#aws - December 2020

what, they do not have enough seats?????????

scalpers probably going to sell seats on ebay

HAHAHA lol

Hi, anyone knows if ACM will support a SAN with one of the alternative names as an IP?

Hi, Anyone knows if I can read a Parameter store secret from one AWS account to another? but using TF?

How big do you make your VPC? Is every VPC running with 10.0.0.0/8 IP range, or do you allocate the whole thing a /24 if it will contain one RDS cluster?

Error: invalid value for domain_name (must start with a lowercase alphabet and be at least 3 and no more than 28 characters long. Valid characters are a-z (lowercase letters), 0-9, and - (hyphen).)

on main.tf line 100, in resource "aws_elasticsearch_domain" "default":
100: domain_name = module.this.id

https://aws.amazon.com/blogs/aws/preview-aws-proton-automated-management-for-container-and-serverless-deployments/ looks very interesting 🤔

does anyone know how to get the specific engine version for the most recent postgres family in RDS (12.4 ) ?

I was wondering if anyone is using internet facing and internal ALB at the same time?

why does telnet on every public EC2 ip address on port 80 and 443 connects? Those ports are closed on SGs

anyone know if it's possible to only allow put policy perms on iam roles that contain a permission boundary ?

Been thinking about using these prefixed lists to consolidate security group rules. Has anyone given these a try?

https://aws.amazon.com/blogs/networking-and-content-delivery/simplify-network-routing-and-security-administration-with-vpc-prefix-lists/

AWS' Internal CA is $400 per month? That expensive! And if I want to use SSL for internal microservice communication I have to pay it. And I have multiple regions and multiple accounts...

Is there anyone here who uses it? I could pay $400/month, but for multiple regions and accounts - that's a lot of many.

Is there any alternative?

Thanks!

3 questions, going to separate into separate items to allow threaded response to each if desired.

1. Is there any non-org based root module setup that builds the identity account like prescribed by Cloudposse without using orgs?

2. Identity account should be separate from ORG account. org account = master account that includes the org + billing details right? Just making sure that makes sense. I don’t think the identity account should be mixed with org.

3. If I have a half baked org setup that is mixed up right now and want to start improving, can I create another org and assign accounts that already have link to the other and then disconnect later, or is it a 1 org to 1 account linkage only?

Has anyone worked with Appsync in combination with S3 & Dynamodb ? I can't find any good documentation on how KMS is integrated ? Will it work with CMK's for S3 & Dynamo ?

I want enable Performance insights. But I can’t chose own master key.
This is AWS RDS master DB (also have 2 replicas).
What I need to do?

do you all store your lambda code in the same repo as your terraform that defines said lambda?

Has anyone ever done lambdas around gracefully handling fargate spot termination? This is more of a thought experiment as I'm not looking to do anything around it at the moment due to a lot of uncertainty..

From what I've read, it seems like there's quite a bit involved, at the very least need to ...
- manually deregister the ecs task that is draining due to SIGTERM on the target group side of things as spot termination doesn't do this
- run a new task with the on demand provider

Anything else?

anyone have ideas on how to keep a list of ec2 instances' public ip addresses up to date across all regions in a single account ?

What about using Consul for Service DIscovery ?

i was thinking of a cloudwatch event the triggers off cloudtrail, then invokes a lambda, that updates maybe a google spreadsheet. just spit balling.

wut

We implemented Consul for a big fleet of EC2 instances we have, when the server is being bootrstrapped, it registers itself to Consul with a bunch of information

Including the Public and Private IP address..

ah I see what you mean

We then use the Consul Directory for querying a lot of info about the instances, thus, we avoid hitting the AWS API

that solution seems novel and more benefits with less work

To be honest, we are super happy with Consul, we manage around 300 EC2 instances with a small Consul cluster

we don't have a service discovery at the moment. we'd have to align on that first then 🤔

3 t2.medium instances for the Consul cluster

in my org it's easier to bring in an aws specific version. i wonder what the aws service discovery is

cloud map ?

Hmmmm to be honest, we haven't explored the AWS option

im sure it's more expensive

for us , Consul is free and super easy to implement

Understood

is anyone using fugue.co at all?

i am looking at automating the creation of accounts in fugue when we create an AWS account via terraform

was wondering if anyone has already done this and if so what approach would they recommend?

Don't suppose anyone is able to please summarise policy/controls for doing a S3 bucket which allows GetObject from within VPC but denies otherwise?
We want:
1. http service that we can dump files in, hence S3.
2. anything in VPC can GetObject it (not sensitive even if got out to world), specifically k8s pods without IAM providing they have egress 443.
3. specific IAM can write to it as per usual.
I'm trying to understand whether I want to Allow on condition of aws:sourceVpc and specific actions (listbucket, GetObject, etc).
Because then I can add allow for specific users/roles to PutObject, or if I want to use Deny per below:
https://aws.amazon.com/premiumsupport/knowledge-center/block-s3-traffic-vpc-ip/

Also how that might work with a typical Public Access Block?

resource "aws_s3_bucket_public_access_block" "aaa" {
  bucket = aws_s3_bucket.aaa.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

Does PagerDuty support inbound Cloudwatch Events/EventBridge as triggering incidents?

All the examples provide metric based alerting.

I configured an event that triggers on IAM policy change. This is event driven, not metric.

I am not seeing any triggered events in PagerDuty as the endpoint with SNS messages. Looking for any examples, or if I’m just trying to do something that isn’t supported.


UPDATE: I was using enqueue url. I think instead this is using the Events API not the cloudwatch api, meaning i should use: <https://events.pagerduty.com/x-ere/>

has anyone successfully run a Java AWS lambda container? https://docs.aws.amazon.com/lambda/latest/dg/java-image.html I’m having issues getting their dockerfile to work with a jar

how do you all manage the ssm-user on your ec2 instances ?

since we've been pushing people more to ssm, we've realized things like the ssm-user is not in the docker group for instance so it needs to be added. have you all noticed other issues that requires additional configuration to make the ssm-user a viable alternative.

this is for things other than console access?

Hi All, curious if you know how often Aurora fails over to it's replicas?

We're standing up 1 aurora instance and loading it with a ton of data. we noticed yesterday it restarted twice and stalled once. we didn't have any replicas, so we had downtime (as expected). But just curious with 2+ replicas, are the failovers seamless from your experiences?

Hi All , wrong channel probably , but trying to automate a git push every day ( may be even more frequent) , is there a git command to only add files that changed and untracked files , I'm using git add . For now , but that won't work as I have to force push it everytime , kinda defeats the purpose of version control

this might be a dumb question but is it straightforward to create an internet facing alb that has a listener that redirects all traffic to say <https://asdaslkdjaslkdjalskdjalskdjalskdj.com> ?

you add a listener rule

and do a Redirect to whatever you want

and you will need a cert that is capable of recognizing whatever name is in the host header

ah ok so that's what i thought. i was clicking in the ui and was havign some difficulty. i should just terraform it and see if it works

thanks

thought i was going a bit crazy

I have done it using the cloudposse modules too

so I know it works

Hi guys, any way to migrate from RedisLabs to ElastiCache (redis)? I can’t loose data, so I need live sync between them.

does anyone have a diagram handy, showing ALL the networking components of a standard architecture using the best practices? something like the following, but with ALL the bits like IGW/RT/ACL/SUBNETS (public/private)/NAT/AZ/ALB/etc.. u get the idea 😅

Any sshuttle people here?

Hey 👋 Having a short question.

Imagine an organisation has different application envoronments. Lets say two of them. Prod and test.
What are some good practises to have these environment split as your aws?

Do you simply replicate the whole infrastructure and use different tags and so on or is there a “cleaner” way to do so?

Anyone know a solid way to monitor if/when RDS has a failover? We have a slightly atypical RDS setup that needs fixing, but in the meantime, I’m looking for a good way to monitor when a failover does happen in an RDS cluster. I looked at CloudWatch but didn’t see a good way to actually monitor that state.

Anybody else in us-east-1 seeing issues with NAT Gateway?

Hi,
How to migrate, RDS instances from one AWS account to another AWS account, with Data n all,
Thank you.

create replica cluster from a snapshot to another region, or just create a cluster from snapshot

I'm thinking about creating an account dedicated to storage within my AWS Org --

My initial plan is to consolidate the S3 bucket sprawl I have between accounts into a single bucket within that account that provides my Org access to write and each account access to read it's files using a prefix condition on the bucket policy.

Bucket sprawl for Service logs: VPC Flow, S3 Access, CloudFront logs, etc -- application buckets would remain in their account....not looking to fix that sprawl.

Any words of wisdom or horror stories that I should be aware of before I embark on my quest? 😄

If someone had access to that account, they have have access to all buckets? You will need to guard the policies really well

I think sprawl is a necessary evil 😈 if your goal is to limit blast radius, and IaC is supposed to help you to achieve that

Don't put all your eggs in the same basket

I'm not trying to put all buckets there. at this point I really only want to consolidate all the service logging into a centralized bucket, but I would grow this account into org wide storage as needed.

I understand the perception that is a bigger security risk to put everything into a single account, but at the same time it seems like it would be better to create a single walled garden rather than try to create dozens/hundreds of them.

Launching a new EC2 instance. Status Reason: Could not launch On-Demand Instances. InvalidParameterValue - You cannot specify tags for Spot instances requests if there are no Spot instances requests being created by the request. Launching EC2 instance failed.	

Bit of a bummer this I guess... scenario:
1. Launch Template which configured Tag specification for instance, volume, spot-instances-request.
2. ASG which uses above Launch Template, with a mixed instances policy ...
3. You then ask for anything except 100% spot on the above ASG.

I just wanted my spot instance requests to get tagged properly. Guess I have to manage without the requests being tagged 😃.

tl;dr - https://ec2throughput.info/ - neat

Hi everyone,

I'm currently trying to create a redirect rule for an ALB Load balancer.

The generic format for the redirect target is as follows:

http://#{host}:#{port}/#{path}?#{query}

I have then changed it to

<http://example.com:80/dGVzdAo=?#{query}>

The issue with the specific path in the above url dGVzdAo= is, that it includes an equal sign (=). and AWS reports as: Invalid URL scheme

I tried %3D instead, but this also results in an Invalid URL scheme error from AWS.

The web page I am redirecting to, does however need this equal sign (=) at the end.

Do you guys know of any workaround to somehow get this equal sign into the redirect target of the ALB rule?

I'm thinking about a bucket archival process for my Org, rather than giving users permissions to delete buckets directly (even with MFA) I'm thinking about giving them access to add a resource tag: ArchiveRequested: $userName

My plan would be to create a scheduled job that queries buckets with the tag and moves their contents to an S3 Bucket w/an Archive Policy then delete the origin bucket: s3://<regionalArchiveBucket>/<account>/<originBucketName>/

1. Can I restrict access to create tags so that the value has to match their username
2. Am I overthinking this? Or is there something already out there that I should be using?