Amazon Web Services (AWS)

• AWS Command line Interface

• Boto3

• use a profile with more permissions (--profile my_profile_with_permissions)
• give ... permissions to used profile

• jq -r '.prefixes[] | select(.region=="GLOBAL") | select(.service=="CLOUDFRONT") | .ip_prefix' < ip-ranges.json

• jq -r '.prefixes[] | select(.region=="eu-west-1") | select(.service=="EC2") | .ip_prefix' < ip-ranges.json

• Dashboard
• FAQ Trusted Advisor

• service-quotas
  • list-services
    • aws --profile ... service-quotas list-services
  • list-aws-default-service-quotas
    • aws --profile ... service-quotas list-aws-default-service-quotas --service-code cloudformation
  • list-service-quotas
    • aws --profile ... service-quotas list-service-quotas --service-code cloudformation

• Rule statements

• rules

• from AWS (list)
  • Baseline rule groups
    • Core rule set (CRS): "Consider using this rule group for any AWS WAF use case."
    • Admin protection
    • Known bad inputs
  • Use-case specific rule groups
    • SQL database
    • Linux operating system
    • POSIX operating system
    • Windows operating system
    • PHP application
    • WordPress application
  • IP reputation rule groups
    • Amazon IP reputation list
    • Anonymous IP list
  • AWS WAF Bot Control rule group
    • AWS WAF Bot Control
• from marketplace

• consider target_processing_time in ALB logs

• Parameters
  • AWS-specific parameter types
  • List
    • CommaDelimitedList
      • Example
        • single value:
          • Parameters:
  MyAllowedInstanceTypes:
    Description: Server allowed instances
    Type: String
    Default: "g5.*"
Resources:
  MyGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
        MixedInstancesPolicy:
          LaunchTemplate:
            Overrides:
              - InstanceRequirements:
                  AllowedInstanceTypes:
                    - Ref: MyAllowedInstanceTypes
        • comma-separated values:
          • Parameters:
  MyAllowedInstanceTypes:
    Description: Server allowed instances
    Type: CommaDelimitedList
    Default: "g4dn.*,g5.*"
Resources:
  MyGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
        MixedInstancesPolicy:
          LaunchTemplate:
            Overrides:
              - InstanceRequirements:
                  AllowedInstanceTypes: !Ref MyAllowedInstanceTypes
  • Conditionally assign a resource property
    • AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  ...
  DBSnapshotName:
    Description: The name of a DB snapshot (optional)
    Default: ""
    Type: String...
Conditions:
  UseDBSnapshot: !Not [!Equals [!Ref DBSnapshotName, ""]]
Resources:
  MyDB:
    Type: "AWS::RDS::DBInstance"
    Properties:
      DBSnapshotIdentifier: !If [UseDBSnapshot, !Ref DBSnapshotName, !Ref "AWS::NoValue"]

• EC2InstanceWithSecurityGroupSample.template

			  graph LR
			  S(AWS::EC2::Subnet) --- SRTA[AWS::EC2::SubnetRouteTableAssociation] --> RT(AWS::EC2::RouteTable)
			  RT --- R[AWS::EC2::Route] --> I(AWS::EC2::InternetGateway)
			  V(AWS::EC2::VPC) --- VGA[AWS::EC2::VPCGatewayAttachment] --> I

			  click S "https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-subnet.html"
			  click RT "https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-routetable.html"
			  click I "https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-internetgateway.html"
			  click V "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-vpc.html"
			  click SRTA "https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-subnetroutetableassociation.html"
			  click R "https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-route.html"
			  click VGA "https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-vpcgatewayattachment.html"
			  
			  %% relacions sense estil
			  classDef relacio fill:none,stroke:none,color:none
			  class SRTA,R,VGA relacio			  
			

• {
    "Description": "Single EC2 instance",
    "AWSTemplateFormatVersion": "2010-09-09",
    "Metadata": {},
    "Resources": {
        "singleEC2": {
            "Type": "AWS::EC2::Instance",
            "Properties": {
                "ImageId":"ami-xxxxxxxx",
                "KeyName":"my_key_pair",
                "InstanceType":"t2.micro"
            }
        }
    }
}

• "Resources": {
...
    "EC2Instance": {
        "Type": "AWS::EC2::Instance",
        "Properties": {
        "ImageId":{"Ref" : "ImageId"},
        "SecurityGroups" : [ { "Ref" : "InstanceSecurityGroup" } ],
        "KeyName":"my_server_key",
        "InstanceType":{"Ref" : "InstanceType"},
        "UserData": {
            "Fn::Base64": {
            "Fn::Join" : [ "", [
                "#!/bin/bash -xe\n",
                "sudo mkfs -t xfs /dev/xvdh \n",
                "sudo mkdir /mnt/vol \n",
                "sudo chmod 777 /mnt/vol \n",
                "sudo mount /dev/xvdh /mnt/vol \n",
            ] ]
            }
        },
        "Tags":[{"Key":"Name","Value":{"Ref":"BaseName"}}]
        }
    },
...
    "NewVolume" : {
        "Type" : "AWS::EC2::Volume",
        "Properties" : {
            "Size" : "100",
            "AvailabilityZone" : { "Fn::GetAtt" : [ "EC2Instance", "AvailabilityZone" ]}
        }
    },    
    "MountPoint" : {
        "Type" : "AWS::EC2::VolumeAttachment",
        "Properties" : {
            "InstanceId" : { "Ref" : "EC2Instance" },
            "VolumeId"  : { "Ref" : "NewVolume" },
            "Device" : "/dev/xvdh"
        }
    },

• When using direct bash commands:
  • add "\n" at the end of each command
  • no need to call sudo

• {
    "Description": "Single EC2 instance with extra volume",
    "AWSTemplateFormatVersion": "2010-09-09",
    "Metadata": {},
    "Parameters" : {
    "InstanceType" : {
        "Description" : "EC2 instance type",
        "Type" : "String",
        "Default" : "t2.micro",
        "AllowedValues" : [ "t1.micro", "t2.micro", "t2.small", "t2.medium", "m1.small", "m1.medium", "m1.large", "m1.xlarge", "m2.xlarge", "m2.2xlarge", "m2.4xlarge", "m3.medium", "m3.large", "m3.xlarge", "m3.2xlarge", "c1.medium", "c1.xlarge", "c3.large", "c3.xlarge", "c3.2xlarge", "c3.4xlarge", "c3.8xlarge", "c4.large", "c4.xlarge", "c4.2xlarge", "c4.4xlarge", "c4.8xlarge", "g2.2xlarge", "r3.large", "r3.xlarge", "r3.2xlarge", "r3.4xlarge", "r3.8xlarge", "i2.xlarge", "i2.2xlarge", "i2.4xlarge", "i2.8xlarge", "d2.xlarge", "d2.2xlarge", "d2.4xlarge", "d2.8xlarge", "hi1.4xlarge", "hs1.8xlarge", "cr1.8xlarge", "cc2.8xlarge", "cg1.4xlarge"]
        ,
        "ConstraintDescription" : "must be a valid EC2 instance type."
    },    
    "HostedZone" : {
        "Type" : "String",
        "Description" : "The DNS name of an existing Amazon Route 53 hosted zone",
        "AllowedPattern" : "(?!-)[a-zA-Z0-9-.]{1,63}(?<!-)",
        "ConstraintDescription" : "must be a valid DNS zone name.",
        "Default" : "example.net"
    },
    "ImageId" : {
        "Type" : "String",
        "Description" : "The image_id for the ec2 instance"
    },
    "NewVolumeSize" : {
        "Type" : "String",
        "Description" : "The size of the new volume (GB)",
        "Default": "5"
    }
    },   
    "Resources": {
    "EC2Instance": {
        "Type": "AWS::EC2::Instance",
        "Properties": {
        "ImageId":{"Ref" : "ImageId"},
        "SecurityGroups" : [ { "Ref" : "InstanceSecurityGroup" } ],
        "KeyName":"wct_streaming_server",
        "InstanceType":{"Ref" : "InstanceType"},
        "UserData": {
            "Fn::Base64": {
            "Fn::Join" : [ "", [
                "#!/bin/bash -xe \n",
                "while [ ! -e /dev/xvdh ]; do echo waiting for /dev/xvdh to attach; sleep 10; done \n",
                "mkfs -t xfs /dev/xvdh \n",
                "mkdir -p /mnt/vol1 \n",
                "mount /dev/xvdh /mnt/vol1 \n",
                "chmod 777 /mnt/vol1 \n"
            ] ]
            }
        },
        "Tags":[{"Key":"Name","Value":{"Ref":"BaseName"}}]
        }
    },   
    "NewVolume" : {
        "Type" : "AWS::EC2::Volume",
        "Properties" : {
        "Size" : {"Ref" : "NewVolumeSize"},
        "AvailabilityZone" : { "Fn::GetAtt" : [ "EC2Instance", "AvailabilityZone" ]}
        }
    },    
    "MountPoint" : {
        "Type" : "AWS::EC2::VolumeAttachment",
        "Properties" : {
        "InstanceId" : { "Ref" : "EC2Instance" },
        "VolumeId"  : { "Ref" : "NewVolume" },
        "Device" : "/dev/xvdh"
        }
    },
}

• {
    "Description": "Single EC2 instance",
    "AWSTemplateFormatVersion": "2010-09-09",
    "Metadata": {},
    "Parameters" : {
    "InstanceType" : {
        "Description" : "EC2 instance type",
        "Type" : "String",
        "Default" : "m1.small",
        "AllowedValues" : [ "t1.micro", "t2.micro", "t2.small", "t2.medium", "m1.small", "m1.medium", "m1.large", "m1.xlarge", "m2.xlarge", "m2.2xlarge", "m2.4xlarge", "m3.medium", "m3.large", "m3.xlarge", "m3.2xlarge", "c1.medium", "c1.xlarge", "c3.large", "c3.xlarge", "c3.2xlarge", "c3.4xlarge", "c3.8xlarge", "c4.large", "c4.xlarge", "c4.2xlarge", "c4.4xlarge", "c4.8xlarge", "g2.2xlarge", "r3.large", "r3.xlarge", "r3.2xlarge", "r3.4xlarge", "r3.8xlarge", "i2.xlarge", "i2.2xlarge", "i2.4xlarge", "i2.8xlarge", "d2.xlarge", "d2.2xlarge", "d2.4xlarge", "d2.8xlarge", "hi1.4xlarge", "hs1.8xlarge", "cr1.8xlarge", "cc2.8xlarge", "cg1.4xlarge"]
        ,
        "ConstraintDescription" : "must be a valid EC2 instance type."
    },    
    "HostedZone" : {
        "Type" : "String",
        "Description" : "The DNS name of an existing Amazon Route 53 hosted zone",
        "AllowedPattern" : "(?!-)[a-zA-Z0-9-.]{1,63}(?<!-)",
        "ConstraintDescription" : "must be a valid DNS zone name."
    }
    },   
    "Resources": {
    "EC2Instance": {
        "Type": "AWS::EC2::Instance",
        "Properties": {
        "ImageId":"ami-437da730",
        "SecurityGroups" : [ { "Ref" : "InstanceSecurityGroup" } ],
        "KeyName":"my_key_pair",
        "InstanceType":"t2.micro"
        }
    },
    "InstanceSecurityGroup" : {
        "Type" : "AWS::EC2::SecurityGroup",
        "Properties" : {
        "GroupDescription" : "Enable SSH, HTTP, RTMP",
        "SecurityGroupIngress" : [
            {
            "IpProtocol" : "tcp",
            "FromPort" : "22",
            "ToPort" : "22",
            "CidrIp" : "0.0.0.0/0"
            },
            {
            "IpProtocol" : "tcp",
            "FromPort" : "80",
            "ToPort" : "80",
            "CidrIp" : "0.0.0.0/0"
            },
            {
            "IpProtocol" : "tcp",
            "FromPort" : "1935",
            "ToPort" : "1935",
            "CidrIp" : "0.0.0.0/0"
            }
        ]
        }
    },
    "MyDNSRecord" : {
        "Type" : "AWS::Route53::RecordSet",
        "Properties" : {
        "HostedZoneName" : { "Fn::Join" : [ "", [{"Ref" : "HostedZone"}, "." ]]},
        "Comment" : "DNS name for my instance.",
        "Name" : { "Fn::Join" : [ "", [{"Ref" : "EC2Instance"}, ".", {"Ref" : "AWS::Region"}, ".", {"Ref" : "HostedZone"} ,"."]]},
        "Type" : "A",
        "TTL" : "900",
        "ResourceRecords" : [ { "Fn::GetAtt" : [ "EC2Instance", "PublicIp" ] } ]
        }
    }   
    },
    "Outputs" : {
    "InstanceId" : {
        "Description" : "InstanceId of the newly created EC2 instance",
        "Value" : { "Ref" : "EC2Instance" }
    },
    "AZ" : {
        "Description" : "Availability Zone of the newly created EC2 instance",
        "Value" : { "Fn::GetAtt" : [ "EC2Instance", "AvailabilityZone" ] }
    },
    "PublicDNS" : {
        "Description" : "Public DNSName of the newly created EC2 instance",
        "Value" : { "Fn::GetAtt" : [ "EC2Instance", "PublicDnsName" ] }
    },
    "PublicIP" : {
        "Description" : "Public IP address of the newly created EC2 instance",
        "Value" : { "Fn::GetAtt" : [ "EC2Instance", "PublicIp" ] }
    },
    "DomainName" : {
        "Description" : "Fully qualified domain name",
        "Value" : { "Ref" : "MyDNSRecord" }
    }
    }    
}

• "MyBucket": {
    "Type": "AWS::S3::Bucket",
    "Properties": {
        "BucketName": "my-bucket-name",
        "AccessControl": "PublicRead",
        "CorsConfiguration": {
            "CorsRules": [
                {
                    "AllowedHeaders": [
                        "*"
                    ],
                    "AllowedMethods": [
                        "GET",
                        "HEAD"
                    ],
                    "AllowedOrigins": [
                        "*"
                    ],
                    "ExposedHeaders": [],
                    "MaxAge": 3000
                }
            ]
        }
    }
}

• ...

• "PriceClass_100" -> Use Only U.S., Canada and Europe
• "PriceClass_200" -> Use U.S., Canada, Europe, Asia and Africa
• "PriceClass_All" -> Use All Edge Locations (Best Performance)

•                     "DefaultCacheBehavior" : {
                       "TargetOriginId" : { "Fn::Join" : [ "", ["S3-", {"Ref":"BucketName"}, "-my_dir" ] ]},
                       "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
                       "OriginRequestPolicyId": "88a5eaf4-2fd4-4709-b370-b4c650ea3fcf",
                       "ResponseHeaderPolicyId": "60669652-455b-4ae9-85a4-c4c02393f86c",
                       "AllowedMethods" : ["GET", "HEAD", "OPTIONS"],
                       "CachedMethods" : ["GET", "HEAD", "OPTIONS"],
                       "ViewerProtocolPolicy" : "allow-all"
                    },

•     "Resources": {
        "MyCloudFront" : {
            "Type" : "AWS::CloudFront::Distribution",
            "Properties" : {
                "DistributionConfig" : {
                    "Origins" : [ {
                        "DomainName": { "Fn::Join" : [ "", [{"Ref":"BucketName"}, ".s3.amazonaws.com"]]},
                        "OriginPath": "my_dir",
                        "Id" : { "Fn::Join" : [ "", ["S3-", {"Ref":"BucketName"}, "-my_dir" ] ]},
                        "S3OriginConfig": {}
                    }],
                    "Enabled" : "true",
                    "Comment" : "My comments",
                    "DefaultCacheBehavior" : {
                        "TargetOriginId" : { "Fn::Join" : [ "", ["S3-", {"Ref":"BucketName"}, "-my_dir" ] ]},
                        "ForwardedValues" : {
                            "Headers" : ["Origin"],
                            "QueryString" : "false",
                            "Cookies" : { "Forward" : "none" }
                        },
                        "ViewerProtocolPolicy" : "allow-all"
                    },
                    "PriceClass" : "PriceClass_100"
                }      
            }
        }
    },

•     "Resources": {
        "MyCloudFront" : {
            "Type" : "AWS::CloudFront::Distribution",
            "Properties" : {
                "DistributionConfig" : {
                    "Origins" : [ {
                        "DomainName": "myserver.toto.org",
                        "OriginPath": "/root_dir",
                        "Id" : "oid-root_dir",
                        "CustomOriginConfig": {
                            "HTTPPort": "80",
                            "HTTPSPort": "443",
                            "OriginProtocolPolicy": "http-only"
                        }
                    }],
                    "Enabled" : "true",
                    "Comment" : "My comments",
                    "DefaultCacheBehavior" : {
                        "TargetOriginId" : "oid-root_dir",
                        "ForwardedValues" : {
                            "QueryString" : "false",
                            "Cookies" : { "Forward" : "none" }
                        },
                        "ViewerProtocolPolicy" : "allow-all"
                    },
                    "CustomErrorResponses" : [ {
                        "ErrorCode" : "404",
                        "ErrorCachingMinTTL" : "2"
                    } ],
                    "PriceClass" : "PriceClass_100"
                }      
            }
        }
    },

• {
    "Description": "Application load balancer",
    "AWSTemplateFormatVersion": "2010-09-09",
    "Metadata": {},
    "Parameters" : {
        "BaseName" : {
            "Type" : "String",
            "Description" : "The basename of the stack",
            "Default": "basename"
        },
        "VPCId" : {
            "Type" : "String",
            "Description" : "Id of the used VPC",
            "Default" : "vpc-de64aab8"
        },
        "AvailabilityZone" : {
            "Description" : "Availability zone to try to deploy the resources to. Passing empty string will let AWS select the AZ. E.g.: eu-west-1a",
            "Type" : "String",
            "Default": "eu-west-1a"
        },
        "CidrSubnet" : {
            "Type" : "String",
            "Description" : "CIDR for the created subnet (must be a subset of VPC CIDR)",
            "Default" : "10.1.1.0/27"
        },
        "SecondaryAvailabilityZone" : {
            "Description" : "Secondary vailability zone to try to deploy the resources to. Passing empty string will let AWS select the AZ. E.g.: eu-west-1a",
            "Type" : "String",
            "Default": "eu-west-1b"
        },
        "CidrSecondarySubnet" : {
            "Type" : "String",
            "Description" : "Secondary CIDR for the created subnet (must be a subset of VPC CIDR)",
            "Default" : "10.1.1.32/27"
        },
        "CertificateId" : {
            "Type" : "String",
            "Description" : "Certificate id"
        }
    },    
    "Resources": {        
        "PrimarySubnet" : {
            "Type" : "AWS::EC2::Subnet",
            "Properties" : {
                "VpcId" : {"Ref" : "VPCId"},
                "AvailabilityZone" : {"Ref" : "AvailabilityZone"},
                "CidrBlock" : {"Ref":"CidrSubnet"},
                "MapPublicIpOnLaunch" : "true",
                "Tags" : [
                    {
                        "Key" : "Name",
                        "Value" : { "Fn::Join" : [ "", ["snet-", {"Ref" : "BaseName"}]]}
                    }
                ]
            }
        },        
        "SecondarySubnet" : {
            "Type" : "AWS::EC2::Subnet",
            "Properties" : {
                "VpcId" : {"Ref" : "VPCId"},
                "AvailabilityZone" : {"Ref" : "SecondaryAvailabilityZone"},
                "CidrBlock" : {"Ref":"CidrSecondarySubnet"},
                "MapPublicIpOnLaunch" : "true",
                "Tags" : [
                    {
                        "Key" : "Name",
                        "Value" : { "Fn::Join" : [ "", ["snet-", {"Ref" : "BaseName"}, "-sec"]]}
                    }
                ]
            }
        },        
        "MyApplicationLoadBalancer": {
            "Type" : "AWS::ElasticLoadBalancingV2::LoadBalancer",
            "Properties" : {
                "Name": "my-alb",
                "Type": "application",
                "IpAddressType": "ipv4",
                "Subnets": [{"Ref" : "PrimarySubnet"}, {"Ref" : "SecondarySubnet"}],
                "LoadBalancerAttributes": [
                    {"Key": "idle_timeout.timeout_seconds", "Value": 60}
                ]
            }
        },
        "MyHTTPSListener": {
            "Type": "AWS::ElasticLoadBalancingV2::Listener",
            "Properties": {
                "LoadBalancerArn": {"Ref" : "MyApplicationLoadBalancer"},
                "Port": 443,
                "Protocol": "HTTPS",
                "Certificates": [{"Ref" : "CertificateId"}],
                "DefaultActions": [
                    {
                        "Order": 1,
                        "Type": "forward",
                        "TargetGroupArn": {"Ref": "MyTargetGroup"}
                    }
                ]
            }
        },
        "MyTargetGroup": {
            "Type": "AWS::ElasticLoadBalancingV2::TargetGroup",
            "Properties": {
                "VpcId": {"Ref" : "VPCId"},
                "TargetType": "instance",
                "Name": "my-targetgroup",
                "Port": 443,
                "Protocol": "HTTPS"
            }
        }        
    }
}

• {
    "Description": "Network load balancer",
    "AWSTemplateFormatVersion": "2010-09-09",
    "Metadata": {},
    "Parameters" : {
        "BaseName" : {
            "Type" : "String",
            "Description" : "The basename of the stack",
            "Default": "nbasename"
        },
        "VPCId" : {
            "Type" : "String",
            "Description" : "Id of the used VPC",
            "Default" : "vpc-de64aab8"
        },
        "AvailabilityZone" : {
            "Description" : "Availability zone to try to deploy the resources to. Passing empty string will let AWS select the AZ. E.g.: eu-west-1a",
            "Type" : "String",
            "Default": "eu-west-1a"
        },
        "CidrSubnet" : {
            "Type" : "String",
            "Description" : "CIDR for the created subnet (must be a subset of VPC CIDR)",
            "Default" : "10.1.3.0/27"
        },
        "CertificateId" : {
            "Type" : "String",
            "Description" : "Certificate id",
            "Default" : "arn:aws:acm:eu-west-1:458626664701:certificate/c82f280a-8f5f-4d34-bbec-45e521724b60"
        }
    },    
    "Resources": {        
        "PrimarySubnet" : {
            "Type" : "AWS::EC2::Subnet",
            "Properties" : {
                "VpcId" : {"Ref" : "VPCId"},
                "AvailabilityZone" : {"Ref" : "AvailabilityZone"},
                "CidrBlock" : {"Ref":"CidrSubnet"},
                "MapPublicIpOnLaunch" : "true",
                "Tags" : [
                    {
                        "Key" : "Name",
                        "Value" : { "Fn::Join" : [ "", ["snet-", {"Ref" : "BaseName"}]]}
                    }
                ]
            }
        },                
        "MyNetworkLoadBalancer": {
            "Type" : "AWS::ElasticLoadBalancingV2::LoadBalancer",
            "Properties" : {
                "Name": "dev-my-nlb",
                "Type": "network",
                "IpAddressType": "ipv4",
                "Subnets": [{"Ref" : "PrimarySubnet"}],
                "LoadBalancerAttributes": [
                ]
            }
        },
        "MyRTMPListener": {
            "Type": "AWS::ElasticLoadBalancingV2::Listener",
            "Properties": {
                "LoadBalancerArn": {"Ref" : "MyNetworkLoadBalancer"},
                "Port": 1935,
                "Protocol": "TCP",
                "DefaultActions": [
                    {
                        "Order": 1,
                        "Type": "forward",
                        "TargetGroupArn": {"Ref": "MyTargetGroup"}
                    }
                ]
            }
        },
        "MyTargetGroup": {
            "Type": "AWS::ElasticLoadBalancingV2::TargetGroup",
            "Properties": {
                "VpcId": {"Ref" : "VPCId"},
                "TargetType": "instance",
                "Name": "my-ntargetgroup",
                "Port": 1935,
                "Protocol": "TCP"
            }
        }        
    }
}

• "MyLoadBalancer": {
    "Type": "AWS::ElasticLoadBalancing::LoadBalancer",
    "Properties": {
        "LoadBalancerName": "MyLoadbalancerName",
        "SecurityGroups" : [ ... ],
        "AvailabilityZones": {
            "Fn::GetAZs": ""
        },
        "CrossZone": "true",
        "ConnectionSettings": {
            "IdleTimeout" : 60
        }
        "Listeners": [
            {
                "LoadBalancerPort": "80",
                "InstancePort": "80",
                "Protocol": "HTTP",
                "PolicyNames": ["MyFirstLBCookieStickinessPolicy"]
            },
            {
                "LoadBalancerPort": "8088",
                "InstancePort": "8088",
                "Protocol": "HTTP",
                "PolicyNames": ["MySecondLBCookieStickinessPolicy"]
            },
            {
                "LoadBalancerPort": "8089",
                "Protocol": "HTTPS",
                "InstancePort": "8089",
                "InstanceProtocol": "HTTPS",
                "SSLCertificateId": "arn:aws:acm:eu-west-1:...",
                "PolicyNames": ["MySecondLBCookieStickinessPolicy"]
            },
            {
                "LoadBalancerPort": "1935",
                "InstancePort": "1935",
                "Protocol": "TCP"
            }
        ],
        "LBCookieStickinessPolicy" : [
            {
                "CookieExpirationPeriod" : "500",
                "PolicyName" : "MyFirstLBCookieStickinessPolicy"
            },
            {
                "CookieExpirationPeriod" : "1000",
                "PolicyName" : "MySecondLBCookieStickinessPolicy"
            }
        ],
        "HealthCheck": {
            "Target": "HTTP:80/",
            "HealthyThreshold": "3",
            "UnhealthyThreshold": "5",
            "Interval": "30",
            "Timeout": "5"
        }
    }
}

• ...

• Download from: 
  • CloudFormation helper scripts reference
  • Bootstrapping Applications using AWS CloudFormation
• kixorz/ubuntu-cloudformation.json
• Install (Debian, Ubuntu)
  • debian.template
    
    • apt-get install -y python3 pipx && pipx ensurepath
    • pipx install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz
• Install (Python 3)
  • ...
  • # install to /usr (e.g. /usr/bin/cfn-signal)
easy_install-3.6 --prefix /usr aws-cfn-bootstrap-py3-latest
• Install (Python 2)
  • mkdir aws-cfn-bootstrap-latest
  • curl https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-latest.tar.gz | tar xz -C aws-cfn-bootstrap-latest --strip-components 1
  • easy_install aws-cfn-bootstrap-latest
• Problemes / Problems
  • Traceback (most recent call last):
  File "/bin/easy_install", line 9, in <module>
    load_entry_point('setuptools==0.9.8', 'console_scripts', 'easy_install')()
  [...]
  File "/usr/lib/python2.7/site-packages/setuptools/command/easy_install.py", line 701, in process_distribution
    distreq.project_name, distreq.specs, requirement.extras
TypeError: __init__() takes exactly 2 arguments (4 given)
    • Diagnose
      • python
        • >>> from pkg_resources import load_entry_point
>>> load_entry_point('setuptools==0.9.8', 'console_scripts', 'easy_install')()
...
pkg_resources.VersionConflict: (setuptools 25.1.4 (/usr/lib/python2.7/site-packages/setuptools-25.1.4-py2.7.egg), Requirement.parse('setuptools==0.9.8'))
    • Solució / Solution
      
      • sudo rm -rf /usr/lib/python2.7/site-packages/setuptools-25.1.4-py2.7.egg

•     "LaunchConfig" : {
        "Type" : "AWS::AutoScaling::LaunchConfiguration",
        "Properties" : {
        "ImageId":{"Ref" : "MyImageId"},
        "SecurityGroups" : [ { "Ref" : "MySecurityGroup" } ],
        "KeyName":"my_key",
        "InstanceType":{"Ref" : "MyInstanceType"},
        "IamInstanceProfile": "role_my_server",
        "UserData": {
            "Fn::Base64": {
            "Fn::Join" : [ "", [
                "#!/bin/bash -xe\n",
                "/usr/bin/cfn-signal -e 0 --stack ", { "Ref": "AWS::StackName" },
                " --resource MyAutoscalingGroup ",
                " --region ", { "Ref" : "AWS::Region" }, "\n"
            ] ]
            }
        }
        }
    },

• CreationPolicy Attribute
• UpdatePolicy Attribute
• attach to a loadbalancer:

  • type	property
    Classic Load Balancer	"LoadBalancerNames"
    Application Load Balancer	"TargetGroupARNs"

• fallback instance types:
  

  without fallback

  with fallback

  MyLaunchTemplate:     ...   MyAutoScalingGroup:     Properties:       LaunchTemplate:         LaunchTemplateId: MyLaunchTemplate         Version:           Fn::GetAtt:             - MyLaunchTemplate             - DefaultVersionNumber

  MyLaunchTemplate:     ...   MyAutoscalingGroup:     Properties:       MixedInstancesPolicy:         InstancesDistribution:           OnDemandAllocationStrategy: prioritized         LaunchTemplate:           LaunchTemplateSpecification:             LaunchTemplateId: MyLaunchTemplate             Version:               Fn::GetAtt:                 - MyLaunchTemplate                 - DefaultVersionNumber           Overrides:             - InstanceType: g4dn.xlarge             - InstanceType: g3.4xlarge             - InstanceType: g3.8xlarge   MyLaunchTemplate:     ...   MyAutoscalingGroup:     Properties:       MixedInstancesPolicy:         InstancesDistribution:           OnDemandAllocationStrategy: lowest-price         LaunchTemplate:           LaunchTemplateSpecification:             LaunchTemplateId: MyLaunchTemplate             Version:               Fn::GetAtt:                 - MyLaunchTemplate                 - DefaultVersionNumber           Overrides:             - InstanceRequirements:                 AllowedInstanceTypes:                   - g5.*                 MemoryMiB:                   Min: 32768                 VCpuCount:                   Min: 8

•     "MyAutoScalingGroup" : {
        "Type" : "AWS::AutoScaling::AutoScalingGroup",
        "Properties" : {
        "LaunchConfigurationName" : { "Ref" : "MyLaunchConfig" },
        "MinSize" : "1",
        "MaxSize" : "3",
        "LoadBalancerNames" : [ { "Ref" : "MyLoadBalancer" } ],
        "Tags":[
            {
            "Key":"Name",
            "Value":{ "Fn::Join" : [ "", ["myinstance-", {"Ref" : "MyName"}]]},
            "PropagateAtLaunch" : "true"
            }
        ]
        },
        "CreationPolicy" : {
        "ResourceSignal" : {
            "Timeout" : "PT15M",
            "Count"   : "1"
        }
        },
        "UpdatePolicy": {
        "AutoScalingRollingUpdate": {
            "MinInstancesInService": "1",
            "MaxBatchSize": "1",
            "PauseTime" : "PT15M",
            "WaitOnResourceSignals": "true"
        }
        }
    },

• {
    "AWSTemplateFormatVersion" : "2010-09-09",
    "Description": "Tetst asg",
    "Parameters": {},
    "Resources": {
        "MyLaunchTemplate": {
            "Type": "AWS::EC2::LaunchTemplate",
            "Properties": {
                "LaunchTemplateData": {
                    "ImageId" : "ami-xxx",
                    "InstanceType" : "t3.nano",
                    "IamInstanceProfile": {"Name": "role_my_server"},
                    "UserData": {
                        "Fn::Base64": {
                            "Fn::Join" : [
                                "",
                                [
                                    "#!/bin/bash -xe\n",
                                    "sudo mkdir /mnt/toto \n",
                                    "sudo chmod 777 /mnt/toto \n"
                                ]
                            ]
                        }
                    }
                }
            }
        },
        "MyGroup": {
            "Type" : "AWS::AutoScaling::AutoScalingGroup",
            "Properties": {
                "MinSize": "1",
                "MaxSize": "1",
                "DesiredCapacity" : "1",
                "AvailabilityZones" : ["eu-west-1a","eu-west-1b","eu-west-1c"],
                "MixedInstancesPolicy": {
                    "InstancesDistribution": {
                        "OnDemandAllocationStrategy": "prioritized"
                    },
                    "LaunchTemplate": {
                        "LaunchTemplateSpecification": {
                            "LaunchTemplateId": {
                                "Ref": "MyLaunchTemplate"
                            },
                            "Version" : {
                                "Fn::GetAtt": ["MyLaunchTemplate", "DefaultVersionNumber"]
                            }
                        },
                        "Overrides": [
                            {"InstanceType": "t3.micro"},
                            {"InstanceType": "t3.small"},
                            {"InstanceType": "t3.medium"}
                        ]
                    }
                }
            }
        }
    }
}

•     "MyUpScalingPolicy" : {
        "Type" : "AWS::AutoScaling::ScalingPolicy",
        "Properties" : {
        "AdjustmentType" : "ChangeInCapacity",
        "AutoScalingGroupName" : { "Ref" : "MyAutoScalingGroup" },
        "Cooldown" : "60",
        "ScalingAdjustment" : "1"
        }
    },
    "MyCPUHighAlarm": {
        "Type": "AWS::CloudWatch::Alarm",
        "Properties": {
        "EvaluationPeriods": "1",
        "Statistic": "Average",
        "Threshold": "80",
        "AlarmDescription": "Alarm if CPU too high or metric disappears indicating instance is down",
        "Period": "60",
        "AlarmActions": [ { "Ref": "MyUpScalingPolicy" } ],
        "Namespace": "AWS/EC2",
        "Dimensions": [ {
            "Name": "AutoScalingGroupName",
            "Value": { "Ref": "MyAutoScalingGroup" }
        } ],
        "ComparisonOperator": "GreaterThanThreshold",
        "MetricName": "CPUUtilization"
        }
    },

• AWS::EC2::LaunchTemplate
• UserData
  • AWS Batch: Amazon EC2 user data in launch templates
  • ...

• Amazon EC2 Auto Scaling will no longer add support for new EC2 features to Launch Configurations
• AWS::AutoScaling::LaunchConfiguration
  • InstanceMonitoring (detailed monitoring)
• auto_scaling_with_instance_profile.template
• AWS::IAM::InstanceProfile
• Associating an existing IAM role with AWS::EC2::Instance in CloudFormation
• Tags
  • Tags should be defined at AutoscalingGroup:
    • Auto Scaling Tags Property Type
• PassRole permission
  • Granting Permission to Launch EC2 Instances with IAM Roles (PassRole Permission)
  • needed when using IamInstanceProfile
  • passos / steps
    • create a role that will be used by Cloudformation:
      • IAM -> Roles
        • create a new role
        • copy the Role ARN (it will be used at Resource in PassRoleMyServer):
          • arn:aws:iam::xxxxxxxxxx:role/role-my_server
    • create a policy
      • IAM -> Policies
        • Filter: Customer Managed Policies
        • Create Policy
          • PassRoleMyServer
            • {
    "Version": "2012-10-17",
    "Statement": [
        {
           "Sid": "Stmt1454093987000",
           "Effect": "Allow",
           "Action": [
                "iam:PassRole"
            ],
           "Resource": [
                "arn:aws:iam::xxxxxxxxxx:role/role-my_server"
            ]
        }
    ]
}
    • associate this policy to your group or role:
      • IAM -> Groups/Roles -> Permissions -> Attach policy
        • PassRoleMyServer

• ...

• ssh ...
• sudo modinfo ena
• ethtool -i eth0
  • driver: ena

• instance_id=...
aws ec2 describe-instances --instance-ids ${instance_id} --query "Reservations[].Instances[].EnaSupport"

• ami_id=...
aws ec2 describe-images --image-id ${ami_id} --query "Images[].EnaSupport"

1. check ENA kernel module
   • sudo modinfo ena
   • CentOS: if not available, update the kernel
     • sudo yum install kernel
2. check systemd version
   • rpm -qa | grep -e '^systemd-[0-9]\+\|^udev-[0-9]\+'
3. if it is greater or equal than  197, disable predictable network interface names:
   • sudo sed -i '/^GRUB\_CMDLINE\_LINUX/s/\"$/\ net\.ifnames\=0\"/' /etc/default/grub
   • sudo grub2-mkconfig -o /boot/grub2/grub.cfg
4. stop instance
5. from local computer:
   • set ENA support:
     
     • instance_id=...
aws ec2 modify-instance-attribute --instance-id ${instance_id} --ena-support
   • check ENA support:
     • aws ec2 describe-instances --instance-ids ${instance_id} --query "Reservations[].Instances[].EnaSupport"
       • should return True
6. change instance type to c5 or t3
7. start instance
8. you may need to update Route53 with the new public ip address
9. to create an AMI from this one:
   1. connect to your new instance: ssh ...
      
   2. sudo rm /etc/udev/rules.d/70-persistent-net.rules
   3. stop instance
   4. create AMI: Actions -> Image -> Create image
   5. check that AMI has ENA enabled:
      • ami_id=...
aws ec2 describe-images --image-id ${ami_id} --query "Images[].EnaSupport"
        • should return True

• 	systemd service	journalctl -f	/var/log/cloud-init-output.log
  1. Detect
  2. Local	cloud-init-local.service	Starting Initial cloud-init job (pre-networking)... Finished Initial cloud-init job (pre-networking).	running 'init-local'
  3. Network	cloud-init.service	Starting Initial cloud-init job (metadata service crawler)... Finished Initial cloud-init job (metadata service crawler).	running 'init'
  4. Config	cloud-config.service	Starting Apply the settings specified in cloud-config... Finished Apply the settings specified in cloud-config.	running 'modules:config'
  		Reached target Multi-User System.
  5. Final	cloud-final.service	Starting Execute cloud user/final scripts... Finished Execute cloud user/final scripts.	running 'modules:final'

• util.py[WARNING]: Running module scripts-user (<module 'cloudinit.config.cc_scripts_user' from '/usr/lib/python3.6/site-packages/cloudinit/config/cc_scripts_user.py'>) failed

1. rm -f /var/lib/cloud/instance/sem/config_scripts_user
2. cloud-init --debug modules --mode final

• lsblk
  • NAME    MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
xvda    202:0    0  10G  0 disk
??xvda1 202:1    0  10G  0 part /
xvdg    202:96   0  20G  0 disk

• sudo file -s /dev/xvdg
  • "/dev/xvdg: SGI XFS filesystem data (blksz 4096, inosz 256, v2 dirs)"
    • ready to mount
  • "/dev/xvdg: data"
    • you need to create filesystem (e.g. XFS):
      • sudo mkfs -t xfs /dev/xvdg

• temporarily
  • mkdir /mnt/my_point
  • mount /dev/xvdg /mnt/my_point
• permanently
  • /etc/fstab
    • /dev/xvdg /mnt/my_point xfs     defaults        0 0

• Amazon EBS Update – New Elastic Volumes Change Everything
• Automating Amazon EBS Volume-resizing with AWS Step Functions and AWS Systems Manager
• Ebs Auto Resize
• IMPORTANT:
  • An error occurred (VolumeModificationRateExceeded) when calling the ModifyVolume operation: You've reached the maximum modification rate per volume limit. Wait at least 6 hours between modifications per EBS volume.
• Passos / Steps
  1. Comproveu la mida inicial / Check original size:
     • lsblk
     • voleu modificar la partició dins d'un disc / you want to modify a partition in a disk:
       • NAME        MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
         nvme0n1     259:1    0  20G  0 disk
         ??nvme0n1p1 259:2    0  20G  0 part /
     • voleu modificar un disc sense particions / you want to modify a disk without partitions:
       • NAME        MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
nvme1n1     259:0    0  20G  0 disk /mnt/vol1
  2. Modifiqueu la mida del volum AWS / Modify AWS volume size (e.g. from 20GB to 25GB):
     • AWS console:
       • Volumes -> Modify
     • CLI
       • ...
     • boto3
       • ...
  3. Espereu que el disc estigui a punt: passarà de l'estat «modifying» a «optimizing». Encara que el percentatge a «optimizing» sigui 0%, ja podeu passar al següent pas / Wait for disk to be ready: it will go from "modifying" to "optimizing". Even if percentage of optimizing is 0%, you can now proceed with the next step
  4. Comproveu els canvis al disc / Check changes on disk:
     • lsblk
     • NAME        MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
       nvme0n1     259:1    0  25G  0 disk
       ??nvme0n1p1 259:2    0  20G  0 part /
     • NAME        MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
nvme1n1     259:0    0  25G  0 disk /mnt/vol1
  5. Feu créixer la partició (si n'hi ha) / Grow partition (if any):
     • si el disc té una partició, feu créixer la que volgueu. Per exemple, per a fer créixer la primera (1) partició del disc /dev/nvme0n1 (és a dir nvme0n1p1) / if disk has any partition on it, grow the desired partition. E.g. to grow first (1) partition of disk /dev/nvme0n1 (i.e. nvme0n1p1)
       • CentOS
         • sudo yum install ...
       • growpart /dev/nvme0n1 1
       • check changes with lsblk:
         • NAME        MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
nvme0n1     259:1    0  25G  0 disk
??nvme0n1p1 259:2    0  25G  0 part /
     • si el disc no té cap particio, aneu al pas següent / if disk has no partition, you can proceed with the next step
  6. Amplieu el sistema de fitxers / Extend file system (parameter for xfs_growfs is the mount point: /, /mnt/vol1 ...):
     • comproveu el tipus de sistema de fitxers utilitzat / check the used filesystem (e.g. ext4, xfs...):
       
       • df -hT
     • ext2, ext3, ext4
       • resize2fs /dev/sda1
     • xfs
       • sudo yum install xfsprogs
         
       • sudo xfs_growfs -d /
       • sudo xfs_growfs -d /mnt/vol1
  7. Comproveu el resultat final / Check the final result:
     • df -h
       • Filesystem       Size  Used Avail Use% Mounted on
         /dev/nvme0n1p1    25G   18G  7.7G  70% /
         /dev/nvme1n1      25G   12G   13G  49% /mnt/vol1
• check_disk.sh
  • #!/bin/bash
# usage threshold: 80%
usage_threshold=80
# instance_id
instance_id="id-1234"
#instance_id=$(curl -m 2 -s http://169.254.169.254/latest/meta-data/instance-id/)
# resize factor
resize_factor=1.5
# check local (not efs-mounted) disk usage
full_disks=$(df --local --output=source,fstype,pcent,target | tail -n +2 | awk -v usage_threshold=${usage_threshold} '{gsub(/%/,"",$3)} $3+0 >= usage_threshold {print $1 " " $2 " " $3 " " $4}')
# if needed, resize on AWS and resize partition/disk
while IFS= read -r linia
do
    if (( ${#linia} > 0 ))
    then
        echo "-- ${linia}"        
        # split line using bash array
        array_df_line=(${linia// / })
        device_name=${array_df_line[0]}
        fs_type=${array_df_line[1]}
        usage=${array_df_line[2]}
        mount_point=${array_df_line[3]}        
        # 1. change aws ebs volume size
        echo " 1. change volume size: /usr/local/bin/aws_resize_volume.py --instance-id ${instance_id} --device-name ${device_name} ${resize_factor}"
        # grow partition (if any) (e.g. nvme0n1p1)
        # get partition from device name
        # - /dev/nvme0n1p1 is a partition and needs to be grown
        # - /dev/nvme1n1 is not a partition and does not need to be grown
        # lsblk --inverse --nodeps
        # NAME      MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
        # nvme0n1p1 259:2    0  25G  0 part /
        # nvme1n1   259:0    0  25G  0 disk /disc1
        # 2. grow partition (if any)
        short_device_name=${device_name##*/}
        # get only entry if TYPE is part (not when TYPE is disk)
        partition=$(lsblk --inverse --nodeps | awk -v pattern=${short_device_name} '$1 ~ pattern && $6 ~ /part/ {print $1}')
        if [ -v partition ]
        then
            # /dev/nvme0n1p1: growpart /dev/nvme0n1 1
            # /dev/sda1: growpart /dev/sda 1
            device_name_partition_index=${device_name: -1}
            device_name_without_partition_index=${device_name: : -1}
            device_name_root=${device_name_without_partition_index%p*}
            echo " 2. grow partition: sudo growpart ${device_name_root} ${device_name_partition_index}"
        else
            echo " 2. no partition"
        fi        
        # 3. grow filesystem
        case ${fs_type} in
            "xfs" )
                echo " 3. grow filesystem: sudo xfs_growfs -d ${mount_point}"
                ;;
            "ext4" )
                echo " 3. grow filesystem: sudo resize2fs ${mount_point}"
                ;;
            * ) echo " 3. unknown filesystem ${fs_type}"
                ;;
        esac
    fi
done < <(echo "${full_disks}")
exit 0

• SwapTotal
• SwapFree

1. sudo dd if=/dev/zero of=/swapfile bs=1M count=1024
2. sudo mkswap /swapfile
3. sudo chmod 0600 /swapfile
4. sudo swapon /swapfile
5. sudo echo "/swapfile swap swap defaults 0 0" >>/etc/fstab

• swapon -s

• ...
• Network:
  • add a security group with port 2049 open for your Cidr

• not mounted
  • check that port 2049 is accessible:
    • nmap -p 2049 ${fs_dns_name}
    • if response is "filtered", then you need to open the port in the security group associated to the mount target

• Instance Metadata Categories

• curl http://169.254.169.254/latest/
• curl http://169.254.169.254/latest/user-data/
• curl http://169.254.169.254/latest/meta-data/public-keys/
• curl http://169.254.169.254/latest/meta-data/public-ipv4
• local_ipv4=$(curl http://169.254.169.254/latest/meta-data/local-ipv4/)
• instance_id=$(curl http://169.254.169.254/latest/meta-data/instance-id/)
• ami_id=$(curl -s http://169.254.169.254/latest/meta-data/ami-id)

• dynamic/	instance-identity/	document	{   "accountId" : "...",   "architecture" : "x86_64",   "availabilityZone" : "eu-west-1b",   "billingProducts" : null,   "devpayProductCodes" : null,   "marketplaceProductCodes" : [ "..." ],   "imageId" : "ami-...",   "instanceId" : "i-...",   "instanceType" : "g4dn.2xlarge",   "kernelId" : null,   "pendingTime" : "2022-04-14T10:23:04Z",   "privateIp" : "...",   "ramdiskId" : null,   "region" : "eu-west-1",   "version" : "2017-09-30" }
  		pkcs7
  		rsa2048
  		signature
  meta-data/	ami-id
  	ami-launch-index
  	ami-manifest-path
  	autoscaling/	target-lifecycle-state
  	block-device-mapping/	ami
  		ebs1
  	events/	maintenance/	history
  	hostname
  	iam/	info	{   "Code" : "Success",   "LastUpdated" : "2022-04-14T11:06:11Z",   "InstanceProfileArn" : "arn:aws:iam::...",   "InstanceProfileId" : "..." }
  	identity-credentials/	ec2/	info	...
  	instance-action
  	instance-id
  	instance-life-cycle
  	instance-type
  	local-hostname
  	local-ipv4
  	mac
  	metrics/	vhostmd
  	network/	interfaces/	macs/	xx:xx:xx:xx:xx:xx/	device-number interface-id ipv4-associations/ local-hostname local-ipv4s mac owner-id public-hostname public-ipv4s security-group-ids security-groups subnet-id subnet-ipv4-cidr-block vpc-id vpc-ipv4-cidr-block vpc-ipv4-cidr-blocks
  	placement/	availability-zone
  		availability-zone-id
  		region
  	product-codes
  	profile
  	public-hostname
  	public-ipv4
  	reservation-id
  	security-groups
  	services/	domain
  		partitition
  user-data/

  
  
• http://169.254.169.254/latest/
  • user-data/
    • ...
  • meta-data/
    • ...
• EC2 Instance Metadata Query Tool
• region
  • Find region from within an EC2 instance
  • # eu-west-1a
availability_zone=$(curl -s http://169.254.169.254/latest/meta-data/placement/availability-zone)
# eu-west-1
#region=$(echo $availability_zone | sed 's/.$//')
region=${availability_zone: : -1}

• des de l'ELB actual, aneu a la pestanya «Migration» i feu clic al botó «Launch ALB Migration Wizard»
  • se us posarà automàticament al pas 6
  • si voleu, aneu al pas 1 i al 4 per a canviar els noms del nou balancejador i del nou target group (si no, us posarà el mateix nom que teníeu a l'ELB)
  • Create
    • After migration is complete, you can do the following as needed:
      Redirect traffic to your new load balancer (see Migrate Traffic).
      Change the deregistration delay (see Deregistration Delay). The default is 300 seconds.
      Change the idle connection timeout if needed (see Connection Idle Timeout). The default is 60 seconds.
      Enable access logs (see Access Logs).
      Suggested next steps
          Discover other services that you can integrate with your load balancer. Visit the Integrated services tab within pro-alb-wbe
          Consider using AWS Global Accelerator to further improve the availability and performance of your applications. AWS Global Accelerator console
• a l'ALB, aneu a Attributes: Idle timeout i poseu-hi el valor que teníeu a l'antic ELB (aquest valor no s'ha copiat amb la migració)
• si teniu un ASG, aneu-hi, i des de la primera pestanya («Details»), aneu a «Load balancing» i associeu-hi el nou target, des de la secció «Application, Network or Gateway Load Balancer target groups»
• comproveu que quan augmenta l'ASG, també hi ha més instàncies dins del nou target group
• a Route53:
  • creeu un nou record, que apunti (alias) cap al nou ALB
    • Routing policy: Weighted
    • Weight: 9
    • Record ID: my_new_alb
  • modifiqueu l'entrada antiga (que té el mateix nom):
    • Routing policy: Weighted
    • Weight: 1
    • Record ID: my_old_elb
• ...

1. type
2. time
3. elb
4. client:port
5. target:port
6. request_processing_time
7. target_processing_time
8. response_processing_time
9. elb_status_code
10. target_status_code
11. received_bytes
12. sent_bytes
13. "request"
14. "user_agent"
15. ssl_cipher
16. ssl_protocol
17. target_group_arn
18. "trace_id"
19. "domain_name"
20. "chosen_cert_arn"
21. matched_rule_priority
22. request_creation_time
23. "actions_executed"
24. "redirect_url"
25. "error_reason"
26. "target:port_list"
27. "target_status_code_list"
28. "classification"
29. "classification_reason"

• get request which returned 4xx from ALB and print response codes and request (if $10 is '-', this is a pure load balancer response):
  • awk 'BEGIN {FPAT="([^ ]+)|(\"[^\"]+\")"}; $9 ~ /^4/ {print $9, $10, $13}' alb.log
• get request which returned 460 from ALB:
  • awk 'BEGIN {FPAT="([^ ]+)|(\"[^\"]+\")"}; $9 ~ /^460/ {print $6, $7, $8, $9, $10, $13}' alb.log
• ...

1. time
2. elb
3. client:port
4. backend:port
5. request_processing_time
6. backend_processing_time
7. response_processing_time
8. elb_status_code
9. backend_status_code
10. received_bytes
11. sent_bytes
12. request
13. user_agent
14. ssl_cipher
15. ssl_protocol

• get backend_status_code
  • awk ...
• ...

• Resource-based policies
  • S3 object: object ACL (xml)
  • Bucket: bucket ACL (xml), bucket policy (json)
• User policies

• ...

• " Prefix-level metrics are not available in CloudWatch."
• boto3
  • ...

• 	account A	access as accountA/userA to accountA/bucketA	if missing some config, you will get this message:
  read, write	accountA-userA accountA-bucketA Bucket policy {     "Version": "2012-10-17",     "Statement": [         {             "Effect": "Allow",             "Principal": {                 "AWS": "arn:aws:iam::accountA_id:user/accountA-userA"             },             "Action": [                 "s3:PutObject",                 "s3:GetObject",             ],             "Resource": [                 "arn:aws:s3:::accountA-bucketA/*"             ]         }     ] }	write: aws --profile accountA-userA s3 cp toto.txt s3://accountA-bucketA/ read:  aws --profile accountA-userA s3 cp s3://accountA-bucketA/toto.txt .	when writing, and missing s3:PutObject in bucket policy: upload failed: ./toto.txt to s3://accountA-bucketA/toto.txt An error occurred (AccessDenied) when calling the PutObject operation: User: arn:aws:iam::xxxx:user/accountA-userA is not authorized to perform: s3:PutObject on resource: "arn:aws:s3:::accountA-bucketA/toto.txt" because no identity-based policy allows the s3:PutObject action when reading, and missing s3:GetObject in bucket policy: fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden
  read, write, list	accountA-userA accountA-bucketA Bucket policy {     "Version": "2012-10-17",     "Statement": [         {             "Effect": "Allow",             "Principal": {                 "AWS": "arn:aws:iam::accountA_id:user/accountA-userA"             },             "Action": [                 "s3:ListBucket",                 "s3:PutObject",                 "s3:GetObject",             ],             "Resource": [                 "arn:aws:s3:::accountA-bucketA",                 "arn:aws:s3:::accountA-bucketA/*"             ]         }     ] }	write: aws --profile accountA-userA s3 cp toto.txt s3://accountA-bucketA/ read:   aws --profile accountA-userA s3 cp s3://accountA-bucketA/toto.txt . list: aws --profile accountA-userA s3 ls s3://accountA-bucketA/	... when listing, and missing s3:ListObject and Resource without asterisk, in bucket poicy: An error occurred (AccessDenied) when calling the ListObjectsV2 operation: User: arn:aws:iam::xxxx:user/accountA-userA is not authorized to perform: s3:ListBucket on resource: "arn:aws:s3:::accountA-bucketA" because no identity-based policy allows the s3:ListBucket action

• 	account A	account B	access as accountB-userB to accountA-bucketA	if some of the two policies are not set, you will get this message:
  read, write	accountA-bucketA Bucket policy {     "Version": "2012-10-17",     "Statement": [         {             "Effect": "Allow",             "Principal": {                 "AWS": "arn:aws:iam::accountB_id:user/accountB-userB"             },             "Action": [                 "s3:PutObject",                 "s3:PutObjectAcl",                 "s3:GetObject"             ],             "Resource": [                 "arn:aws:s3:::accountA-bucketA/*"             ]         }     ] }	accountB-userB Permissions policies {     "Version": "2012-10-17",     "Statement": [         {             "Effect": "Allow",             "Action": [                 "s3:PutObject",                 "s3:PutObjectAcl",                 "s3:GetObject"             ],             "Resource": [                 "arn:aws:s3:::accountA-bucketA/*"             ]         }     ] }	write: aws --profile accountB-userB s3 cp toto.txt s3://accountA-bucketA/ read: aws --profile accountB-userB s3 cp s3://accountA-bucketA/toto.txt .	when writing, and missing s3:PutObject in at least one of the policies: upload failed: ./toto.txt to s3://accountA-bucketA/toto.txt An error occurred (AccessDenied) when calling the PutObject operation: Access Denied when reading, and missing s3:GetObect in at least one of the policies: fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden
  read, write, list	accountA-bucketA Bucket policy {     "Version": "2012-10-17",     "Statement": [         {             "Effect": "Allow",             "Principal": {                 "AWS": "arn:aws:iam::accountB_id:user/accountB-userB"             },             "Action": [                 "s3:ListBucket",                 "s3:PutObject",                 "s3:PutObjectAcl",                 "s3:GetObject"             ],             "Resource": [                 "arn:aws:s3:::accountA-bucketA",                 "arn:aws:s3:::accountA-bucketA/*"             ]         }     ] }	accountB-userB Permissions policies {     "Version": "2012-10-17",     "Statement": [         {             "Effect": "Allow",             "Action": [                 "s3:ListBucket",                 "s3:PutObject",                 "s3:PutObjectAcl",                 "s3:GetObject"             ],             "Resource": [                 "arn:aws:s3:::accountA-bucketA",                 "arn:aws:s3:::accountA-bucketA/*"             ]         }     ] }	write: aws --profile accountB-userB s3 cp toto.txt s3://accountA-bucketA/ read: aws --profile accountB-userB s3 cp s3://accountA-bucketA/toto.txt . list: aws --profile accountB-userB s3 ls s3://accountA-bucketA/	... ... missing s3:ListBucket and Resource without asterisk in at least one of the policies: An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied

• # modify policy to make it publicly available
policy_json = '{"Version":"2008-10-17","Statement":[{"Sid":"AllowPublicRead","Effect":"Allow","Principal":{"AWS":"*"},"Action":["s3:GetObject"],"Resource":["arn:aws:s3:::%s/*"]}]}' % (bucket_name)
print policy_json
bucket.set_policy(policy_json)

• Metadata
  • Key: Cache-Control, Expires

1. go to bucket
2. Permissions tab
3. Cross-origin ressource sharing (CORS)
   • [
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "GET",
            "HEAD"
        ],
        "AllowedOrigins": [
            "*"
        ],
        "ExposeHeaders": [],
        "MaxAgeSeconds": 3000
    }
]

1. Select bucket
2. Add CORS Configuration
   • <?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
    <CORSRule>
        <AllowedOrigin>*</AllowedOrigin>
        <AllowedMethod>GET</AllowedMethod>
        <AllowedMethod>HEAD</AllowedMethod>
        <MaxAgeSeconds>3000</MaxAgeSeconds>
        <AllowedHeader>Authorization</AllowedHeader>
    </CORSRule>
</CORSConfiguration>
3. CloudFront: invalidate
4. In your browser, delete disk cache for images:
   • Chrome
     • Més eines / Esborra les dades de navegació
       • Imatges i fitxers desats a la memòria cau
   • Firefox
     • Preferències -> Privadesa i seguretat -> Galetes i dades dels llocs -> Gestiona les dades

• Error Pages: Create Custom Error Response
  • HTTP Error Code: 403 Forbidden
  • Error Caching Minimum TTL (seconds): 300
  • Customize Error Response: Yes
  • Response Page Path: /index.html
  • HTTP Response Code: 200 OK

• 4. Use Amazon S3 in non-website mode
  •   var S3BL_IGNORE_PATH = true;
  var BUCKET_NAME = 'mybucket';
  • index.html must be public
  • https://mybucket.s3.amazonaws.com/index.html

• SSL support for S3 website endpoints? (AWS Discussion forums)
• Implementing SSL on Amazon S3 Static Websites (2015)
• Setting Up SSL on AWS CloudFront and S3 (2014)

• SSL setup with Let's Encrypt on AWS CloudFront and S3

• Mageia
  • urpmi python-s3cmd

• s3cmd mb s3://...

• s3cmd ls s3://bucket_name

• s3cmd put ...

• sudo yum -y install fuse fuse-libs
sudo easy_install pip
sudo pip install yas3fs
sudo sed -i'' 's/^# *user_allow_other/user_allow_other/' /etc/fuse.conf
yas3fs s3://mybucket/path /mnt/local_path
  
• fusermount -u mnt/local_path

• Alma 8
  • sudo dnf install epel-release
  • sudo dnf install s3fs-fuse

• dependències / dependencies
  • Mageia
    • urpmi lib64fuse-devel
  • CentOS
    • yum install automake gcc-c++ fuse fuse-devel libcurl-devel libxml2-devel
• compilació / compilation
  • git clone https://github.com/s3fs-fuse/s3fs-fuse.git
  • cd s3fs-fuse
  • ./autogen.sh
  • ./configure --exec-prefix=/usr
  • make
  • su; make install
  • Problemes / Problems
    • ./configure: line 4964: syntax error near unexpected token `common_lib_checking,'
./configure: line 4964: `PKG_CHECK_MODULES(common_lib_checking, fuse >= ${min_fuse_version} libcurl >= 7.0 libxml-2.0 >= 2.6 )'
      • ...

• How to use the FUSE-based file system backed by Amazon S3

• ~/.passwd-s3fs (/etc/passwd-s3fs)
  • bucketName:accessKeyId:secretAccessKey
• chmod 600 ~/.passwd-s3fs

• s3fs bucketName /mnt/bucketName -o allow_other,ahbe_conf=/etc/ahbe.conf,iam_role=my_rolename

• How to force s3fs mount on boot
  • option 1:
    • /etc/init.d/local
  • option 2:
    • /etc/fstab
      • s3fs#my_bucket /mnt/my_bucket fuse _netdev,nonempty,allow_other,ahbe_conf=/etc/ahbe.conf 0 0
      • s3fs#my_bucket /mnt/my_bucket fuse _netdev,nonempty,allow_other,ahbe_conf=/etc/ahbe.conf,iam_role=my_rolename 0 0
    • Problems:
      • d????????? ? ? ? ?            ? my_bucket
        • Solution
          • check that _netdev option is present in /etc/fstab

• s3fs#my_bucket /mnt/my_bucket fuse _netdev,nonempty,allow_other,ahbe_conf=/etc/ahbe.conf,iam_role=my_rolename,default_acl=public-read 0 0

• s3fs -d -f

• How to fix permanently transport end point is not connected in S3fs #152 
• s3fs have crashed with a segfault #6

• sample_ahbe.conf
• # mpd and m3u8 files are cached for 2 seconds
.mpd Cache-Control max-age=2
.m3u8 Cache-Control max-age=1

1. Bucket owner
2. bucket
3. datetime
4. remote ip
5. requester
6. request id
7. operation
8. key
9. request-uri
10. http status
11. error code
12. bytes sent
13. object size
14. total time
15. turn-around time
16. referer
17. user-agent
18. version id
19. host id
20. signature version
21. cipher suite
22. authentication type
23. host header
24. tls version

• # show: datetime operation key remote_ip http_status bytes_sent
gawk 'BEGIN {FPAT="([^ ]+)|(\"[^\"]+\")|(\\[[^\\[\\]]+\\])"}; $8 ~ /myfile.mp4/ && $7 ~ /REST.GET.OBJECT/ {print $3, $7, $8, $4, $10, $12}' *

• Route53 weighted records

• Multi-AZ deployments, multi-region deployments, and read replicas

• Multi-AZ deployments
• Multi-Region deployments
• Read replicas

• Set up shared database connections with Amazon RDS Proxy (tutorial)
• Getting started with RDS Proxy
  1. create a Secret in Secrets Manager (for one regular user in database, not the master user) and note its arn
  2. setup a policy in IAM Policies that can access the secret
     • Roles -> Create role
       • RDS -> RDS - Add role to database
       • Create policy
         • JSON: with arn from previous step (sample json)
         • Create
       • Roles (refresh)

• Using Amazon RDS Blue/Green Deployments for database updates
• Getting Started with Amazon Aurora & Amazon RDS Blue/Green Deployments: Simplifying Database Updates (video)

• Upgrades of the RDS for PostgreSQL DB engine
• How to perform a major version upgrade for RDS for PostgreSQL
• Upgrading PostgreSQL extensions in RDS for PostgreSQL databases
  • PostGIS: Step 6: Upgrade the PostGIS extension
• Parameter groups
  • Problemes
    • The current parameter group associated with the blue instance (wct-postgres12) is not the default. You need to explicitly specify a new parameter group (default or custom) for the green instance when creating a blue/green deployment with the --target-engine-version option set to an engine version that's different from the blue instance.
      • Solució:
        • feu servir aws cli en lloc de la consola web:
          • aws rds create-blue-green-deployment --blue-green-deployment-name bg-my-database --source arn:aws:rds:eu-west-1:xxxx:db:my-database --target-engine-version 13.18 --target-db-parameter-group-name my-postgres13
    • Question about blue/green RDS postgreSQL deployment.

  • 		30.8 Configuration Settings (12, 13)	PostgreSQL 12		PostgreSQL 13		b/g
    			default	modified (*)	default	modified
    from b/g docs: Preparing an RDS for PostgreSQL DB instance for a blue/green deployment with logical replication	rds.logical_replication		0	1	0	1	Blue/Green Deployments require a DB instance with logical replication enabled. Before you create a Blue/Green Deployment for a DB instance, associate the DB instance with a custom DB instance parameter group that enables logical replication.
    	max_replication_slots	publisher: must be set to at least the number of subscriptions expected to connect, plus some reserve for table synchronization subscriber: be set to configure how many replication origins can be tracked. In this case it should be set to at least the number of subscriptions that will be added to the subscriber.	10	count(databases) + 3 20	20
    	max_wal_senders	publisher: should be set to at least the same as max_replication_slots plus the number of physical replicas that are connected at the same time	10	max_replication_slots + 3 20 -> 35 (blue logs: The parameter max_wal_senders was set to a value incompatible with replication. It has been adjusted from 20 to 35.) (added 15)	20	35
    	max_logical_replication_workers	subscriber: must be set to at least the number of subscriptions, again plus some reserve for the table synchronization	-	max_replication_slots 20	-	20
    	max_worker_processes	subscriber: may need to be adjusted to accommodate for replication workers, at least (max_logical_replication_workers + 1). Note that some extensions and parallel queries also take worker slots from max_worker_processes	8	max_logical_replication_worker + 3 35	GREATEST(${DBInstanceVCPU*2},8)
    other parameters from PostgreSQL docs (30.8 Configuration Settings)	wal_level	publisher: must be set to logical	(not present)		(not present)
    diff default.postgres12, default.postgres13 (done by copying default to custom and action compare)	ignore_invalid_pages		-		0
    	max_parallel_workers		-		GREATEST(${DBInstanceVCPU/2},8)
    	max_replication_slots		10		20
    	max_wal_senders		10		20
    	max_worker_processes		8		GREATEST(${DBInstanceVCPU*2},8)
    	rds.accepted_password_auth_method		-		md5+scram
    	rds.extensions		...		...
    	rds.force_autovacuum_logging_level		INFO		WARNING
    	rds.replica_identity_full		-		0
    	wal_compression		-		1
    	wal_keep_segments		32		-
    	wal_keep_size		-		2048
    	wal_receiver_create_temp_slot		-		0

• Engine type: Amazon Aurora
• Edition: Amazon Aurora with PostgreSQL compatibility
• Capacity type: Provisioned
• Version: Aurora PostgreSQL (Compatible with PostgreSQL 12.7)

• DB cluster identifier: my-first-cluster
• Master username: postgres
• Master password: xxxx

• Burstable classes: db.t4g.medium

• Create an Aurora Replica or Reader node in a different AZ (recommended for scaled availability)

• Virtual private cloud (VPC): Default VPC
• Subnet group: default
• Public access: Yes
• VPC security group
  • Create new: sg_aurora

• Backup
  • Backup retention period: 35 days
• ...
• Log exports
  • Publishing Amazon Aurora MySQL logs to Amazon CloudWatch Logs

• Migrating from a self-managed PostgreSQL instance to an Aurora PostgreSQL instance
  • pg_dump and pg_restore
  • Logical replication
  • AWS DMS

• Create the cluster with a dedicated IAM role
  1. create a role role-eks-create
     • Trusted entity type: Custom trust policy
     • Add a principal
       • Principal type: IAM users
       • ARN: arn:aws:iam::{Account}:user/myuser
     • Permission policies:
       • {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstanceTypeOfferings",
                "ec2:DescribeAvailabilityZones",
                "ec2:AllocateAddress",
                "ec2:CreateVpc",
                "ec2:DeleteVpc",
                "ec2:DescribeVpcs",
                "ec2:DescribeAddresses",
                "ec2:ReleaseAddress",
                "ec2:CreateInternetGateway",
                "ec2:AttachInternetGateway",
                "ec2:CreateTags",
                "ec2:DescribeInternetGateways",
                "ec2:DeleteInternetGateway",
                "ec2:DetachInternetGateway",
                "ec2:ModifyVpcAttribute",
                "ec2:CreateSubnet",
                "ec2:DeleteSubnet",
                "ec2:DescribeSubnets",
                "ec2:ModifySubnetAttribute",
                "ec2:CreateRouteTable",
                "ec2:CreateRoute",
                "ec2:DeleteRoute",
                "ec2:CreateSecurityGroup",
                "ec2:DescribeSecurityGroups",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:DeleteSecurityGroup",
                "ec2:DescribeRouteTables",
                "ec2:DeleteRouteTable",
                "ec2:AssociateRouteTable",
                "ec2:DisassociateRouteTable",
                "ec2:CreateNatGateway",
                "ec2:DescribeNatGateways",
                "ec2:DescribeNatGateways",
                "ec2:DeleteNatGateway",
                "ec2:CreateLaunchTemplate",
                "ec2:DeleteLaunchTemplate",
                "ec2:DescribeLaunchTemplateVersions",
                "ec2:RunInstances",
                "cloudformation:CreateStack",
                "cloudformation:DescribeStacks",
                "cloudformation:DescribeStackEvents",
                "cloudformation:ListStacks",
                "cloudformation:DeleteStack",
                "iam:DetachRolePolicy",
                "iam:DeleteRole",
                "iam:GetRole",
                "iam:CreateRole",
                "iam:AttachRolePolicy",
                "iam:PutRolePolicy",
                "iam:DeleteRolePolicy",
                "iam:PassRole",
                "iam:ListAttachedRolePolicies",
                "eks:DescribeCluster",
                "eks:ListClusters",                 "eks:DescribeNodegroup",
                "eks:CreateCluster",
                "eks:TagResource",
                "eks:DeleteCluster",
                "eks:CreateNodegroup",
                "eks:DescribeNodegroup",
                "eks:DeleteNodegroup"
            ],
            "Resource": "*"
        }
    ]
}
  2. ~/.aws/config
     • [profile eks-create]
role_arn = arn:aws:iam::xxxxx:role/role-eks-create
source_profile = myuser
  3. export AWS_PROFILE=eks-create
  4. verify that eks-create role will be used by eksctl:
     • aws sts get-caller-identity
  5. eksctl create cluster --name my-cluster --region eu-west-1 --nodegroup-name my-cluster-nodes --node-type t3.micro --nodes 2
     • this will create 2 CloudFormation stacks:
       • eksctl-<my-cluster>-cluster
       • eksctl-<my-cluster>-nodegroup-<my-cluster-nodes>
  6. verify:
     • CloudTrail / Event history / Event Name = CreateCluster
  7. cluster will be available in about 15-20 minutes

• use "Custom" instead of "Use Origin Cache Headers"

• User player requests a resource, but it is still no available. It gets a 404 from CloudFront. If response 404 is cached (default configuration for CloudFront), even if the player (e.g. HLS player) requests again the resource, CloudFront will not request the origin again, and player will always get the 404. Usually seen in live distributions.
  • Solution
    • mark 404 responses as no cached
      • in origin
        • Nginx: no-cache for 404 responses
      • in CloudFront
        • aws console
          • Distribution -> Error Pages -> Custom Error Response
            • HTTP Error Code: 404 Not Found
            • Error Caching Minimum TTL (seconds): 2
        • Cloudformation: CloudFront no cache for 404

• Configuring CloudFront to Respect Cross-Origin Resource Sharing (CORS) Settings

• Headers that CloudFront Returns to the Viewer

• Solution
  • allow passing the needed request headers (Origin) from final user to origin, to force the generation of CORS response header (Access-Control-Allow-Origin)
    • in origin
      • AWS S3 CORS
      • Nginx: CORS
    • in CloudFront (see CloudFormation)
      • console
        • Distribution -> Behaviour
          • Forward Headers -> Whitelist
            • Origin
            • Access-Control-Request-Headers
            • Access-Control-Request-Method
          • Allowed HTTP Methods (to avoid a 403 response from CloudFront when requested a CORS preflight)
            • GET, HEAD, OPTIONS
          • Cached HTTP Methods
            • OPTIONS
      • Cloudfromation: CloudFront Forward headers

• ...

• The S3 bucket that you specified for CloudFront logs does not enable ACL access
  • from April 2023
  • NOTICE: new S3 Buckets trying to use ACLs fail to create if not explicitly opted in #25358
  • Solution:
    • on your bucket, activate Object writer as Object ownership:
      • from console (Permissions -> Object Ownership):
        • ACLs enabled
          • Object Ownership: Object writer
      • from CloudFormation:
        • "MyBucket": {
    "Type" : "AWS::S3::Bucket",
    "Properties": {
        "OwnershipControls": {
            "Rules" : [
                {"ObjectOwnership": "ObjectWriter"}
            ]
        }, [...]

• CloudFront Real-Time Monitoring Solution
  • using AWS SAM CLI
  • components
    • Amazon Kinesis Data Streams
    • AWS Lambda
    • Amazon Timestream
• Creating realtime dashboards using Amazon CloudFront logs
  • components
    • Amazon Kinesis Data Streams
    • Amazon Kinesis Firehose with AWS Lambda, to:
      • S3 Bucket
      • Amazon OpenSearch Service (previoulsy known as: Amazon Elasticsearch Service)
        • includes OpenSearch Dashboards (previously: Kibana)
        • Tutorial: Creating a search application with Amazon OpenSearch Service
        • REST API reference
          • Search
          • examples (see also Firehose stream console "Test with demo data")
            • curl -v -XGET -u 'master-user:master-user-password' 'https://search-....aos.eu-west-1.on.aws/realtime/_search'
• ...

• 46-63: Common Media Client Data (CMCD)

• when creation of bucket is recent, access through cloufront returns 307 responses
  • AWS CloudFront returns http 307 when origin is S3 bucket
  • Solution:
    • specify region in origin:
      • <bucket>.s3.amazonaws.com
      • <bucket>.s3-eu-west-1.amazonaws.com

• function handler(event) {
  var request = event.request;
  var olduri = request.uri;
  var newuri = olduri.replace(/\/$/, '\/index.html');
  request.uri = newuri;  
  return request;
}

• Introducing CloudFront Functions – Run Your Code at the Edge with Low Latency at Any Scale

• Function purpose
  

  	event type
  Modify the HTTP request in a viewer request event type	viewer request	function handler(event) {     var request = event.request;     // Modify the request object here.     return request; }
  Generate an HTTP response in a viewer request event type	viewer request	function handler(event) {     var request = event.request;     var response = ...; // Create the response object here,                         // using the request properties if needed.     return response; }
  Modify the HTTP response in a viewer response event type	viewer response	function handler(event) {     var request = event.request;     var response = event.response;     // Modify the response object here,     // using the request properties if needed.     return response; }

• event structure:

  context	distributionDomainName distributionId eventType: viewer-request, viewer-response requestId
  viewer	ip
  request	method uri (relative path) querystring (*) headers (except Cookie) cookies
  response	statusCode (int) statusDescription headers cookies body encoding data

• ...

• Validate Referrer Headers Using CloudFront Function
• amazon-cloudfront-functions

• Tutorial: Create a simple function with CloudFront Functions
• Tutorial: Create a CloudFront function that includes key values
  • access to KeyValueStore from function:
    • import cf from 'cloudfront';
// This fails if there is no key value store associated with the function
const kvsHandle = cf.kvs();
async function handler(event) {
    const key = ...
   let value = "Not found" // Default value
   try {
        value = await kvsHandle.get(key);
    } catch (err) {
        console.log(`Kvs key lookup failed for ${key}: ${err}`);
    }
    ...
}

• activació
• ...
• generació
• var request = event.request;
var headers = request.headers;
  
• if (headers.origin && headers.origin.value) {
    var receivedOrigin = headers.origin.value;
    console.log(`Origin is: ${receivedOrigin}`);
} else {
    console.log("No Origin");
}

• if (headers.referer && headers.referer.value) {
    var receivedReferer = headers.referer.value;
    console.log(`Referer is: ${receivedReferer}`);
} else {
    console.log("No Referer");
}
• visualització
• CloudWatch (N. Virginia) / Logs / Log groups
  • /aws/cloudfront/function/myFunction

• Mozilla HTTP Observatory

• Delete Lambda@Edge functions and replicas
  • go to your CloudFront distribution
  • edit your Behaviour:
    • (bottom) Function associations: Lambda@Edge -> No association
• ...

• JSON Web Tokens using Lambda@Edge
• aws-samples/cloudfront-secure-media

• amazon-cloudfront-functions/redirect-based-on-country
• when creating jwt token, include e.g.:
  • "aud": ["FR","AD"]
• in distribution behaviour, include cache header:
  • CloudFront-Viewer-Country
• when validating jwt token, compare both:
  •     try{
        var payload = jwt_decode(jwtToken, secret_key);
        log(`payload.aud: ${payload.aud}`)
    }
    catch(e) {
        log(e);
        return response401;
    }    
    var headers = request.headers;
    if (headers['cloudfront-viewer-country']) {
        var countryCode = headers['cloudfront-viewer-country'].value;
        log(`countryCode=${countryCode}`)
    } else {
        log("no cloudfront-viewer-country")
    }
    if (payload.aud.includes(countryCode)) {
        log(`${countryCode} in ${payload.aud}`);
    } else {
        log(`${countryCode} not in ${payload.aud}`);
    }

• Validate a simple token in the request
  • Verify a JSON Web Token (JWT) using SHA256 HMAC signature:
    • amazon-cloudfront-functions/kvs-jwt-verify
• steps (see: Tutorial: Create a CloudFront function that includes key values):
  1. go to CloudFront Functions console
  2. Create the key value store (tab: KeyValueStores)
     
     • Create KeyValueStore
       • Name: myJWTVerifyValueStore
       • Description: ...
       • S3 bucket: (empty)
     • go to your recently created KeyValueStore
       • Key value pairs
       • Add key value pairs
         • Add pair
           • jwt.secret = xxxx
       • Associated functions
         • (here the associations done from next section will appear)
     • ...
  3. Create the function (tab: Functions)
     
     • Create function
       • Name: myJWTVerifyFunction
       • Description: ...
       • Runtime: cloudfront-js-2.0
     • go to detail of your recently created function
     • Function code:
       • paste from aws-samples/amazon-cloudfront-functions/kvs-jwt-verify/verify-jwt.js
     • Publish
       • Publish function
       • Associated distributions
         • Add association
           • Distribution:
           • Event type: Viewer request
           • Cache behavior: ...
  4. associate KVS
     • go to detail of your function
     • Associated KeyValueStore
       • Associate existing KeyValueStore
  5. modify generate-jwt.sh
     • # same value as in your KeyValueStore
secret='xxxx'
  6. test
     • curl -I https://.../myobject?jwt=<token_generated_with_generate-jwt.sh>
• ...

• Secure your Media Workloads with JWT Token with Lambda@Edge
• Protecting your media assets with token authentication
• Protecting an AWS Lambda function URL with Amazon CloudFront and Lambda@Edge
• (valid?) steps
  1. go to lambda (IMPORTANT: us-east-1 N. Virginal Region, where all CloudFront distributions reside)
  2. Create Function
     • Author from scratch
     • Basic information
       • Function name: myVerifyJWT
       • Runtime: Node.js 20.x
     • Additional Configurations
     • ...
  3. open created function details
  4. Add trigger
     • Trigger configuration
       • Select a source: CloudFront
       • Deploy to Lambda@Edge
         • Distribution: ...
         • Cache behavior: ...
         • CloudFront event: Viewer request
         • Include body: disable
         • Confirm deploy to Lambda@Edge: enable
• ...

• AWS_DEFAULT_OUTPUT=json ./vpc_script.sh

• tag every instance on the same multicast group with tag: multicast=MYCOMMUNITY
• every instance must have a bridge:
  • bridge_name=mcbr-MYCOMMUNITY
# determine a second local ip address, different from the real one, in a completely different subnet, to give it to the bridge. E.g.:
local_ip_address_and_subnet_used_for_multicast="172.16.0.3/24"
# create the bridge
#deprecated: brctl addbr ${bridge_name}
ip link add name ${bridge_name} type bridge
# set tables
ebtables -P FORWARD DROP
# add address/subnet_mask that will be used for multicast, to bridge
ip addr add ${local_ip_address_and_subnet_used_for_multicast} dev ${bridge_name}
# set bridge up
ip link set ${bridge_name} up
• and a route for multicast:
  • multicast_cidr="224.0.0.0/4"
#deprecated: route add -net ${multicast_cidr} ${bridge_name}
ip route add ${multicast_cidr} dev ${bridge_name}
• every instance must establish a grep tunnel to each other member of the community (and periodically check for changes):
  • local_ip_address="10.0.1.5"
remote_ip_address=...
# got from another script that searches for instances with tag multicast=MYCOMMUNITY
gretap_name=gre-...
# create GRE tunnel interface
ip link add ${gretap_name} type gretap local ${local_ip_address} remote ${remote_ip_address}
# set tunnel up
ip link set dev ${gretap_name} up
# add tunnel interface to bridge
#deprecated: brctl addif ${bridge_name} ${gretap_name}
ip link set ${gretap_name} master ${bridge_name}

• MTU is reduced by 38 bytes because of GRE

• Get all instances with a multicast tag, and filter those within a specific community (e.g.: foo)
  • aws --output json ec2 describe-instances --filters "Name=tag-key,Values=multicast" >instances_multicast.json
  • jq '.Reservations[].Instances[] | select( .Tags[] | . and .Key=="multicast" and (.Value | startswith("foo")) )' instances_multicast.json
    
  • from the selected instances, get only some information:
    
    • jq '.Reservations[].Instances[] | select( .Tags[] | . and .Key=="multicast" and (.Value | startswith("foo")) ) | [.InstanceId, .PrivateIpAddress, .PublicIpAddress, .Tags]' instances_multicast.json

• Setup step 1: prepare network
  
  • Option 1: just create one or more subnets in a existing VPC
  • Option 2: Create new AWS VPC (vpc-xxxxxx) with a subnet and a route table to Internet:
    • Subnet
      • Name: Public subnet
      • IPv4 CIDR: 10.0.0.0/24
    • Cloudformation
      • {
    "Resources": {
        "MyVPC": {
            "Type" : "AWS::EC2::VPC",
            "Properties" : {
                "CidrBlock": "10.0.0.0/16",
                "EnableDnsSupport" : "true",
                "EnableDnsHostnames" : "true",
                "Tags" :[ { "Key" : "Name", "Value" : "my-vpc"} } ]
            }
        },
        "MyInternetGateway" : {
            "Type" : "AWS::EC2::InternetGateway"
        },
        "MyVPCGatewayAttachment" : {
            "Type" : "AWS::EC2::VPCGatewayAttachment",
            "Properties" : {
                "InternetGatewayId" : {"Ref" : "MyInternetGateway"},
                "VpcId" : {"Ref" : "MyVPC"}
            }
        },
        "MyPublicSubnet" : {
            "Type" : "AWS::EC2::Subnet",
            "Properties" : {
                "VpcId" : { "Ref" : "MyVPC" },
                "CidrBlock" : "10.0.0.0/24",
                "MapPublicIpOnLaunch" : "true",
                "Tags" : [ { "Key" : "Name", "Value" : "my-subnet"} ]
            }
        },        
        "PublicRouteTable" : {
            "Type" : "AWS::EC2::RouteTable",
            "Properties" : {
                "VpcId" : {"Ref" : "MyVPC"}
            }
        },        
        "PublicRoute" : {
            "Type" : "AWS::EC2::Route",
            "DependsOn" : "MyVPCGatewayAttachment",
            "Properties"  : {
                "RouteTableId" : {"Ref" : "PublicRouteTable"},
                "DestinationCidrBlock" : "0.0.0.0/0",
                "GatewayId" : {"Ref" : "MyInternetGateway"}
            }
        },        
        "PublicSubnetRouteTableAssociation" : {
            "Type" : "AWS::EC2::SubnetRouteTableAssociation",
            "Properties" : {
                "SubnetId" : {"Ref" : "MyPublicSubnet"},
                "RouteTableId" : {"Ref" : "PublicRouteTable"}
            }
        },
    }
        }
• Setup step 2: Create AWS role with policy:
  • {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1414071732000",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:DescribeTags",
                "ec2:DescribeRegions"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}
  • Cloudformation:
    • ...
• Setup step 3: Create AWS security group (sg-yyyyyy) in your VPC (vpc-xxxxxx)
  • Inbound Rules:
    • Type: Custom Protocol Rule
    • Protocol: GRE (47)
    • Port Range: All
    • Source: sg-yyyyyy
  • Cloudformation (to avoid circular dependency, because SourceSecurityGroupId is the same as GroupId, a AWS::EC2::SecurityGroupIngress must be created)
    •      "MyInboundRule" : {
        "Type": "AWS::EC2::SecurityGroupIngress",
        "Properties":{
        "IpProtocol" : "47",
        "SourceSecurityGroupId" : {"Fn::GetAtt" : ["MySecurityGroup","GroupId"]},
        "GroupId" : {"Fn::GetAtt" : ["MySecurityGroup","GroupId"]}
        }
    },    
    "MySecurityGroup" : {
        "Type" : "AWS::EC2::SecurityGroup",
        "Properties" : {
            "GroupDescription" : "Enable ports 22 (ssh), GRE (47) (multicast)",
            "SecurityGroupIngress" : [
                {
                    "IpProtocol" : "tcp",
                    "FromPort" : "22",
                    "ToPort" : "22",
                    "CidrIp" : "0.0.0.0/0"
                }
            ]
        }
    },
    •    "MyInboundRule" : {
        "Type": "AWS::EC2::SecurityGroupIngress",
        "Properties":{
        "IpProtocol" : "47",
        "SourceSecurityGroupId" : {"Ref" : "MySecurityGroup"},
        "GroupId" : {"Ref" : "MySecurityGroup"}
        }
    },    
    "MySecurityGroup" : {
        "Type" : "AWS::EC2::SecurityGroup",
        "Properties" : {
            "GroupDescription" : "Enable ports 22 (ssh), GRE (47) (multicast)",
            "VpcId" : {"Ref" : "MyVPC"},
            "SecurityGroupIngress" : [
                {
                    "IpProtocol" : "tcp",
                    "FromPort" : "22",
                    "ToPort" : "22",
                    "CidrIp" : "0.0.0.0/0"
                }
            ]
        }
    },
• Setup step 4: Creation of several instances with this role and security group, with tag:
  • Name: multicast; Value: foo,172.16.0.7/24
  • Name: multicast; Value: foo,172.16.0.8/24
  • ...

• Option 1:
  • Installation of Ruby script
    • CentOS
      • sudo yum install unzip bridge-utils ebtables curl ruby ruby-devel rubygem-nokogiri rubygem-daemons libxml2-devel
      • sudo gem install aws-sdk-v1 integration libxml-ruby
    • cd
    • wget https://s3.amazonaws.com/mcd-code/mcd-code-2014-07-11.zip
    • cd mcd-code-2014-07-11
    • sudo chmod 755 *
    • sudo mkdir -p /opt/mcast
    • sudo cp -pr * /opt/mcast'
    • sudo chown -R root:root /opt/mcast
  • Start Ruby script
    • temporarily
      • sudo ruby -d /opt/mcast/mcd
    • daemon
      • CentOS
        • mcd.service
          • [Unit]
Description=Multicast daemon for AWS EC2 instances
After=syslog.target network.target cloud-init.service
[Service]
Type=simple
#PIDFile=/run/mcd.pid
ExecStartPre=/usr/local/bin/mcd_setup.sh foo 172.16.0.0/24
ExecStart=/opt/mcast/mcd
ExecStartPost=/usr/local/bin/mcd_setup_route.sh foo
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s QUIT $MAINPID
[Install]
WantedBy=multi-user.target
        • mcd_setup_route.sh
          • #!/bin/bash
function print_help_and_exit {
    cat <<EOF
Usage: `basename $0` multicast_name
Add route for multicast: mcbr-<multicast_name>
Examples:
- `basename $0` foo
EOF
    exit 1
}
MIN_ARGS=1
MAX_ARGS=1
if (( $# < $MIN_ARGS )) || (( $# > $MAX_ARGS ))
then
    print_help_and_exit
fi
# options
if ! params=$(getopt -o h --long help -n $0 -- "$@")
then
    # invalid option
    print_help_and_exit
fi
eval set -- ${params}
while true
do
    case "$1" in
        -h | --help ) print_help_and_exit;;
        -- ) shift; break ;;
        * ) break ;;
    esac
done
# parameters
multicast_name=$1
# wait for bridge to exist
bridge_name="mcbr-${multicast_name}"
timeout=60
increment=5
t=0
while (( t < timeout )) && (brctl show ${bridge_name} 2>&1 1>/dev/null | grep -q "No such device")
do
    echo "[`basename $0`] bridge ${bridge_name} is not available yet (${t}s/${timeout}s)"
    (( t+=increment ))
    sleep ${increment}
done
# add route for multicast
echo "[`basename $0`] adding route for multicast: mcbr-${multicast_name}"
route add -net 224.0.0.0/4 mcbr-${multicast_name}
exit 0
        • mcd_setup.sh
          • #!/bin/bash
function print_help_and_exit {
    cat <<EOF
Usage: `basename $0` multicast_name multicast_cidr
Set the AWS EC2 tag: "multicast", "<multicast_name>,<multicast_cidr>"
Address multicast_cidr has the same number as local ip address, but converted to specified subnet
E.g.: if local address is 10.1.2.3/24 and you specify 172.16.0.0/24, the multicast_cidr=172.16.0.3/24
IMPORTANT: role for this ec2 instance must include a policy with: "ec2:CreateTags"
Examples:
- `basename $0` foo 172.16.0.0/24
EOF
    exit 1
}
MIN_ARGS=2
MAX_ARGS=2
if (( $# < $MIN_ARGS )) || (( $# > $MAX_ARGS ))
then
    print_help_and_exit
fi
# options
if ! params=$(getopt -o h --long help -n $0 -- "$@")
then
    # invalid option
    print_help_and_exit
fi
eval set -- ${params}
while true
do
    case "$1" in
        -h | --help ) print_help_and_exit;;
        -- ) shift; break ;;
        * ) break ;;
    esac
done
# parameters
multicast_name=$1
multicast_cidr=$2
function translate_ip {
    input_cidr=$1
    output_cidr=$2
    # remove subnet
    input_address=${input_cidr%/*}
    # get network and prefix
    eval $(ipcalc -np $output_cidr)
    output_prefix=$PREFIX
    output_network=$NETWORK
    # calculate number of bytes (n)
    let output_positions=${output_prefix}/8
    # remove first n bytes
    input_array=(${input_address//./ })
    input_significative=${input_array[@]:${output_positions}}
    # get first n bytes
    output_array=(${output_network//./ })
    output_significative=${output_array[@]:0:${output_positions}}    
    # join all bytes
    total_address_array=(${output_significative[@]} ${input_significative[@]})
    total_address=$(IFS='.';echo "${total_address_array[*]}";IFS=$'')
    total_cidr="${total_address}/${output_prefix}"
    echo $total_cidr
}
# check whether ip command is available
if ! (which ip >/dev/null 2>&1)
then
    echo "ERROR: command ip not found. Consider running this script as root or sudo."
    exit 1
fi
# get own information
local_cidr=$(ip -o address | awk '$2 !~ /lo/ && $3 ~ /^inet$/ {print $4; exit;}')
#local_ipv4=$(curl http://169.254.169.254/latest/meta-data/local-ipv4/)
multicast_cidr=$(translate_ip $local_cidr $multicast_cidr)
echo multicast_cidr: $multicast_cidr
# eu-west-1c
if ! aws_subregion=$(curl -s -m 4 http://169.254.169.254/latest/meta-data/placement/availability-zone)
then
    echo "no aws_subregion found. Are you sure that you are running this script on an AWS instance?"
    exit 1
fi
# eu-west-1
aws_region=${aws_subregion: : -1}
instance_id=$(curl -s -m 4 http://169.254.169.254/latest/meta-data/instance-id)
# create a tag
aws ec2 create-tags --region ${aws_region} --resources $instance_id --tags Key="multicast",Value="${multicast_name}\,${multicast_cidr}"
exit 0
• Option 2: Install bash script
  • Installation of mcd.sh
  • Start bash script
    • temporarily
    • daemon
      • CentOS

• Process
  • sudo ps -edalf | grep mcd
• Logs
  • tail -f /var/log/messages | grep mcd
• Created bridges
  • brctl show
• Created GRE tunnels
  • ip link show
• Routes
  • route -n
  • ip route
• Members
  • netstat -g
  • ip maddr
• Omping: to test multicast
  
  • from each instance, simultaneously, specify all the addresses in local_ip_address_and_subnet_used_for_multicast, including the own one:
    • omping 172.16.0.7 172.16.0.8 ...
      • output will show the remote address
  • if it does not work:
    • check if some gretap points to a non existing address
      • to get the remote address, check the logs in /var/log/messages when the gretap was created

• routes
  • in each instance, specify that multicast traffic should go through the bridge:
    • route add -net 224.0.0.0/4 mcbr-foo
    • ip route add 224.0.0.0/4 dev mcbr-foo
• application:
  • from one instance:
    • ffmpeg ...
  • from the other one:
    • ...

• Swap s3transfer packages (awscli-1.14.28-5):
  
  • yum swap python2-s3transfer python-s3transfer
    
• Use pip
  • sudo pip install awscli
    • a pair of working packages is, e.g.: awscli==1.14.28, botocore==1.8.32

• aws autoscaling create-launch-configuration --launch-configuration-name lc_stateless_yyyymmdd_hhmm --image-id ami-2dd81a5a --security-groups launch-wizard-2 --instance-type t1.micro
• aws autoscaling describe-launch-configurations --launch-configuration-names lc_stateless_yyyymmdd_hhmm
• pas de paràmetres en crear una instància / pass parameters when creating an instance:
  • aws autoscaling create-launch-configuration --user-data ...

• aws autoscaling create-auto-scaling-group --auto-scaling-group-name grup_stateless --launch-configuration-name lc_stateless_yyyymmdd_hhmm --min-size 1 --max-size 2 --load-balancer-names lb-stateless
• aws autoscaling update-auto-scaling-group --auto-scaling-group-name grup_stateless --launch-configuration-name lc_stateless_yyyymmdd_hhmm
• number of instances inside an autoscaling group, given its name
  • result=$(aws --output json autoscaling describe-auto-scaling-groups --auto-scaling-group-names $asg_name)
    number_instances=$(echo $result | jq '.AutoScalingGroups[0].Instances | length')
• get autoscaling group, given its tag Name=myname:
  • asg_info=$(aws --output json autoscaling describe-auto-scaling-groups)
asg_name_tag_value="myname"
asg=$(echo "$asg_info" | jq ".AutoScalingGroups[] | select( .Tags[] | . and .Key==\"Name\" and .Value==\"${asg_name_tag_value}\")")
• aws autoscaling set-desired-capacity --auto-scaling-group-name $asg_name --desired-capacity 2
• Instance protection
  • aws autoscaling set-instance-protection --instance-ids i-93633f9b --auto-scaling-group-name my-auto-scaling-group --protected-from-scale-in
• given an instance id, get the autoscaling group name it belongs to:
  • aws ec2 describe-tags --filters "Name=resource-id,Values=$instance_id" "Name=key,Values=aws:autoscaling:groupName" | jq '.Tags[] | .Value'
  • ...
• retrieve own instance id and region and get the autoscaling group name it belongs to:
• REGION=$(curl -s http://169.254.169.254/latest/meta-data/placement/region)
INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id)
aws ec2 describe-instances --instance-id $INSTANCE_ID --query "Reservations[*].Instances[*].Tags[?Key=='aws:autoscaling:groupName'].Value" --region $REGION --output text

• aws_options="--profile my_profile --output json --region eu-west-1"
next_token=""
max_items=50
page_size=100
total_number=0
total_elements=$(jq -n '[]')
while [[ $next_token != "null" ]]
do
    if [[ "$next_token" ]]
    then
        lc_info=$(aws ${aws_options} autoscaling describe-launch-configurations --max-items $max_items --page-size $page_size --starting-token $next_token)
    else
        lc_info=$(aws ${aws_options} autoscaling describe-launch-configurations --max-items $max_items --page-size $page_size)
    fi
    #echo $lc_info | jq '.'
    returned_number=$(echo $lc_info | jq  '.LaunchConfigurations | length' )
    returned_elements=$(echo $lc_info | jq  '.LaunchConfigurations')
    echo $returned_elements | jq '.'
    total_elements=$( echo $total_elements | jq ". += $returned_elements")
    echo "returned_number: $returned_number"
    total_number=$(( total + returned_number ))
    echo "total_number: $total_number"
    echo $lc_info | jq  '.LaunchConfigurations[] | ([.LaunchConfigurationName] | join (" "))'
    next_token=$(echo $lc_info | jq '.NextToken')
    echo "next_token: $next_token"    
done
echo "---------------------------"
echo $total_elements | jq '.[].LaunchConfigurationName'

• aws cloudfront list-distributions --output json

• aws cloudfront get-distribution --id E1KBXTVP599T0A

• aws cloudfront get-distribution-config --id E1KBXTVP599T0A

• aws cloudfront get-distribution-config --id ${cloudfront_id} --output json > /tmp/${cloudfront_id}.json
# get etag
etag=$(jq -r '.ETag' /tmp/${cloudfront_id}.json)
# modify /tmp/${cloudfront_id}.json
...

aws cloudfront update-distribution --id ${cloudfront_id} --if-match $etag --distribution-config $(jq -c '.DistributionConfig' /tmp/${cloudfront_id}.json) 

• ~/.aws/credentials (for all SDKs)
• ~/.aws/config (only for CLI)

• [default]
output = json
region = eu-west-1 aws_access_key_id = xxx
aws_secret_access_key = yyy
[preview]
cloudfront = true

• [default]
aws_access_key_id = xxx
aws_secret_access_key = yyy

• aws --profile myprofile configure
• will create ~/.aws/config
  • [profile myprofile]
output = json
region = eu-west-1
• and ~/.aws/credentials
  • [myprofile] aws_access_key_id = xxx
aws_secret_access_key = yyy
• una de les següents opcions / one of the following:
  
  • aws --profile myprofile ...
  • # necessari quan es fa servir kubectl i eksctl
    export AWS_PROFILE=myprofile
    aws ...