#aws - February 2020

Hey, does anyone seen a boto3 behaviour where 1st request fails with unable to find credentials exception? I’ve recently started to observe this behaviour on an multi-docker elastic beanstalk environment (which until ~thursday was running flawlessly). For me it happens only when a new instance is brough up by autoscaling and worker starts to send records to firehose. What’s even more strange is that when debug was enabled to have a littlebit more verbose output in the logs for boto problem perished.

For those who use CircleCi, how do you manage rotating the IAM User credentials you supply to your CI workflows?

I am trying to replace a bastion host that was used for port forwarding an RDS db to localhost, and replace it with an EC2 with SSM permissions. The command we used before was ssh -i ${sshPrivateKeyPath} -L ${localPort}:${remoteDbUri} -Nf ${publicBastionUri}

remoteDbUri would be something like db.private:5432, with both a private DNS name and a port.

In SSM, I found the AWS-StartPortForwardingSession document, but that won't let me specify the db.private part I need.

Anyone know how I can do this?

Finally an updated cli with binary distribution and built in SSO support

Well, AWS SSO support... At least there is credential_process for others I guess

for when when your builds break after upgrading:
https://docs.aws.amazon.com/cli/latest/userguide/cliv2-migration.html#cliv2-migration-ecr-get-login

ecr get-login has been removed and replaced with ecr get-login-password

or actually

RTFM The older aws ecr get-login command is still available in the AWS CLI version 1 for backward compatibility.

ignore me 😄

Hello, I am trying to attach an CSV file from local to email as attachment AWS CLI (SES)
First i tried

cat <<EOF > ./message.json
{
  "Data": "From: <mailto:from@example.com|from@example.com>\nTo: <mailto:to@example.com|to@example.com>\nSubject: Report\nMIME-Version: 1.0\nContent-type: Multipart/Mixed; boundary=\"NextPart\"\n\n--NextPart\nContent-Type: text/plain\n\nReports: report\n\n--NextPart\nContent-Type: text/csv;\nContent-Disposition: attachment; filename=\"report.csv\";\npath=\"report.csv\"\n;Content-Transfer-Encoding: base64;\n--NextPart--"
  }
EOF
cat message.json
aws ses send-raw-email --raw-message <file://message.json>

i also tried modifying

  {
"Data": "From: <mailto:from@example.com|from@example.com>\nTo: <mailto:to@example.com|to@example.com>\nSubject: [Subject]\nMIME-Version: 1.0\nContent-type: Multipart/Mixed; boundary=\"NextPart\"\n\n--NextPart\nContent-Type: text/plain\n\n[Body]\n\n--NextPart\nContent-Type: text/comma-separated-values;\nContent-Disposition: attachment;\nContent-Transfer-Encoding: base64; filename=\"report.csv\";\npath=\"report.csv\";--NextPart--"
}

Both the methods didn't work for me, not sure how to modify next to achieve what i am trying to do ?

@Erik Osterman (Cloud Posse) does the maintainer of ssm-diff live in this slack? rofl
https://github.com/runtheops/ssm-diff/pull/27

Looking for some free tool/options/advice to generate Reports based on CPU utilization of EC2 instances, primarily to check if they cross above 80% and 10 % between certain period ? Thoughts ?

Does CloudWatch+Excel not meet your use case?

Hey someone are already use "Provisioned Concurrency Lambda" to avoid cold start ?
I have always on X-RAY some request with "Initiliazation" on Lambda....
The article : https://aws.amazon.com/fr/blogs/aws/new-provisioned-concurrency-for-lambda-functions/

@UUB28NLDS help keep tabs! 😉

sorry for the rant but why does it suck so hard to deploy an eks cluster on aws with terraform? This is the most unusable provider I have seen so far.

Please elaborate

I think the right answer would be, "Please vent more" 😄

It takes 18 different resources to deploy a single eks cluster.. With Digital Ocean I get the same in 11 lines https://github.com/helm-notifier/Terraform-Infrastructure/blob/master/01-base/digitalOceanK8s.tf with azure I can get the same in 30 lines .. I do not need autoscaling groups to get started.. 😄

Like I get that AWS is hard to get into but this is just .. not fun?

example is taken from here; https://github.com/terraform-providers/terraform-provider-aws/tree/master/examples/eks-getting-started

Pierre, SaaS is always more fun than IaaS , you just have to select your poison 🙂

wait till you see ECS 😛

puuuuuuuuuuuuh.

Well anyways I got it working..

but it took me like 6 hours

I just needed to vent I am sorry.. 😞

if you’re part of APN you can get funding via Innovation Sandbox: https://aws.amazon.com/partners/funding/

looking for strategies to use in bash scripting (hope it's fine asking here as it uses aws-cli)
I got this far using jq from the json output of aws cloudwatch get-metric-statistics

Instance-ABC
19.514049550078127  
12.721997782508938  
13.318820949213313  
15.994192991030545  
18.13096421299414 

Instance-BCD
19.5140495 
12.7219977 
13.3188209
15.9941929  
18.1309642
13.3188209
15.9941929  
18.1309642 

I want to achieve

Instance above 70% 
Instance-ABC
Instance-BCD

Instances below 20% 
Instance-EFG
Instance-HIJ

lets see your current query

Does anyone has experience setting up codepipeline for all the branches ? I want to run default pipeline for any branch the code is pushed to / created new branch

Hey folks — Just realizing having 4 NAT Gateways (one for each private subnet) across 2 VPCs is costing a client 120 bucks a month (0.045/hour 24 30 * 4). That’s almost a 1/3 of their bill at the moment as this is a small application that is still in Development…

That seems outrageous, but I do understand that’s nice to not have to manage a NAT instance. For those of you that have to deal with cost a lot — Do you just eat the cost or is there any cost mitigation tactic on that front?

Good day, community, are there any best practices for naming convention for internal hosted zones in AWS world with Route53 with consideration of ACM certificates (use public domains to approve private names 🙂 ) and environments like dev or prod, regions & multiple aws accounts, clouds?

Hey guys, I have a pretty annoying problem with ECS. I'm using AWS Batch which manages an ECS cluster that uses regular EC2 instances. Once a day I run ~50 batch jobs (i.e. ECS tasks) in parallel. Everything is fine, except when the container exits the task fails with CannotInspectContainerError: Could not transition to inspecting; timed out after waiting 30s. My research has brought me to believe it may be related to exhausted IOPS, but after increasing IOPS the errors keep coming in. Has anybody experienced the same?

Since we are on the topic of ECS, I got a confirmation from AWS Support today that Fargate performance is not guaranteed. We have noticed significant differences in cpu performance between regions, and Fargate also seems to be frequently outperformed by T2 instances. AWS recommendation was to switch to using EC2-backed ECS setup.

Good to keep in mind, especially since now Fargate is available for EKS as well

does anyone know what’s the best way to develop,test and deploy AWS lambda functions ?

Anyone have any experience with setting up cross account cloudwatch logging in aws ? Like sending cloudwatch logs of one account to another

i don't suppose anyone knows of a magical tool to inspect cloudformation templates and then spit out an iam policy for creating/update/deleting those resources?

As in finding out what permissions a CFN template is gonna require to allow you to run it? No, if you find one 👍️

Anyone know when AWS are going to add K8 1.15 to EKS

nvm im just slow on the go

Hey folks — new to CloudFront usage here… I have a Django application that has 3 concerns in regards to CDN caching:
1. CMS Uploaded Media Files — All Stored in a S3 bucket.
2. Javascript / CSS Static Files — Served by the Django application via whitenoise (CDN cache management package).
3. Basic HTML caching. Will have a blacklist for HTML paths that shouldn’t be cached.
Now for the actual question at hand: Should I have two CloudFront distributions or one?

The two CDNs would work where all S3 content is served by one CF distribution and the other CF distribution has the application as it’s origin and it serves the Static + HTML files.

The one CDN option would serve content from both the Application and the S3 bucket.

I think one CDN would be ideal as it’s less to manage, but I’m actually just confused on if this is possible since CF has such a wide footprint in terms of configuration / usage.

Any thoughts / suggestions on a path forward here? Gonna start reading more into CF, but figured someone here would have a quick: “Yes do the second option” or “No that’s not possible, you’ll need two”.

it could be (and we usually do it like this) one CF distribution with two Origins (one from the load balancer for the Python app, the other is for the S3 bucket), and a few behaviors. e.g. one behavior could be for the S3 origin and to cache everything, another could be for the load balancer origin for the static files (and caching), another for HTML files with possible diff caching rules, and a behavior for the blacklist path with no caching

@Andriy Knysh (Cloud Posse) Cool — Yeah digging around and I’m starting to understand that’s possible and likely the correct route to go down. Thanks for weighing in!