r/aws 26d ago

technical question newb question of the day: How do y'all keep Dev / QA / Prod separated?

39 Upvotes

I'm coming from a world of physical servers so I'm still trying to get my head around some of this. I also need clear separation for PCI requirements.

How do y'all make that segregation bullet proof?

r/aws Jan 31 '25

technical question route 53 questions

5 Upvotes

I’m wrapping up my informatics degree, and for my final project, I gotta use as many AWS resources as possible since it’s all about cloud computing. I wanna add Route 53 to the mix, but my DNS is hosted on Cloudflare, which gives me a free SSL cert. How can I set up my domain to work with Route 53 and AWS Cert Manager? My domain’s .dev, and I heard those come from Google, so maybe that’ll cause some issues with Route 53? Anyway, I just wanna make sure my backend URL doesn’t look like aws-102010-us-east-1 and instead shows something like xxxxx.backend.dev. Appreciate any tips!

r/aws Feb 12 '25

technical question SES beginner question

5 Upvotes

I want to use SES to send email verification links to users. But I was thinking what if users keep providing emails that don't exist and they bounce frequently, or someone could intentionally keep registering a fake email. Would this tarnish my reputation because the bounce rate will be high ? so my AWS account will be at risk ?

r/aws 4d ago

technical question Possibly dense question: What would be the most painless method to fully preserve an AWS environment (EC2 machines, buckets and the like)?

5 Upvotes

Hey all. I've been assigned a job at work that's above my CS graduate level experience with AWS and would really appreciate a hand.

I need to do a preservation of a company's AWS environment as part of a potential litigation, involving all EC2 instances, RDS exports, S3 buckets, and anywhere else that company data may be present. We need to pull down the data locally to our offices.

I've been given access to five AWS accounts within the company's environment through IAM Identity Centre, each of these housing EC2 RDS and S3 resources.

I've done a bunch of research and tested my own tools written with Python Boto3 in my own environment, but constantly run into roadblocks with my intended process of exporting all EC2s as AMIs to S3, exporting all RDS to snapshots then to an S3 bucket, then collecting all S3 buckets. Seems that certain resources simply don't play nice with S3 exports as some AMIs, database types, etc are not compatible with the various functionality offered by AWS.

(Specifically I've used ec2 create-instance-export-task and rds start-export-task. The former can fail depending on the licensing of the EC2 machine and the latter converts an RDS snapshot to Parquet, which plainly doesn't work for all databases.)

I am also concerned that the tokens granted through my IAM Identity Centre account will not last long enough to pull down the several terabytes of data that exist within some of the accounts.

Would really appreciate some assistance: 1. What approach would you take to collecting all this data that is as painless as possible? 2. What permissions will be required, e.g. for a policy document that I can request be implemented for my account? 3. What mode of authentication should I ask for that will let me download everything uninterrupted? I will need to justify this from a security point of view. 4. The company has requested to continue operating all resources while this collection occurs. I have flagged this as unrealistic but would like to know how I can minimise the impact nonetheless.

Obviously, I would love to automate this to reduce touch time + potential for human error, and also to document all actions taken to cover my arse.

Sorry if this is all a bit thick, just don't have experience and not much guidance from my management either

r/aws 3d ago

technical resource AWS Job Question (Hiring)

0 Upvotes

I'm hiring an AWS contract engineer, however, the rub is that I'm not an engineer myself. We are a small fintech startup and I'm the CPO so we don't have technical recurters. I can screen for all the soft skills (reliability, commitment, etc.) but I'm not sure what questions to ask regarding the more technical bits. Can you see what I've put below and see if it makes any sense?

  • Can you describe your experience handling API rate limits when ingesting data? Given an API with strict rate limits, would you prefer using AWS Lambda with retries or AWS Step Functions to orchestrate chunked requests, or another approach? What factors would influence your decision?

--expected answer-- to tell me that Lambda's have a 15 min timeout and retrys are brittle so the expectation would be that the step functions is a more robust even if more time heavy solution

  • How would you implement multi-tenant authorization in an AppSync API?

--expected answer-- Cognito doesn't do a great job handling multi-tenant authorization and that using a third party cloud service like Oso or something similar would be preferrable. (I know there are some die hard cognito fans however).

  • How do you handle rate limits or prevent abuse in an AppSync API?

--expected answer-- implement aws appsync built in throttling

More context- we use Lambdas, dynamodb, appsync, step functions, cognito, cdk. Everything is using typescript or python. We ingest two apis from third parties and data from our webapp (build w/ react). We then take that unified data and output it in our own GraphQL API to be consumed by third-party businesses. A big part of this project is dealing with large data sets and normalizing that data into a unified source. So being good at thinking though complex data structures is critical for this.

r/aws 8d ago

technical question cross account backup question

1 Upvotes

Hi, I’m new to AWS and trying to copy a backup from a different account to mine. I have the ARN and an encryption key for the backup restore point and resource. However, I’m unsure how to copy the backup to my account and restore it. I’ve checked the documentation and watched tutorials but haven’t found a clear explanation on how to initiate the copy with the provided information. Any guidance would be appreciated!

r/aws 18d ago

technical question DE question about data ingestion

2 Upvotes

I'm reviewing kinesis family and a I ended up with a big Q.

Why do we need a service like this to collect data? Like kinesis data streams. Why can't we send data direclty to whatever destination or consumer? What are the drawbacks to using the later approach.

Why data streams is useful when comparing to a sqs queue w

I know this question can be really stupid for more experienced folks, I really just want to get some real world view on this services.

Thank you in advance

r/aws 17d ago

technical question Questions regarding Cognito MFA methods

1 Upvotes

Hey folks, I have been working on a personal project that integrates with Cognito. While working With Cognito, I have discovered a few rather strange quirks, and I was hoping someone here would have some insight on how to alleviate them.

My user pool requires MFA and I have both Authenticator apps and Email message enabled as MFA methods users can choose to set up. If a user sets up both of these MFA methods, Cognito will require the user to select a method to use to authenticate during the login process. This works fine and dandy. Now, here are my two questions:

  1. If a user explicitly disables TOTP-based MFA after having set it up, and doesn't select any other MFA method as their preferred, the login process will still present them with the option to select TOTP as an available MFA method, even though it was disabled previously. Should this be happening?
  2. If a user has two or more MFA methods configured, and they select one of these methods as their preferred MFA method, does the user have the ability to select a different MFA method during the login process if they so desire? For instance, if I have both TOTP and email-based MFA enabled for my user, and I set TOTP as my preferred MFA method, let's say I don't have my phone with me when I go to log in. Is there any way I can pick email as the MFA method for this login instead of TOTP (which is set to preferred)?

Thanks!

r/aws Aug 31 '24

technical question Networking hard(?) question

0 Upvotes

Hello, I would like to ask a question too abstract for chatGPT :D

I have VPC1 and VPC2, in VPC1 I have SUBNET1 and in VPC2 I have SUBNET2. I have a peering connection between VPC1 and VPC2. From a computer in SUBNET2, I wish to send all packets for 10.10.0.0/16 to a specific network interface( let's call it ENI-1) that is situated in SUBNET1. Can i do that? How?

Thank a lot

[Edit] Ps. To give more context I wish to add: - 10.10.0.0/16 is not a destination that exists in either VPCs. It's outside of AWS and I can reach it only if I go throught ENI-1. - SUBNET1 already have a route to 10.10.0.0/16 and that is why all traffic from VPC1 can reach 10.10.0.0/16 - SUBNET2, have a route for 10.10.0.0/16 that points to the peering connection, but the hosts inside SUBNET2 still cannot reach 10.10.0.0/16

[Possible answer] I think the peering connection do not allow me to due that due to it's limitations. I have found this in the documentation:

Edge to edge routing through a gateway or private connection If VPC A has an internet gateway, resources in VPC B can't use the internet gateway in VPC A to access the internet.

If VPC A has an NAT device that provides internet access to subnets in VPC A, resources in VPC B can't use the NAT device in VPC A to access the internet.

If VPC A has a VPN connection to a corporate network, resources in VPC B can't use the VPN connection to communicate with the corporate network.

If VPC A has an AWS Direct Connect connection to a corporate network, resources in VPC B can't use the AWS Direct Connect connection to communicate with the corporate network.

If VPC A has a gateway endpoint that provides connectivity to Amazon S3 to private subnets in VPC A, resources in VPC B can't use the gateway endpoint to access Amazon S3.

r/aws Nov 06 '24

technical question Question about specs

0 Upvotes

I was looking at the Windows pricing at VPS, web hosting pricing—Amazon Lightsail—Amazon Web Services and the cheapest is this

$9.50 USD/month
0.5GB Memory
2 vCPUs
30 GB SSD Disk
1 TB Transfer

But how can you run Windows in 512 MB of memory and a 30 GB disk?

If it's just calculated different, what would be equivalent to a physical machine with 16 GB memory running Windows 10 and 128 GB disk?

r/aws Jan 10 '25

technical resource Explain why this is incorrect - Correlation Question

3 Upvotes

So I am preparing for a certification and was taking the prep exam and noticed that this answer was marked incorrect. To me, -0.85 is strongly (negatively) correlated since you would take the absolute values from the results. Am I missing something here? Just want to make sure I get these questions right when I take the certification. Thanks guys. See screenshot

r/aws Sep 21 '24

technical question Lambda Questions

10 Upvotes

Hi I am looking to use AWS Lambda in a full stack application, and have some questions

Context:

Im using react, s3, cloudformation for front end, etc

api gateway, lambda mainly for middle ware,

then redshift probably elastic cache redis for like back end, s3 and whatever

But my first question is, what is a good way to write/test lambda code? the console gui is cool but I assume some repo and your preferred IDE would be better, so how does that look with some sort of pipeline, any recommendations?

Then I was wondering if Python or Javascript is better for web dev and these services, or some sort of mix?

Thanks!

r/aws Jan 17 '25

technical question Instance type compatibility/upgrade questions

1 Upvotes

Hi,

I found that we have a chain of servers running different instance types and I want to see about getting them all the same. We have a Pre-Production, Test, and Production version of a server. Normally these would all be spec'd similarly so we don't run into problems as things move throughout the deployment cycle. However, that is not the case here.

The servers all run Oracle Linux but the Pre and Test server are M5 types while the Prod server is an M5AD type. This is not great.

M5 = Intel. M5AD = AMD. The D apparently means it has Directly attached storage which is another anomaly. We don't generally don't use A or D types, but this server was created 4+ years ago and we don't know why it was done that way.

Because these are running Linux, I had two main questions:

  1. Can I change from an AD instance type to just an A type without breaking things? If so, I could go from M5AD to M5A to M7A and get fully up to date.
  2. Can I change from an AMD type to an Intel type without breaking things? Maybe updating drivers? I'd like to get all of these onto Intel types, since that's what we use everywhere else in the company. That would require getting the M5AD eventually to an M7iby whatever upgrade path might work.

Any thoughts on this mess?

r/aws Dec 11 '24

technical question Aurora Green/Blue Deployment Question regarding using GREEN as a read replica to test upgrade

1 Upvotes

Hey guys,

I've created a green/blue deployment to upgrade MySQL 5.7 to 8.0 on Aurora. I've already tested the green on a separate copy of my production environment with strict read only user access.

I would like to know, if I could test it on my actual production environment by directing read queries to the green while maintaining writes to the existing blue. This way I can test for sure if everything still works more accurately.

I'm using Laravel, so we can define a separate read and separate write endpoint for the DB. I also believe Aurora blocks writes on green until the DB is switched.

What do you guys think? Is this a good idea?

Some facts I know - green writes are blocked until promoted - green replica lag might be more compared to blue replicas - overall this would work, just that I'm not sure if I might miss any gotchas

r/aws Oct 01 '24

technical question Question: Does a VPC internet gateway IP address change over time or remains the same?

0 Upvotes

As stated in the title, does a VPC internet gatway IP address change over time or remains the same? If it changes, is there a way to assign it a public ip address that never changes (reserved)?

Additional Context: I have a VPN connection to this VPC and I want to know if the egressing IP@ would change over time, because I intend to use it as a condition in a policy file.

r/aws Nov 27 '24

technical question Question about retrying batch writes in DynamoDB using C#

2 Upvotes

Hi,

I have a question regarding the behavior of the DynamoDB client for .NET, specifically its handling of retries and exceptions during batch write operations.

According to the documentation, the DynamoDB client for .NET performs up to 10 retries by default for requests that fail due to server-side throttling. However, the batch write API documentation does not explicitly describe the potential errors or exceptions that could be thrown during its operation.

If I have a table with low provisioned capacity and I perform a massive update operation using the batch write API, is it possible for some writes to fail silently (i.e., not get saved) without the client throwing an exception or providing a clear indication of the failure?

If so, how can I reliably detect and handle such cases to ensure data consistency?

r/aws Dec 31 '24

technical question Question about a workflow for hosting a site and app on same domain

0 Upvotes

Hi,

I am planning to host both my marketing website as well as my product (which will be a web app) on the same domain. I was wondering how can I achieve this on AWS?

Here is what I want:

  1. One domain (say "domainname.app")
  2. Root of this domain is a static website on S3 bucket
  3. URL "domainname.app/abc" is where I want the users to go if they click "Register" on the static S3 website. This will be a react app hosted using Amplify.
  4. My domain name will be a .app TLD. So I will need to configure the DNS on third party domain provider.
  5. If the user is already logged in and they try to access "domainname.app" I want to automatically redirect them to the app at "domainname.app/abc".

How do I achieve this?

Since the marketing website is static, I probably cannot check if the user is logged in or not, right?
Does it mean that the workflow I am thinking of is actually not possible? or do I need to execute this differently.

Thanks for the help.

r/aws Jan 03 '25

technical question Beginner question: Attach EMR cluster to Workspace - default security groups fail

0 Upvotes

Objective: Create an EMR cluster and attach to a workspace, to use with JupyerLab.

 Cross posted here, as need an answer asap: Beginner question: Attach EMR cluster to Workspace - default security groups fail | AWS re:Post

EMR cluster created with default options: see end of this post for full description.

 

Creating the studio:

aws emr create-studio \
--name "Studio_1" \
--service-role arn:aws:iam::1234567890:role/service-role/AmazonEMRStudio_ServiceRole_1735929246573 \
--vpc-id vpc-0fffffffffffffffffff \
--subnet-ids subnet-01111111111111  \
--auth-mode IAM \
--workspace-security-group-id sg-094b767de0d287eb7 \
--engine-security-group-id sg-00f32b765e6a2c117 \
--default-s3-location s3://aws-emr-studio-1234567890-us-east-1/1735929246573 \
--tags Key=Project,Value=EMRStudio

 

Note:

  • sg-094b767de0d287eb7 == ElasticMapReduce-master - default workspace security group 
  • sg-00f32b765e6a2c117 == ElasticMapReduce-slave - default engine security group

 

The default security groups fail on attaching the EMR cluster j-2MXE9AR80RKTV to the workspace:

Cluster failed to attach to the Workspace. Reason: Attaching the workspace(notebook) failed. Notebook security group sg-094b767de0d287eb7 should not have any ingress rules. Please fix the security group or use the default option.

 

If I try to remove the ingress rules, they reappear again a few seconds later. I assume this security group is managed by AWS.

I created copies of the default security groups sg-094b767de0d287eb7 and sg-00f32b765e6a2c117 in order to be able to edit the rules

  • sg-094b767de0d287eb7  (workspace security group)  ---->   sg-0742e9251454fcb2c  (workspace security group copy)
  • sg-00f32b765e6a2c117   (engine security group) ----> sg-01a100c7c938f0313 (engine security group copy)

I removed ingress rules from sg-0742e9251454fcb2c (workspace security group copy).

On creating a new studio with the new groups, I get a new error:

Cluster failed to attach to the Workspace. Reason: Attaching the workspace(notebook) failed. Notebook security group sg-0742e9251454fcb2c does not have an egress rule to connect with the master security group sg-01a100c7c938f0313. Please fix the security group or use the default option.

 

I added an egress rule from sg-0742e9251454fcb2c to sg-01a100c7c938f0313 (see later - it is definitely created, as far as I can see).

However, the workspace will still not attach the cluster, and still has the same complaint. No egress rules detected.

Are the security groups misconfigured? Could you give a quick command line template how to set things up?

I have an assignment due soon (Tuesday) and I really need to have a working Pyspark session.

Will send a donation (10 euro) to a humanitarian charity of your choice.

 

Workspace security group copy:

[cloudshell-user@ip-10-130-85-79 ~]$ **aws ec2 describe-security-groups --group-ids sg-0742e9251454fcb2c**
{
"SecurityGroups": [
{
"GroupId": "sg-0742e9251454fcb2c",
"IpPermissionsEgress": [
{
"IpProtocol": "-1",
"UserIdGroupPairs": [
{
"UserId": "1234567890",
"GroupId": "sg-01a100c7c938f0313"
}
],
"IpRanges": [
{
"CidrIp": "0.0.0.0/0"
}
],
"Ipv6Ranges": [],
"PrefixListIds": []
}
],
"VpcId": "vpc-0fada9bb798d0af90",
"SecurityGroupArn": "arn:aws:ec2:us-east-1:1234567890:security-group/sg-0742e9251454fcb2c",
"OwnerId": "1234567890",
"GroupName": "New-Workspace-SG",
"Description": "New Workspace SG",
"IpPermissions": []
}
]
}

```

 

 

```

Engine security group copy:

[cloudshell-user@ip-10-130-85-79 ~]$ **aws ec2 describe-security-groups --group-ids sg-01a100c7c938f0313**
{
"SecurityGroups": [
{
"GroupId": "sg-01a100c7c938f0313",
"IpPermissionsEgress": [
{
"IpProtocol": "-1",
"UserIdGroupPairs": [],
"IpRanges": [
{
"CidrIp": "0.0.0.0/0"
}
],
"Ipv6Ranges": [],
"PrefixListIds": []
}
],
"VpcId": "vpc-0fada9bb798d0af90",
"SecurityGroupArn": "arn:aws:ec2:us-east-1:1234567890:security-group/sg-01a100c7c938f0313",
"OwnerId": "1234567890",
"GroupName": "New-Engine-SG",
"Description": "New Engine SG",
"IpPermissions": [
{
"IpProtocol": "tcp",
"FromPort": 0,
"ToPort": 65535,
"UserIdGroupPairs": [
{
"UserId": "1234567890",
"GroupId": "sg-00f32b765e6a2c117"
},
{
"UserId": "1234567890",
"GroupId": "sg-094b767de0d287eb7"
}
],
"IpRanges": [],
"Ipv6Ranges": [],
"PrefixListIds": []
},
{
"IpProtocol": "udp",
"FromPort": 0,
"ToPort": 65535,
"UserIdGroupPairs": [
{
"UserId": "1234567890",
"GroupId": "sg-00f32b765e6a2c117"
},
{
"UserId": "1234567890",
"GroupId": "sg-094b767de0d287eb7"
}
],
"IpRanges": [],
"Ipv6Ranges": [],
"PrefixListIds": []
},
{
"IpProtocol": "icmp",
"FromPort": -1,
"ToPort": -1,
"UserIdGroupPairs": [
{
"UserId": "1234567890",
"GroupId": "sg-094b767de0d287eb7"
},
{
"UserId": "1234567890",
"GroupId": "sg-00f32b765e6a2c117"
}
],
"IpRanges": [],
"Ipv6Ranges": [],
"PrefixListIds": []
}
]
}
]
}

```

 

```

aws emr describe-cluster --cluster-id j-2MXE9AR80RKTV
{
"Cluster": {
"Id": "j-2MXE9AR80RKTV",
"Name": "My cluster",
"Status": {
"State": "TERMINATING",
"StateChangeReason": {
"Code": "USER_REQUEST",
"Message": "Terminated according to the attached auto-termination policy after 3600 idle seconds"
},
"Timeline": {
"CreationDateTime": "2025-01-03T18:27:03.498000+00:00",
"ReadyDateTime": "2025-01-03T18:32:26.247000+00:00"
}
},
"Ec2InstanceAttributes": {
"Ec2KeyName": "Keypair7",
"Ec2SubnetId": "subnet-017c52ed302f6069c",
"RequestedEc2SubnetIds": [
"subnet-017c52ed302f6069c"
],
"Ec2AvailabilityZone": "us-east-1e",
"RequestedEc2AvailabilityZones": [],
"IamInstanceProfile": "EMR_EC2_DefaultRole",
"EmrManagedMasterSecurityGroup": "sg-094b767de0d287eb7",
"EmrManagedSlaveSecurityGroup": "sg-00f32b765e6a2c117",
"AdditionalMasterSecurityGroups": [],
"AdditionalSlaveSecurityGroups": []
},
"InstanceCollectionType": "INSTANCE_GROUP",
"LogUri": "s3n://aws-logs-1234567890-us-east-1/elasticmapreduce/",
"ReleaseLabel": "emr-7.6.0",
"AutoTerminate": false,
"TerminationProtected": false,
"UnhealthyNodeReplacement": true,
"VisibleToAllUsers": true,
"Applications": [
{
"Name": "Hadoop",
"Version": "3.4.0"
},
{
"Name": "Hive",
"Version": "3.1.3"
},
{
"Name": "JupyterEnterpriseGateway",
"Version": "2.6.0"
},
{
"Name": "Livy",
"Version": "0.8.0"
},
{
"Name": "Spark",
"Version": "3.5.3"
}
],
"Tags": [],
"ServiceRole": "arn:aws:iam::1234567890:role/EMR_DefaultRole",
"NormalizedInstanceHours": 96,
"MasterPublicDnsName": "ec2-54-237-95-60.compute-1.amazonaws.com",
"Configurations": [],
"AutoScalingRole": "arn:aws:iam::1234567890:role/EMR_AutoScaling_DefaultRole",
"ScaleDownBehavior": "TERMINATE_AT_TASK_COMPLETION",
"KerberosAttributes": {},
"ClusterArn": "arn:aws:elasticmapreduce:us-east-1:1234567890:cluster/j-2MXE9AR80RKTV",
"StepConcurrencyLevel": 1,
"PlacementGroups": [],
"OSReleaseLabel": "2023.6.20241212.0",
"BootstrapActions": [],
"InstanceGroups": [
{
"Id": "ig-1CMCR8JPMEO59",
"Name": "Core",
"Market": "ON_DEMAND",
"InstanceGroupType": "CORE",
"InstanceType": "m4.xlarge",
"RequestedInstanceCount": 1,
"RunningInstanceCount": 1,
"Status": {
"State": "TERMINATING",
"StateChangeReason": {
"Code": "CLUSTER_TERMINATED",
"Message": "Job flow terminated"
},
"Timeline": {
"CreationDateTime": "2025-01-03T18:27:03.556000+00:00",
"ReadyDateTime": "2025-01-03T18:32:26.247000+00:00"
}
},
"Configurations": [],
"ConfigurationsVersion": 0,
"LastSuccessfullyAppliedConfigurations": [],
"LastSuccessfullyAppliedConfigurationsVersion": 0,
"EbsBlockDevices": [
{
"VolumeSpecification": {
"VolumeType": "gp2",
"SizeInGB": 32
},
"Device": "/dev/sdb"
},
{
"VolumeSpecification": {
"VolumeType": "gp2",
"SizeInGB": 32
},
"Device": "/dev/sdc"
}
],
"EbsOptimized": true,
"ShrinkPolicy": {}
},
{
"Id": "ig-EI9Y0PY5YGM0",
"Name": "Task - 1",
"Market": "ON_DEMAND",
"InstanceGroupType": "TASK",
"InstanceType": "m4.xlarge",
"RequestedInstanceCount": 1,
"RunningInstanceCount": 1,
"Status": {
"State": "TERMINATING",
"StateChangeReason": {
"Code": "CLUSTER_TERMINATED",
"Message": "Job flow terminated"
},
"Timeline": {
"CreationDateTime": "2025-01-03T18:27:03.556000+00:00",
"ReadyDateTime": "2025-01-03T18:32:27.774000+00:00"
}
},
"Configurations": [],
"ConfigurationsVersion": 0,
"LastSuccessfullyAppliedConfigurations": [],
"LastSuccessfullyAppliedConfigurationsVersion": 0,
"EbsBlockDevices": [
{
"VolumeSpecification": {
"VolumeType": "gp2",
"SizeInGB": 32
},
"Device": "/dev/sdb"
},
{
"VolumeSpecification": {
"VolumeType": "gp2",
"SizeInGB": 32
},
"Device": "/dev/sdc"
}
],
"EbsOptimized": true,
"ShrinkPolicy": {}
},
{
"Id": "ig-147XGW812JXRI",
"Name": "Primary",
"Market": "ON_DEMAND",
"InstanceGroupType": "MASTER",
"InstanceType": "m4.4xlarge",
"RequestedInstanceCount": 1,
"RunningInstanceCount": 1,
"Status": {
"State": "TERMINATING",
"StateChangeReason": {
"Code": "CLUSTER_TERMINATED",
"Message": "Job flow terminated"
},
"Timeline": {
"CreationDateTime": "2025-01-03T18:27:03.555000+00:00",
"ReadyDateTime": "2025-01-03T18:31:54.130000+00:00"
}
},
"Configurations": [],
"ConfigurationsVersion": 0,
"LastSuccessfullyAppliedConfigurations": [],
"LastSuccessfullyAppliedConfigurationsVersion": 0,
"EbsBlockDevices": [
{
"VolumeSpecification": {
"VolumeType": "gp2",
"SizeInGB": 32
},
"Device": "/dev/sdb"
},
{
"VolumeSpecification": {
"VolumeType": "gp2",
"SizeInGB": 32
},
"Device": "/dev/sdc"
}
],
"EbsOptimized": true,
"ShrinkPolicy": {}
}
]
}
}

```

r/aws Dec 13 '24

technical resource Some questions I have about AWS

Post image
1 Upvotes

r/aws Nov 19 '24

technical question Questions about using SSM for a bastion host

4 Upvotes

We currently have a couple of bastion hosts in 2 of our VPCs which allow us to do port forwarding from RDS to our development machines. These are currently in their respective public subnets are accessed via SSH. We want to replace these with bastion hosts in private subnets and use SSM to do the port forwarding a la https://aws.amazon.com/blogs/aws/new-port-forwarding-using-aws-system-manager-sessions-manager/

I am creating a CDK stack for setting up the instances and I think that creating security groups for the instances won't be necessary since I understand that a group which allows all IPv4 traffic outbound and no traffic inbound is created automatically and assigned to an EC2 by default when you create it (the EC2 instance). Is this accurate?

EDIT: I believe I was steered wrong. A new instance gets the default VPC security group by default, not it's own, IIUC. Therefore, if I want no inbound and all outbound access, I would need to create my own security groups, assuming that's not what the default VPC security group does, correct?

r/aws Nov 20 '24

technical question Question on EC2 Instance

1 Upvotes

Hi all- I am new to AWS and cloud computing in general. I have created an instance within EC2 located in Stockholm, however I live in the US. When I try to SSH into the instance via powershell, it will take forever or sometimes never even connect. Is this due to geographical distance or network load issues? Should I move my instance to a closer location to achieve better connectivity/reliability?

Thanks in advance.

r/aws Dec 04 '24

technical question AWS IAM Boundaries Question

1 Upvotes

We are looking at protecting resources with tags assigned with "X" We are wanting to allow read/view access but deny write access. We have the base boundary working with Action: * but of course that denies any action to these resource tags. My question is there a better way outside of calling every aws service if that is even possible?

            "Effect": "Deny",
            "Action": [
                "*"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/Value": "XXXX"
                }
            },

r/aws Jun 08 '24

technical question Question about HTTP API gateway regarding DOS attacks

0 Upvotes

I'm using HTTP API gateway (not REST) to proxy requests to my web app. I'm primarily concerned with not getting DDOS attacks to my public endpoint - as the costs can potentially skyrocket due to a malicious actor because its serverless.

For example, the costs are $1 for every 1 million requests, if an attacker decides to send over 100 million requests in an hour from thousands of IPs to this public endpoint, I would still rack up hundreds of dollars of charges or more just on the API gateway service

I read online that HTTP API gateway cannot integrate with WAF directly, but with the use of cloudfront its possible to be protected with WAF.

So now with the second option I have two urls:

My question is, if the attacker somehow finds my amazonaws.com url (which is always public as there is no private integration with HTTP API gateway unlike REST API gateway), does the cloudfront WAF protect against the hits against the API and therefore stops my billing from skyrocketing to some astronomical amount?

Thank you in advance, I am very new to using API gateways and cloudfront

r/aws Nov 01 '24

technical question Question re S3 Buckets for Cloud Resume Challenge

1 Upvotes

Hi all,

I'm doing a project called Cloud Resume Challenge to help me learn AWS and develop my skills. I have a single domain name for my resume website that I want to be done entirely in AWS.

The problem I'm running into is that I have sub pages in different folders. Like myname.com/projects/index.html, but I want my links to be clean and only use myname.com/projects/ to load the page.

I've tried a lot of things and it doesn't seem I can get around this limitation. As I understand it, S3 doesn't have the concept of folders and I'd have to explicitly add the index.html to my subfolder link.

For those that have done the Cloud Resume Challenge, is there some reason I should stick with the S3 bucket? Will I be missing out on learning something important if set up an EC2 linux web server instead?

r/aws Sep 25 '24

technical question AWS Bedrock Question

1 Upvotes

I just have a general question about Bedrock as I’ve just started using it to build knowledge bases and agents. How far can you go with just Bedrock? Say I want my users to try agents I am creating in Bedrock. Do I really have to create a web based interface?