New answers tagged

0

Does your VPC have an internet gateway? Does your subnets have route tables?


0

I have found the problem, and the solution. It seems the base AMI is causing some issues. What has happened is, the windows instance was created in availability zone A, and when its created, the AWS middleware configures some routes into the windows network configuration for that availability zone, which points at the gateway of that subnet(AZ): Current ...


2

That 112.110.x.x belongs to Idea Cellular Ltd, you shouldn’t use it in your VPC. Instead choose one of the reserved “private IP ranges” (RFC1918): 10.0.0.0/16, 172.16.0.0/12 or 192.168.0.0/16 Having said that you should still be able to connect to your EC2 instance. Make sure it’s got a Public IP address assigned, it will probably be something like 3.x.x....


0

It's my understanding that you want to sync GAL contacts with another domain? What you need is a third-party tool which can create the MailContacts from DomainA to DomainB and vice versa. I recommend you using GALSync from NetSec.Similar issue for your reference, How to sync exchange gal contact with another domain


0

You can't manipulate data in S3, you can only upload to S3, download from S3 and delete from S3, but you can't for example "unzip" in S3. If you want to upload the content of your unzipped archives you will have to unzip them locally on your laptop and then upload to S3. If you are on Windows you can use a S3 client like S3 Browser to use your S3 storage. ...


1

Do all the instances have the same IAM Role? For SSM to work there are a couple of prerequisities: The instances must have access to ssm.eu-west-2.amazonaws.com - either through IGW if they have a public IP, or through NAT if they are in a private subnet. Can you ping ssm.eu-west-2.amazonaws.com from all the instances? The instance IAM Role must have ...


0

So the solution was quite...interesting. To say the least I'm quite frustrated it has taken this long for me to figure this out but here it is: From what I understand Google owns the .dev TLD and have since required an SSL certificate (https://) to host a domain on a .dev domain. Since I did not have one yet, it wasn't working. So the solution would be to ...


0

With EC2 you don’t have to make it right from the start because it’s easy to change the instance size later. For start make a guess - e.g. new project may be ok with t3.small, moderately busy site may do for example with m5.large, etc. Once it’s up and running monitor the CPU and memory utilisation in CloudWatch and if the chosen instance type was too big ...


1

Short general answer: one account per environment lowers risk, reduces the chances of hitting limits, and gives best isolation. -- Longer answer: There's no one answer to this question, but here are a few options: One account per application per environment. Best isolation for workloads and users, lowest risk, lowest chance of a test account maxing out ...


1

If you want to do it right take it one step further. First about your user accounts. Have 3 accounts - login, test and prod. All your IAM users are only in the login account and they all have MFA enabled for security. In test and prod accounts you only have IAM Roles that can be assumed from the login account. Check out Cross-account access for more ...


0

Yes there are services such as Elastic Beanstalk [1] which create alarms automatically. Beanstalk for examples provisions an underlying CloudFormation stack which includes a CloudWatch alarm to trigger scaling actions for Load-balancing, Autoscaling Environments [2]. However, it is difficult to tell which services are doing this since there are so many AWS ...


2

I don't know of any services, but it's not difficult to roll your own. Option One Get a VPS, install the AWS CLI, and run a command the aws s3 sync such as something like this (I don't think this is quite right but I'm not on the right machine to look up the syntax) aws s3 sync s3://bucketname/ file://folder/ That isn't a backup - that's a copy. You ...


0

If you use minikube take notice that when Minikube is started after than kubectl is configured automatically. minikube start Starting local Kubernetes cluster... Kubernetes is available at https://192.168.99.100:8443. Kubectl is now configured to use the cluster. You can check and validate the cluster and context with command below: $ kubectl config view


1

One way of achieving this would be to deploy the aws-alb-ingress-controller. The AWS ALB Ingress Controller satisfies Kubernetes ingress resources by provisioning Application Load Balancers. k8s get permissions to create ELB resources on your behalf through IAM like everything in AWS. AWS API Access To perform operations, the controller must have ...


1

You can check the details of a specific device and act based on that: blkid --match-token TYPE=ext4 /dev/nvme123 || mkfs.ext4 -m0 /dev/nvme123 What this does is: blkid checks whether /dev/nvme123 is ext4 formatted, and if not it returns non-zero return code. The double-pipe || runs the second command (mkfs.ext4) only if the first one returned non-zero. ...


0

As mentioned in the aws certificate manager document (https://aws.amazon.com/certificate-manager/faqs/). ACM removes the wildcard label (*) when generating CNAME records for wildcard names. As a result, the CNAME record generated by ACM for a wildcard name (such as *.example.com) is the same record returned for the domain name without the wildcard label (...


2

Try something like below # for type in ext4 ext3 ext2 iso9660;do [[ `blkid |grep /dev/vdc|awk '{print $NF}'` =~ TYPE=\"$type\" ]] && echo matched ;done Output matched List the expected filesystem types and check if match, flag it and use it for further processing.


0

Finally I got anwser for that. The only thing I need to provide is VirtualHost for the 80 port. it will be something like this (.ebextensions/myconfig.config). files: /etc/httpd/conf.d/default.conf: mode: "000644" owner: root group: root content: | <VirtualHost *:80> RewriteEngine On ...


1

Resizing instances, let alone hundreds of instances, is not something you would normally need to do in production. Ideally your instances should be in Auto Scaling Group (ASG) and if you need more computing power you either add more instances to your ASG, or update the ASG Launch Configuration to a bigger instance size and roll over the ASG. If you want to ...


1

All computers on the internet have an IP address. A group of sequential IP addresses can be expressed as a CIDR block, of various sizes. For example 10.0.0.0/32 is a single IP address, 10.0.0.0, 10.0.2.0/24 is a group of 256 IP addresses from 10.0.2.0 to 10.0.2.255, etc. You can Google CIDR. Generally you want to allow access to your bastions only to your ...


0

Sorry found the issue - though I don't completely understand it. Not to do with AWS - I had https still on the API URL. Changed this to http and it worked fine. Obviously if I'm in the VPC then I don't need the https anyway. Thanks for your answer @MLu - yes, I had checked both those and they were ok.


0

Check if your public IP address has not changed. Probably you are using dynamic IP settings on your instance


1

Buckets are the highest level container in AWS S3. You can't have a bucket inside a bucket - it doesn't make sense given how the service works. S3 is an object store, not a file system, and it doesn't have folders as such. You can create objects with a path separator, when you view the bucket in the web console it shows it with a folder / tree view. You don'...


0

Apparently you can't us "aws s3 mb". I had to use "aws s3api put-object" aws s3api put-object --bucket example-bucket --key testing/ The forward slash is needed so that aws knows it is a directory otherwise it will create an empty file.


2

I took the advice from Tim in the comments and signed up for AWS Support so I could chat with someone about this. The explanation was: Aurora is built and tailored for Highly concurrent workloads, Single-threaded are unlikely to result in the impressive results as also the concurrency levels in your benchmarks need to be verified. So if we are in the ...


3

This is not possible. As the documentation states: You cannot create a bucket within another bucket.


1

EBS is block, EFS is file, S3 is object. SG are fancy local caches and gateways to access the remote storage with familiar protocols. SG still requires the other storage systems. If AWS is like a non-cloud remote storage array, SG is the filer and VTL options that speak file and tape.


3

First, I would double check my application configuration if it use the proper sqs name/region/account settings. Here is an example what permissions you might need to give to your application to work with your SQS. { "Version": "2012-10-17", "Statement": [ { "Action": [ "sqs:DeleteMessage", "sqs:...


0

Does the Lambda Security Group permit outbound access? Try opening all outbound to 0.0.0.0/0 for start. Does the EC2 Security Group permit inbound access from Lambda's SG?


1

CloudFront has been around since 2008, but originally required that the bucket be public. OAIs and CloudFront signed URLs became available in 2009. IAM did not become generally available until 2011. That is likely the best explanation available -- OAIs existed before IAM.


3

The new way is to create systemd unit file for your application or startup script. It may seem like an overkill for simple startup scripts but it is the way that most current Linux distros adopted - Amazon Linux, Redhat, Ubuntu, Debian, they all use systemd so it pays to know how to do it properly. Have a look here for example: Creating and modifying ...


0

This has nothing to do with ECR. It's just the way that docker registries work. (1) The code in question pushes the same image with two different tags, so it makes perfect sense that you see both latest and <commit-id> tags on the same image. MLu is correct in suggesting that you had some image on ECR already tagged latest. When you push a new image ...


1

You can only use public AMIs and private AMIs that were explicitly shared with you. If you used a private AMI that is no longer shared with you, then you can no longer start instances with that AMI. In the future, if you intend to use a private AMI that was shared with you, you should copy the AMI first, in case the original is unshared or deleted, then use ...


9

Yes it is possible. Create a SSL certificate for your domain in ACM (Amazon Certificate Manager). Create a HTTPS Listener in the ALB that will listen on port 443 and configure it to use the above SSL Certificate. Open the ALB Security Group to permit inbound traffic on port 443. That's it, pretty much. The ALB must have one Listener per port, so if you ...


1

Simply put MON-FRI in the day of week field and question mark in the day of month field. 15 3 ? * MON-FRI * Note that the times are always in UTC. See here for docs: https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html Hope that helps :)


2

The diagram is fine. The important thing to understand here is the nature of the ALB, which does by itself NAT. That consequences that the NAT gateway in the diagram is is only used for outbound connections initiated from the fargate task to the internet. All inbound connections through the ALB will be responded through the ALB, as the ALB sets its own IP ...


1

Since you choose Compute Optimized instance types please check this page https://aws.amazon.com/ec2/instance-types/ under Compute Optimized section. you can calculate cost from this page https://calculator.s3.amazonaws.com/index.html as your requirements. You have option to select c4.xlarge or other type depend on your future expansion plans.


1

Put wowza on a subdomain such as media.example.com using port 443. It will have the same IP address but with SNI that every modern client supports it will work fine. If you have any really, really old clients then there's a chance you'll have to get another IP or find another solution.


0

The credentials used to perform an aws s3 sync command require: Read permissions on the source bucket, AND Write permissions on the destination bucket Since you are assuming a role from the source account (that already has read permissions on the source bucket), you will need to grant permissions for that role to write to the destination bucket in your ...


0

The solution proposed by vlfig works. But, I think that it can be improved. In my example, I'm trying to run the Puppet agent after cloud-init is finished. In my case, we wanted Puppet to only run after Cloud Init is done with its set up. In order to achieve that, we need to modify the setup of its systemd unit. The default execution order for the ...


0

Found the issue, it was actually not related to the user pool. I had a resource that created the default user, which had not set the DesiredDeliveryMedium property; said property defaults to SMS, setting it to EMAIL solved it.


1

Well that would be my expected behavior. What do you want to be happening? Shall the browser interpret the CSV somehow and display it? Maybe you have a link of an example where it behaves the way you want it to, so we get an idea...


3

Backup your tfstate first and use the rm command to remove the resource from the tfstate. Use it like this: terraform state rm module.myproject-mainprocess.aws_db_event_subscription.send_rds_event_to_sns terraform state rm module.myproject-mainprocess.module.rds_event_sns.aws_sns_topic.topic_simple edit Just read This command will output a backup copy ...


1

You should determine your public IP address using a website such as What's My IP. Once you identify that and put it into your policy things should start to work with your existing policy.


0

If your corporate router is using NAT then S3 will only see the remapped IP of your external IP address on the router. If you only want access for your internal corporate network it may be better to create a VPN to a VPC and then an endpoint that is only accessible to the VPC: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-s3.html


1

Just a tip before anyone tries EEAA's answer, If you have not run the iptables save or iptables-save command to save your configurations, then just restart the server. Citing this answer on AskUbuntu, I learnt that iptables saves your configurations in the RAM itself unless you explicitly save it to the configuration files. EC2 instances can be easily ...


1

Basically, you need to create a policy to allow access to the S3 bucket on your side and a role and attach this policy to the role. Then, a user in Account B needs to assume this role you created which allows access to your bucket. I believe that this is the article that you are looking for (the more elaborated one): https://docs.aws.amazon.com/IAM/latest/...


2

For HA sftp best option for production grade solution will be aws sftp https://aws.amazon.com/sftp/ or some production grade sftp server.


0

In AWS you'll need to request a certificate through the Certificate Manager. When requesting a certificate you can verify domain ownership through DNS or email.


0

On Azure if you're talking about making static content available publicly, you probably want to use Azure CDN. This contains basic DDoS protection free of charge: https://docs.microsoft.com/en-us/azure/cdn/cdn-ddos If you're talking about dynamically generated content, you could use Application Gateway to have a single point to control access. This service ...


Top 50 recent answers are included