#aws (2019-12)

I am following https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/ to setup IAM roles for my pods. While trying to execute the command

aws sts assume-role-with-web-identity \
 --role-arn $AWS_ROLE_ARN \
 --role-session-name mh9test \
 --web-identity-token file://$AWS_WEB_IDENTITY_TOKEN_FILE \
 --duration-seconds 1000 > /tmp/irp-cred.txt 

I am getting the error :

An error occurred (AccessDenied) when calling the AssumeRoleWithWebIdentity operation: Not authorized to perform sts:AssumeRoleWithWebIdentity

What am I missing ?

I figured this out .. I wasn’t setting the namespace (non-default) in the assume-role-policy json

Anyone at reinvent this week?

Checkout #aws-reinvent

Hi, my company I’ve just open-sourced a tool I’ve written. I didn’t know any other which is as accurate and faster. Hope it will be useful for some : https://github.com/claranet/aws-inventory-graph

Hello AWS friends. I’m trying to create a aws_rds_cluster and for the life of me I can’t find a match for engine, and engine_version, and cluster_family (and probably instance_type while I’m at it. I want mysql (or aurora-mysql). I think I’d prefer 5.7 but I’d be happy with 5.6. I keep getting the error

InvalidParameterCombination: RDS does not support creating a DB instance with the following combination

I’ve look over so many “documentation” pages but nowhere can I find a chart that tells me what is compatible with what.

Ok, so in a stroke of genius (or more likely dumb luck) – I found my answer: use the aws cli to tell me ~~ I had no idea. First get the possible engine combinations:

then choosing the possible instance combinations:

aws rds describe-orderable-db-instance-options --engine aurora-mysql --engine-version 5.7.12 | jq '.OrderableDBInstanceOptions[] | ([.Engine, .EngineVersion, .DBInstanceClass])' -c
["aurora-mysql","5.7.12","db.r3.2xlarge"]
["aurora-mysql","5.7.12","db.r3.4xlarge"]
["aurora-mysql","5.7.12","db.r3.8xlarge"]
["aurora-mysql","5.7.12","db.r3.large"]
...many rows omitted

AND IT WORKED. Yey. Thx.

anyone using django-amazon-ses with SES domain configured in another account?

(i know it’s not aws specific but couldn’t find a better place to ask)

Hi Guys I have a question about EBS snapshot: in our case we gonna take snapshot of 3 volume which is 100GB. snapshot gonna take daily, expected change volume is 2% per day as 2gb. Retention not couted yet. so total cost just for EBS snapshot is around:

Total snapshots: 30 Initial snapshot cost: 100 GB x 0.0500000000 = 5 USD Monthly cost of each snapshot: 2 GB x 0.0500000000 USD = 0.1 USD Discount for partial storage month: 0.1 GB x 50% = 0.05 USD Incremental snapshot cost: 0.05 USD x 30 = 1.5 USD Total snapshot cost: 5 USD + 1.5 USD = 6.5 USD 6.50 USD x 3.00 instance months = 19.50 USD (total EBS snapshot cost)

So anyway this ebs snapshot can be reduced ? ( retention policy on snapshot ) And if the snapshots taken remained to the next month, will the cost stay the same from the above or it will increase somehow

Hi guys, some one here was migrate ec2 containers to ECS ??

What is your questiob @Rudyard?

I have one environment with some microservices running in EC2 but I want to migrate to AWS ECS with the same ECS, it’s that possible?

I take it you are not wanting to go to Fargate then?

You could install the ECS agent on the currently running instances and have them talk to ECS, but I’d likely stand up a new cluster with the agents on and cut over traffic once you are happy with it

thanks @joshmyers

I login to an aws account through okta. It is read only. There is an iam role id like to assume in the same account which would let me approve codepipeline. Is this possible?

The trust policy princial for the iam role is set to the account number of the said read only account

but I get the following error when trying to assume the role

Could not switch roles using the provided information. Please check your settings and try again. If you continue to have problems, contact your administrator.

any ideas/tips?

AssumeRole is not a read only action. Probably need to modify the read only role with a policy that allows you to assume the role you want

I have configured a VPC PrivateLink back to an ASG that acts as a TCP Proxy to RDS due to CIDR collision across VPCs. I understand this is less than ideal but the overhead from this proxy is staggeringly slower than hitting the RDS LB intra-VPC. Assuming that at present I cannot use VPC Peering is there anybody that might have a better architecture for hitting RDS across these VPCs with less overhead?

Hi there.. I am a newbie for AWS system manager[SSM].. I am trying to invoke a lambda function through the automation document. The lambda function expects two input args which is supposed to be passed in as mandatory input parameters to the document while execution. I am trying to configure the lambda function as the only step in my automation document. I couldn’t figure out how to pass in the two input parameters[tagKey & tagValue] into my step.1 lambda function.. I couldn’t figure it out from AWS docs. Maybe too naive/dumb.. here is my current document

schemaVersion: '0.3'
parameters:
  tagKey:
    type: String
  tagValue:
    type: String
mainSteps:
  - name: script
    action: 'aws:invokeLambdaFunction'
    inputs:
      FunctionName: getInstances

I got it working now

schemaVersion: '0.3'
parameters:
  tagKey:
    type: String
  tagValue:
    type: String
mainSteps:
  - name: InvokeLambda
    action: 'aws:invokeLambdaFunction'
    inputs:
      FunctionName: getInstances
      Payload: |-
        {
          "tagKey": "{{tagKey}}",
          "tagValue": "{{tagValue}}"
        }

Anyone else just have a couple minutes of network issues in us-east-1

Hey people. I’m confused by aws s3 permissions. I’m using an admin user and getting 403 when trying to upload a package to my bucket using REST.PUT.OBJECT when I use the go sdk

But succeed when using the python sdk (using awscli)

I enabled access logs for a bit and can see in the output the following:

for EFS storage on Amazon ECS tasks - rexray vs CloudStore vs any of the other things that popped up since 2017… rexray seems like a good bet, right?

Hello..I am trying to access AWS Secrets Manager in python code which is deployed as a pod to EKS. I haven’t enabled IRSA yet and the nodes have access to Secrets Manager, however the pod errors out saying unable to locate credentials. Why is boto not able to generate the temporary creds using the node role that the pod is deployed to? What am I missing please? Here’s my code :

session = boto3.session.Session()
            client = session.client(service_name='secretsmanager',
                                    region_name=os.environ["AWS_REGION"])

I just released a new version, with a better look for lists and proxy availibilty : https://github.com/claranet/sshm/releases/tag/1.1.1

rds related question - for gp2 rds databases that have burstable iops, is the rds database supposed to be just as performant at 100% burst balance as it is at say 15% burst balance? Is it only once you get to 0% burst balance that your rds database gets essentially throttled?

hi everyone, I’m currently using CloudCheckr as an AWS cost reporting tool but I am not too happy with it. Does anyone have any recommendations for AWS cost reporting/management tools?

we used cloudcheckr

we endeup using cost explorer

with some custom reports

with all our accounts in AWS Organizations

in the “billing” org

@jose.amengual - what was the reason to drop cloudcheckr? (if you can share)

We’ve been using Metabase with Stitchdata to load the CSV into our own data warehouse

but it requires a lot of SQL fu

(this is for cloudposse internal, not customers)

same as you, cost reports were not that clear, price, overcrowded UI, lack of API etc

@Erik Osterman (Cloud Posse) may skip that option

haha

the homegrown option

If I need to add a custom host mapping on an ECS Fargate container running in awsvpc networking mode, what’s the way to do it?

Do I need to modify /etc/hosts in the container on startup? Or is there a better way, maybe through Route 53?

(unfortunately extraHosts on the task definition doesn’t work with awsvpc mode)

Hi guys! Have someone tried to send CloudWatch alarms to the Slack using sns+aws-chatbot?

Does it work?