Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
ledge
Jun 10, 2003

I mainly deal with Connect (the contact centre service) but that then involves a lot of lambdas and dynamoDB, and s3, oh and cloudwatch and and I just had to figure out how to get a .net core MVC app to work with ElasticBeanstalk and Cognito. Which then also involves buggering around with Route 53, oh and cloudtrail and SNS. And whatever else. Plus API gateway, then I get asked to stand up EC2 instances and now apparently use Transcribe and Comprehend. And lucky me I get to be the IAM guy as well.

So good luck being an expert in one thing.

And a couple of weeks back I did a course so I can get the Associate SysOp cert (having already got Associate Developer), and by then end of three days I was just about ready to shoot myself.

Adbot
ADBOT LOVES YOU

ledge
Jun 10, 2003

CarForumPoster posted:

Hear hear! My first bit of advice to my team on diagnosing weird AWS errors that aren't obvious are, do you have permissions to access what you want? Yes. How do you know? Did you test it? Yes. Escalate to support.

1 in 5 issues gets escalated.

Even obvious errors like this one from s3 "Insufficient permissions You need s3:CopyObject permission to perform this action" but s3:CopyObject does not exist as a permission. Don't know if this dialog has been fixed yet.

ledge
Jun 10, 2003

Have you run the reachability analyzer? That worked for me when I was having trouble with network nonsense earlier today.

ledge
Jun 10, 2003

fletcher posted:

Why not stick these instances behind a NAT gateway so they all have the same public IP?

Or a load balancer.

ledge
Jun 10, 2003

Scrapez posted:


The software in question is an IVR and...

So the answer here is rebuild the IVR in Connect :) Then you can forget about maintaining servers and networks ever again.

ledge
Jun 10, 2003

Hughmoris posted:

My new employer has pockets and is willing to pay for good training. Is there any well-respected AWS training courses/companies that I should check out? They'd need to be data focused courses.

I'm thinking something like what SANS does for cyber training.

These are the AWS courses for data, just need to find a training provider, they are linked from the specific courses I think. All the providers are following the same course if you go through this.

https://www.aws.training/LearningLibrary?query=&filters=Domain%3A107%20Language%3A1&from=0&size=15&sort=_score

I've used Bespoke Training in Australia who were good.

ledge
Jun 10, 2003

CarForumPoster posted:

Could schedule an AWS lambda function (e.g. cron or rate) to do it if the 15min timeout isn't an issue in your application.

It sounds like you dont want to trigger on each new file in the S3 bucket but if you did, AWS lets you trigger a lambda by adding a file to S3 p easily.

Yeah, lambda on a schedule would be the way to go. Just setup a rule in EventBridge to call the lambda.

Edit: It will be easier to do this file by file if you trigger the lambda for each created file in the s3 bucket, as that way you get passed the details of the item (bucket arn and object key) when the lambda is triggered. If you run it on a scheduled you'll have to call the s3 api to list the objects and iterate through them. But if the avro grouping is a requirement that isn't an option.

ledge fucked around with this message at 05:08 on Feb 18, 2022

ledge
Jun 10, 2003

Cheston posted:

I'm trying to understand cloud pricing so I'm not such a mook. Data transfer out of us-east-1 costs $0.09 per GB. Cheaper regions cost $0.05 per GB. Backblaze charges $0.01 per GB. Both services claim eleven nines of durability. Why such a big price difference?

Because they can? :shrug:

ledge
Jun 10, 2003

I don't think security groups can redirect. So alb is necessary, or you could use nginx and do the ssl redirection in that. I'm using that method for a simple website where I don't want to pay for an alb, seeing as it costs 5 times as much as the t3a.nano ec2 instance.

ledge
Jun 10, 2003

Haha, I kept failing to deploy via ElasticBeanstalk with the new preview Publish to AWS tool in visual studio so much that the product owner wants me to show their engineers why I am such an abject failure at using their tool. I'll get a $50 Amazon voucher for embarrassing myself in front of them though, so at least I got that going for me.

It is mostly due to VS saving new text files encoded as UTF-8 BOM and doing CRLF for eol. Of course the error messages are not that useful, e.g. you get a "File can't be found" message if the eol is set to CRLF instead of just LF in your configuration files.

ledge
Jun 10, 2003

ledge posted:

Haha, I kept failing to deploy via ElasticBeanstalk with the new preview Publish to AWS tool in visual studio so much that the product owner wants me to show their engineers why I am such an abject failure at using their tool. I'll get a $50 Amazon voucher for embarrassing myself in front of them though, so at least I got that going for me.

It is mostly due to VS saving new text files encoded as UTF-8 BOM and doing CRLF for eol. Of course the error messages are not that useful, e.g. you get a "File can't be found" message if the eol is set to CRLF instead of just LF in your configuration files.

Just had the meeting with the SDK guys to show them this and they actually found it useful!

They plan to at least add this as a gotcha in their documentation and hopefully to update the deployment tool to check the elasticbeanstalk deployment config files and automatically change their encoding and eol to be unix compliant when they zip up the build before uploading it. So that's a win.

Still waiting for the $50 voucher though.

ledge
Jun 10, 2003

LtDan posted:

I'm studying for the SysOps Associate cert and I was wondering if anyone could tell me if the lab portion is as descriptive as the challenge labs on ACloudGuru? For example:


Good question. I've done the SysOps course but haven't got around to sitting the exam yet. I didn't even realise there was a lab portion!

Tell you what, if you could come back and let me know once you have set the exam that would be super!

ledge
Jun 10, 2003

Startyde posted:

I’d shift that 80% up closer to 90 but otherwise concur.
The amount of very bad shell invoking the aws cli passing for IaC I’ve seen is harrowing, though that might be a local quirk from so minicomputing grognards in the region.

I'm not too proud to deny that I may have used excel to create a bunch of cli commands to add users to Connect via the cli.

One thing I have found is that provisioning via cf seems slow as poo poo compared to doing the same via the sdks.

ledge
Jun 10, 2003

Pile Of Garbage posted:

90% of critical business infrastructure is dependent on a Excel spreadsheet Access database and a Dell OptiPlex sitting under some dudes desk.

fixed that for you.

ledge
Jun 10, 2003

Anyone else's day being ruined by the us-west-2 API gateway outage? 3 hours and counting now.

ledge
Jun 10, 2003

Methanar posted:

I die a little bit every time I'm logged into the prod aws account and then realize I need to do the whole login MFA dance again for the dev account in incognito.

I have multiple chrome profiles, one for each AWS account I have to work on. Slightly painful, but it keeps me sane and means I only have to login once per day for each account I'm working on that day.

This also means account access via our landing zone, which remembers that my laptop is a trusted device, doesn't ask for MFA each time I log in.

ledge
Jun 10, 2003

Docjowles posted:

What is it like having an IT group that can correctly configure MFA to not reauthenticate you 69,000 times per day? I feel like I spend half my life responding to Duo prompts

I work for a small consulting company, so I am my companies IT group :) I do not miss corporate IT one bit (nor HR, or middle managers, or any of that bullshit, I thoroughly recommend it).

ledge
Jun 10, 2003

Arzakon posted:

Lambda to trigger a forward isnt Rube Goldbergian. My team project to take an incoming SES e-mail and pass it through SNS to SQS to Lambda to parse the subject line and run that as a query against an RDS database and drop the output into an S3 object was Rube Goldbergian. Mostly because it was part of a joke team building exercise to build a Rube Goldberg machine using as many AWS services as possible (back when there weren’t very many services).

Two steps is not Rube Goldberg. Rube Goldberg is:
file arrives in S3,
triggers lambda to process file line by line into SQS queue, with a dummy entry to indicate the end of the file
SQS sends to Lambda which loads entries into one of two DynamoDBs (one active on empty) based on environment variables in the lambda,
When the dummy eof entry is received call another lambda
this Lambda updates the environment variables on loading lambda and reading lambda and itself about what DynamoDB to target and then deletes and recreates what was previously the active dynamoDB table.

Which I have to do as loading into DynamoDB is slow as poo poo and the file is big enough to take over 15 minutes so I can't do it all in a single lambda.

ledge
Jun 10, 2003

Startyde posted:

I know Batch is a bad word in lots of shops but this sounds like something I'd throw at batch if my org didn't like naked ec2s getting spun up, depending on frequency. At least a step function to avoid lambdas calling lambdas manipulating themselves.

The lambda manipulation has to happen anyway as I am swapping between to tables to avoid any downtime and the call to lookup against the table comes from Connect. The load only happens once a day. That said I might try making a multithreaded lambda to load into the Dynamo DB and see if I can get rid of the SQS part.

Ajaxify posted:

Hope you're using a FIFO queue
:)

ledge
Jun 10, 2003

Xerxes17 posted:

Correct, when I run it manually in SSH it works. AFAIK, it is something to do with the permissions but I've found it rather difficult to find answers on that. I don't think I have cloud trail logs setup.

Does the EC2 instance created by Elastic Beanstalk have a role associated to it that has a policy granting access to the S3 bucket?

ledge
Jun 10, 2003

Startyde posted:

SES is just hot garbage

It works fine for just sending email from AWS services, and there are email marketing platforms out there that use it. But you have to build everything on top of it and just treat it like an SMTP server with terrible logging.

I don't think you'd ever want to give end users the ability to send via it directly.

ledge
Jun 10, 2003

BaseballPCHiker posted:

That AI assist thing is so loving dumb and annoying.

I feel bad for anyone at AWS who gets stuck working on that thing.

I've asked it three different things and the answer has been wrong every time.

Just like CodeWhisperer which creates broken code, even when calling aws apis. I mean it adds incorrect arguments to functions that look right but are wrong.

AI is such a loving disaster zone and the sooner it and the companies surrounding it collapse the better. And they will because it is already hitting the limits of what it can do, and it isn't very good at doing it.

Adbot
ADBOT LOVES YOU

ledge
Jun 10, 2003

lazerwolf posted:

Is it a good practice to use container images for lambda functions? Seems to be the easiest way to handle dependencies. Are there any obvious downsides?

Is there a reason to not use layers? It's what they are there for.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply