10

Yes it is possible. Create a SSL certificate for your domain in ACM (Amazon Certificate Manager). Create a HTTPS Listener in the ALB that will listen on port 443 and configure it to use the above SSL Certificate. Open the ALB Security Group to permit inbound traffic on port 443. That's it, pretty much. The ALB must have one Listener per port, so if you ...


6

Elastic Beanstalk is your traditional hosting - you can upload a PHP or Java or whatever application, say Wordpress, configure a database, etc, and go. There are some smarts for scaling, recovery, etc, but it’s still very much a traditional hosting platform. ECS Containers can still run your traditional app but there are some more specifics - most notably ...


4

A reverse proxy isn't required, but the web servers that ship with Rails have minimal functionality, so for any application that is public facing and can potentially grow, its a good idea to integrate a reverse proxy (eg Nginx) early on. For example, this would give you advanced rate-limiting capability, caching and the ability to do end to end SSL ...


2

Run the command with a CLI --profile which assumes the IAM role on account-B: aws ecs update-service --profile account-B_roleName In ~/.aws/config: [profile account-B_roleName] role_arn = arn:aws:iam::808449698514:role/PowerUser You can only apply a command on a resource in an account with an (assumed) role or user which is defined in that account.


2

I am answering my own question, so it may help some one who is getting same issue. Solution was pretty straightforward, i need to check the privilaged tab which i didn't notice. Solution : From the AWS CodeBuild Console, select the Build Project. Select the 'Edit' dropdown from the top-right corner, and select the 'Environment' option. Within the 'Edit ...


2

Choose the right service for the job. RDS Managed service Automatic fail-over Automatic backup, easy restore Automatic disk space management (in case of Aurora) Detailed performance stats in CloudWatch Little more expensive, however you get a lot more for the money MySQL on EC2 Cheaper than RDS You have full control of the setup (do you really need it?) ...


1

You can’t pass SSH through ALB. It doesn’t work because ALB is purely for HTTP / HTTPS traffic, it won’t let SSH through. You can use NLB (Network Load Balancer) for SSH if you want. (However SSH’ing to containers is a big NO NO ;) You can’t mix different services in one Target Group. Create two target groups - one for the port 3000 container and one for ...


1

Adding to the previous answer - Elastic Beanstalk is more of a Pet platform while Docker (ECS) and Lambda are Cattles. That also means that Docker and Lambda are stateless which means they don't (must not) store any state locally, everything is in a database, in a memcache cluster, and in S3. Beanstalk on the other hand can store local state but it's ...


1

The problem with NLB is that it passes through the client IP. If you’re on ECS1 (e.g. 10.0.0.10) and connect to NLB (10.0.0.20) and it happens to send you back to ECS1’s mysql container it will look like the connection is coming from ECS1. In other words your mysql client connects from 10.0.0.10 to 10.0.0.20, but mysql thinks it connects from 10.0.0.10, ...


1

Always use IAM Roles and never use any explicit access/secret keys in production. Read more about EC2 instance roles here, the same applies to ECS IAM Roles. In your ECS case you should: Create IAM Role with permissions to s3:GetObject from the S3 bucket. Attach that IAM Role to your ECS Task as a TaskRole. If you are using ECS Fargate instead of EC2-based ...


1

The UID that a docker process runs as can be fairly arbitrary. By default, all docker processes run with UID 0 (root). There are a few ways in which this changed: By baking a different default user into the image via the USER command in your Dockerfile Specifying a user in docker's cli using --user Setting user or uid in your ECS container definition for ...


1

A load balancer is a type of reverse proxy. Its benefits including accepting traffic on specific ports, acting as a type of firewall, and prevents some kinds of attacks reaching the server. For the common case of a web app I can't see any significant benefit of having both a load balancer and a second reverse proxy.


1

Use AWS Batch. It is a service specifically designed for your situation, and can be triggered by CloudWatch Events


1

Like this? PolicyDocument: Statement: - Effect: Allow Action: - ssm:GetParameter Resource: '*' - Effect: Allow Action: - s3:* Resource: - 'arn:aws:s3:::the-bucket' - 'arn:aws:s3:::the-bucket/*' Check out the S3 ARN docs for more details on ARN ...


1

Can you run the task in a Fargate container? With Fargate you don't have to run and manage any EC2 instances, simply schedule the job to run in Fargate and be done with it. It runs standard docker images, same as on your EC2-based ECS cluster. The only limitation is that it can't do any privileged operations like mounting network filesystems or spawning ...


1

In case it's helpful to anyone else, here's the solution we landed on for now... Configure docker-compose.yml with a sidecar Nginx container with a shared volume for static assets, like so: version: '3' services: nodejs: build: ./ volumes: - asset-volume:/opt/nodejs_app/static nginx: build: ./nginx ports: - 80:80 volumes: - ...


1

You should have ELB as part of your stack, ie one ELB for blue stack and one ELB for green stack. That way you can run a complete suit of acceptance testing against the new ELB and once happy replace the ELB name in DNS. That won’t affect your long running sessions as they will retain their connections to the old ELB even if the DNS changes. Hope that ...


1

I have created a Lambda function to update the instance agent in all my ECS clusters: var AWS = require('aws-sdk'); AWS.config.update({ region: 'sa-east-1' }); exports.handler = async(event, context) => { var ecs = new AWS.ECS(); var responseArray = []; const clusters = await ecs.listClusters({}).promise(); for (var i = 0; i < ...


1

are you using an ecs optimized ami? i would do that and then include this in your user-data when you spawn the instance #!/bin/bash echo ECS_CLUSTER=your-cluster-name >> /etc/ecs/ecs.config if you ssh onto the box, you should be able to see it register with the cluster then in the ecs agent docker logs eg. [ec2-user@ip-10-0-X-XXX ~]$ docker logs my-...


1

I'm expanding on @user326608's answer above (thanks for the insight!). This will restart ALL TASKS FOR ALL SERVICES FOR A CLUSTER by stopping all of its tasks. Each service will then automatically launch X number of new tasks, where X is the service's desired task count. #!/bin/bash index=0 taskArn=$(aws ecs list-tasks --cluster ${CLUSTER_NAME} --query "...


Only top voted, non community-wiki answers of a minimum length are eligible