#aws - July 2019

arniam::634880740321:user/ad.dt is not authorized to perform: kms:DescribeKey on resource: arnkms:us-east-1:634880740321:key/ac43ea17-741a-4347-ac04-88d42ffec899

anyone can help me to fix this error

user is trying to access the SQS and SNS and user has full access for SQS and SNS

@vishnu.shukla I think you should remove your account id

@Nikola Velkovski thanks but got fixed i just created a custom policy for KMS and attached to the user and it worked.

@Nikola Velkovski (-:

¯\(ツ)/¯

Oh, I didn't realize that eksctl was a joint effort.

I thought it was only by Weaveworks + community

yeah, awesome tool for creating EKS cluster compared to AWS EKS Console (web)

Anyone create an ALB to point to a KOPS k8 cluster?

heh, interesting read

Hi, I am setting up my qa env using terraform and after the ec2 is provisioned the instance is failing health check. Any suggestions on why this is happening. I am using the right port number for health check.

@Laxman health check from what? A load balancer or from outside?

check security groups in any case

Template format error: Unresolved resource dependencies [] in the Resources block of the template

anyone has any ideas what to look for in cloudformation template?

doesn’t matter. fat fingers putting !Ref without pointing it to a resource

How do you deal with multiple services running on ecs where everyone of them is configured with awsvpc networking?

deal in terms of placing services on instances which e.g. have enough available NICs and doing autoscaling

do you spread applications across multiple clusters and generally don’t care about this issue or do you have a fancy way of having a single ecs cluster with multiple services up and running?

@Maciek Strömich https://github.com/aws/containers-roadmap/issues/7

Great link

(Via previous link)

And for EKS: https://github.com/aws/containers-roadmap/issues/398

Did anyone catch today’s keynote at AWS Summit in NYC?

Any thoughts on AWS CDK for IaC?

This just went GA today: https://aws.amazon.com/cdk/

Aiming at Terraform it seems.

Hello there someone has some experience using app mesh with k8s making routing im different aws accounts? I have the idea to connect a eks pod app with another eks pod app in another account

The request should be do in aws backbone without go out to internet

@Hugo Lesta You can look at using VPC peering.

Is It works with app mesh? Aws support told me that is not possible share app mesh service or be used with cross account role

Now I’m thinking that I should use cloud map to route internally in different accounts using vpc link

The current architecture accounts is

The inbound traffic enters in an account called shared services and this traffic is routed to other accounts but for example, when account A with eks app send traffic to eks in account B , it should be sent using aws backbone instead internet

is there a way to map port 443 on the LB to port 80 on the web server if so where do I make that modification?

Check out your target group configuration

really good article: https://medium.com/containers-on-aws/using-aws-application-load-balancer-and-network-load-balancer-with-ec2-container-service-d0cb0b1d5ae5

is using an Aurora Serverless DB cluster with a Heroku app not possible because of this limitation?

You can’t give an Aurora Serverless DB cluster a public IP address. You can access an Aurora Serverless DB cluster only from within a virtual private cloud (VPC) based on the Amazon VPC service.

that would appear to be the case. that said, you can deploy a connection proxy

e.g. https://github.com/CrunchyData/crunchy-proxy for postgres

and https://github.com/mysql/mysql-proxy for mysql

@Dave Yu actually you should also be able to create an NLB with a target group to an IP

an internet-facing NLB in a public subnet with a target group of Aurora Serverless endpoint IP addresses worked. thanks @Erik Osterman (Cloud Posse)!

ALB you mean

?

nope, network load balancer

@Dave Yu that's awesome! glad there's an easy/reliable/scalable workaround

hey everyone, I have AutomatedSnapshotFailure alarm for my elasticsearch
but i don have any log, any error in cluster (it it green)
does anyone know whot could be a reason of AutomatedSnapshotFailure ?
AutomatedSnapshotFailure = Insufficient data

hey, is anyone using localstack’s cloudformation mocks in their local pipelines?

EKS is ... hmm
Decided to pop an EKS cluster up via rancher... also hmm but with extra (no ones tested this)

Are there any good TF, secure eks with calico network isolation and NLB (my god does EKS feel like its optimized for AWS's wallet)

https://eksctl.io/ seems quite nice

in the world of "lets all make a new tool for every job" 😄

Interesting tool; no userdata for the amis though like tf

The spot configs nice though

It's impressive how they made cloudformation sooooooooo god damn slow

don’t tell me about it

Not being from the parallel universe the created EKS; assuming node groups are dumpable; without manually intervening via the UI like its 1999, is there a way to make sure nodes from the ASG are registered with the ILB
All a chap wants is (private net) ILB > (K8 Workers / nginx ingress)

I tried the k8 ALB module; interesting but who wants to pay per ingress 😄

if i lean back just hard enough I can see that terraform does what I want

in that it unglues the extra cloud formation so I can do stuff that wont evaporate 🙄

The aws eks providers (<https://github.com/terraform-aws-modules/terraform-aws-eks>) pretty nasty; luckily the cloudposse splits it out as I like. Hate nested objects as params in modules (looking at you aws-eks), terraforms dog rough when it comes to isolating things. its nice to have a flat hierarchy of mods 😄

looking for a way - when I have a s3 new file upload, I need Jenkins to trigger a new job --- CAN anyone help me out ?

is there a decent tool to remove all resources within an AWS account?

there are a few of them out there

ooh nuke

thank you

there are quite a few out there.. 🙂

three that are maintained

one thing azure does better than aws is separate the machine from the data; I can resize a vm in azure with a slider / if the hardware under its gone to pot they'll notify you and migrate the machine.
AWS is just one big rotating middle finger to your vms when it comes to stuff like that. Change it yourself; or we've murdered it, hope there wasn't anything important on there

Any folks using fargate here? Good tooling/frameworks?

Am tempted to go with airship as feels robust

But also kinda like the idea of fargate cli for unlimited staging environments

Which means the ECS is out of Terraform control

Don't forget about limit of 50 Fargate tasks per region, per account.

Limits can be changed, fargate is just very expensive if you're doing 50 🙂

Fargate is a lot cheaper than it used to be. Fargate limits can be increased to 1000's if needed. I think I have it at 3000 in 2 accounts.

Anyone have an idea to how to change the the ecs agent docker image directory to use something else instead of /var/lib/docker ?

in an ECS optimized instance the agent is already pulled and started

Hey Folks, Trying to find some Terraform Modules related to AWS - app stream service ( for creating fleets and stacks) any help appreciated

Hi All,
Is there any way to setup alert for RDS Slow QRY log