#aws - December 2019 | Slack Archive

56 messages

Discussion related to Amazon Web Services (AWS)
Archive: https://archive.sweetops.com/aws/

Nov 2019

December 2019

Jan 2020

curious deviantabout 6 years ago

I am following https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/ to setup IAM roles for my pods. While trying to execute the command

aws sts assume-role-with-web-identity \
 --role-arn $AWS_ROLE_ARN \
 --role-session-name mh9test \
 --web-identity-token file://$AWS_WEB_IDENTITY_TOKEN_FILE \
 --duration-seconds 1000 > /tmp/irp-cred.txt

I am getting the error :

An error occurred (AccessDenied) when calling the AssumeRoleWithWebIdentity operation: Not authorized to perform sts:AssumeRoleWithWebIdentity

What am I missing ?

curious deviantabout 6 years ago

I figured this out 🙂 .. I wasn't setting the namespace (non-default) in the assume-role-policy json

lorenabout 6 years ago

Anyone at reinvent this week?

Erik Osterman (Cloud Posse)about 6 years ago

Checkout #aws-reinvent

Issifabout 6 years ago

Hi, my company I've just open-sourced a tool I've written. I didn't know any other which is as accurate and faster. Hope it will be useful for some : https://github.com/claranet/aws-inventory-graph

vluckabout 6 years ago

Hello AWS friends. I'm trying to create a aws_rds_cluster and for the life of me I can't find a match for engine, and engine_version, and cluster_family (and probably instance_type while I'm at it. I want mysql (or aurora-mysql). I think I'd prefer 5.7 but I'd be happy with 5.6. I keep getting the error

InvalidParameterCombination: RDS does not support creating a DB instance with the following combination

vluckabout 6 years ago

I've look over so many "documentation" pages but nowhere can I find a chart that tells me what is compatible with what.

vluckabout 6 years ago(edited)

Ok, so in a stroke of genius (or more likely dumb luck) -- I found my answer: use the aws cli to tell me ~~ I had no idea. First get the possible engine combinations:

vluckabout 6 years ago

aws rds describe-db-engine-versions | jq '.DBEngineVersions[] | ([.Engine , .EngineVersion, .DBParameterGroupFamily])' -c
["aurora-mysql","5.7.12","aurora-mysql5.7"]
["aurora-mysql","5.7.mysql_aurora.2.03.2","aurora-mysql5.7"]
["aurora-mysql","5.7.mysql_aurora.2.03.3","aurora-mysql5.7"]
["aurora-mysql","5.7.mysql_aurora.2.03.4","aurora-mysql5.7"]
...many rows omitted

vluckabout 6 years ago(edited)

then choosing the possible instance combinations:

aws rds describe-orderable-db-instance-options --engine aurora-mysql --engine-version 5.7.12 | jq '.OrderableDBInstanceOptions[] | ([.Engine, .EngineVersion, .DBInstanceClass])' -c
["aurora-mysql","5.7.12","db.r3.2xlarge"]
["aurora-mysql","5.7.12","db.r3.4xlarge"]
["aurora-mysql","5.7.12","db.r3.8xlarge"]
["aurora-mysql","5.7.12","db.r3.large"]
...many rows omitted

vluckabout 6 years ago

AND IT WORKED. Yey. Thx.

Maciek Strömichabout 6 years ago

anyone using django-amazon-ses with SES domain configured in another account?

Maciek Strömichabout 6 years ago

(i know it’s not aws specific but couldn’t find a better place to ask)

Phucabout 6 years ago

Hi Guys I have a question about EBS snapshot:
in our case we gonna take snapshot of 3 volume which is 100GB. snapshot gonna take daily, expected change volume is 2% per day as 2gb. Retention not couted yet. so total cost just for EBS snapshot is around:

Total snapshots: 30
Initial snapshot cost: 100 GB x <tel:00500000000|0.0500000000> = 5 USD
Monthly cost of each snapshot: 2 GB x <tel:00500000000|0.0500000000> USD = 0.1 USD
Discount for partial storage month: 0.1 GB x 50% = 0.05 USD
Incremental snapshot cost: 0.05 USD x 30 = 1.5 USD
Total snapshot cost: 5 USD + 1.5 USD = 6.5 USD
6.50 USD x 3.00 instance months = 19.50 USD (total EBS snapshot cost)

So anyway this ebs snapshot can be reduced ? ( retention policy on snapshot )
And if the snapshots taken remained to the next month, will the cost stay the same from the above or it will increase somehow

Rudyardabout 6 years ago

Hi guys, some one here was migrate ec2 containers to ECS ??

joshmyersabout 6 years ago

What is your questiob @Rudyard?

Rudyardabout 6 years ago

I have one environment with some microservices running in EC2 but I want to migrate to AWS ECS with the same ECS, it's that possible?

joshmyersabout 6 years ago

I take it you are not wanting to go to Fargate then?

joshmyersabout 6 years ago

You could install the ECS agent on the currently running instances and have them talk to ECS, but I’d likely stand up a new cluster with the agents on and cut over traffic once you are happy with it

Rudyardabout 6 years ago

thanks @joshmyers

Brij Sabout 6 years ago

I login to an aws account through okta. It is read only. There is an iam role id like to assume in the same account which would let me approve codepipeline. Is this possible?

Brij Sabout 6 years ago(edited)

The trust policy princial for the iam role is set to the account number of the said read only account

Brij Sabout 6 years ago

but I get the following error when trying to assume the role

Could not switch roles using the provided information. Please check your settings and try again. If you continue to have problems, contact your administrator.

Brij Sabout 6 years ago

any ideas/tips?

lorenabout 6 years ago

AssumeRole is not a read only action. Probably need to modify the read only role with a policy that allows you to assume the role you want

timduhenchanterabout 6 years ago

I have configured a VPC PrivateLink back to an ASG that acts as a TCP Proxy to RDS due to CIDR collision across VPCs. I understand this is less than ideal but the overhead from this proxy is staggeringly slower than hitting the RDS LB intra-VPC. Assuming that at present I cannot use VPC Peering is there anybody that might have a better architecture for hitting RDS across these VPCs with less overhead?

Madhavan Thiyagarajanabout 6 years ago

Hi there.. I am a newbie for AWS system manager[SSM].. I am trying to invoke a lambda function through the automation document. The lambda function expects two input args which is supposed to be passed in as mandatory input parameters to the document while execution. I am trying to configure the lambda function as the only step in my automation document. I couldn't figure out how to pass in the two input parameters[tagKey & tagValue] into my step.1 lambda function.. I couldn't figure it out from AWS docs. Maybe too naive/dumb.. here is my current document

schemaVersion: '0.3'
parameters:
  tagKey:
    type: String
  tagValue:
    type: String
mainSteps:
  - name: script
    action: 'aws:invokeLambdaFunction'
    inputs:
      FunctionName: getInstances

Madhavan Thiyagarajanabout 6 years ago

I got it working now

schemaVersion: '0.3'
parameters:
  tagKey:
    type: String
  tagValue:
    type: String
mainSteps:
  - name: InvokeLambda
    action: 'aws:invokeLambdaFunction'
    inputs:
      FunctionName: getInstances
      Payload: |-
        {
          "tagKey": "{{tagKey}}",
          "tagValue": "{{tagValue}}"
        }

davidvasandaniabout 6 years ago

Anyone else just have a couple minutes of network issues in us-east-1

William Fishabout 6 years ago

Hey people. I'm confused by aws s3 permissions. I'm using an admin user and getting 403 when trying to upload a package to my bucket using REST.PUT.OBJECT when I use the go sdk

William Fishabout 6 years ago

But succeed when using the python sdk (using awscli)

William Fishabout 6 years ago

I enabled access logs for a bit and can see in the output the following:

William Fishabout 6 years ago

47f98aca4f8daea37b80eff11d8c5665183bbe5982ba3468ee855c24541e5aa9 <bucket-name> [16/Dec/2019:16:56:03 +0000] 88.97.110.121 arn:aws:iam::<account-number>>:user/william 0D07E35C2A2D59AA REST.PUT.OBJECT pool/main/n/nodejs/nodejs_8.16.2-1nodesource1_amd64.deb "PUT /pool/main/n/nodejs/nodejs_8.16.2-1nodesource1_amd64.deb HTTP/1.1" 403 AccessDenied 243 - 3 - "-" "aws-sdk-go/1.13.31 (go1.12.6; linux; amd64)" - MPnRd23yUt/d7UE7rcQcthmcpQX1hazCQLjLW1aTjXXx44Fh1gIdDO1yGlWIgQ6UigqOmeBbt3I= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader <bucket-name>.<http://s3.eu-west-2.amazonaws.com|s3.eu-west-2.amazonaws.com> TLSv1.2

mfridhabout 6 years ago(edited)

for EFS storage on Amazon ECS tasks - rexray vs CloudStore vs any of the other things that popped up since 2017... rexray seems like a good bet, right?

curious deviantabout 6 years ago(edited)

Hello..I am trying to access AWS Secrets Manager in python code which is deployed as a pod to EKS. I haven't enabled IRSA yet and the nodes have access to Secrets Manager, however the pod errors out saying unable to locate credentials. Why is boto not able to generate the temporary creds using the node role that the pod is deployed to? What am I missing please? Here's my code :

session = boto3.session.Session()
            client = session.client(service_name='secretsmanager',
                                    region_name=os.environ["AWS_REGION"])

Issifabout 6 years ago

I just released a new version, with a better look for lists and proxy availibilty : https://github.com/claranet/sshm/releases/tag/1.1.1

btaiabout 6 years ago

rds related question - for gp2 rds databases that have burstable iops, is the rds database supposed to be just as performant at 100% burst balance as it is at say 15% burst balance? Is it only once you get to 0% burst balance that your rds database gets essentially throttled?

Carlos Tovarabout 6 years ago

hi everyone, I’m currently using CloudCheckr as an AWS cost reporting tool but I am not too happy with it. Does anyone have any recommendations for AWS cost reporting/management tools?

PePe Amengualabout 6 years ago

we used cloudcheckr

PePe Amengualabout 6 years ago

we endeup using cost explorer

PePe Amengualabout 6 years ago

with some custom reports

PePe Amengualabout 6 years ago

with all our accounts in AWS Organizations

PePe Amengualabout 6 years ago

in the “billing” org

Carlos Tovarabout 6 years ago

@PePe Amengual - what was the reason to drop cloudcheckr? (if you can share)

Erik Osterman (Cloud Posse)about 6 years ago

We've been using Metabase with Stitchdata to load the CSV into our own data warehouse

Erik Osterman (Cloud Posse)about 6 years ago

but it requires a lot of SQL fu

Erik Osterman (Cloud Posse)about 6 years ago(edited)

(this is for cloudposse internal, not customers)

PePe Amengualabout 6 years ago

same as you, cost reports were not that clear, price, overcrowded UI, lack of API etc

Carlos Tovarabout 6 years ago

@Erik Osterman (Cloud Posse) may skip that option 😄

Erik Osterman (Cloud Posse)about 6 years ago

haha

Carlos Tovarabout 6 years ago

the homegrown option

Erik Osterman (Cloud Posse)about 6 years ago

😃

Igorabout 6 years ago

If I need to add a custom host mapping on an ECS Fargate container running in awsvpc networking mode, what's the way to do it?

Igorabout 6 years ago

Do I need to modify /etc/hosts in the container on startup? Or is there a better way, maybe through Route 53?

Igorabout 6 years ago

(unfortunately extraHosts on the task definition doesn't work with awsvpc mode)

Sergeyabout 6 years ago

Hi guys!
Have someone tried to send CloudWatch alarms to the Slack using sns+aws-chatbot?

Does it work?

November 2019 Browse by date January 2020