Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
fluppet
Feb 10, 2009

ickna posted:

Just a friendly reminder to turn on MFA if you use AWS. My account was compromised yesterday morning and I wouldn't have caught it if Amazon didn't do checks on unusual activity (like maxing instances in every area). In 3 hours it racked up $2k in usage charges, which they are fortunately making a concession for.

I'm still not sure how they got my password, it was a pretty secure one (random alpha + numbers).

I'd be checking the iam keys rather than the password

Adbot
ADBOT LOVES YOU

fluppet
Feb 10, 2009

Pollyanna posted:

Yeah, I'm really confused on why things are being made from scratch every time. I'll have to confirm that's actually happening, but since the only thing changing is pulling a different commit of the master branch at any point in time, then there's no reason to bake entire AMIs.

So it sounds as though you have a couple of options to speed things up

If you setup a common base ami with as much of your standard tooling installed on it as possible then to prep a release all you now need to do in run a git pull

Also depending on how many amis you bake it may be worth getting packer to attach an EBS volume to an already running instance and snapshot it rather than waiting for a new instance to launch (t2.nanos are perfect for this)

fluppet
Feb 10, 2009

2nd Rate Poster posted:

For new infrastructure a checkout of terraform will be done locally and after changes are made updates to state files will be pushed to github.

Is there a particular reason you opted to have remote states pushed to git rather than a versioned s3 bucket that seems to be the common practice?

fluppet
Feb 10, 2009

Cancelbot posted:

Does anyone know how bad the Developer - Associate cert is? I know the DevOps Professional will kick my arse but I need to get onto associate first. I'm going through the recommended "quest" first and will probably do the practice exam in a couple weeks.

Background: Been doing AWS/DevOps stuff for a large UK online retailer for about 2 years now. Recently finished migrating all of our physical infrastructure to AWS and I come from a strong senior developer background, far stronger than my networking/infrastructure knowledge.

As long as your familiar with the basics of ec2 vpc rds you should be fine with the sysops associate,not really looked at the Dev associate but have the devops pro booked for next month

fluppet
Feb 10, 2009
Just found out I need to deploy a couple of environments on alibaba cloud. Given that we're only using rds, ec2 and s3 and they look to have equivalents on alibaba are there any major gotchas that I'm likely to run into?

fluppet
Feb 10, 2009

FamDav posted:

just out of curiosity but why doesn't the mainland china region for aws work here?

It's not China we need to be in otherwise we would still be on aws

fluppet
Feb 10, 2009
Does the vm import service not cover this for you? How exotic an os are we talking about?

fluppet
Feb 10, 2009
Simple db still exists even if it is a little unloved

fluppet
Feb 10, 2009

SnatchRabbit posted:

Thanks for the replies. Another question: can anyone recommend a good S3 viewer for Mac OS?

Cyber duck is one of the least bad options if you need a gui
If not stick to s3cmd

fluppet
Feb 10, 2009
Where has decent study material/practice papers for the professional level exams?

fluppet
Feb 10, 2009

very stable genius posted:

Hey CF, can you tell me what's going to change if I run this template? lol nope

Hey CF, why is this job running for so long? Well, you forgot to define something but instead of failing immediately on this missing piece of required data I'm gonna spin for a long time and fail after 10 minutes. lol

Hey CF, why is it that if a stack creation fails I need to go manually delete the stack before I can run it again? Because I loving suck.

And don't forget the classic

Hey CF, you've failed to update a stack, failed to rollback, and I can't delete that stack as it's running production workloads. How long will it take for support to reset that state?

fluppet
Feb 10, 2009
You can have a bucket called my.domain and then set a cname for my.domain to point at the s3 url which will work but you need cloudfront to provide ssl but your bucket name will have to match your url

fluppet
Feb 10, 2009
https://aws.amazon.com/workspaces/ I think it now handles Linux desktops

fluppet
Feb 10, 2009
Why is this the first time I've ever heard of elasticwolf?

fluppet
Feb 10, 2009
Am i misremembering or was there a way to trigger an ssm runcommand action on a failing elb healthcheck?

We have have instances running multiple services and arnt allowed to set the asg to use the elb health to trigger a termination

fluppet
Feb 10, 2009

Vanadium posted:

Why are you using the Cloudwatch Logs interface when you could be using Cloudwatch Logs Insights!!

Both are awful

fluppet
Feb 10, 2009
You'll want to look at filtering possibly network-interface-id
https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-addresses.html

Why are you using elastic ips over just using the ip that the instance comes up with?

fluppet
Feb 10, 2009
Either proxy a ssh session through the bastion and use scp or i believe you can tunnel it through a ssm-session

fluppet
Feb 10, 2009
Got my devops pro booked for later this week, how representational are the acg practice exams?

fluppet
Feb 10, 2009
How long does it take for an application to aws be rejected via the job portal?
Its been 3 weeks so I'm assuming they dont want to interview me

fluppet
Feb 10, 2009
Always reach out to your TAM your never know what fun toys are tucked away behind a NDA

fluppet
Feb 10, 2009

Agrikk posted:

What’s the position?

Things are moving a bit slowly in Post-new year. I recommend to keep after it and keep bugging HR people for updates. Eagerness is a good thing here.

Persistence does seem to be the key as im now got an interview for a devops consultant role lined up

fluppet
Feb 10, 2009
I think you need to go down the sso route for that

fluppet
Feb 10, 2009
Install ssm agent on windows server use lambda to call ssm run command

fluppet
Feb 10, 2009

22 Eargesplitten posted:

Hate to double post, but does anyone have any recommendations for practice exams for the Certified Solutions Architect - Associate? I think I'm ready to see where I stand and what I need to study more.

Im working my way through the a cloud guru course, it did the job for the devops professional exam

fluppet
Feb 10, 2009
im trying to get a list of EBS Snapshots that aren't from a list of policy-ids

code:
aws ec2 describe-snapshots --owner-ids self --query "Snapshots[?Tags[?Key=='aws:dlm:lifecycle-policy-id' && Value!='policy-foo']].[SnapshotId,Description]" 
but trying to exclude multiple policies fails and my google skills can't turn up the correct jmes syntax to query it properly

any suggestions?

fluppet
Feb 10, 2009


Is there a reason that the aws android app doesn't support u2f

fluppet
Feb 10, 2009

SnatchRabbit posted:

Has anyone had any luck copying objects in bulk from a FTP server (or any server really) into s3, ideally using sync command but not required, and keeping the source file's attributes, such as file created/updated, tags etc, and populating that data into the s3 object's custom metadata? Really, my only requirement is I just want to know the source files creation date/time on the FTP and just have that value stuck into a custom metadata tag on S3. This sounds like an easy thing I'm just not seeing any obvious solution. I thought maybe something like S3Browser might have that built in but I'm just not seeing it.


Would https://aws.amazon.com/aws-transfer-family/ do the job?

fluppet
Feb 10, 2009
Best one I saw was <developer name>.<company name> hosting production assets. Every couple of months there someone would come along and ask about deleting that bucket.

Keith had long since departed the company

fluppet
Feb 10, 2009
Anyone else having issues with ssm sessions over ipv6?

Adbot
ADBOT LOVES YOU

fluppet
Feb 10, 2009
Anyone using zesty to manage reserved instances or is there a better alternative?

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply