#aws - September 2019 | Slack Archive

aws

81 messages

Discussion related to Amazon Web Services (AWS)
Archive: https://archive.sweetops.com/aws/

Aug 2019

September 2019

Oct 2019

Maciek Strömichover 6 years ago

https://aws.amazon.com/blogs/compute/announcing-improved-vpc-networking-for-aws-lambda-functions/

Alejandro Riveraover 6 years ago

Is there a way to use wildcards on s3 bucket policies on Principals ? e.g.:
we have:

arn:aws:iam::999999999:role/role-name123456789

would like to do something like:

arn:aws:iam::999999999:role/role-name*

Andyover 6 years ago(edited)

@Alejandro Rivera Take a look at this:
https://stackoverflow.com/a/56678945/10846194
Ref: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html

You cannot use it as a wildcard to match part of a name or an ARN. We also strongly recommend that you do not use a wildcard in the Principal element in a role's trust policy unless you otherwise restrict access through a Condition element in the policy. Otherwise, any IAM user in any account can access the role.

Shannon Dunnover 6 years ago

for anyone with using OU and SCPs with lots of accounts inside, how do you manage change of the SCPs and the OU structure it self

Shannon Dunnover 6 years ago

is it wise to replicate the entirety of the OU structure into a dev,qa,prod, each with its own root etc...

Shannon Dunnover 6 years ago

especially for hub and spoke modules, things like a logging,transit, shared services, would get their own dev/qa/prod as well

Shannon Dunnover 6 years ago

or is anyone using IAC to manage SCPs and OU

curious deviantover 6 years ago

Hey Shannon.. I just started a spike around AWS Control Tower (CT) for multi-account governance and one of the first questions that came to my mind was similar to yours. I think a lot depends on how we organize our OUs. So far I can only speak to the SCP change 🙂 ...How I think I'll go about it is I'll create 3 OU's : DEV , QA and PROD say .. and SCPs changes would be rolled out first to DEV and then higher environments. So basically I would not replicate the OU structure but create separate OUs and move changes through them. This will give me an opportunity to identify and address any breaking changes. For my particular case (using CT), IAC is not an option since CT doesn't expose any APIs yet..everything is pretty much manual/done by CT (logging bucket creation etc). I will be spending sometime on CT further.

curious deviantover 6 years ago(edited)

Let me know if you have more questions/suggestions.. will help me plan my OU structure better 🙂

joshmyersover 6 years ago

Anyone seen it look like a CloudWatch rule triggered - i.e. you can see the rule metrics for “invoked” - where invoke invokes a Lambda function…but checking the lambda function that is invoked, doesn’t show any invocations or logs…? I can “test” the lambda function manually and it works fine…

Maciek Strömichover 6 years ago

maybe cloudwatch events doesn’t have ability to trigger lambda?

Maciek Strömichover 6 years ago

we had similar issues in the beginning while triggering lambdas behind api-gateway

joshmyersover 6 years ago

Also seeing this for a different thing but similar issues whereby Cloudwatch alert > SNS > Lambda , it looks like the thing is working, but Lambda isn’t actually invoked and isn’t showing anything in the logs either… but enabling sns delivery notifications…

joshmyersover 6 years ago

SNS thinks it successfully triggered that lambda function…

joshmyersover 6 years ago

lambda function thinks otherwise…

joshmyersover 6 years ago

Can’t see anything in Cloudtrail and this def has worked in the past..

Maciek Strömichover 6 years ago

maybe lambda isn’t able to save logs ;D

joshmyersover 6 years ago

It can when I invoke it manually with a test event

joshmyersover 6 years ago

and the code hasn’t changed that does this, and it was working yesterday… >_<

joshmyersover 6 years ago

Lambda doesn’t even look like it has been invoked looking at the metrics for it…

joshmyersover 6 years ago

Also seeing 2 different AWS Elasticsearch clusters 504…while another is OK…all in eu-west-1

joshmyersover 6 years ago

nvm, swamped ENIs

Brij Sover 6 years ago

has anyone used github actions with the awscli? The repo has the HCL syntax and im trying it with yml and running into some issues

Marcio Rodriguesover 6 years ago

Hello, i'm curious about how you guys are doing disaster recover tasks in your company

Marcio Rodriguesover 6 years ago

Do you guys fully automate it? Run via CI? Do heavy tasks with terraform? How is your plan

Marcio Rodriguesover 6 years ago

ps: by limited money, i am tasked to not keep a full replicated environment in another AWS region, but i should have a plan to recreate my infrastructure in another region if needed

Brij Sover 6 years ago

for python lambda packages; do you need to include os and json in the deployment package?

mkover 6 years ago

Anyone he experienced with setting up an health check between AWS and Aliyun?

Abel Luckover 6 years ago

since july the session manager should support ssh tunnels

Abel Luckover 6 years ago

has anyone actually got it working?

asmitoover 6 years ago

for me no, please share your experience with it, when you experiment it

Abel Luckover 6 years ago

well first, i discovered that the ssm-agent wasn't up to date on my ubuntu and debian hosts, because they don't release the snap package to the stable channel often

Abel Luckover 6 years ago

so if you're running the ssm-agent via snap, then you need to switch to the candidates channel

Abel Luckover 6 years ago

see: https://github.com/aws/amazon-ssm-agent/issues/196

Abel Luckover 6 years ago

that'll get you the latest ssm-agent version

Abel Luckover 6 years ago

the docs regarding the new feature are https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-enable-ssh-connections.html

Abel Luckover 6 years ago

however they aren't working for me, when I execute the ssh command I get the error

Abel Luckover 6 years ago

debug1: ssh_exchange_identification: ----------ERROR-------

debug1: ssh_exchange_identification: Encountered error while initiating handshake. SessionType failed on client with status 2 error: Failed to process action SessionType: Unknown session type Port

asmitoover 6 years ago

thanks for sharing your experience will check it with you

Abel Luckover 6 years ago

Got it working 😄

Abel Luckover 6 years ago

My local session manager plugin was out of date

Abel Luckover 6 years ago

so make sure you update the ssm-agent on the ec2 instance, and also your local session manager plugin

Abel Luckover 6 years ago

https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html#install-plugin-linux

Abel Luckover 6 years ago

you need session manager plugin version 1.1.23.0 or later, and on the ec2 instance amazon-ssm-agent 2.3.672.0 or later

asmitoover 6 years ago

Cool, congrats then 🚀

Abel Luckover 6 years ago

"SessionType failed *on client*" was the clue

asmitoover 6 years ago

Team, Question regarding Costs please :
- i have created a CNAME record in cloudflare that points to an Internal Load balancer of Nginx, the record will be used just inside the vpc the same region different AZs, normally i will be charged for 0.01/GB of data transfer + load balancing costs, but using cloudflare, does the traffic will be out the vpc to cloudflare and in again ?

joshmyersover 6 years ago

https://sweetops.slack.com/archives/CBW699XE0/p1568283901015100

Phucover 6 years ago

Hi Guys, anyone deal with SSM module in terraform. we have a case that we want to use that TF module to read the content in the file and create a list of key-value pairs to put on AWS SSM. Kinda long list in this format:
```
VARA="value"
VARB="value1"
.

Maciek Strömichover 6 years ago

https://twitter.com/QuinnyPig/status/1172239124251709449

dalekurtover 6 years ago

Has anyone seen or used AWS Landing Zone solution?

oscarover 6 years ago

What is the recommended EBS size for Kafka?

Erik Osterman (Cloud Posse)over 6 years ago

Can that be generalized? I think it relates directly to the amount of data you will be storing and the retention

Erik Osterman (Cloud Posse)over 6 years ago

The number replicas you will have

vluckover 6 years ago

Hiya! Has anyone gotten RDS clusters to work with micro size? (db.t2.micro or db.t3.micro)? Although it's listed in the documentation, I keep getting

InvalidParameterCombination: RDS does not support creating a DB instance with the following combination: DBInstanceClass=db.t3.micro, Engine=aurora-postgresql, EngineVersion=10.7,

Andriy Knysh (Cloud Posse)over 6 years ago

Aurora Support for db.t3

Aurora MySQL supports the db.t3.medium and db.t3.small instance classes for Aurora MySQL 1.15 and higher, and all Aurora MySQL 2.x versions. These instance classes are available for Aurora MySQL in all Aurora regions except AWS GovCloud (US-West), AWS GovCloud (US-East), and China (Beijing).

Aurora PostgreSQL supports only the db.t3.medium instance class for versions compatible with PostgreSQL 10.7 or later. These instance classes are available for Aurora PostgreSQL in all Aurora regions except China (Ningxia).

vluckover 6 years ago

supports only the db.t3.medium instance class

vluckover 6 years ago

wow

vluckover 6 years ago

then it goes on to say

vluckover 6 years ago

These instance classes are available for Aurora PostgreSQL

vluckover 6 years ago

like, it should say "instance class", not plural. There is one. 😞

vluckover 6 years ago

thanks @Andriy Knysh (Cloud Posse)

pabloover 6 years ago(edited)

Hi, anyone know whats the minimum set of permissions needed to run an EMR "jobflow"? This action creates an emr cluster, executes whatever, then terminates the cluster. I'm setting this up from an ec2 instance running Airflow, and I'm reluctant to give it full admin access

rohitover 6 years ago

Does anyone know if there is a way to copy all version of S3 objects from bucket to another S3 bucket ?