Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
I'm fairly new to AWS so I apologise for the super basic question, but what service(s) would I use if I wanted to make a website that could compile less into CSS for a user to download? I figure that I should to do this in a Node.js Lambda and then send the result to S3 and publish to an SNS to say that the download is ready, which my webpage can then react to. Am I on the right track?

Adbot
ADBOT LOVES YOU

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
You guys have both given me plenty to go on, thanks! In a way I'm fine with a little bit of over engineering too, since I'm also trying to learn how everything plays together.

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION

SnatchRabbit posted:

Speaking of certs is there a good resource for free practice exams? I just finished a course for associate solutions architect so I'm looking for some more exams to make sure I'm on my A game.

A Cloud Guru is what I used. You can get a membership for $20/mo that gives you access to all their courses plus the exam simulations which I would say were a HUGE help in my passing the exam.

https://acloud.guru/membership

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
I have a question - over the Christmas break one of my coworkers decided to wind down some EC2 instances that are only used for testing etc (i.e. not needed outside business hours). This is fine for most of our stuff, but some of the instances he terminated were actually belonging to Elastic Beanstalk stacks. Since they've been started back up, they've been having funny behaviour (constant cycle of scaling up and down, CPU strain etc). In each case, rebuilding the environment fixed the problem. I'm just wondering three things:

1) Is manually terminating the instances definitely what caused this issue or am I suffering confirmation bias? Has anyone experienced this before?
2) Is there a simpler, lower impact way to fix this problem other than a complete environment rebuild?
3) Is there a recommended way to do what my coworker was trying to do (i.e. pause the environment's underlying instances while they were not required)?

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION

JHVH-1 posted:

Its really just there to prototype things and make it easier for developers, and not meant for a production environment.

Is this really the case? I mean I can see that it would be the case in practice perhaps, if it's unreliable or a bit lovely or whatever. But is this truly AWS's intent for the service?

JHVH-1 posted:

If you stick with EB then I think you have to manage it through the cli or its own dashboard. If you start screwing with the EC2 instances it is using it tends to get confused.

Thanks, this is kind of what I thought and I was honestly pretty annoyed that the tech lead went ahead and just started directly loving with the instances.

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION

Seventh Arrow posted:

I booked my Solutions Architect - Associate exam for Feb 12 so I'm going to try and do as many labs and practice exams as I can until then. I've heard that there are a lot of scenario questions, so it seems best to have a well-rounded knowledge of the material instead of just mastering AWS trivia questions. Looking at the A Cloud Guru forums, however, it seems that the exams take a keen interest in subjects that one would never think to focus on initially - like bastion hosts, SWF use cases, and so on.

I'm also studying data engineering at a local place and the teacher who runs it says he has employers requesting AWS-certified people all the time - to the degree that he's thinking of starting an AWS course just to fill the demand. But I wonder if SAA alone will help me get my foot in the door. I mean, it's kind of the "paper trainee hat" level of AWS certs.

If you're on A Cloud Guru I assume you're using their training material? In that case, try doing the exam simulation, it's reasonably close to what the real exam will be like.

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
How on earth do you guys handle Environment Variables in Elastic Beanstalk for .NET projects? I can set them up just fine, but how do I access the values in code? The AWS documentation seems to imply that they will be made available in the AppSettings dictionary, but it's not working. A bit of Googling has revealed that apparently this is a known issue, but the suggestions I've found for addressing it aren't working and they seem kind of inelegant.

Surely this is a common enough requirement that there's a well understood process for this, and my Google-fu is maybe just terrible?

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION

Cancelbot posted:

Not sure if its because Elastic Beanstalk is being weird, but just use the Environment class;

https://msdn.microsoft.com/en-us/library/77zkk0b6(v=vs.110).aspx
pre:
Environment.GetEnvironmentVariable("MYVAR");

Yeah it doesn't work correctly apparently. There's a workaround to manually load in the JSON configuration file EB creates on the instances, and that's about the only option. It worked well once I got it set up, but what a pain in the arse...

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION

SnatchRabbit posted:

Thanks, those are very useful links. Re: Lambda, I wasn't sure how feasible it was, it was more like an idea for us to dip our toe into serverless. Yeah, I'll bring that up that we are supposed to notify AWS. the problem with flow logs is that this is a build/test environment so I don't think there's much traffic flowing through as of yet.

If it's just a one-time attempt to access a certain port to see whether it's open, a Lambda behind API Gateway is way overcomplicated.

If you want to monitor the port that's a different story, but Lambda is still not really the appropriate tool. I don't have a lot of experience with pen. testing otherwise I'd offer you some suggestions on tools to use.

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION

Acidian posted:

That's exactly what it was. I had a feeling it had to do with me being retarded.

Thank you!

Not retarded at all, this gets every AWS user from time to time "Why can't I see this thing? Oh... duh..."

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
I worked in a DevOps team at my last job and it was great. We had full knowledge of the pipeline and where everything deployed and how it all interacted. It's a great approach, it's a shame it's so often implemented so badly.

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
Not AWS but hoping someone can help. We have a Varnish server configured to cache requests and behind that we have an Azure load balancer that balances between 3-4 VMs depending on requirements. The problem is that something about the Varnish server being there is causing the load balancer to go stupid and it seems to be confusing the traffic as one visitor and sending it all to the one VM. In other words, it doesn't seem to know or care about the X-Forwarded-For header when determining where to send requests.

Am I right in this assumption? Is there any way to configure the load balancer to ignore the client IP and use the X-Forwarded-For header instead?

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION

12 rats tied together posted:

There are a lot of different ways to load balance traffic but commonly you'll see a load balancer perform some kind of source NAT on incoming traffic, replace the destination IP on it with a selection from its available targets, and then forward it along.

The target receives the traffic and perceives it as originating from the load balancer on an IP address level -- almost all of the time this is a good thing. Your target will respond back to the load balancer which usually implements some kind of connection-level tracking and caching and the load balancer does the same thing again: switches the source IP on the traffic to itself, replaces the destination IP, and forwards it back to whoever sent the original request.

If you're load balancing traffic like this you actually want the client IP regardless of the X-Forwarded-For header, those headers are usually application specific and outside of some specialized use cases you generally don't want your load balancers inspecting them.

If you're seeing your requests through your load balancer not actually being balanced and you've confirmed that you aren't intentionally doing this by setting sticky sessions or similar, you should probably start by answering 2 questions: Are all of your targets healthy, and what algorithm is the load balancer using to balance traffic? It looks like azure load balancers default to a 5-tuple hash based algorithm? The linked page has better documentation but the short version of this is that any time any attribute of your traffic changes, you should get a new backend host.

For something like varnish initiating requests to backend servers through a load balancer, each individual request should have a different source port, the source port changing is what should get you a new backend host. You should be able to find out whether or not this is happening pretty easily by tcpdumping from your varnish host and looking at the outbound traffic.

Thanks for the info, super helpful. I looked at the traffic using tcpdump as suggested and it definitely initiates using a different port each time, but always requests port 80 on the LB. Is this a problem? Sorry for the potentially stupid question, I'm far more Dev than Ops unfortunately.

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
After some further investigation it seems like actually the load balancer itself is doing okay, but one of the servers just seems to have a much harder time processing requests. In other words its CPU spikes regularly even though it's handling the same volume as the others. Unfortunately this was all set up long before my arrival so these VMs are far from immutable, in fact they're significantly mutated, so it wouldn't surprise me if there's some configuration defect on that specific VM.

Thanks for the help anyway guys, I definitely learned a lot.

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION

necrobobsledder posted:

You can use a tool like goss to identify a lot of system configurations, emit a policy, and then use the tests to validate any new container or EC2 instance you build with automation.

This looks amazing, but sadly Linux only 😢

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
Curious to hear some feedback from anyone who has tried LocalStack for developing AWS stuff without actual resource spin up and pull down. It looks super promising to me, but I've never used it in practice, I'm keen to hear some thoughts from you much more experienced gurus?

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
Vent time.

I hate these weird gaps in functionality that AWS has, for no discernible reason and with no documentation available to explain the problem. In this case I'm trying to shift some of our current Azure poo poo over to AWS and wanted to set up our CICD stuff in the AWS tooling, Code Build, Deploy and Pipeline. Already I got stuck at the very first step because Windows is mysteriously missing from the dropdown list of build container environments. I Google and Google, and I look through all the AWS docs and they all say the same thing "Select Windows from the dropdown". Finally I try doing the same thing using a JSON file and the CLI tool and lo and behold I finally get a useful message. For some reason the Windows container environment is not available in ap-southeast-2. This is not mentioned anywhere in their documentation. Anyway, I Google this and see someone has asked about it and AWS's response is "we have no current plans to do this". This is so frustrating...

On a related note: does anyone know of a way to build a .NET Framework project in a non-Windows environment? I've heard about Mono but I'm not sure how that works exactly, do you have to modify the project itself to get it to build with Mono? Is there some straightforward reading I can use to give me a fairly generalised understanding of the relationship between Mono and regular .NET Framework build options?

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION

deedee megadoodoo posted:

You’ve learned one of the most important lessons: the AWS console is absolute poo poo and should be avoided.

Well the problem isn't so much the Console in this case, rather the documentation which instructs me to do something that isn't possible in my region without mentioning that it's a region specific thing. But yes, I do agree that the Console loving sucks.

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION

Adhemar posted:

Please also vent on the feedback forms, there should be feedback links on every doc page. I totally agree our docs are poo poo.

As for your .NET question, you could look into .NET Core, if your project builds on it. It runs on Linux too.

Yeah someone mentioned this in the .NET thread, so I gave it a go. I had to change all of my projects to the new SDK style but it worked beautifully, and I now have a successful Build and Deploy pipeline set up. Thanks!

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
Sorry for a pretty newbie question, but I'm looking at this: https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structure-hooks.html

I'm setting up a CodeDeploy application to deploy to EC2 instances and I'd like to us the Blue/Green approach. I want to use original instances (not replacement instances), so I'm looking at the table showing available lifecycle hooks and it seems like I can only assign scripts to these two:

  • BeforeBlockTraffic
  • AfterBlockTraffic

Is this correct? If so, why? Is there a technical limitation as to why I can't attach scripts to - for example - the AfterInstall hook?

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION

Adhemar posted:

Not sure if I understand the question right; the three steps in the table are the only ones that happen for the original instances. There is no installation happening on them.

Yeah I had a fundamental misunderstanding about how the in place deployments worked, I understand what's going on now. Ignore my idiot question haha.

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
Has anyone had any success with the Packer/Ansible/Windows EC2 combination? All the Googling I'm doing seems contradictory (I'm assuming things have changed over time) and I'm not sure on the right combination of config options to get it all working.

Packer is able to created the EC2 instance and retrieve the auto-generated password and connect to WinRM. But as soon as Ansible gets involved I get a permissions error regarding the Ansible remote temp directory. Does anyone know how to resolve this, or where to start looking?

Packer output:
code:
[redacted]-webserver output will be in this color.

==> [redacted]-webserver: Prevalidating AMI Name...
    [redacted]-webserver: Found Image ID: ami-00b6e9c313c647f4a
==> [redacted]-webserver: Creating temporary keypair: packer_5e0d7fe1-db34-bbc1-eb6b-4434ea37e15b
==> [redacted]-webserver: Launching a source AWS instance...
    [redacted]-webserver: Instance ID: i-0398a8c5f51ab557c
==> [redacted]-webserver: Waiting for instance (i-0398a8c5f51ab557c) to become ready...
==> [redacted]-webserver: Adding tags to source instance
    [redacted]-webserver: Adding tag: "Name": "Packer Builder"
==> [redacted]-webserver: Waiting for auto-generated password for instance...
    [redacted]-webserver: It is normal for this process to take up to 15 minutes,
    [redacted]-webserver: but it usually takes around 5. Please wait.
    [redacted]-webserver:
    [redacted]-webserver: Password retrieved!
==> [redacted]-webserver: Waiting for WinRM to become available...
==> [redacted]-webserver: Connected to WinRM!
==> [redacted]-webserver: Provisioning with Ansible...
==> [redacted]-webserver: Executing Ansible: ansible-playbook --extra-vars packer_build_name=[redacted]-webserver packer_builder_type=amazon-ebs -i /tmp/packer-provisioner-ansible528142365 /mnt/c/Users/[redacted]/[redacted]-webserver.yml --private-key /tmp/ansible-key492638774
    [redacted]-webserver:  [WARNING] Ansible is in a world writable directory (/mnt/c/Users/[redacted]), ignoring it as an ansible.cfg source.
    [redacted]-webserver:
    [redacted]-webserver: PLAY [[redacted]Web Server Image - [redacted]-WEBSERVER] ****************************
    [redacted]-webserver:
    [redacted]-webserver: TASK [[redacted]-webserver : win_whoami] ******************************************
    [redacted]-webserver: fatal: [default]: UNREACHABLE! => {"changed": false, "msg": "Authentication or permission failure. In some cases, you may have been able to authenticate and did not have permissions on the target directory. Consider changing the remote tmp path in ansible.cfg to a path rooted in \"/tmp\". Failed command was: ( umask 77 && mkdir -p \"` echo /var/tmp/ansible-tmp-1577943249.49-120691292680057 `\" && echo ansible-tmp-1577943249.49-120691292680057=\"` echo /var/tmp/ansible-tmp-1577943249.49-120691292680057 `\" ), exited with result 1", "unreachable": true}
    [redacted]-webserver:  to retry, use: --limit @/mnt/c/Users/[redacted]/[redacted]-webserver.retry
    [redacted]-webserver:
    [redacted]-webserver: PLAY RECAP *********************************************************************
    [redacted]-webserver: default                    : ok=0    changed=0    unreachable=1    failed=0
    [redacted]-webserver:
==> [redacted]-webserver: Terminating the source AWS instance...
==> [redacted]-webserver: Cleaning up any extra volumes...
==> [redacted]-webserver: No volumes to clean up, skipping
==> [redacted]-webserver: Deleting temporary keypair...
Build '[redacted]-webserver' errored: Error executing Ansible: Non-zero exit status: exit status 4

==> Some builds didn't complete successfully and had errors:
--> [redacted]-webserver: Error executing Ansible: Non-zero exit status: exit status 4

==> Builds finished but no artifacts were created.
My Packer file:
code:
{
  "variables": {
    "role": "[redacted]-webserver"
  },
  "builders": [
    {
      "name": "[redacted]-webserver",
      "profile": "[redacted]",
      "type": "amazon-ebs",
      "region": "ap-southeast-2",
      "instance_type": "t2.micro",
      "ami_name": "[redacted]-{{ build_name }}-{{ timestamp }}",
      "ami_description": "[redacted] Web Server Image",
      "user_data_file": "./roles/[redacted]-webserver/userdata.ps1",
      "communicator": "winrm",
      "winrm_username": "Administrator",
      "winrm_use_ssl": true,
      "winrm_insecure": true,
      "associate_public_ip_address": false,
      "subnet_id": "[redacted]",
      "security_group_id": "[redacted]",
      "source_ami_filter": {
        "filters": {
          "virtualization-type": "hvm",
          "name": "Windows_Server-2019-English-Full-Base-*",
          "root-device-type": "ebs"
        },
        "owners": [
          "amazon"
        ],
        "most_recent": true
      },
      "tags": {
        "environment": "prod",
        "brand": "[redacted]",
        "category": "web"
      }
    }
  ],
  "provisioners": [
    {
      "type": "ansible",
      "playbook_file": "./[redacted]-webserver.yml",
      "ansible_env_vars": [
        "WINRM_PASSWORD={{.WinRMPassword}}"
      ]
    }
  ]
}
My Ansible playbook:
code:
- name: [redacted] Web Server Image - {{ packer_build_name | upper }}
  hosts: all
  gather_facts: no
  roles:
    - [redacted]-webserver
  become: yes
  become_method: runas
  become_user: Administrator
  vars:
    ansible_become_pass: "{{ lookup('env','WINRM_PASSWORD') }}"
My main.yml tasks file:
code:
- win_whoami:
  become: yes

putin is a cunt fucked around with this message at 06:42 on Jan 2, 2020

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION

Pile Of Garbage posted:

Try removing the become configuration and just inject the following:

code:
ansible_connection: winrm
ansible_user: Administrator
ansible_password: "{{ lookup('env','WINRM_PASSWORD') }}"

This seems to have done the trick, thank you!

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
Hmm I spoke too soon... It definitely seems to have gotten me further, but now I'm getting SSL errors. Again the problem I'm having in fixing this is that Google is returning advice from 2015-2019, all of which contradicts each other and there doesn't appear to be a single documented process for working with WinRM. Ansible has this page: https://docs.ansible.com/ansible/latest/user_guide/windows_winrm.html but doesn't mention anything about SSL (or at least it has some stuff about it, but indicates that the Windows server version I'm using should be configured correctly by default). I'm using a stock standard Amazon AMI and the Ansible supplied WinRM setup script, so I'm surprised that it doesn't work when I follow the documentation - I'm not doing anything strange, it's all just the standard poo poo.

I wish I could just abandon the Windows servers but alas that's not an option :(

Edit to add more details:

The specific error I'm getting is saying the SSL version is incorrect. The WinRM page from the Ansible docs says that it needs to be configured as TLS v1.2. So I've manually started up an instance based on the same AMI using the same userdata script, and when I use openssl to check the SSL info it tells me that it is definitely using TLS v1.2.

putin is a cunt fucked around with this message at 00:56 on Jan 6, 2020

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
Wow. Not at all an important part of AWS.

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
I'm playing with ECS at the moment and trying to use Secrets Manager to hold my database credentials. This works fine, but the 'value' is an object with each of the necessary properties, serialised to a JSON string, so when I pass it into the environment variables for the container, it's just a JSON string which means I'll need to modify my project to read the variable as a string and then parse it into an object. I'd rather not do something like this just to satisfy a deployment-specific eccentricity, is there any way I can inject the credentials as separate environment variables? So I end up with four variables for Username, Password, Host and Database? I tried adding :host etc to the end of my secret ARN, but no dice. ECS just tells me it's an invalid ARN.

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
Never mind, I should have Googled some more: https://github.com/aws/containers-roadmap/issues/385

What a pain in the arse :/

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
I reckon there'll be someone here who will say "you loving idiot, obviously this is how you do it" because this seems like a pretty common scenario.

With ECS, if you have a pipeline set up to deploy I'm finding that I keep hitting an issue where the new task won't start if it's on the same underlying instance because it uses the same port. How am I supposed to work around this? I did some reading that suggests using 0 as the host port so it'll use the ephemeral range, but if you do that how do you tell the load balancer to use the right port on a new deploy?

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION

Precisely what I needed, this is why I love you guys! Thanks mate

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION

The Fool posted:

I know this is possible in Azure with blob storage.

Ew

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
Can we please have a rule against suggesting self harm?

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION

Scrapez posted:

That IP is just my PC. The instance is in a VPC/subnet that is routed to it via the VPC Endpoint. My actual issue is that retrieving the file via http protocol gets a 403 but pulling it down via s3 cp works fine:
code:
curl [url]https://mybucket.s3.amazonaws.com/Welcome.wav[/url]
<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>36447CC5D79808FD</RequestId><HostId>6v6naApWr55vwgne7ZnO8b28QOgOAvv4qJ3pZnS7ADrjDUnBd8v958U95t8=</HostId></Error>
code:
aws s3 cp s3://mybucket/Welcome.wav Welcome.wav
download: s3://mybucket/Welcome.wav to ./Welcome.wav

I'm no expert, but I think using the CLI within the EC2 instance would use the instance role, as opposed to HTTP which wouldn't have any associated role-granted permissions. Check the permissions policies on your bucket, in particular GetItem.

Edit: nvm, I somehow missed that you posted the policy already

putin is a cunt fucked around with this message at 04:09 on Feb 7, 2020

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
Really simple question for the experts here I'm sure, but I have an ECS cluster and the underlying EC2 instance (just one at the moment, it's an in-development project) is using an AMI that now has a more recent version available. I know how to change the AMI and so on, but what is the easiest way to quickly locate the AMI ID for the latest version of this AMI? Searching for the AMI brings up a bunch of different ones and there is no way to sort by version, or even creation date.

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION

Skier posted:

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-ami-versions.html says

code:
aws ssm get-parameters --names /aws/service/ecs/optimized-ami/amazon-linux-2/recommended
can get you what you need. Here's what I see with some weird double encoding:

code:
"{\"schema_version\":1,\"image_name\":\"amzn2-ami-ecs-hvm-2.0.20200218-x86_64-ebs\",
\"image_id\":\"ami-0c0415cdff14e2a4a\",\"os\":\"Amazon Linux 2\",
\"ecs_runtime_version\":\"Docker version 18.09.9-ce\",\"ecs_agent_version\":\"1.37.0\"}"

Oh nice, thanks!

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
How did you get into this situation anyway? Like I know the literal sequence of events that you posted, but why did that happen? Why are you still using resources that were created with a CF template that no longer exists?

I'm not trying to override your question or invalidate it, sorry. Just curious what happened?

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
I'm trying to use localstack to develop some S3 stuff and I'm stuck at the very start getting the AWS SDK to communicate with localstack. I've set the endpoint like this (using Node.js):

code:
const params = {
    Bucket: "testbucket",
    Key: <my file name>,
    Body: <my file stream>,
};
const s3 = new AWS.S3({ endpoint: "http://localhost:4572" });
s3.upload(uploadParams);
It seems to be generating the endpoint URL incorrectly somewhere internal though, because I end up getting this message:

getaddrinfo ENOTFOUND testbucket.localhost
{
"service": "user-service",
"errno": -3008,
"code": "NetworkingError",
"syscall": "getaddrinfo",
"hostname": "testbucket.localhost",
"region": "us-east-1",
"retryable": true,
"time": "2020-05-28T04:56:21.583Z",
"stack": "Error: getaddrinfo ENOTFOUND testbucket.localhost\n at GetAddrInfoReqWrap.onlookup [as oncomplete] (dns.js:66:26)"
}


For some reason it's trying to use testbucket.localhost as the endpoint URL, even though I've clearly given it a different one.

Have I missed out a setting somewhere that I need to include?

I can use awslocal just fine, so I know localstack is actually up and running properly.

EDIT:

As always, I struggled with this all day and as soon as I post about it I figure out the answer. I needed to include s3ForcePathStyle: true in my S3 config to force it to use the path style URLs.

putin is a cunt fucked around with this message at 06:18 on May 28, 2020

Adbot
ADBOT LOVES YOU

putin is a cunt
Apr 5, 2007

BOY DO I SURE ENJOY TRASH. THERE'S NOTHING MORE I LOVE THAN TO SIT DOWN IN FRONT OF THE BIG SCREEN AND EAT A BIIIIG STEAMY BOWL OF SHIT. WARNER BROS CAN COME OVER TO MY HOUSE AND ASSFUCK MY MOM WHILE I WATCH AND I WOULD CERTIFY IT FRESH, NO QUESTION
Is it possible to use AWS SDK v3 in a Lambda function? I've tried to install v3 of the S3 client but when the Lambda runs it says the module can't be found - this is a serverless application if that matters.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply