ☺️
davidvasandani
davidvasandanialmost 8 years ago
👋 Hi all!
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
hey @davidvasandani
joshmyers
joshmyersalmost 8 years ago
Terraform is a CRUD tool, that doesn't really align with slack notifications. The slack-notifer docker solutions work for me
S
SweetOpsalmost 8 years ago
Have we helped you in some way? We'd love to know! If you could leave us a testimonial it would make our day.
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @mpmsimo! Good to have you here ☺️
mpmsimo
mpmsimoalmost 8 years ago
Hey everyone!
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
hi @mpmsimo
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Hey! Glad you joined Michael
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
@mpmsimo is from the #atlantis community
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
@Andriy Knysh (Cloud Posse) is responsible for all of our extensions to Atlantis
mpmsimo
mpmsimoalmost 8 years ago
Awesome, good to know! You guys have some awesome information out on the net about Terraform + Atlantis. Definitely looking forward to learning from you all.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
Z
Zapieralmost 8 years ago
@Erik Osterman (Cloud Posse) created a new channel #terraform-aws-modules. Join if this sounds interesting!
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @vadim! Good to have you here ☺️
Gonzalo Peci
Gonzalo Pecialmost 8 years ago
Welcome!
vadim
vadimalmost 8 years ago
hi there
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Hey there!
mmarseglia
mmarsegliaalmost 8 years ago
i've looked into Chef inspec to write tests for terraform, to ensure I'm creating resources correctly. anyone else doing testing beyond terraform validate and if so, what?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Taking a little different approach
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Goal is to make it easy for anyone to write tests without installing ruby and the kitchen sink
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Using bats-core we can write simple tests that will catch the essential problems
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Plan, apply, reapply test for idempotency, destroy, etc
mmarseglia
mmarsegliaalmost 8 years ago
interesting..
mmarseglia
mmarsegliaalmost 8 years ago
i'll have to look into this too..
mmarseglia
mmarsegliaalmost 8 years ago
thanks!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Sorry at DMV
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago(edited)
Will share example
mmarseglia
mmarsegliaalmost 8 years ago
dept. of motor vehicles?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Ya
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Takes for ever in Los Angeles
mmarseglia
mmarsegliaalmost 8 years ago
if the experience is anything like my state (RI), i wouldn't wish it on my worst enemy. 🙂
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Ya same!
OScar
OScaralmost 8 years ago
OMG #SweetOps is the shizzle! @here, just wanted to thank you for all the stuff you’ve put out on github. I’ve got a todo on my part to enter an issue and then actually implement it very soon on the KMS module! Thank you, just thank you for all this goodness!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
thanks @OScar! on behalf of all of us here, it really means a lot to us to know we're helping others out...
Z
Zapieralmost 8 years ago
@Erik Osterman (Cloud Posse) created a new channel #aws-reinvent. Join if this sounds interesting!
OScar
OScaralmost 8 years ago
So I don’t look forward to going to DMV myself. Just had this beast shipped from FL and now registering in CA!
Matthew
Matthewalmost 8 years ago
Pick me up on Wilshire downtown LA
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @ellisera! Good to have you here ☺️
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
oh nice!! R8?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
welcome @ellisera! have a look around...
S
SweetOpsalmost 8 years ago
• Are you hiring? Post a link to your job ad in our #jobs channel.
• Looking for work? Let everyone know by promoting what you do in the #jobs channel by sharing your LinkedIn profile and GitHub links.
• Are you a freelancer/consultant? Feel free to engage in self-promotion in the #jobs channel by sharing a link to your website and a tidbit about what you do.
yurchenko
yurchenkoalmost 8 years ago
yo guys i keep on getting "unable to connect to helm server" with build harness
yurchenko
yurchenkoalmost 8 years ago
what build harness version should i be using
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Hrmmm we are using the latest version with helm on Codefresh
yurchenko
yurchenkoalmost 8 years ago(edited)
hey, erik, weird it stopped working yesterday
yurchenko
yurchenkoalmost 8 years ago
i am using 0.5.5
yurchenko
yurchenkoalmost 8 years ago
might be a different problem
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
We don’t do anything funky in the container
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
We just install helm
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
On alpine
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Let’s see... so can you try using kubectl?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Just to test the connection.
yurchenko
yurchenkoalmost 8 years ago
it breaks on make/helm/upsert
yurchenko
yurchenkoalmost 8 years ago
sure
yurchenko
yurchenkoalmost 8 years ago(edited)
what should i run?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Let’s move to #release-engineering
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Actually let’s move to #codefresh
yurchenko
yurchenkoalmost 8 years ago
ok
Z
Zapieralmost 8 years ago
@Erik Osterman (Cloud Posse) created a new channel #codefresh. Join if this sounds interesting!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Or #codefresh :-)
Z
Zapieralmost 8 years ago
@sarkis created a new channel #prometheus. Join if this sounds interesting!
U
Unknown Useralmost 8 years ago
There are no events this week
Z
Zapieralmost 8 years ago
@Maarten van der Hoef created a new channel #airship. Join if this sounds interesting!
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Amos! Good to have you here ☺️
Amos
Amosalmost 8 years ago
Hello there, I've got a quick question for someone about this project: https://github.com/cloudposse/terraform-aws-kops-vpc-peering
Amos
Amosalmost 8 years ago
I'm attempting to peer a VPC in another region but get this error message
* module.cluster_to_vpn.module.vpc_peering.data.aws_vpc.requestor: data.aws_vpc.requestor: InvalidVpcID.NotFound: The vpc ID 'vpc-xxxxxx' does not exist
	status code: 400
Amos
Amosalmost 8 years ago
I have had success peering within my same region, but when I enter the vpc id for the remote region it breaks
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
welcome @Amos!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
let's move to #terraform
Nikola Velkovski
Nikola Velkovskialmost 8 years ago
Is AWS IAM down for everyone ?
Maarten van der Hoef
Maarten van der Hoefalmost 8 years ago
not very fast here..
Maarten van der Hoef
Maarten van der Hoefalmost 8 years ago
aws iam get-user 0.52s user 0.22s system 59% cpu 1.252 total
Nikola Velkovski
Nikola Velkovskialmost 8 years ago
I get a 505
Nikola Velkovski
Nikola Velkovskialmost 8 years ago
ok now it's ok 🙂
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @masterwill! Good to have you here ☺️
masterwill
masterwillalmost 8 years ago
Glad to be here
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
hey @masterwill! let me know if we can help
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @ay-ay-ron! Good to have you here ☺️
ay-ay-ron
ay-ay-ronalmost 8 years ago
Hello everyone!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
hey there!
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @JustPerfect! Good to have you here ☺️
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Kasun! Good to have you here ☺️
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Jorge Rodrigues! Good to have you here ☺️
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
@Jorge Rodrigues @Kasun @JustPerfect @ay-ay-ron welcome!
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @nutellinoit! Good to have you here ☺️
nutellinoit
nutellinoitalmost 8 years ago
Hi everyone!
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
hey @nutellinoit
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @BKC! Good to have you here ☺️
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
hey @BKC! let me know if we can help with anything...
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @rbadillo! Good to have you here ☺️
rbadillo
rbadilloalmost 8 years ago
Hi Team, quick question
rbadillo
rbadilloalmost 8 years ago
rbadillo
rbadilloalmost 8 years ago
My understanding is that you tell that tool which exporter to scrape and it will send the metrics to AWS, is that correct?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
yes
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
^ to scrape kube-state-metrics
rbadillo
rbadilloalmost 8 years ago
This is amazing, I was looking for a tool like this
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
🙂
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
it has some limitations though (see the open issue), which we did not address yet
rbadillo
rbadilloalmost 8 years ago
let me check
rbadillo
rbadilloalmost 8 years ago
I see, so let me explain my situation
rbadillo
rbadilloalmost 8 years ago(edited)
let’s say that I have 1 EC2 server and I have the node_exporter running locally (At the Ec2 box) Port 9100.
If I run your tool locally in the same EC2 server and tell it to scrape http://localhost:9100/metrics . Those metrics will ended up in CloudWatch. correct?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
If that’s a Prometheus endpoint, yes
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago(edited)
It uses Prometheus client to read the metrics
rbadillo
rbadilloalmost 8 years ago
by prometheus endpoint you mean any /metrics endpoint that can be scrape by a Prometheus server ?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
Yep
rbadillo
rbadilloalmost 8 years ago
perfect
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago(edited)
To be clear, the tool was just an experiment. The correct official way would be to write a Prometheus operator using the operator framework, which would be managed by Kubernetes and would scrape metrics and send them to CloudWatch
rbadillo
rbadilloalmost 8 years ago
I understand but this is a great start for I was planning on writing
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
if you manage to resolve the issue, we accept PRs 🙂
rbadillo
rbadilloalmost 8 years ago
I think I know how to fix it
rbadillo
rbadilloalmost 8 years ago
I will take a look next week and let you know guys
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
that would be awesome! thanks
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
thanks @rbadillo
rbadillo
rbadilloalmost 8 years ago
you’re welcome, talk to you later
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Rok Carl! Good to have you here ☺️
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
hey @Rok Carl welcome!
Rok Carl
Rok Carlalmost 8 years ago
glad to be here
OScar
OScaralmost 8 years ago
@here i might have asked this, but maybe it wasn’t clear. Using the Geodesic Framework, setting up CloudTrails that send logs to central Audit account S3. All good there, I have that in place. My question is; what module do i use to send other AWS events to the bucket from all of the accounts?
OScar
OScaralmost 8 years ago
I am super stoked to be using this framework with a company that I hope will be a Case Study for it!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Other than CloudTrail events, it’s on a case by case basis
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Let’s move to #geodesic
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @bob! Good to have you here ☺️
bob
bobalmost 8 years ago
@Igor Rodionov tnx for invite 🙏
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
hey @bob! welcome
Igor Rodionov
Igor Rodionovalmost 8 years ago
@bob you are welcome
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Jan! Good to have you here ☺️
Jan
Janalmost 8 years ago
o/
Maarten van der Hoef
Maarten van der Hoefalmost 8 years ago
hi @Jan !
Jan
Janalmost 8 years ago
hey hey
Jan
Janalmost 8 years ago
Dutch or Afrikaans?
Maarten van der Hoef
Maarten van der Hoefalmost 8 years ago
My Afrikaans is Braai
Maarten van der Hoef
Maarten van der Hoefalmost 8 years ago
Dutch is better 🙂
Jan
Janalmost 8 years ago
Dutch I guess based on time
Jan
Janalmost 8 years ago
😄
Jan
Janalmost 8 years ago
cool cool
Maarten van der Hoef
Maarten van der Hoefalmost 8 years ago
I can also do a bit of Xhosa
Maarten van der Hoef
Maarten van der Hoefalmost 8 years ago
when drunk
Jan
Janalmost 8 years ago
some nice ideas you have going on in your terraform
Jan
Janalmost 8 years ago
haha awesome, I can speak Dutch when drunk
Jan
Janalmost 8 years ago
and Xhosa a little
Maarten van der Hoef
Maarten van der Hoefalmost 8 years ago
What are you working on atm ?
Jan
Janalmost 8 years ago
I was rewriting an example multi aws account org, with IAM roles an d sts assume patterns. Opinionated modules for vpc's peering, logging etc
Jan
Janalmost 8 years ago
doing a workshop with some engineers for a company I joined recently
Jan
Janalmost 8 years ago
stumbled across your sweetops
Jan
Janalmost 8 years ago
would have been amazing to have this several years back 😄
Jan
Janalmost 8 years ago
So today im exploring doing the same setup with your modules
Jan
Janalmost 8 years ago
and then see if I can work CIS benchmark compliance into it
Maarten van der Hoef
Maarten van der Hoefalmost 8 years ago
Myself I'm not cloudposse, more of a pro-active lurker, but happy to help out, most of the cloudposse guys show up US working times.
Jan
Janalmost 8 years ago
makes sense
Jan
Janalmost 8 years ago
tx
joshmyers
joshmyersalmost 8 years ago
Have folks implemented https://github.com/cloudposse/root.cloudposse.co out of the box switching out CP variables for their own? I’m hitting orderings issues which is expected during any bootstrap but they aren’t documented from what I can see..
Jan
Janalmost 8 years ago
what sort of ordering issues?
joshmyers
joshmyersalmost 8 years ago
Ordering of resources. i.e. account-settings > users > iam
Jan
Janalmost 8 years ago
I will be doing a similar test setup shortly
Jan
Janalmost 8 years ago
will let you know if I see the same issues
joshmyers
joshmyersalmost 8 years ago
Only used in anger for an hour or so
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @mumoshu! Good to have you here ☺️
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Shane! Good to have you here ☺️
Shane
Shanealmost 8 years ago
@Erik Osterman (Cloud Posse) thanks for the invite
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
welcome @Shane & @mumoshu! awesome to have you guys onboard. We have an #atlantis channel where we can coordinate efforts. @Andriy Knysh (Cloud Posse) is the one on my team who worked on it.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
hi @mumoshu and @Shane
Z
Zapieralmost 8 years ago
@Erik Osterman (Cloud Posse) created a new channel #helmfile. Join if this sounds interesting!
rajcheval
rajchevalalmost 8 years ago(edited)
I am considering using your terraform code build module. I have a few questions: 1. Does it support git repos in CodeCommit? 2. currently it creates a IAM role and policy. In our scenario we will be running code build in 1 AWS account. We will actually run terraform inside code build. We will be using terraform to provision infrastructure in other AWS accounts. so the role inside code build has to be able to assume roles in other accounts. This is why I was trying to determine if it is possible to update the policy statements for the role created by the module. Perhaps we can pass in a role Arn. I am open to any other suggestion you have for me. Thanks
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
@rajcheval we can definitely provide an external IAM policy to the module. Please open a PR if you know how to do it. If not, open an issue and we’ll get to it
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
@loren thanks for sharing
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @gyoza! Good to have you here ☺️
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Hey John! welcome 😃
gyoza
gyozaalmost 8 years ago
yo
gyoza
gyozaalmost 8 years ago
I work for blackberry now lol
gyoza
gyozaalmost 8 years ago
(shrug)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
cool! whatcha working on over there?
gyoza
gyozaalmost 8 years ago
Well, Cylance got bought out, so we’re doing the same thing as of yesterday
gyoza
gyozaalmost 8 years ago
just operating under blackberry
erik
erikalmost 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
heh, i missed the news
gyoza
gyozaalmost 8 years ago
yea its everywhere
gyoza
gyozaalmost 8 years ago
Did you see that hashicorp absorbed atlantis?
gyoza
gyozaalmost 8 years ago
im sure you have
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
yep! that was a surprise announcement. hope to see #atlantis will get more engineering resources
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
we've forked, but hoping to ultimately converge on functionality
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago(edited)
are you guys using some flavor of atlantis?
gyoza
gyozaalmost 8 years ago
i was planning on doing it
gyoza
gyozaalmost 8 years ago
i had a demo working with bitbucket
gyoza
gyozaalmost 8 years ago
but i stopped as soon as i saw it was going to be in terraform-0.12
gyoza
gyozaalmost 8 years ago
also the pay-wallish features being released
gyoza
gyozaalmost 8 years ago
im looking forward to that
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @dio! Good to have you here ☺️
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
hi @dio
dio
dioalmost 8 years ago
Hello!
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @demeringo! Good to have you here ☺️
antonbabenko
antonbabenkoalmost 8 years ago
Who is going to AWS re:invent and want to chat about stuff we do? 🙂
OScar
OScaralmost 8 years ago
I am!! Let’s meet up, grab a drink and talk shop!
Jan
Janalmost 8 years ago
not this year
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Anmol! Good to have you here ☺️
davidvasandani
davidvasandanialmost 8 years ago
👋🏻 Hi @Anmol
Anmol
Anmolalmost 8 years ago
Hello
Jan
Janalmost 8 years ago
Where would you say is the best place to get started
Jan
Janalmost 8 years ago
docs wise?
Jan
Janalmost 8 years ago
I have a 7 hour train journey tomorrow so I figure I can do a deep dive
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
@Jan do you want to get started with the reference architecture
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
We have our QuickStart guide that links to everything, but it needs a lot of work
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Jan
Janalmost 8 years ago(edited)
Oh I did notice one thing just before, let me dig it up
Jan
Janalmost 8 years ago
was a dead link to local dev
Jan
Janalmost 8 years ago
There are a few changes I will explore, I need to build with CIS compliance in mind
Jan
Janalmost 8 years ago
will see how it works out
Jan
Janalmost 8 years ago
thanks for the quick-start, will take a look there
Jan
Janalmost 8 years ago
terraform is one of my strong areas so should be able to follow through most of it
Jan
Janalmost 8 years ago
I mean almost all the tool chain you are using is my strong area 😄
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Cool! I am afk today, but will be around all day tomorrow
Jan
Janalmost 8 years ago
epic
Jan
Janalmost 8 years ago
Will be here asking stuffs depending on my internet connection
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @j.baldzer! Good to have you here ☺️
U
Unknown Useralmost 8 years ago
There are no events this week
OScar
OScaralmost 8 years ago
@here I am excited this morning because I am deploying @AWS accounts using Geodesic!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago(edited)
sorry I've been AWOL for the last few days. Drove up to Oregon for a mini work "vacay" for Thanksgiving
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
catching up on all the messages now!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
@Jan is doing the same right now
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
he found a couple of issues with the #docs
Jan
Janalmost 8 years ago
I found a few other things I wanna think through
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
cool - remember we're so familiar with this stuff that getting your outside feedback is what we really need
Jan
Janalmost 8 years ago(edited)
I ma used to building vpc's with terraform and rendering a k8s cluster.yaml template and launcing into the TF created vpc
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
@Mike Crowe banged his head against the while for a while until we got these docs online
Jan
Janalmost 8 years ago
I did see from the docs that you are launching from a rendered cluster spec
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
@Jan you mean using terraform to provision the VPC and launching kops in that VPC?
Jan
Janalmost 8 years ago
exactly
Jan
Janalmost 8 years ago
I only looked at your example
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
gotcha, yes, there are some pros with that and i've seen others do it that way
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago(edited)
our approach was slightly different, but i'd be open to supporting both methods
Jan
Janalmost 8 years ago
and I think even if it its a supported case it should be easy enough to add
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
our approach is to let kops manage it's VPC and all resources
Jan
Janalmost 8 years ago
Yea
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
and use terraform to manage it's own VPC
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
then peer them
Jan
Janalmost 8 years ago
So I have in the past had vpc's that have services running in them where I want to add k8s
Jan
Janalmost 8 years ago
I lied having the programmatic blast radius separation between k8s / infra / rds data
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
this is the kops manifest template
Jan
Janalmost 8 years ago
I mean what happens for example if you create the vpc with kops and then after that launch other EC2 resources into said vpc
Jan
Janalmost 8 years ago
if you do a kops destroy cluster will it kill the vpc?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
i believe so... but i just saw an issue raised by a customer where it was not, but haven't looked into it
Jan
Janalmost 8 years ago
the nice aspect of the other wey is that you cant destroy a TF controlled vpc without first destroying the k8s cluster
Jan
Janalmost 8 years ago
blast radius control 😛
Jan
Janalmost 8 years ago
any how I need to walk to my colleges house and its like -3 so no more typing
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
haha
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
ok, we can discuss more later
Jan
Janalmost 8 years ago
👍️
Jan
Janalmost 8 years ago
I am also keen to explore gitlab in place of github
Jan
Janalmost 8 years ago
as we use gitlab
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
We have a customer using GitLab. That's not a blocker. Personally, I'm still not a fan or sold on GitLab.
Ramesh Kumar
Ramesh Kumaralmost 8 years ago
anyone aware then terraform is going to support new ECS ARN formats?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
@Maarten van der Hoef might know more about that
Nikola Velkovski
Nikola Velkovskialmost 8 years ago
Hey People I am not sure if this is the right place to ask but does anyone have a comparison chart for fargate and ECS. I know that fargate is way more limited than ecs but I cannot seem to find anything that compares those 2 on the interwebz.
Nikola Velkovski
Nikola Velkovskialmost 8 years ago
any help is appreciated 🙂
joshmyers
joshmyersalmost 8 years ago
Maybe?
Nikola Velkovski
Nikola Velkovskialmost 8 years ago
kinda 🙂
Nikola Velkovski
Nikola Velkovskialmost 8 years ago
but thanks 🙂
Nikola Velkovski
Nikola Velkovskialmost 8 years ago
I am slowly compiling the list I just need to dig through a lot of blogs, docs etc 🙂
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @zerocool_jb! Good to have you here ☺️
Maarten van der Hoef
Maarten van der Hoefalmost 8 years ago
@Ramesh Kumar afaik, Terraform is not forcing any certain patterns on ARN's.
I'm running TF with the new format without problems. Resources affected are mostly resources Terraform doesn't care about, container instances, task-id's, and they mentioned services, although services don't have an ARN afaik.
Nikola Velkovski
Nikola Velkovskialmost 8 years ago
I guess it will be like when they switched the instances ids to longer ones, terraform will be agnostic in this case.
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @mishinev! Good to have you here ☺️
Ryan Smith
Ryan Smithalmost 8 years ago(edited)
The right thing to do, when @Erik Osterman (Cloud Posse) sends you stickers.. is put them on your boss's office window @stobiewankenobi
stobiewankenobi
stobiewankenobialmost 8 years ago
Oh that is one handsome dude
Ryan Smith
Ryan Smithalmost 8 years ago
in the reflection? I know right
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
HAHAH
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
that was fast
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
i just mailed them last friday.
Ryan Smith
Ryan Smithalmost 8 years ago
😉
OScar
OScaralmost 8 years ago
@here pardon my ignorance, but i want to ask something that may make sense for others, just not clear to me:

The IAM User that is created for the <http://root.cloudposse.co|root.cloudposse.co> repository. Which is used to manage other accounts. Can that be a federated user since it assumes IAM Roles? or?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
so there is no specific account designated as "the account to manage other accounts"
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
let's move to #geodesic
Z
Zapieralmost 8 years ago
@Erik Osterman (Cloud Posse) created a new channel #packages. Join if this sounds interesting!
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @integratorz! Good to have you here ☺️
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
hey @integratorz! what bring you around?
Ramesh Kumar
Ramesh Kumaralmost 8 years ago
@Maarten van der Hoef thanks for the confirmation
Maarten van der Hoef
Maarten van der Hoefalmost 8 years ago
@Nikola Velkovski Fargate is just extremely expensive, there is a reason AWS only has monthly pricing example for running Fargate tasks a few hours a day. A 1CPU fargate with 2GB of memory costs 54 USD/month. Leaving out EBS that's about the same price as a c5.large..
integratorz
integratorzalmost 8 years ago
Hey @Erik Osterman (Cloud Posse), just taking a look at some of the modules that Cloud Posse has for Terraform and wanted to hop into the slack channel.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
awesome! feel free to ask questions in #terraform if you get stuck on anything
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Martin! Good to have you here ☺️
OScar
OScaralmost 8 years ago
@here I’m guessing folks are still working (you workaholics!). I should talk right? Just wanted to wish everyone in this amazing community a safe and happy Thanksgiving!
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
Thanks @OScar
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
Happy thanksgiving everybody
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Thanks @OScar !
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Have a good one...
OScar
OScaralmost 8 years ago
@here anyone have this issue trying to assume the role?

Enter passphrase to unlock /conf/.awsvault/keys/:

An error occurred (InvalidClientTokenId) when calling the GetCallerIdentity operation: The security token included in the request is invalid.
OScar
OScaralmost 8 years ago
I am able to assume the cnc-root-admin via the web console however
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Probably something wrong in the AWS config
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Sec
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
If you want you can PM me your config assuming no secrets are in it!
OScar
OScaralmost 8 years ago
I am also able to assume the role via a plain aws-vault login cnc-root-admin command and the web console opens with the assumed role
OScar
OScaralmost 8 years ago
ok
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Let’s move to #geodesic
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Duong! Good to have you here ☺️
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Bogdan! Good to have you here ☺️
Jan
Janalmost 8 years ago
wellcome 🙂
Bogdan
Bogdanalmost 8 years ago
Hey! I'm the HUG Zurich leader and long-time user/fan of CloudPosse's TF modules joining at @antonbabenko’s invitation
Bogdan
Bogdanalmost 8 years ago
We just had a Meetup focused TF with @antonbabenko as a guest speaker yesterday: https://www.meetup.com/Zurich-HashiCorp-User-Group/events/255859299/
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
hey @Bogdan welcome! Thanks for sharing the link
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
@antonbabenko nice presentation https://www.slideshare.net/secret/k6svGkP445g45q
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
welcome @Duong
antonbabenko
antonbabenkoalmost 8 years ago
@Andriy Knysh (Cloud Posse) thanks.
antonbabenko
antonbabenkoalmost 8 years ago
If anyone wants to see my talk at Hashicorp User Group meetup in New York city 3rd of December - Join me at Terraform Modules and Best Practices http://meetu.ps/e/G3zHX/1MhZb/a
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @gauravg! Good to have you here ☺️
Jan
Janalmost 8 years ago
welcome
gauravg
gauravgalmost 8 years ago
Thanks
gauravg
gauravgalmost 8 years ago
Jan
Janalmost 8 years ago
I think most of the folks are not around, given that its thanks giving holidays
Jan
Janalmost 8 years ago
I could try though
gauravg
gauravgalmost 8 years ago
yeah
Jan
Janalmost 8 years ago
whats up?
gauravg
gauravgalmost 8 years ago
I am getting this error Error: resource 'datadog_monitor.cpu_usage' config: unknown module referenced: label
Jan
Janalmost 8 years ago
im also on a high speed train crossing Germany right now so my internet is not super reliable 😛
gauravg
gauravgalmost 8 years ago
good luck 🙂
gauravg
gauravgalmost 8 years ago
module "datadog_cpu_usage_us_east_1" {
  source     = "./module/cpu"
  namespace  = "test"
  stage      = "dev"
  name       = "els1"
  attributes = "us-east-1"
  delimiter  = "-"
  tags       = "ci"
}

provider "datadog" {
  api_key = "${var.datadog_api_key}"
  app_key = "${var.datadog_app_key}"
}

variable datadog_api_key {}
variable datadog_app_key {}
gauravg
gauravgalmost 8 years ago
This is my main.tf in root ^
Jan
Janalmost 8 years ago
let me see
Jan
Janalmost 8 years ago

module "label" {
  source     = "git::<https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.3.1>"
  namespace  = "${var.namespace}"
  stage      = "${var.stage}"
  name       = "${var.name}"
  attributes = "${var.attributes}"
  delimiter  = "${var.delimiter}"
  tags       = "${var.tags}"
}
Jan
Janalmost 8 years ago
did you do a terraform init
Jan
Janalmost 8 years ago
or terraform get -update
gauravg
gauravgalmost 8 years ago
yes it's giving error on same
Jan
Janalmost 8 years ago
mm
gauravg
gauravgalmost 8 years ago
the difference is in source. Instead of using githib url, I am using my local which has same module of cpu
Jan
Janalmost 8 years ago
for sure
Jan
Janalmost 8 years ago
do you have a local copy of the "git::<https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.3.1>" module?
gauravg
gauravgalmost 8 years ago
oh yeah, got it now. Somehow that copy on different location
Jan
Janalmost 8 years ago
🙂
gauravg
gauravgalmost 8 years ago
Let me try to move it and then try
gauravg
gauravgalmost 8 years ago
it works
gauravg
gauravgalmost 8 years ago
Thanks Jan 🙂
Jan
Janalmost 8 years ago
brilliant 👍️
gauravg
gauravgalmost 8 years ago
Now let me see why monitor not created
Jan
Janalmost 8 years ago
its one of those things with terraform, if you are using local, relative path, modules you gotta be careful to validate the paths
Jan
Janalmost 8 years ago
@gauravg did you go through the cold-start?
Jan
Janalmost 8 years ago
for geodesic
gauravg
gauravgalmost 8 years ago
nope
Jan
Janalmost 8 years ago
dang
Jan
Janalmost 8 years ago
oki
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
@Jan I can give you some tips on provisioning AWS accounts, if you ready
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
The docs were written when we provisioned accounts manually in the AWS console
Jan
Janalmost 8 years ago
Yea im ready
Jan
Janalmost 8 years ago
I suspected that might be the case
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
Jan
Janalmost 8 years ago
just because of the env calls
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
so, in short, are you able to login to the root account from geodesic?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
root means the master Org account
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
let’s switch to #geodesic
Jan
Janalmost 8 years ago
kk
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
funny ^
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @ManojH! Good to have you here ☺️
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Bryan! Good to have you here ☺️
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @boz! Good to have you here ☺️
U
Unknown Useralmost 8 years ago
There are no events this week
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
will be nice if AWS adds MongoDB and Kafka as managed services https://seekingalpha.com/news/3410999-aws-develops-new-services-amid-open-source-pushback
Ryan Smith
Ryan Smithalmost 8 years ago(edited)
Lol, it's nice when my peers organically stumble on cloudposse projects: https://github.com/cloudposse/prometheus-to-cloudwatch in particular
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
whoot! yea, that's been a popular one
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
@Andriy Knysh (Cloud Posse) worked on that
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Ben Hecht! Good to have you here ☺️
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago(edited)
welcome @Ben Hecht !
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @jerry! Good to have you here ☺️
gyoza
gyozaalmost 8 years ago
i wish i could open source the stuff i work on
gyoza
gyozaalmost 8 years ago
i would get mad internet points
joshmyers
joshmyersalmost 8 years ago
@gyoza Interested now… 😉
gyoza
gyozaalmost 8 years ago
i built an autohealing federated prometheus cluster thing using consul-template, consul, and some python..
gyoza
gyozaalmost 8 years ago
the consul template looks ilke hieroglyphics
gyoza
gyozaalmost 8 years ago
so if the master goes down and a new one comes up it will resync, and the child nodes, if one of them dies its fine
gyoza
gyozaalmost 8 years ago
a new one will come up and resync
gyoza
gyozaalmost 8 years ago
as long as they all dont die at once
gyoza
gyozaalmost 8 years ago
should be ok:P
gyoza
gyozaalmost 8 years ago
not using LTS
gyoza
gyozaalmost 8 years ago
any of you guys using thanos?
Jan
Janalmost 8 years ago
Exploring it
gyoza
gyozaalmost 8 years ago
yea, i like it for the LTS stuff
gyoza
gyozaalmost 8 years ago
RONCO style
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @samhagan! Good to have you here ☺️
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @John Shiple! Good to have you here ☺️
John Shiple
John Shiplealmost 8 years ago
Hello!
Jan
Janalmost 8 years ago
hey hey
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Hey john! Glad you signed up
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @chialun! Good to have you here ☺️
davidvasandani
davidvasandanialmost 8 years ago
I really have to say this is the most active DevOps Slack team I’m apart of. Way to go!
i5okie
i5okiealmost 8 years ago(edited)
hey i have a general question..
i’ve just configured my bastion host to automatically look at aws iam users, sync them, and copy their ssh public keys. so now i can ssh into bastion. great.

my previous method was sshing in using a shared key, then using a key on bastion to ssh into the private EB instances.

question:
now that my users are sshing into bastion, and there are now like 10 users, how do I seamlessly ssh to the private instances without copying the key to all their .ssh folders?

extra note: i wrote a gem that replicates Heroku cli functionality. so its all automated
$ mygem ssh --app myappname --env myenvstage #and it automatically sshes through bastion to one of the app instances.
so internally now i have to change it to use ssh <iamuser>@privatehost instead of ec2-user@privatehost. and im just trying to figure this out. any suggestions?
i5okie
i5okiealmost 8 years ago
key being, how can i automate this, maybe via a single line command.. instead of telling everyone to change their ssh_config
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Adam Kaplan! Good to have you here ☺️
Maarten van der Hoef
Maarten van der Hoefalmost 8 years ago
@i5okie Try adding this into your .ssh/config and then directly ssh into the ec2 instance.

Host bastionhost
    ForwardAgent yes

Host 10.* <- fix your range here
     ProxyCommand ssh user@Bastionhost -W %h:%p
i5okie
i5okiealmost 8 years ago
im trying to do it without that 😕
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
welcome @Adam Kaplan
Adam Kaplan
Adam Kaplanalmost 8 years ago
😄
joshmyers
joshmyersalmost 8 years ago
@i5okie could your gem template some SSH config? A bit yuk.
Maarten van der Hoef
Maarten van der Hoefalmost 8 years ago
ssh -t ec2-user@bastion ssh ec2-user@ec2node
joshmyers
joshmyersalmost 8 years ago
I think it is generally acceptable for folks to have to add some SSH config in order to access things, and preferably not as a shared user.
i5okie
i5okiealmost 8 years ago
yeah i just got this going on my bastion: https://github.com/widdix/aws-ec2-ssh
i5okie
i5okiealmost 8 years ago(edited)
pretty neat
Maarten van der Hoef
Maarten van der Hoefalmost 8 years ago
i5okie
i5okiealmost 8 years ago
now the last leg… im trying to avoid modifying ssh_config.. in theory i could use sshkit and dynamically change ssh_config on the fly. but “yuk” is perfect word here
joshmyers
joshmyersalmost 8 years ago(edited)
What is wrong with having users add some SSH config? I think this is pretty standard practice in onboarding docs
i5okie
i5okiealmost 8 years ago
we have multiple aws accounts, multiple vpcs…
i5okie
i5okiealmost 8 years ago
that sshconfig is going to look like a book
i5okie
i5okiealmost 8 years ago
bigger hurdle is, there might be some vpc cidr overlapping
i5okie
i5okiealmost 8 years ago
might be easier to script the code that syncs users, to also copy the ssh key into their home folders.. 😞
joshmyers
joshmyersalmost 8 years ago(edited)
SSH config does wildcard matching which works nicely with CNAMEs
i5okie
i5okiealmost 8 years ago
josh, one of the accounts has vpcs that overlap the other account’s ip address. different bastion hosts for similar address space
i5okie
i5okiealmost 8 years ago
10.1.0.0
10.1.0.0
for example
joshmyers
joshmyersalmost 8 years ago
Attach an EIP to each bastion and CNAME to it, bastion.production.bla, bastion.staging.bla ?
i5okie
i5okiealmost 8 years ago
but ssh config starts with remote host.. if that wildcard matches, then it picks which bastion host.. right
i5okie
i5okiealmost 8 years ago
so bastion host ip doesn’t matter. its the private instance ip address
i5okie
i5okiealmost 8 years ago
i guess another option is to sftp the key to bastion, right before they ssh through it
i5okie
i5okiealmost 8 years ago
or scp
i5okie
i5okiealmost 8 years ago
stupid elastic beanstalk.
Z
Zapieralmost 8 years ago
@Erik Osterman (Cloud Posse) created a new channel #lax. Join if this sounds interesting!
tamsky
tamskyalmost 8 years ago
keymaker has been useful
i5okie
i5okiealmost 8 years ago
my private hosts are all elastic beanstalk hosts.
i5okie
i5okiealmost 8 years ago
with instance refresh, etc etc. so i need to get that automated somehow.
i5okie
i5okiealmost 8 years ago
I’ve just added this copy_ssh_key function to the script i’ve been using: https://github.com/i5okie/aws-ec2-ssh/blob/master/import_users.sh#L161-L180
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
@i5okie have you seen our github-authorized-keys service?
i5okie
i5okiealmost 8 years ago
nope
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
the idea here is that you use AuthorizedKeysCommand (or something like that) to avoid needing to provision keys
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
it can also provision users too
i5okie
i5okiealmost 8 years ago
yeah the aws-ec2-ssh script does that by getting the ssh public key associated with your iam user
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
i think the bastion container implements support for that.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
ah right - forgot you're using aws iam (which is nice)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
if we did it all over again, i would implement it slightly differently
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
i would use pam.d to automatically query IAM on user connection
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
which would then provision the user (if permitted) and then add their key
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
this is possible with pam_exec
i5okie
i5okiealmost 8 years ago
hmm sounds like keymaker and aws-ec2-ssh are very similar.
next question is, does it work with Amazon Linux 2 ami? because they’ve taken over the AuthorizedKeysCommand for use with ssm
i5okie
i5okiealmost 8 years ago
and broken functionality of all these scripts that use that command lol
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
haha
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
i didn't know that
i5okie
i5okiealmost 8 years ago
i don’t like how they are forcing people to use ssm to connect to instances.
i5okie
i5okiealmost 8 years ago
if it was a one-line command, that’d be nice. otherwise its kinda like meh
i5okie
i5okiealmost 8 years ago
ooh
i5okie
i5okiealmost 8 years ago
“and home directory sharing (via optional EFS integration)” this is very interesting re: keymaker
erik
erikalmost 8 years ago
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Stephen! Good to have you here ☺️
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
I setup https://www.linkedin.com/groups/13649396/ if LinkedIn is your thang and you want a badge on your profile 😃
erik
erikalmost 8 years ago
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @rohit! Good to have you here ☺️
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
hey @rohit!
rohit
rohitalmost 8 years ago
Hi
rohit
rohitalmost 8 years ago
I have a question related to cloudposse/terraform-null-label
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
sure, let's move to #terraform
rohit
rohitalmost 8 years ago
Just curious, how did you generate the image used here https://docs.cloudposse.com/helm-charts/
rohit
rohitalmost 8 years ago
i see lot of people generating something like this
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
oh haha, that was actually just a screenshot from one of our slide decks
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
which I had a fancier answer 😃
rohit
rohitalmost 8 years ago
🙂
rohit
rohitalmost 8 years ago
but lot of people are generating something like this
rohit
rohitalmost 8 years ago
so i was wondering how people do it
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
i literally googled everyone of those projects to find a nice transparent logo and placed them
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
so i’ve seen various implementations
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
some use favicons
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
rohit
rohitalmost 8 years ago
gotcha
rohit
rohitalmost 8 years ago
i thought there was some tool to generate something like this
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
yea, something to generate a montage
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
if you find one, lmk!! 😃
rohit
rohitalmost 8 years ago
will do
rohit
rohitalmost 8 years ago
@Erik Osterman (Cloud Posse) what did you use clearbit for ?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
oh just googling logo api
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
😃
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
never used it
rohit
rohitalmost 8 years ago
when i searched for Cloud Posse your pic showed up 🙂
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
oh, haha
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
yea, i think their algo is weak
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
i tried another one of these services and it returned one of our customer’s logo for <http://cloudposse.com|cloudposse.com>
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
i guess they pulled it from our logo slider on the homepage
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
alas, google FTW
erik
erikalmost 8 years ago
rohit
rohitalmost 8 years ago
yeah their algo looks weak
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @pigglesticks! Good to have you here ☺️
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
welcome @pigglesticks
pigglesticks
pigglesticksalmost 8 years ago
Thanks @Andriy Knysh (Cloud Posse)
pigglesticks
pigglesticksalmost 8 years ago
I think I might be in the wrong timezone over here 🙂
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
what timezone are you in?
pigglesticks
pigglesticksalmost 8 years ago
I am based in Cape Town
pigglesticks
pigglesticksalmost 8 years ago
UTC+2
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
oh nice, I have a friend here in Florida, he is from Cape Town originally
Jan
Janalmost 8 years ago
I'm from Cape Town
Jan
Janalmost 8 years ago
Live in Germany now
pigglesticks
pigglesticksalmost 8 years ago
I am originally from the UK, but I've lived in SA for 8 years now
pigglesticks
pigglesticksalmost 8 years ago
I've fallen for the lifestyle 🙂
pigglesticks
pigglesticksalmost 8 years ago
How long in Germany Jan?
Jan
Janalmost 8 years ago
2 years
Jan
Janalmost 8 years ago
Almost
joshmyers
joshmyersalmost 8 years ago
@pigglesticks Best out of the UK 😂
pigglesticks
pigglesticksalmost 8 years ago
Theresa May's dancing is enough to scare anyone away for good 😉
joshmyers
joshmyersalmost 8 years ago
hahaha
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
@Kenny Inggs is also in South Africa - Cape Town if I am not mistaken
Z
Zapieralmost 8 years ago
@Erik Osterman (Cloud Posse) created a new channel #ansible. Join if this sounds interesting!
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @chhed13! Good to have you here ☺️
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
welcome @chhed13
chhed13
chhed13almost 8 years ago
Hi everybody!
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
hey Andrey, where are you from?
chhed13
chhed13almost 8 years ago
From Russia. But currently I am on re:Invent
chhed13
chhed13almost 8 years ago
We've met once there with @antonbabenko
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
👍️
antonbabenko
antonbabenkoalmost 8 years ago
Hi @chhed13 ! Great to have you here, enjoy your trip further :)
G
GreetBotalmost 8 years ago
hey everyone give a warm welcome to @Valdemir! Good to have you here ☺️
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago(edited)
hey @chhed13! what'd you think of #aws-reinvent this year?
Z
Zapieralmost 8 years ago
@Erik Osterman (Cloud Posse) created a new channel #packer. Join if this sounds interesting!
OScar
OScaralmost 8 years ago
Anyone know of a module or something that can help me get all Cloudwatch logs from several accounts to the audit account?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
you mean the new capability that was just announced? 😃
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
(forget what they called it)
joshmyers
joshmyersalmost 8 years ago
Organizational cloudtrail
joshmyers
joshmyersalmost 8 years ago
Think the PR to add functuoanlity is merged but probably waiting for a release
joshmyers
joshmyersalmost 8 years ago
Needs to be run in the master account org
loren
lorenalmost 8 years ago(edited)
Can't you do that already? Just create the bucket in the audit account, and point the trail in each account at that bucket? At least, that's how we're doing it, and no limit on the org boundary, so still works if you need multiple payer accounts for compliance reasons...
joshmyers
joshmyersalmost 8 years ago
That is you managing a individual trail per account and telling them all to log into a single bucket
loren
lorenalmost 8 years ago
Is this implementation different? Or is it just creating the trail for you, from the master account?
joshmyers
joshmyersalmost 8 years ago
Organizational trails you create a new trail in master, with an added Boolean of isOrganizationalTrail and it will create and manage in all underling accounts of the org. Master config is applied to all
loren
lorenalmost 8 years ago
Meh. If it's just creating the trail, I like our approach better. Rather have terraform manage the config for each trail
joshmyers
joshmyersalmost 8 years ago(edited)
Hmm, yeah, think I'd rather less code and a single account to manage. There are other benefits like an underling account can't turn it off or update the trail, which is an attack vector if an account is compromised
loren
lorenalmost 8 years ago
Yeah, we already manage these compliance related resources in child accounts, including the IAM role assignment, so no chance of that
loren
lorenalmost 8 years ago
Thank goodness for the permission boundary feature... Makes it possible to delegate IAM permissions to their roles without escalation risk
joshmyers
joshmyersalmost 8 years ago
What if your production account IAM creds were compromised? Or someone managed to impersonate a service that has cloudtrail access?
joshmyers
joshmyersalmost 8 years ago
loren
lorenalmost 8 years ago(edited)
I don't see how this feature changes that risk, you still have something, somewhere with permissions to these things, and it's still centrally controlled
joshmyers
joshmyersalmost 8 years ago
I generally want to setup alerts if anyone messes with CT
joshmyers
joshmyersalmost 8 years ago
Because it is in one place that can be more locked down than each underling account
joshmyers
joshmyersalmost 8 years ago
joshmyers
joshmyersalmost 8 years ago
Hook that up to SNS
loren
lorenalmost 8 years ago
Eh, I don't really see any difference. Once you have the module written, it's just a matter of being able to implement it, and if you have multiple payer accounts then you need to be able to implement multiple times anyway
loren
lorenalmost 8 years ago
The org-centric features are certainly nice for those who do things manually, through the console though
joshmyers
joshmyersalmost 8 years ago
I agree that where Terraform is concerned, sometimes it is just easier to manage a thing in each account rather than turn on in one and magic behind the scenes, treat others differently.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
i added a bunch more emoji. let me know what i'm missing!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
:cool-doge:
joshmyers
joshmyersalmost 8 years ago
:picard_fail: