New answers tagged

0

The answer is already given but I was looking for current instance attach volume from which I am running query. So you can just pass the instance Id from the curl response. aws ec2 describe-volumes --filters Name=attachment.instance-id,Values=$(curl -s http://169.254.169.254/latest/meta-data/instance-id) sample output { "Volumes": [ { ...


0

AWS Lightsail firewall now supports Ping(ICMP): https://aws.amazon.com/blogs/compute/enhancing-site-security-with-new-lightsail-firewall-features/ Just select Ping(ICMP) from the "Application" drop-down when you add a new rule to your lightsail firewall.


1

As pointed out in the comments this is probably best solved on the web server running on the ec2 instance. If you are looking for a managed solution you should check AWS WAF - Web Application Firewall. WAF checks every request for the path and a bunch of other parameters and allows to define block and allow rules based on those request parameters. If you are ...


0

Based on your questions I don't think you should be setting up anything AWS. AWS and other cloud services are enterprise grade systems that are very powerful, but they're also very complex. AWS professionals have typically studied AWS for hundreds of hours and worked in the area for years to get good at it. If you put things up in AWS, Azure, Google you're ...


2

The ultimate in cost savings (for infrastructure) is going to be to use CloudFormation. Using CloudFormation, you can have a template file that can: Launch your EC2 instance, Install any software you require. When you're done, delete your CloudFormation stack and your EC2 instance will be deleted as well. This will work for Windows as long as you have the ...


0

If your load balancer is properly configured to support X-Forwarder-For HTTP header, you can use something like map $http_x_forwarded_for $block { 59.92.130.106 1; <another_blocked_ip> 1; ... } server { ... location / { if ($block) { return 403; } ... } ... } or if you want to allow access forsome ...


15

Your question is, to some extent, looking at things backwards: EC2 isn't a general-purpose hosting solution that happens to use VMs; it is a service for hosting VMs. As such, there's a few ways to interpret your question. Why wasn't EC2 designed to use containers? The answer to this can be deduced from the timeline: EC2 was launched in beta in 2006, and full ...


1

From the beginning: You can launch an instance with the required S.O. Once it's running, connect to the instance and configure your required applications and O.S settings. Then, you can create an AMI from your configured instance, so you can launch future instances with the applications and settings that you have done previously. Please see: https://docs.aws....


2

Step 1: Create your instance with the installed apps Step 2: Use it for 1 - 2 hours maybe 3 times per month. Step 3: Stop the instance when you're done. Don't terminate it or it will go away. Turn on termination protection. Step 4: Start the instance again when you need it 1 - 2 hours maybe 3 times per month. Repeat step 1 - 3. As asked that is the most cost ...


3

Nope. The idea that a properly written database is a CPU hog is a delusion - high CPU utilizatzation in databases quite often is the result of awful queriey, i.e. joining mismatching data types (int vs string, resulting in a TON of conversions). Normally a databases uses - in this order: Memory IO CPU Memory is first because it will try to cache as much as ...


12

There's several different approaches to containers, and the current accepted answer only seems to account for the OCI-style (docker-like) containers. There's many other types of containers, such as LXC and BSD jails, which have different approaches. LXC for example can easily contain several applications, and is mutable by default. It also has init scripts ...


0

When you enable versioning on an existing S3 bucket, then versioning does "work" for existing objects (depending on what exactly you're expecting!). If you delete the old object, it just uses a delete marker. You can restore that old object by deleting the delete marker in the usual way. Here's what I see after deleting: aws s3api list-object-...


1

You have placed your load balancer on one public subnet and one private subnet, which is an invalid configuration and will result in behavior similar to what you observe, because a balancer is assigned at least one public IP for each subnet to which it is attached... but by definition, public IP addresses don't work unless the subnet is a public subnet. ...


0

I was having the same problem. New users were getting the following error message: Either user is not authorized to perform iam:ChangePassword or entered password does not comply with account password policy set by administrator This despite the "Allow users to change their own password" option being set. Explicitly adding the iam:ChangePassword ...


0

Simplify it. Remove all the ALB and CloudWatch scaling stuff for start. Disable (remove) CreationPolicy and UpdatePolicy to prevent the error you're seeing. With that removed ASG won't expect the signal. With that the instance should boot up and stay up. SSH to the instance and check out what errors you see in /var/log/cloud-init.log and /var/log/cloud-init-...


1

There should be a link somewhere like "Having trouble with authentication?" Find something like that and go through account recovery. Then remove SMS from your account and use an authenticator app or hardware key. SMS authentication is not secure, so Amazon has deprecated it and will eventually remove it.


35

Containers typically run only a single application and are immutable, i.e. and changes are not preserved across restarts. Containers also don't have their own kernel. VMs on the other hand run the whole Operating System, including the kernel, init scripts, system daemons, etc. And the storage is typically preserved across restarts. VMs and Containers serve ...


17

Security is definitely a reason. Containers share the same kernel between them and the host. So they are not considered 100% isolated. Yet cloud providers do provide containers also. AWS does it too. I suppose containers are cheaper than VMs, but I haven't checked. In essence what you ask is a more general topic, VMs vs. containers; regardless of platform, ...


1

You are trying to install packages for RHEL/CentOS on Amazon Linux 2. These packages are not compatible, as Amazon Linux 2 is not compatible with RHEL/CentOS and will not run software packaged for RHEL/CentOS except by sheer accident. To resolve the problem, use CentOS 8 or RHEL 8, the correct distributions for the package you are trying to install. Do not ...


0

You have to open port 443 in your AWS security group.


0

In short: you will not be charged, so long as you use an S3 endpoint in your VPC. The Data Transfer tab of S3 Pricing tells you what you need to know. You pay for all bandwidth into and out of Amazon S3, except for the following: - Data transferred in from the internet. - Data transferred out to an Amazon Elastic Compute Cloud (Amazon EC2) instance, when ...


0

Data transfers are free if you are within the same region, within the same availability zone, and use a private IP address. Data transfers within the same region, but in different availability zones, have a cost associated with them.


0

There are now API calls to discover availability of Instance Types in each AZ. See: describe-instance-type-offerings — AWS CLI Command Reference


1

There is no reason why the EC2 free tier and the SES free tier can't be used together as long as you select the same AWS region for both services. (Otherwise there would be cross-region bandwidth charges.) Regarding using an Elastic IP (EIP), those are also free as long as they are attached to an instance, and that instance is running, and no other EIPs are ...


3

Service Discovery is enough. New nodes will be added to the SD name resolution when they are started. Unfortunately many people don't know / use Service Discovery and resort to the more expensive ALB. Good on you for using SD :)


0

Looks like the actual problem was with the authorization rules. I had set two (as described in the original question), one with open access to everybody, and one with a restriction to a specific group on 10.1.0.0/24. The group specified exists - but on IAM. However, the description says something about IDP and/or Active Directory, but no mention of IAM. I ...


2

You have nothing running that is listening on that ports. Your problem is not the firewall, if it were you would get a timeout. If the port is closed, nothing is listening on that port. This is confirmed by your netstat output, which shows that nothing is listening. Your service is not running. Start it.


3

If you don't need external access to the graph-ALB you can make the ALB internal - then it will only have private IPs. To reduce your data transfer costs even more try to limit the cross-AZ traffic (internal traffic between Availability Zones in the same VPC costs $0.02/GB). One way is to disable cross-account access in the ALB config: Check out this for ...


0

I don't think you need an NLB here. First Option Install an https certificate on Nginx in your fargate container - self signed or other. You can't use AWS Certificate Manager as ACM won't share the private key, which Nginx needs. Have the ALB connect to the https port. Just create a target group that uses the https protocol. Second Option Given you're ...


0

You can now log user activity using Cloudtrail: https://docs.aws.amazon.com/workspaces/latest/adminguide/amazon-workspaces-monitoring.html It's not quite the same thing as capturing screen shots, but it might get you the information you need.


0

I'm going to put my solution down here, although its a bit of a different problem than op - its around the same idea and hopefully answers some of the other commenters questions about nodejs. This is for Amazon Linux 2 running Node.js 12.x Problem: nodejs stdout logs are mixed in with nginx logs under "web" and are badly formatted. Previously, in ...


0

Create a script on the EC2 server that runs on cron script that Truncates the database Pushes a clean database to the server (mysql command line is easy, use Google) Runs "sudo reboot now" on the EC2 server. This outputs the database, which you'd run once when the server is in the desired initial state mysqldump -h localhost -u root -p (password) ...


0

NCDU is a very useful text / graphic utility that helps you find where your disk space is being used. sudo apt-get install ncdu sudo ncdu / You can also make the disk bigger. First step is expand the EBS disk (go into the EC2 console, find the EBS disk, resizing is trivial) Expand the Linux volume.


0

log onto the machine as root and issue cd / du -k | sort -n | tail -222 dir / is the root dir from which all other dirs start from ... at bottom of the listing will be the biggest dirs ... some of those big dirs may be system owned and are typically not a concern ... hopefully you simply have a logging dir which has become full ... try to bake into your ...


0

As far as I can see the tunnels have the options you want. If you’re wondering about the last parameter ... modp-3072 is DH Group 15, same thing. And Phase 2 is always ESP so it’s not explicitly noted (unless you’ve got some very special tunnel using AH protocol, but that’s very rare and I doubt AWS VGW supports it). Hope that helps :)


0

If you use ECS cluster auto scaling, the cluster will automatically add new instances as needed to place tasks during a deployment. Or, you could use Fargate and not worry about EC2 instance scaling at all.


0

This is indeed opinion-based but if you've got your Security Groups right adding NACLs between Public and Private subnets is an overkill. Typically I use NACL mainly in 2 scenarios: To separate Dev / Test / Qual / Prod subnets where we expect no traffic at all between them. Or when it's a PCI / HIPAA / etc deployment and the auditor absolutely positively ...


0

Option 1 - Use ECS instead of EC2+docker. ECS is the same thing (EC2+docker) but better because it's integrated with other AWS services like CloudWatch and the container logs are automatically fed into CloudWatch Logs. Option 2 - Use CloudWatch Logs logging agent in Docker Option 3 - Use standalone CloudWatch Logs Agent that can read log files and feed them ...


0

In downloaded xml file change SPSSODescriptor to IDPSSODescriptor for both opening and closing tags. Also entityID should be "https://KEYCLOAK-URL/auth/realms/YOUR-REALMS-NAME"


0

This is usually called blue / green deployment and is described here. Remember to give the old container some time for connections to drain so all traffic goes to the new container. In short, ECS can do this for you. Amazon Elastic Container Service (ECS) performs rolling updates when you update an existing Amazon ECS service. A rolling update involves ...


0

Hosted zones for subdomains are used for cases where you want to have a subdomain run on Route53 without having to move the whole domain. By adding extra nameservers for the subdomain(s) to the Route53 nameservers in the parent domain's DNS settings, you can manage the subdomain in Route53. This is not meant for cases where all domains are running on Route53....


3

Your EC2 instance is managed by an Auto Scaling group. EC2 instances that are managed by Auto Scaling may be launched and terminated at any time. It's goal is to preserve a number of running instances greater than (or equal to) the Minimum count, and less than (or equal to) the Maximum count.. ideally the Desired count. If you stop your EC2 instance, then ...


1

I’m pretty sure that the application running in the container will have that environment variable available. The problem is with ssh and bash that clear / sanitise the environment vars before you get the shell. I suggest you run the task on EC2-based ECS for testing (ie not on Fargate) and docker exec -it {container} bash into it - more likely than not you ...


1

You can't use the EPEL repository with Amazon Linux 2, because it is not compatible with this Linux distribution. Packages from EPEL are not intended for Amazon Linux 2, and even if you somehow managed to install one, it probably would not work. You will need to obtain certbot from another source, or use another Linux distribution.


0

last time it happened i was able to clone using cli but now I'm having worst issue, I created new ami then I did update the environment then I aborted the update, but the old AMI is already deleted, now I'm stuck and cloning the environment doesn't help because the old AMI is no longer exists I also tried to update the AMI using awscli and still getting the ...


2

Having ELB in a different AZ than the instance has two downsides: Slightly higher latency Cross-AZ traffic (which costs $0.02/GB) ELB/ALB gives you the option to Enable / Disable Cross-AZ access. For small deployments you should keep it enabled so that the ELB can talk to any available host in any AZ (especially if you've got only one) to improve the ...


1

I think you are writing your credentials in a different way than I. This way it should work for you. withAWS(region: 'us-east-2', credentials: 'Nour') { s3Upload(file: 'generate.html', bucket: 'nouran.portfolio', path: 'generate.html') }


2

If this is for strictly outgoing connections to your partner's network, then a NAT Gateway is your only chance in getting one IP for all outbound connections from an Auto Scaling Group. You will need a NAT and assign an ElasticIP to it that your partner can whitelist. If you want to avoid single points of failure, go with a managed NAT Gateway as that is ...


2

As of 6/16/2020 EC2 AutoScaling supports Instance Refresh - a single API call to replace every instance in an ASG safely and autonomously. To use it, update your ASG, setting a Launch Configuration or Launch Template containing your desired AMI, and then call StartInstanceRefresh. https://aws.amazon.com/blogs/compute/introducing-instance-refresh-for-ec2-auto-...


0

If your script could take hours to run, I think Cloud functions (GCP) is not an option for you. a Cloud Function can only be run for up maximum 9 minutes, default value is 60 seconds. After this time the functions is shut down. If you want to keep an instance for hours as you mentioned, a better option could be to use Compute Engine or App Engine Standard ...


Top 50 recent answers are included