New answers tagged

0

Amazon SES wasn't really designed or intended for this purpose. It's main purpose is for use as a "transactional" email service; sending email from your websites, applications, etc. It's not a proper email "hosting" service. You can have SES deliver your email to an S3 bucket but then you'll need to figure out how to retrieve that email from the S3 bucket. ...


1

The SSL certificate on your server is not usable in this configuration. You're bypassing validation with curl, but CloudFront (sensibly enough) provides no such bypass mechanism. Your cert must match either the origin hostname or the Host: header in the original request, if you have the Host: header whitelisted for forwarding to the origin. If your ...


0

Do the upgrade ahead of time. Launch a fresh RDS from the snapshot. This instance will be temporary. Upgrade the new instance to your desired version. Create a new snapshot. Use this new snapshot for your new RDS instance.


0

This now works, I requested a certificate from Certificate Manager and assigned to my US West (Oregon) Elastic Load Balancer. I added an EC2 instance to the ELB and had the ELB point to port 80 on the EC2 instance, not port 443 (this is some what faster I suppose). The ELB will then encrypt the connection between the user and the EC2 instance. It is things ...


1

The following steps were needed to achieve my goal. echo "200 VPN" > /etc/iproute2/iproute ip route add default via 10.0.0.200 table vpn ip rule add from 10.8.0.0/24 lookup vpn Which gives me the following.


1

Raptor, There are really two main ways of setting up mail boxes. The first is the default when the mailbox is associated with a unix/linux id. The second method is to create a service id in linux and use it to serve all email. The second one is the one you want and the setup is a little more complicated than the first. It appears that you have implemented ...


0

OK, I figured it out. It looks as though in MyISAM tables, my query against name and description fields works even without a separate FULLTEXT key for name or description. Ie, in my definition above, you can see that I have added one FULLTEXT INDEX for the combination of name_description, but in my query I'm targeting those columns individually as well. ...


0

You can use Minio client aka mc, It is open source and compatible with AWS S3. You can use Minio client ``mirrorcommand to do the upload. Minio client also hasresume session` command which will upload the object where it was left in last disconnect. Example: $ mc cp myminio92/atul/yEd-3.15.0.2_with-JRE8.dmg play/kline ....0.2_with-JRE8.dmg: 7.13 MB / ...


1

CloudFormation itself doesn't have the feature you describe currently. Amazon has acknowledged something similar to a --dry-run feature for the create-stack command would be useful, e.g. this thread: https://forums.aws.amazon.com/thread.jspa?threadID=122514 Suggested workarounds: Split up stacks into smaller chunks (nesting) and then run them ...


1

I found the problem. The gateway for 10.0.2.x was wrong. I fix it and it's working. ec2-user@ec1 ~# route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default ip-10-0-1-1.ec2 0.0.0.0 UG 0 0 0 eth0 10.0.1.0 * 255.255.255.0 U 0 0 0 ...


1

Pick one? The 4, are roughly speaking, mutually incompatible (I suppose you could use Chef to install/start the docker containers or something). B is probably right out as strictly worse than the others but the rest are all fine depending on your existing workflow and tooling.


0

If your challenge is that you need to change the permissions after your application has been deployed, then you'll need to use a post-deploy hook. Unfortunately post-deploy hooks are not officially supported by AWS, but they seem to be pretty widely used. I done similar things using the technique described here: ...


1

The question is premised on incomplete information. An AMI consists of one or more snapshots -- which are billed exactly the same as any other snapshot -- plus a few bytes of metadata. There is no documentation of a charge for storing the metadata that I am aware of. If it is billable, it will be such a small charge as to go unnoticed. If you are going ...


1

So I figured out the answer. The problem was due to the bad query design. (This query was coming from a Wordpress Plugin, so it's not surprising). The third join was not only worthless, it was attaching "creating" 1 record in the result set for every record in the Post Meta table that had wpcr3_enable set to 1 * every record in the WP Post table, resulting ...


0

At the time of AWS instance creation you will get a private key to download and you need to use this key to connect to the server. Please see how I am connecting to my aws ubuntu instance. Ex: ssh -i /home/user/Downloads/aws_key.pem ubuntu@xx.xxx.xxx.xxx -v Here aws_key.pem is the private key that I have downloaded at the time of instance creation. I ...


0

Thankfully, I managed to get this configured using only .ebextensions configs. I created the following config file... packages: yum: httpd24-devel: [] commands: xsendfile_download: command: wget https://tn123.org/mod_xsendfile/mod_xsendfile.c cwd: /home/ec2-user ignoreErrors: true xsendfile_install: ...


1

It's possible to copy an unencrypted EBS snapshot to an encrypted EBS snapshot. So the following process can be used: Stop your EC2 instance. Create an EBS snapshot of the volume you want to encrypt. Copy the EBS snapshot, encrypting the copy in the process. Create a new EBS volume from your new encrypted EBS snapshot. The new EBS volume will be encrypted. ...


0

The snapshot process shouldn't be visible to the instance. The real problem would come when you try to restore from the "unclean" snapshot. If a process is writing to the volume (or rather, to an open file descriptor for a file on the volume), write requests in the instance's kernel cache may not be written to disk, or may only be partially written. These ...


0

The following process worked well for us to convert our existing EBS volumes to be encrypted volumes. Create a volume of the same exact size and in the same availability zone as the unencrypted volume but with encryption enabled. If the old volume is named "XYZ", name the new volume as "New XYZ" so you don't lose track of it. We are using the default AWS ...


1

There are a variety of solutions for this. OpenVPN will work, but my preferred solution is to set up an L2TP over IPSEC VPN, using an OpenSwan VPN server inside your AWS VPC. IMHO, IPSEC VPNs are a better option that SSL/TLS based VPNs (eg OpenVPN), given all the issues with SSL over the last few years. This allows you to create a local VPN connection on ...


0

You can download a complete list of IP address ranges used by AWS, and get your clients to whitelist the lot. They will need to update the whitelist when the list is updated. Or just tell them to whitelist 0.0.0.0/0.


0

AWS directs traffic to its ELBs via its Edge network, so the ip address that the request arrives at will depend on the ip address from where the request originated at. From that point of view, you can't reliably pin-point which ip addresses your clients requests will go to. You can deploy internal ELBs which exist inside VPCs. These will have fixed RFC 1918 ...


0

It should just work if you add the Alias tag query as you did the Name query: aws ec2 describe-instances --filters "Name=instance-state-name,Values=running" --query 'Reservations[].Instances[].[ [Tags[?Key==`Name`].Value][0][0],[Tags[?Key==`Alias`].Value][0][0],PrivateIpAddress,State.Name ]' --output json


0

The AWS instance install is the most obvious common point in this scenario, followed by your internet connection / router. First try ssh'ing in from a spot instance in the same AZ and check it's reliable, to make sure it's not your VM. You could try from an AZ in a different region to double check. This should cost you around 10c total. Next try from a ...


0

I would bet that you have one query which is particularly slow. When this runs the connections pile up behind it. I'd start by identifying the problematic query and then figure out how to fix it.


0

These two domains ideally considered as one. So they do not need two various certificates. At present, most of SSL certificates (Comodo, RapidSSL) support both WWW and Non-WWW version of domain name. So both version of your domain name example.com and www.example.com will be supported by HTTPS. Therefor you will have to set 301 redirection of example.com to ...


1

Well, if you want to disable the default ubuntu user (a reasonable thing to do), you will need to add another user to the system that you will use to connect via SSH. Needless to say, this second user should have sudo privileges.


0

In many cases, there is no reason to use a CNAME. You have a single public IP address, so point an A record at your IP address, to avoid the second lookup that a CNAME requires. Also, for example.com (no www) the A-record is your only option when pointing directly to an EC2 instance that isn't using Elastic Load Balancer (ELB) or CloudFront as a front-end. ...


2

I believe you are talking about the default security group, which cannot be deleted. You can learn more about it from the following link http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html#default-security-group


3

It's easier to maintain if you have one certificate, and there are no real downsides. You can put as many unrelated domains as you like on a certificate, so putting the www subdomain on seems fairly reasonable. Just use one certificate IMHO.


0

A little bit off topic, but this is the only search result for this issue. We had a similar problem, but our existing instances were rebooted and suddenly couldn't communicate. Turns out there were too many rules in the security group - just removing some allowed communication to resume. It was still working before the reboot because the rules get added ...


-1

It was due to special character in Certificate Name: .(dot) in my case. Everything worked fine after remove all dots from certificate name


1

Looks like the problem was that for dedicated tenancy, the RDS instance class has to correspond to the EC2 instance class, e.g. m3.medium EC2 corresponds to db.m3.medium. I was using m3.medium with db.t2.large. Makes sense, but it's kinda buried in the docs.


1

The reason an app must not connect directly to the database is simple: the app is code that you have released which runs in a place that you do not control, and thus cannot be trusted with database credentials. Code can be reverse engineered, and the credentials discovered, and now the attacker has complete access to your database and can do anything the ...


0

Perhaps it is misunderstanding. Today Web application are NOT simple two tier setup. Even the good old XAMPP, WAMPP are Controller (Model-View-Controller). User doesn't interact directly to your apps DB backend, they see the UI, the View layer. The backend workflow logic is your code, the Controller. While you connect to your DB model through your ...


0

The DB can be on any back-end server, including the web server or any other online services. Since Parse doesn't support PostGres, you will have to find another system to manage your back-end, which may have a considerable impact on the front-end interactions as well. What you shouldn't do is try to find a way for the front-end to connect directly to a ...


0

Resolution of your website to any server totally depends on your domain control panel. Your Name-Servers defines that where is your zone file located. Lets say you have purchased domain from Go-daddy, they have provided you with domain control panel where by default you are assigned with default name servers of Go-daddy. So in this case you just need to ...


0

You don't have to use Route 53 with your EC2 instance, you can use GoDaddy's DNS system. This is included in your fees, and is simpler than Route 53. In this case you just change the A records and CNAMEs to point to your new AWS IP address (whether that's Elastic Load Balancer, Elastic IP Address, or if you're foolish your default public IP address), MX ...


0

The AWS documentation tells you how to do it: aws s3 ls s3://bucketnanme --recursive --human-readable --summarize This is the output you get: 2016-05-17 00:28:14 0 Bytes folder/ 2016-05-17 00:30:57 4.7 KiB folder/file.jpg 2016-05-17 00:31:00 108.9 KiB folder/file.png 2016-05-17 00:31:03 43.2 KiB folder/file.jpg 2016-05-17 00:31:08 158.6 KiB ...


1

Amazon VPC peering connections don't allow for transitive connections across VPC networks. You would have to create a tunnel/vpngw for each and every VPC. http://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/invalid-peering-configurations.html I currently have the same issue with 7 VPCs across three different consolidated billing accounts and can't ...


1

Choose a single hostname for CloudFront to use as the origin server hostname when accessing the back-end. This hostname needs to be in a domain that you control, a domain is provisioned in Route 53. What we're going to do is arrange it so that any time an edge location in CloudFront tries to look up this hostname, it will receive the IP address of the ...


2

Rather than doing all this IP address shuffling, consider making all of your instances client on a VPN, each with their own private IP address assigned by you. I think Amazon has something like this in place, but the way I did it was by putting up an instance of the open source Openvpn server ( the Community Edition). My little VPN routed traffic between my ...


2

The attachment information is included in the describe-volumes function. aws ec2 describe-volumes --output text --region us-east-1 includes a section called ATTACHMENTS (if attached), such as the following: VOLUMES us-east-1a 2016-03-22T23:00:54.577Z False 300 100 available vol-12345678 gp2 TAGS backup yes VOLUMES ...


0

Go to this Importing a VM into Amazon EC2 as an Image And dig deeper, you will see this VM Import/Export Prerequisites. Although it doesn't mentioned Ubuntu 16.04 in there, you should file a ticket to AWS to ask them whether they accept 16.04 . You can try to meet ALL the VM creation before submitting the image. There is a Ubuntu 16.04 AMI found here ...


0

Ephemeral public IP addresses (drawn from a shared pool) are assigned at instance start: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#concepts-public-addresses. On the other hand, elastic IPs (EIPs, to which the said account limit applies) are owned by your account (until released) and are explicitly associated with EC2 ...


0

I finally found a way to fix this. I removed the .. from STATIC_ROOT STATIC_ROOT = os.path.join(BASE_DIR, 'static/') STATIC_URL = '/static/'


2

When putting data in Amazon S3, there are two ways to encrypt the data: Client-side encryption, or Server-side encryption. Client-side Encryption Amazon does not have any built-in client-side encryption mechanism. You'll have to roll this yourself: Encrypt the data in Jenkins using your favourite tool then upload it. When the objects are downloaded from ...


0

You can contact support to request a resource limit increase.


1

Depending on exactly what you're trying to do and whether it fits, you might find AWS' Elastic Transcoder video processing service offers a ready-to-use solution. It certainly lists thumbnail generation as part of the offering.


0

I know this is a fairly old post but I was searching for load balancing remote desktop on AWS and came across it. Personally I prefer NOT using RD Gateway and just sticking to plain old session broker with a load balancer in front of it for high-availability). You could always use a VPN for extra security.



Top 50 recent answers are included