#aws - September 2019 | Slack Archive

aws

81 messages

Discussion related to Amazon Web Services (AWS)
Archive: https://archive.sweetops.com/aws/

Aug 2019

September 2019

Oct 2019

Maciek Strömichabout 7 years ago

https://aws.amazon.com/blogs/compute/announcing-improved-vpc-networking-for-aws-lambda-functions/

Alejandro Riveraabout 7 years ago

Is there a way to use wildcards on s3 bucket policies on Principals ? e.g.:
we have:

arn:aws:iam::999999999:role/role-name123456789

would like to do something like:

arn:aws:iam::999999999:role/role-name*

Andyabout 7 years ago(edited)

@Alejandro Rivera Take a look at this:
https://stackoverflow.com/a/56678945/10846194
Ref: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html

You cannot use it as a wildcard to match part of a name or an ARN. We also strongly recommend that you do not use a wildcard in the Principal element in a role's trust policy unless you otherwise restrict access through a Condition element in the policy. Otherwise, any IAM user in any account can access the role.

Shannon Dunnabout 7 years ago

for anyone with using OU and SCPs with lots of accounts inside, how do you manage change of the SCPs and the OU structure it self

Shannon Dunnabout 7 years ago

is it wise to replicate the entirety of the OU structure into a dev,qa,prod, each with its own root etc...

Shannon Dunnabout 7 years ago

especially for hub and spoke modules, things like a logging,transit, shared services, would get their own dev/qa/prod as well

Shannon Dunnabout 7 years ago

or is anyone using IAC to manage SCPs and OU

curious deviantabout 7 years ago

Hey Shannon.. I just started a spike around AWS Control Tower (CT) for multi-account governance and one of the first questions that came to my mind was similar to yours. I think a lot depends on how we organize our OUs. So far I can only speak to the SCP change 🙂 ...How I think I'll go about it is I'll create 3 OU's : DEV , QA and PROD say .. and SCPs changes would be rolled out first to DEV and then higher environments. So basically I would not replicate the OU structure but create separate OUs and move changes through them. This will give me an opportunity to identify and address any breaking changes. For my particular case (using CT), IAC is not an option since CT doesn't expose any APIs yet..everything is pretty much manual/done by CT (logging bucket creation etc). I will be spending sometime on CT further.

curious deviantabout 7 years ago(edited)

Let me know if you have more questions/suggestions.. will help me plan my OU structure better 🙂

joshmyersabout 7 years ago

Anyone seen it look like a CloudWatch rule triggered - i.e. you can see the rule metrics for “invoked” - where invoke invokes a Lambda function…but checking the lambda function that is invoked, doesn’t show any invocations or logs…? I can “test” the lambda function manually and it works fine…

Maciek Strömichabout 7 years ago

maybe cloudwatch events doesn’t have ability to trigger lambda?

Maciek Strömichabout 7 years ago

we had similar issues in the beginning while triggering lambdas behind api-gateway

joshmyersabout 7 years ago

Also seeing this for a different thing but similar issues whereby Cloudwatch alert > SNS > Lambda , it looks like the thing is working, but Lambda isn’t actually invoked and isn’t showing anything in the logs either… but enabling sns delivery notifications…

joshmyersabout 7 years ago

SNS thinks it successfully triggered that lambda function…

joshmyersabout 7 years ago

lambda function thinks otherwise…

joshmyersabout 7 years ago

Can’t see anything in Cloudtrail and this def has worked in the past..

Maciek Strömichabout 7 years ago

maybe lambda isn’t able to save logs ;D

joshmyersabout 7 years ago

It can when I invoke it manually with a test event

joshmyersabout 7 years ago

and the code hasn’t changed that does this, and it was working yesterday… >_<

joshmyersabout 7 years ago

Lambda doesn’t even look like it has been invoked looking at the metrics for it…

joshmyersabout 7 years ago

Also seeing 2 different AWS Elasticsearch clusters 504…while another is OK…all in eu-west-1

joshmyersabout 7 years ago

nvm, swamped ENIs

Brij Sabout 7 years ago

has anyone used github actions with the awscli? The repo has the HCL syntax and im trying it with yml and running into some issues

Marcio Rodriguesabout 7 years ago

Hello, i'm curious about how you guys are doing disaster recover tasks in your company

Marcio Rodriguesabout 7 years ago

Do you guys fully automate it? Run via CI? Do heavy tasks with terraform? How is your plan

Marcio Rodriguesabout 7 years ago

ps: by limited money, i am tasked to not keep a full replicated environment in another AWS region, but i should have a plan to recreate my infrastructure in another region if needed

Brij Sabout 7 years ago

for python lambda packages; do you need to include os and json in the deployment package?

mkabout 7 years ago

Anyone he experienced with setting up an health check between AWS and Aliyun?

Abel Luckabout 7 years ago

since july the session manager should support ssh tunnels

Abel Luckabout 7 years ago

has anyone actually got it working?

asmitoabout 7 years ago

for me no, please share your experience with it, when you experiment it

Abel Luckabout 7 years ago

well first, i discovered that the ssm-agent wasn't up to date on my ubuntu and debian hosts, because they don't release the snap package to the stable channel often

Abel Luckabout 7 years ago

so if you're running the ssm-agent via snap, then you need to switch to the candidates channel

Abel Luckabout 7 years ago

see: https://github.com/aws/amazon-ssm-agent/issues/196

Abel Luckabout 7 years ago

that'll get you the latest ssm-agent version

Abel Luckabout 7 years ago

the docs regarding the new feature are https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-enable-ssh-connections.html

Abel Luckabout 7 years ago

however they aren't working for me, when I execute the ssh command I get the error

Abel Luckabout 7 years ago

debug1: ssh_exchange_identification: ----------ERROR-------

debug1: ssh_exchange_identification: Encountered error while initiating handshake. SessionType failed on client with status 2 error: Failed to process action SessionType: Unknown session type Port

asmitoabout 7 years ago

thanks for sharing your experience will check it with you

Abel Luckabout 7 years ago

Got it working 😄

Abel Luckabout 7 years ago

My local session manager plugin was out of date

Abel Luckabout 7 years ago

so make sure you update the ssm-agent on the ec2 instance, and also your local session manager plugin

Abel Luckabout 7 years ago

https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html#install-plugin-linux

Abel Luckabout 7 years ago

you need session manager plugin version 1.1.23.0 or later, and on the ec2 instance amazon-ssm-agent 2.3.672.0 or later

asmitoabout 7 years ago

Cool, congrats then 🚀

Abel Luckabout 7 years ago

"SessionType failed *on client*" was the clue

asmitoabout 7 years ago

Team, Question regarding Costs please :
- i have created a CNAME record in cloudflare that points to an Internal Load balancer of Nginx, the record will be used just inside the vpc the same region different AZs, normally i will be charged for 0.01/GB of data transfer + load balancing costs, but using cloudflare, does the traffic will be out the vpc to cloudflare and in again ?

joshmyersabout 7 years ago

https://sweetops.slack.com/archives/CBW699XE0/p1568283901015100

Phucabout 7 years ago

Hi Guys, anyone deal with SSM module in terraform. we have a case that we want to use that TF module to read the content in the file and create a list of key-value pairs to put on AWS SSM. Kinda long list in this format:
```
VARA="value"
VARB="value1"
.

Maciek Strömichabout 7 years ago

https://twitter.com/QuinnyPig/status/1172239124251709449

dalekurtabout 7 years ago

Has anyone seen or used AWS Landing Zone solution?

oscarabout 7 years ago

What is the recommended EBS size for Kafka?

Erik Osterman (Cloud Posse)about 7 years ago

Can that be generalized? I think it relates directly to the amount of data you will be storing and the retention

Erik Osterman (Cloud Posse)about 7 years ago

The number replicas you will have

vluckabout 7 years ago

Hiya! Has anyone gotten RDS clusters to work with micro size? (db.t2.micro or db.t3.micro)? Although it's listed in the documentation, I keep getting

InvalidParameterCombination: RDS does not support creating a DB instance with the following combination: DBInstanceClass=db.t3.micro, Engine=aurora-postgresql, EngineVersion=10.7,

Andriy Knysh (Cloud Posse)about 7 years ago

Aurora Support for db.t3

Aurora MySQL supports the db.t3.medium and db.t3.small instance classes for Aurora MySQL 1.15 and higher, and all Aurora MySQL 2.x versions. These instance classes are available for Aurora MySQL in all Aurora regions except AWS GovCloud (US-West), AWS GovCloud (US-East), and China (Beijing).

Aurora PostgreSQL supports only the db.t3.medium instance class for versions compatible with PostgreSQL 10.7 or later. These instance classes are available for Aurora PostgreSQL in all Aurora regions except China (Ningxia).

vluckabout 7 years ago

supports only the db.t3.medium instance class

vluckabout 7 years ago

wow

vluckabout 7 years ago

then it goes on to say

vluckabout 7 years ago

These instance classes are available for Aurora PostgreSQL

vluckabout 7 years ago

like, it should say "instance class", not plural. There is one. 😞

vluckabout 7 years ago

thanks @Andriy Knysh (Cloud Posse)

pabloabout 7 years ago(edited)

Hi, anyone know whats the minimum set of permissions needed to run an EMR "jobflow"? This action creates an emr cluster, executes whatever, then terminates the cluster. I'm setting this up from an ec2 instance running Airflow, and I'm reluctant to give it full admin access

rohitabout 7 years ago

Does anyone know if there is a way to copy all version of S3 objects from bucket to another S3 bucket ?

Maarten van der Hoefabout 7 years ago

@rohit have you tried it with the awscli ?
aws s3 sync

rohitabout 7 years ago(edited)

AFAIK aws s3 sync does not copy all the versions

Maarten van der Hoefabout 7 years ago

the version ID's will get lost but where have you read that it does not copy all versions ?

rohitabout 7 years ago

i tried the sync command before posting my question and it did not copy all the versions

Maarten van der Hoefabout 7 years ago

That's interesting @rohit , versions missing, or was it only copying exactly one version ?

rohitabout 7 years ago

yes it is only copying one version

rohitabout 7 years ago

maybe the latest version

Maarten van der Hoefabout 7 years ago

and have you set versioning to enabled on the destination bucket ?

Maarten van der Hoefabout 7 years ago

probably, otherwise you wouldn't see different versions.

rohitabout 7 years ago

correct

Nikola Velkovskiabout 7 years ago

Hi people, anyone having issues with lambdas and setting reserved-concurrent-executions ?
it seems that it doesn't work but there's no mention on any outages on AWS

Nikola Velkovskiabout 7 years ago

they've just published it

IvanMabout 7 years ago

Guys don’t you pls know whether it’s possible to extract host parts in AWS ALB listeners custom redirection?

My use case is that I will have a host <http://foo.bar.com|foo.bar.com> and inside listener redirect rule I want to extract foo from #{host}

Igorabout 7 years ago

@IvanM I don't think that's possible

August 2019 Browse by date October 2019