New answers tagged

2

Option 5 - stop managing Security Groups (essentially IP-based firewalls) and use TLS Client Certificates. If you're using modern user management systems like Azure AD or LDAP, you already have the right tool to issue and distribute the certificates. You'll setup a private CA and configure the HTTP server (Nginx, Apache2 or AWS ALB) to authenticate by ...


0

Building on vlfig: I was trying to do this with pm2. It has a startup script that creates pm2-ubuntu.service so I modified that. BUT I also found that there was also a symlink inside /etc/systemd/system/multi-user.target.wants that needed to be moved to /etc/systemd/system/cloud-init.target.wants. So there may be other things like that blocking. Hope that ...


0

It is recommended to use ACM for storing (or issuing certificates), but as per my comment above in case ACM is not supported within a region then you can upload the certificate to IAM. Such a certificate could then be used in an Application Load Balancer or Network Load balancer or by setting up a Custom SSL in your CloudFront distribution.


0

Turns out I needed to allow HTTP and HTTPS traffic on my instance. I used this as a guide to enable it


0

you should check AWS instance inbound and outbound rules.


1

Is there a way to use this same command to return specific snapshot data. Answer: No, if you want to use mysqldump on the snapshot, you should create it as an instance first. You can also restore it as an instance from CLI/API and wait until completed, after you get the db host, you could use mysqldump to that snapshot. Here is the reference : https://docs....


0

You need to have permission for writing to the folders/files to use rsync. In your case the owner of the file and folder is www-data but I don't think you are logged in as www-data. So you need give permission example use chmod 77x to the user(and add it to the www-data group) or give it sudoer.


22

Option 4 - stop controlling the access through Security Groups and instead implement some decent authentication mechanism. For example put an Application Load Balancer in front of the web app and configure the ALB to require Cognito authentication. Only authenticated users will make it through the ALB to your web app - problem solved. The Cognito can have ...


0

This is not a full answer, more some thoughts to try and questions that won't fit in a comment box. Please try to resist the urge to downvote :) VPC peering is definitely worth a shot, that way traffic stays on the AWS backbone which should reduce latency a bit. I don't know how much that will help. Those three areas are 200 - 300ms ping apart, so you will ...


0

Its because the max storage size for auto-scale will be at least 10% of your actually size 217 GB.


0

When building docker image in gitlab-ci, you must add this (dind is for "docker in docker"): services: - docker:dind


0

If you configure something like Snoopy beforehand then you may be able to correlate the IP with the TTY and with the command. But note that it must be done before the activity and it can relatively easily be inhibited if someone is keen to hide their actions. However you may still be lucky - check the output of last command to see who was logged in and from ...


0

That is a bit odd. Thank you for the workaround. I've also had some issues previously backing up to glacier. The backup seemed to get stuck after a while, when the size of the backup (even though incremental) got too large. Eventually I just stopped backing up to glacier, it just did not make sense.


0

So the problem was that there were numerous files in subfolders which I overlooked. Using AWS cli I could finally "init restore" all of them. Afterwards Synology's Hyper Backup restoration worked normally. Here the commands to restore all files from Glacier back to S3 using aws cli: # create a text file with all glacier files: aws s3api list-...


9

Yes using CloudFront is a legitimate way to enable https, and (as iBug pointed out in comments) can reduce your bandwidth egress costs a little. Another option is to use an application balancer, which integrates with AWS Certificate Manager (ACM) to enable https. A lower cost method is to install a certificate directly on your EC2 instance using Lets Encrypt ...


3

Check out aws-nuke. It is a tool to help remove all resources in an AWS account. The resources listed in the screenshot are related to the default VPC which is automatically created for each region on account creation. IMHO it is ok to keep those.


1

The actual memory usage of a single socket isn't that much. What does eat up memory is the state associated with which client is interested in which updates, and which client has already received a particular update. In a primitive implementation (i.e. using the OS network stack), the latter state is kept in the form of outgoing buffers -- so if an update is ...


1

You will want one of 3 things; either: assume the arn:aws:iam::123456789012:role/myAmazonEKSClusterRole in a terminal session such that the aws eks get-token run by kubectl will behave correctly create an awscli profile that assumes the arn:aws:iam::123456789012:role/myAmazonEKSClusterRole role and update the args: to include [..., "--profile", &...


0

I'm finding your question slightly confusing. When you say "NSG" I assume you mean "Security Group". Azure has "Network Security Groups", AWS as Security Groups. Also, you haven't said what you're trying to achieve, you've said what's not working, which makes it difficult to help you. I'll give you some general thoughts, but if ...


0

In my case, removing the line IdentitiesOnly=yes from my ~/.ssh/config file solved the issue.


0

Quickly found the solution: I had forgotten to set up a behaviour using my new origin. This allowed access through CloudFront with no problems.


0

I do use private subnets for RDS databases and for EC2 instances that are behind loadbalancers. They are not to be accessed directly by the public, but they can be accessed internally by other resources in the VPC and can communicate with the exterior through NAT gateways.


1

You can use a combination of IAM roles, ActiveDirectory and Corporate Firewall to limit the access. You can have an ActiveDirectory group with users from your company only that can access AWS only through Corporate VPN and are assigned IAM roles based on the corporate permissions. I assume that the corporate firewall can be accessed only from corporate ...


1

SSH Timeout usually points to a Firewall or Security Group issue. One way or another your SecureCRT is blocked from accessing the Bastion host on the network level. Make sure that the Security Group associated with the instance has a rule that allows SSH from your external IP address.


0

You can set variables on any task, block, or play using the vars keyword. - name: Wait for SSH to come up delegate_to: "{{ ec2.instances[0].public_dns_name }}" wait_for_connection: delay: 60 sleep: 15 timeout: 40 vars: ansible_user: centos


0

For your case WebDAV (see "Server Support" and "Client Support" section) seems to be a viable solution because of the flexibility you can have on EC2 instance. On Fargate which is a controlled environment, you can built client tools into your image that can interact with the server over the network, eg. HTTP, FTP, sFTP etc.


1

Issue is resolved , as my NAT gateway was the problem. the subnet in which NAT was present, it was not associated with my route table. After i added NAT in my route table, i created new node group and it was able to join the cluster and coredns pods also got deployed.


1

I found a real edge case reason leading me to this problem and associated resolution. Have an existing AWS account (e.g. ABC-123) with custom domain related resources. In my case in API Gateway. Cancel/suspend the AWS account with a naive expectation that it'll remove all resources, whereas it leaves most, if not all resources intact. Open another AWS ...


0

Why don't you just find an old x86-64 based laptop / pc, instead of EC2? I don't think you will be able to experience all CentOS/RHEL features in EC2, especially for the stuffs related to baremetal like installation, pxe, etc. Btw, you can try to use the free developer subscription to get RHEL8 for your laptop/pc. Hope this helps.


0

Best practice for AWS resources such as EC2 / Lambda / etc is to use IAM roles, detailed here. In short you don't create a user for a server, you create a role that the service can assume that has a set of permissions which is associated with the EC2 server. That server with a role is given "temporary" credentials when it's running so it can access ...


0

To obtain the public IP address associated with a given interface, first, get the MAC address from the interface, then retrieve the info you're looking for from the Instance Metadata Service (IMDS). So in your example above, eth1 has MAC address 06:a6:9a:4a:98:c6, so you can get the public IPv4 address with: curl http://169.254.169.254/latest/meta-data/...


0

First of all you need predefined access policies to resources (like SQS,EC2,ElastiCache etc). After that you can add user with programmatic access and store credential in safe way or use Roles to assign it to services for access. For example: create IAM role to access RDS and assign it to ec2 instance, then try to access our database from ec2 instance.


0

Two possible reasons come to mind: The region / AZ you're trying doesn't have any t2.micro RDS instances available. Try a different AZ or different region. us-east-1 is usually a good bet It could be that the free tier offering hasn't kept up with the RDS instance availability. Nothing you can do about this.


0

No simple answer here unfortunately. There are multiple superblocks and also a number of smaller allocations for us-east-2 service region. The good news is you can download a json file that contains all the AWS IP blocks and get the ones that you're looking for. https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html


1

Given you have a very small set of IP addresses hitting your server I suggest you add deny rules on your public subnet Network Access Control List (NACL). It's in the EC2 console. If it were a DDOS then AWS Shield (free) would probably have taken care of it, and if not AWS WAF may also help.


1

Virtual IPs can typically only be used within a single network, e.g. in an Oracle RAC cluster. You can't really do that between the office and the cloud. You may have also heard of Anycast IPs but that needs a much more advanced network infrastructure than you probably have. It also depends on what kind of server you're building. Some services are designed ...


0

You can use EC2 however if I remember correctly AWS will charge you extra for using proper RHEL. Without the distribution media you will also not have the lab exercises that are buried in the Extras folder. These exercises are the tasks you will be required to complete to successfully pass the exam. You will also have to make sure the environment is ...


1

It appears that a parameter setting was incorrect. I had been trying to get the AutoUpdate of the platform version to go through, and that was failing silently, but when I tried to manually apply a different version of the platform I got the following message: Configuration validation exception: Invalid option value: '100' (Namespace:'aws:autoscaling:...


1

Without digging into it - is it perhaps removal of the old, weak ciphers like sha1 and aes128? Try to change it to aes256-sha256-modp2048 in the working kernel version and then upgrade to see if it still breaks. Also maybe ikev2 instead of ikev1? But that’s a userspace concern, not a kernel setting. Give that a try…


0

For some reason, the DNS record you are modifying is not current. You need to talk to Amazon and figure out why the records shown in Route53 are not the same as the records exposed to the Internet. If I do an nslookup -type=SOA on writeurl.com I see the SOA for that domain is ns-232.awsdns-29.com. Your screenshot shows SOA is ns-696.awsdns-23.net. I would ...


1

It's usually easiest to pay for a static IP. You can use a static IP but it means changing it regularly. Add your static or dynamic IP to a new security group. Assign that security group to all resources you want to log into. Security groups are additive. Your question isn't really very clear on what you've done so I can't say what's wrong. You have replied ...


0

I've faced similar issue where client authentication should have been validated against intermediate certificate. Setup that works: bind *:11029 ssl crt server.pem ca-file client_trusted.pem ca-verify-file client_trusted.chains.pem verify required Here key points were: ca-file contained all necessary intermediate certificates for our API gateway to ...


0

Instead of a server in an AZ use the AWS Elastic File System service. EFS supports NFS, and your files are stored in multiple AZs. If an AZ goes down you can't address any resources in that AZ, which cuts out your lambda / reconnect idea. EBS volumes are in a single AZ. You could get around this with volume snapshots, which are stored in S3 multi-AZ, but ...


1

Your picture shows a maximum storage threshold of 198GB and usage of 197GB. According to this page the "The maximum storage threshold is the limit that you set for autoscaling the DB instance. You can't set the maximum storage threshold for autoscaling-enabled instances to a value greater than the maximum allocated storage. Based on that it looks like ...


1

According to this post from an AWS staff member on their forum you can use SES for this. The steps are: Verify your domain - maybe you need a different domain? https://docs.aws.amazon.com/ses/latest/DeveloperGuide/receiving-email-verification.html Create an email receipt rule https://docs.aws.amazon.com/ses/latest/DeveloperGuide/receiving-email-receipt-...


1

Your "has not been very effective" is "not too informative" Basically you need to conduct a stress test connected with the scalability test, to wit: Start with 1 virtual user Gradually increase the load Inspect the correlation of the following metrics: Concurrency Response time Transactions per second First start your test without ...


1

AWS defines some policies that are available in every account. As new services are added these policies are updated so the policy always has read only access. Some of them are job function policies, some are mmore general. The most relevant ones are: ReadOnlyAccess ( https://console.aws.amazon.com/iam/home#policies/arn:aws:iam::aws:policy/ReadOnlyAccess ) ...


1

Distinguishing between different domains on the same IP address is done using the server_name extension (SNI) in the TLS handshake. Changing this information by some man-in-the-middle would lead to a failing integrity check over the TLS handshake, causing the handshake to fail. This means that this kind of approach is not possible.


0

This is a known bug in MySQL Performance Schema affecting these MySQL versions: >= 5.6.46 >= 5.7.28 >= 8.0.18 https://forums.aws.amazon.com/thread.jspa?messageID=961243 It's been over a year, no fix yet: https://bugs.mysql.com/bug.php?id=99039


1

It is possible to use the Origin Request Policy to forward all headers (use the Managed-AllViewer) which includes Authorization. As stated above, this does cause a conflict with API Gateway because the HOST header doesn't match the request (request is coming from CloudFront, HOST is from the user) and so API Gateway will return a 403. In order to deal with ...


Top 50 recent answers are included