#aws (2018-11)
Discussion related to Amazon Web Services (AWS)
Discussion related to Amazon Web Services (AWS)
Archive: https://archive.sweetops.com/aws/
2018-11-01



@Erik Osterman (Cloud Posse) Whoa, good looking out!
2018-11-04
2018-11-07


From the start, AWS has focused on choice and economy. Driven by a never-ending torrent of customer requests that power our well-known Virtuous Cycle, I think we have delivered on both over the years: Choice – AWS gives you choices in a wide range of dimensions including locations (18 operational geographic regions, 4 more in […]
2018-11-17

Hey guys i have a question. Is it possible to create a private dns route 53 address and resolve it as static website in web browser internally behind vpn

with added alb or without alb
2018-11-18

I think that should be possible. Openvpn can push a DNS option to the vpn client. So either you push the AWS DNS server as an option and push a route for that IP. Or you host a DNSMASQ daemon on your VPN instance and push that IP as DNS to your clients.
Not AWS but similar: https://superuser.com/questions/1090216/internal-domain-on-openvpn-with-dnsmasq
I’m trying to get dnsmaq and OpenVPN working together on DigitalOcean. I want to create a VPN that forwards the requests that end with *.local to the droplet and the others to be resolved by Google…

I can create wild card ssl certs *.internal.domain.com and renew them even year manually so it looks like https://something.internal.domain.com as its private hosted route53 domain attached to vpcs. Its not resolved outside vpcs. Right now i can ping inside vpc on ec2 instances but not in web browser

Do you think this is possible @maarten

What exactly ?

The above @maarten

Right now i can ping internal domain names from ec2 instances with in vpc

I think I did answer that question already, haven’t I ?

But the same link is not resolved or webpage is not shown in chrome

When connected to vpn

Yes, but did you read what I mentioned regarding DNS & VPN ?

It tried that but let me try with the link you sent

Thanks

Thanks @maarten

For a private domain there is no need for anything public or even any normal domain root. In the past I’ve used <env>.<company>.aws for private domains and issue our own SSL certs with any length of life that is desired. Depending on service, have ranged between 1 and 20 years for service certs as well as using a wildcard one.

What you can also do is just use a public visible domain btw, not sure what the security context is but that will work too.
2018-11-19

@Tee we do something just like this. Client-> VPN -> AWS
We just have 2 unbound recursive servers running that FW->AWS DNS and only send *.ourdomain or *.internal.whatever and *.awsinternaldomains to them

Does it need to be a VPN? If you want auth in front of a static website you could use CloudFront/Lambda/S3 and have it serverless.

@Tee, similar to @joshmyers point, the Identity-Aware Proxy (IAP) approach is advantageous over the VPN approach. It’s like having a point-to-point VPN whereby exactly one service is exposed and behind auth.

This is the “BeyondCorp” model pioneered at Google. I can share more if it sounds interesting.

It interesting @Erik Osterman (Cloud Posse) but our company is more likely want to stay away from Google services as much as they can. Is beyondcorp opensourced

It’s more of a concept than a technology

It’s not owned by google

There are open source implementations

As well as SaaS

CloudFlare Argo

duo access

Google IAP

AWS ALBs support cognito now

It was coined at Google because they have a large intranet. So large that if they used a VPN it would be indistinguishable from the public internet. As such, it made it impractical to use VPNs to provide secure, remote access with limited scope

to this approach, we do it that way with IAP or similar as much as we can

we only have the VPN to host a legacy system

Thanks
2018-11-20
2018-11-22


Fits nicely with geodesic

NIce

That’s awesome!

I note that it isn’t yet supported in Terraform, would be a small PR. The vendored version of aws-sdk supports it too. Maybe interesting in terms of geodesic. What could that mean for the audit account? That would need to be the org master account

Audit account is just the sink. I presume you enable it in the master but ship it to the sink.
2018-11-23


As I have discussed in the past, our customers use multiple AWS accounts for many different reasons. Some of them use accounts to create administrative and billing boundaries; others use them to control the blast radius around any mistakes that they make. Even though all of this isolation is a net positive for our customers, […]
2018-11-26

Fintech startups , rejoice! https://aws.amazon.com/about-aws/whats-new/2018/11/aws-transfer-for-sftp-fully-managed-sftp-for-s3/
Introducing AWS Transfer for SFTP, a fully managed SFTP service for Amazon S3. AWS Transfer for SFTP enables you to easily move your file transfer workloads that use the Secure Shell File Transfer Protocol (SFTP) to AWS without needing to modify your applications or manage any SFTP servers.


Introducing AWS Transfer for SFTP, a fully managed SFTP service for Amazon S3. AWS Transfer for SFTP enables you to easily move your file transfer workloads that use the Secure Shell File Transfer Protocol (SFTP) to AWS without needing to modify your applications or manage any SFTP servers.

@Andriy Knysh (Cloud Posse) duplicate (see above)

do you have the link to mongodb announcement

ah yes

it’s not announcement yet, just speculations, but prob will happen https://seekingalpha.com/news/3410999-aws-develops-new-services-amid-open-source-pushback
Amazon (AMZN -4.3%) continues to use open-source software to build out AWS despite tensions with the open-source community, according to The Information.AWS is reportedly developing two new cloud serv

Any recommendations for sites summarizing all announcements from reinvent?

r/aws: News, articles and tools covering Amazon Web Services (AWS), including S3, EC2, SQS, RDS, DynamoDB, IAM, CloudFormation, Route 53, CloudFront, Lambda, VPC, Cloudwatch, Glacier and more.

10 votes and 0 comments so far on Reddit
2018-11-27


Amazon Web Services is rolling out new services at a rapid clip, highlighting custom ARM processors and adding to its suite of Internet of things tools.
2018-11-28

https://aws.amazon.com/blogs/aws/new-amazon-cloudwatch-logs-insights-fast-interactive-log-analytics/

Many AWS services create logs. Off the top of my head there are VPC Flow Logs, Route 53 Logs, Lambda Logs, CloudTrail Logs (for AWS API calls), RDS Logs, IoT Logs, ECS Logs, API Gateway Logs, and S3 Server Access Logs, EC2 Instance Logs (via the CloudWatch Agent), to name a few. The services that […]

@Andriy Knysh (Cloud Posse) that looks super sweet!
2018-11-30

