#aws (2023-07)

It all depends on usage honestly, it ranges from few dollars to thousands depending on accounts. But as an example, a account with like 7000$ spend, around 150$ of it is guardduty, the account hosts a web application.

Just asking, because of all three modules have similiar merge requests, I change already something in the single ec2 module, which is still missing at ec2group module. looks like its hard to solve the pipeline for ec2 group module, alot of stuck pr’s there

Are you asking why CloudPosse has three? It’s probably a mix of two reasons:

1. Modules which have fewer knobs are easier to reason about
2. As new requirements came up, CloudPosse created new modules to meet new needs

@Alex Jurkiewicz the EC2 module with a count would be the same like https://github.com/cloudposse/terraform-aws-ec2-instance-group but less to maintain. the instance group module is totally outdated at the moment

If that’s true, there are probably many users of one or the other who don’t want to spend time migrating

The preserve mode for AWS Application Load Balancer (ALB) is useful when it comes to managing client connections and maintaining “stickiness”. By enabling preserve mode, you can maintain the connection between a client and your application’s instances, even if the targets of the load balancer change.

This is especially beneficial in scenarios where you have applications that maintain stateful connections or utilize real-time protocols. For example, when you have WebSockets or long-polling connections, the connections between the client and the instances need to be maintained.

Normally, ALB will close connections to targets as they are deregistered, but in preserve mode, existing connections remain open and new requests from existing connections are sent to other targets. This can be useful in situations where you are updating or scaling down your backend services and want to minimize disruptions.

It is not stuck, need to enter username/password

I made this on terraform with the same project we worked on lol, how do you put the username and password in?

ssh key should be used, instead of username/password

It looks like you’ve connected to the serial console. That’s not really a recommended access path. Use SSH or SSM Session Manager

This is much better than I assumed it would be. The answers are good for easy questions but quickly fail once you start asking anything which is harder

I tried only one test which previously yielded me a false answer (halucination) on ChatGPT. My question was how to enable end to end TLS using an ALB to pods on Kubernetes. The wrong answer was terminating TLS on the ALB and using security groups to protect the pod. Using this new service I got the right answer, which involved a tls sidecar.

I’m really a bad prompt engineer

having same issues here guess we destroyed it.

Heh, they must have run out of GPT credits

problem is not there .

https://docs.aws.amazon.com/vpc/latest/reachability/what-is-reachability-analyzer.html

Thank you for a suggestion! Reachability Analyzer is a great tool, but isn’t it limited to traffic inside VPC only? I looked at it some time ago and it seemed quite limited. Good idea though, I will at least jog my memory and see what it can do for me in this scenario

from the Reachability Analyzer docs: *Source and destination resources* The source and destination resources must be in the same Region. The source and destination resources must be in the same VPC or in VPCs that are connected through a VPC peering connection or a transit gateway. The source and destination resources can belong to different AWS accounts in the same organization from AWS Organizations.

Sounds promising

Does not seem this can help in my case with cross region traffic. I can enable organisational wide cross account trust but I don’t see an option for Analyzer to do cross-region tests.

Try asking AWS support. They can often do this sorry if troubleshooting for you

Thank you everyone, I managed to get it resolved with few rounds of Reachability Analyzer!

For what service? Check AWS Backup

for Velero. Velero creates the snapshots for me and I would like to copy/sync them to different region to able to restore backup in different region on different cluster … with aws backup I saw I can do the snapshot and copy them, but I don’t want to create snapshots by aws backup.

are you writing to s3? https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html

yeah, I know this. it is good for objects… but I have snapshots in the “aws” s3 bucket, so nnot managed by me.

What do you mean? If you’re using Velero, you can write to any S3 bucket of your choice?

I assume you’re talking about EKS btw, you still haven’t said

not eks, self managed cluster with kops. OK I can write to any S3 bucket, but can I set 2 ? so until my primary cluster is running it should write to 2 locations. … when pirmary goes down then I can restore everything on secondary in different region.

in case of aws region where my primary cluster is running goes down and I don’t want to run multi region cluster

You don’t want to write to two buckets. Write to one and replicate the bucket to one in another region

See the link Mike posted before

yeah, I saw that but will that work for snapshots as well? Guess it is working only if I use the https://velero.io/docs/v1.11/file-system-backup/ this one has a higher inconsistency issue than using CSI https://velero.io/docs/v1.11/csi/ or original cloud api call. Or using CSI will be the option for me and that can go to the bucket I choose. with cloud api, I still can do the snapshot copy to region but for that I think I need a job or something else.

S3 can be replicated to other region/account

We are using blue-green heavily for upgrades, especially for 5.7 to 8 migrations. We don’t manage the process with Terraform, we use clickops. We lock our Terraform state, migrate by hand over a week or two, then perform state surgery to reconcile Terraform with reality.

I think terraform is quite weak at managing complex project state transitions, so this is a pattern we use often for things like migrations, restore from snapshot, etcetera etcetera

@Chris Wash any additional insight here from your experience?

@Jeremy G (Cloud Posse)

@Erik Osterman (Cloud Posse)

Does GitOps + CODEOWNERS + Branch protections + IAC + PRs count for change management? Then that’s what we have in our refarch

It is possible to set a custom value by boto3, https://github.com/boto/botocore/blob/227c1cef8fefd2600a56dd3570a0d589def4bd52/botocore/docs/waiter.py#L142C5-L142C26

oh this is not for ECS service

as a workaround, may run services-stable multiple times in for loop

from this PR, https://github.com/boto/botocore/pull/1267, awscli supports custom waiter configuration

Thanks @Hao Wang, I will try this solution

seems not, the cert is assigned by AWS which can be downloaded in public

yeah, confirmed from a few sources

Only AWS cert in different regions can be used

ok thanks

From my understanding with Aurora Serverless snapshots are taken automatically every 5 minutes, but AWS does not allow customizing the snapshot frequency

Also the limit on infinite backups is because the backup window cannot overlap with the weekly maintenance window for the DB cluster

Not sure your specific use-case but could you not automate (through a cron or lambda) to trigger a manual snapshot on some set interval?

As I know yes, but from RDS I cannot copy the snapshots to a different region to able to restore from that snapshot. I would like to use aws backup apps to have a hourly task that backups the serverless DB and copy it to another region…. Really cannot do this with aws backup apps ?

I only want to have a copy of the snapshot in a second region… and have this hourly, not daily.

AH. Google can tell when I give up on it, because the next result is what I’m looking for. https://repost.aws/knowledge-center/cloudfront-serving-outdated-content-s3

I’m sure that detail used to be in the CloudFront invalidation docs…

10-100secs sounds like a reasonable p95 interval to me. I’ve seen invalidations take 10+mins in unusual circumstances.

Depends. Anywhere you’re caching api responses that’s a long time. Fastly’s ~150ms global purge on objects/surrogate key is what I’ve come to expect. Their VCL language offers a lot of capability over cf also. Cf is really basic. But sometimes that’s all you need.

Sorry, what I meant by sounds reasonable is that it reflects reality for CF

It’s better than it used to be if I remember right. I think I saw it taking +/- 10m to flush. Eesh

@Andriy Knysh (Cloud Posse) @Dan Miller (Cloud Posse)

here is a good option https://github.com/fivexl/terraform-aws-cloudtrail-to-slack

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudformation_stack.html