![cloudonaut](/img/default-banner.jpg)
- Видео 98
- Просмотров 235 664
cloudonaut
Германия
Добавлен 7 сен 2020
Your launchpad for Amazon Web Services
🔥 AWS News Check: New AWS Region in Mexico is in the works
This is an excerpt of the cloudonaut podcast, where Andreas and Michael Wittig share insights into building with AWS and discuss the latest AWS announcements every two weeks.
New AWS Region in Mexico is in the works ➡️ aws.amazon.com/blogs/aws/new-aws-region-in-mexico-is-in-the-works/
#amazonwebservices #awscommunity #cloudonaut #podcast
New AWS Region in Mexico is in the works ➡️ aws.amazon.com/blogs/aws/new-aws-region-in-mexico-is-in-the-works/
#amazonwebservices #awscommunity #cloudonaut #podcast
Просмотров: 66
Видео
🔥 AWS News Check: API Gateway now supports TLS 1.3
Просмотров 866 месяцев назад
This is an excerpt of the cloudonaut podcast, where Andreas and Michael Wittig share insights into building with AWS and discuss the latest AWS announcements every two weeks. API Gateway now supports TLS 1.3 ➡️ aws.amazon.com/about-aws/whats-new/2024/02/api-gateway-tls-1-3/ #amazonwebservices #awscommunity #cloudonaut #podcast
🔥 AWS News Check: AWS Resource Explorer supports 65 new resource types
Просмотров 446 месяцев назад
This is an excerpt of the cloudonaut podcast, where Andreas and Michael Wittig share insights into building with AWS and discuss the latest AWS announcements every two weeks. AWS Resource Explorer supports 65 new resource types ➡️ aws.amazon.com/about-aws/whats-new/2024/02/aws-resource-explorer-new-resource-types/ #amazonwebservices #awscommunity #cloudonaut #podcast
🔥 AWS News Check: AWS Systems Manager Parameter Store now supports cross-account sharing
Просмотров 1526 месяцев назад
This is an excerpt of the cloudonaut podcast, where Andreas and Michael Wittig share insights into building with AWS and discuss the latest AWS announcements every two weeks. AWS Systems Manager Parameter Store now supports cross-account sharing ➡️ aws.amazon.com/about-aws/whats-new/2024/02/aws-systems-manager-parameter-store-cross-account-sharing/ #amazonwebservices #awscommunity
How to reduce costs for GitHub Actions?
Просмотров 3766 месяцев назад
Discover cost-saving strategies for GitHub Actions with our guide on utilizing Octolense for expenditure insights and HyperEnv for deploying economical self-hosted runners on AWS. Blogpost - How to reduce costs for GitHub Actions? 👉 cloudonaut.io/how-to-reduce-costs-for-github-actions Octolense - Gain Valuable Insights into Your GitHub Actions 👉 octolense.com HyperEnv - Self-hosted GitHub runne...
[S3.1] S3 Block Public Access setting should be enabled | How to solve AWS Security Hub findings
Просмотров 1,2 тыс.Год назад
[S3.1] S3 Block Public Access setting should be enabled | How to solve AWS Security Hub findings
Serverless and DevOps a match made in heaven | Builder's Diary Vol. 006
Просмотров 361Год назад
Serverless and DevOps a match made in heaven | Builder's Diary Vol. 006
Avoid horrendous AWS bills with unusd.cloud - AWS Toolkit
Просмотров 433Год назад
Avoid horrendous AWS bills with unusd.cloud - AWS Toolkit
How to import data to S3 with AWS Snowcone?
Просмотров 2 тыс.Год назад
How to import data to S3 with AWS Snowcone?
ECS Anywhere Hybrid Cloud Containers | Builder's Diary Vol. 005
Просмотров 594Год назад
ECS Anywhere Hybrid Cloud Containers | Builder's Diary Vol. 005
Write IAM policies like a pro with IAM Legend - AWS Toolkit
Просмотров 1,6 тыс.Год назад
Write IAM policies like a pro with IAM Legend - AWS Toolkit
Serverless Software Engineering | Builder's Diary Vol. 4
Просмотров 331Год назад
Serverless Software Engineering | Builder's Diary Vol. 4
[Hot off the Cloud] Vol. 008 - re:Invent + Cross-Account CloudWatch + AuthZ Verified Permissions
Просмотров 236Год назад
[Hot off the Cloud] Vol. 008 - re:Invent Cross-Account CloudWatch AuthZ Verified Permissions
Infrastructure Pipeline with GitLab and Terraform Cloud | Builder's Diary Vol. 3
Просмотров 535Год назад
Infrastructure Pipeline with GitLab and Terraform Cloud | Builder's Diary Vol. 3
[Hot off the Cloud] Vol. 004 - Lambda Parameters + Dark Mode + SQS FIFO + Nitro Enclaves
Просмотров 167Год назад
[Hot off the Cloud] Vol. 004 - Lambda Parameters Dark Mode SQS FIFO Nitro Enclaves
Serverless ETL with Athena and Airflow | Builder's Diary Vol. 2
Просмотров 424Год назад
Serverless ETL with Athena and Airflow | Builder's Diary Vol. 2
[Hot off the Cloud] Vol. 003 - Lambda event filtering Kafka + Athena query engine v3 + more
Просмотров 132Год назад
[Hot off the Cloud] Vol. 003 - Lambda event filtering Kafka Athena query engine v3 more
[Hot off the Cloud] Vol. 001 - Amazon File Cache + EBS Snapshots Archive + EC2 Auto Recovery
Просмотров 164Год назад
[Hot off the Cloud] Vol. 001 - Amazon File Cache EBS Snapshots Archive EC2 Auto Recovery
The command-line, SDKs, and CloudFormation | AWS-to-go Vol. 4:
Просмотров 247Год назад
The command-line, SDKs, and CloudFormation | AWS-to-go Vol. 4:
Using Virtual Machines: EC2 | AWS-to-go Vol. 3
Просмотров 238Год назад
Using Virtual Machines: EC2 | AWS-to-go Vol. 3
Enhance EFS file system protection with TLS and IAM
Просмотров 7602 года назад
Enhance EFS file system protection with TLS and IAM
WordPress in Fifteen Minutes - an Example | AWS-to-go Vol. 2
Просмотров 2392 года назад
WordPress in Fifteen Minutes - an Example | AWS-to-go Vol. 2
AWS Marketplace: Getting started with an AMI + CloudFormation product
Просмотров 1,4 тыс.2 года назад
AWS Marketplace: Getting started with an AMI CloudFormation product
What's Amazon Web Services? | AWS-to-go Vol. 1
Просмотров 3382 года назад
What's Amazon Web Services? | AWS-to-go Vol. 1
Successful Cloud Migrations | Builder's Diary Vol. 1
Просмотров 3882 года назад
Successful Cloud Migrations | Builder's Diary Vol. 1
Building multi-architecture container images for AWS Graviton
Просмотров 2,1 тыс.2 года назад
Building multi-architecture container images for AWS Graviton
#44 AWS Security: Stephen Kuenzli and Andreas Wittig on IAM
Просмотров 5312 года назад
#44 AWS Security: Stephen Kuenzli and Andreas Wittig on IAM
Connect to your EC2 instance using SSH the modern way
Просмотров 10 тыс.2 года назад
Connect to your EC2 instance using SSH the modern way
Calculate AWS Costs in Detail: S3 VirusScan Calculation (2021)
Просмотров 2,7 тыс.2 года назад
Calculate AWS Costs in Detail: S3 VirusScan Calculation (2021)
Good one, thank you very much - helped me to understand how to work with security hub
I'm happy to hear that!
Well explained. Spot on.
Thank you!
this is great as its helpful for pros already working in AWS.
Thanks a lot for your motivating feedback!
Quick question. What is the advantage of using Terraform for the IAM management process over some bash/python scripting processes? I understand Terraform can do it, but is it the right tool for that process compared with the scripts versioned?
In our opinion, tools using the descriptive approach to define infrastructure work best (Terraform, CloudFormation, CDK, ...). Using scripts is error prone and complicated, as you have to deal with creating, updating, and deleting resources in code.
Could you share me the docker file please
The approach works with any Dockerfile. When not using a package manager to install software, ensure you are downloading the binaries depending on the CPU architecture. Nevertheless, I've probably used the Dockerfile listed at cloudonaut.io/how-to-dockerize-your-nodejs-express-application-for-aws-fargate/ in the video.
what an amazing video
Thanks for your awesome video! I have a question, how to connect your PC to the Snowball device? just plug ethernet cable or need to set a local network to connect with? Thank you.
By default the Snowball devices uses DHCP to configure an IP address. But it is also possible to configure a static IP address. So both scenarios should be possible.
@@cloudonaut got it. Thanks for your answer, Sir!
Great episode thanks. cloudonaut.io/tidying-up-after-failed-terraform-tests/
this is incredible! Thank you for this. Your demonstrations are practical realistic and well appliable. I hope you continue to make videos!
Thank you! Will do!
This is a wonderful video. Thanks cloudonaut.
Thank you!
Thank you for the great video. Any idea if it is possible to automate the process to auto refresh the temporary credentials? If we want to try out SSM with SSO, if we do aws configure sso and set up profile, every time it asks for approval from browser. Any way we can automate this to avoid browser approvals?
Thanks for the feedback. I'm not aware of a way to automate refreshing the credentials.
Thank you for creating such good video !!
Thank you!
Wow, this might be the problem we are facing, the SNS messages would sometimes arrive hours later. We have the same 1 second limit. I will test this soon. Very hard to find people talking about this throttling anywhere online
The bug was fixed in November 13th, 2020. Not sure if they reintroduced the bug? :) You can find the history of the bug here: cloudonaut.io/loosing-trust-in-aws-sns-broken-for-24-days/
Best video on SSO. Is it possible to integrate third party tools ( Jenkins ) with users generated from SSO ( AD Entra ) , how can we get access keys for the new users to access AWS from jenkins on IAM Identity Center.
Hi, I have one question when we say that AMP provides high scalability can this not be achieved if we create a self managed Prometheus as daemon set that would scale itself depending upon the nodes it has to monitor ?
Hi! Sorry, we have no experience scaling Prometheus.
what about if we want to terraform apply(CI) on specific AWS account? would you create an SSO user like e.x. deployer from which you would run aws sso get-role-credentials to get temporary credentials and apply terraform?
Depend on your CI solution. If you use GitHub, you can use docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services
The Organisation is created from the AWS root account so I guess the SSO should be activated from the AWS root account where the Organisation exists?
Yes, root account or a delegated admin account, see docs.aws.amazon.com/singlesignon/latest/userguide/delegated-admin.html
Guys, i keep hearing about Cloudformation with you guys, and i get that it is really popular for AWS. But how do you incorporate it with CI/CD, lets say via Gitlab
We use the AWS CLI: aws cloudformation deploy ...
Super very informative, thank you
Thank you!
What advantage hyperenv provide over using webhooks to send notification to AWS lambda?
Good question! First, HyperEnv deploys an API Gateway + Lambda as well as configures the GitHub webhook automatically. Second, HyperEnv uses a SQS queue to add resiliency, for example to avoid issues caused by rate limiting of the EC2 API. Third, HyperEnv provides an AMI pre-configured to launch a just-in-time GitHub runner. And last but not least, we are maintaining the whole step which includes patching the AMI.
I just read your latest newsletter and now watching this video. What a journey from 2015 until now! Very inspiring! Cool that you guys planned your parental leaving a year apart! Following you now on LinkedIn! Super fan!
Thank you!
Very funny. Today, AWS announced that they have decided to remove the following controls from all security standards: * Athena.1 (“Athena workgroups should be encrypted at rest”) [1]. Athena workgroups send results to Amazon S3 Buckets. Amazon S3 now provides default encryption on new and existing buckets with S3 managed keys (SSE-S3). Bucket encryption cannot be removed, only changed to a different method [2]. * AutoScaling.4 (“Auto Scaling group launch configuration should not have a metadata response hop limit greater than 1”) [3]. There are certain cases where a hop limit greater than 1 is required. For example, Amazon Linux 2023 AMI allows for a hop limit of 2 to support containerized workloads [4]. * CloudFormation.1 (“CloudFormation stacks should be integrated with Simple Notification Service (SNS)”) [5]. While integrating important CloudFormation stacks with SNS topics can be useful, it is not required for all stacks. * CodeBuild.5 (“CodeBuild project environments should not have privileged mode enabled”) [6]. There are certain cases where privileged mode is required for CodeBuild Docker projects. For more information, see the CodeBuild User Guide [7]. * IAM.20 (“Avoid the use of the root user”) [8]. The functionality of this control is incorporated into existing control CloudWatch.1 (“A log metric filter and alarm should exist for the usage of the root user”) [9]. * SNS.2 (“Logging of delivery status should be enabled for notification messages sent to a topic”) [10]. While logging of delivery status for important SNS topics can be useful, it is not required for all topics. In addition, the following controls will be removed only from the AWS Foundational Security Best Practices (FSBP) standard [11], but will still be included in the NIST SP 800-53 r5 standard: * S3.10 (“S3 buckets with versioning enabled should have Lifecycle configurations”) [12]. This security practice remains covered by controls S3.13 (“S3 buckets should have lifecycle policies configured”) [13] and S3.14 (“S3 buckets should use versioning”) [14], both of which belong to the FSBP standard. * S3.11 (“S3 buckets should have event notifications enabled”) [15]. While there are certain cases where event notifications for S3 buckets can be useful, this not a universal security best practice. * SNS.1 (“SNS topics should be encrypted at rest using AWS KMS”) [16]. Amazon SNS now stores messages and files using default disk encryption [17]. Security Hub will remove these controls starting March 16, 2024, in a process which can take up to a month. Once the controls are removed from your account, their findings will be archived within 5 days and will be deleted after 90 days. This does not require any action from your side. However, if you wish to stop receiving findings from these controls before they are removed, you may disable them by using the Security Hub console or API [18]." It's likely not because of us but we are happy to see some of the controls that we mentioned to be removed :)
After 3 hours of wasting time, hop-limit=2 fixed the issue. Thank you so much for sharing.
I'm trying to wrap my head around the fact that we still need our own prometheus server with AMP... AMP supposedly allows for easy scalability and provision of resources, but then I need to handle the Prometheus server anyway. So why should I use it? It's a legit question, I don't get it and I wanted a simple solution to monitor my services running on EC2/Beanstalk. But it looks like I could be better off not using AMP.
There is a new feature called managed collector. At the moment it can only collect metrics from EKS but if that's your use case you might be covered :), see aws.amazon.com/about-aws/whats-new/2023/11/amazon-managed-service-prometheus-agentless-collector-metrics-eks/
@@cloudonaut Thanks a lot for the reply, your content is superb! I'm looking forward to digging more into your videos, they're helping me a lot. I'm not using EKS, and a lot of the documentation for AMP seems directed to it. My idea is that I'm gonna try pushing my metrics directly to AMP using the write endpoint, using the prometheus-client library for Python. I'm not confident it will work, but I'll see. If you have any pointers you could give me, I would appreciate. thanks!
@@angelotessaro Good luck :)
how do you set the credentials?
Please see docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/setting-credentials.html
Scary? Overreacted... man really so many steps to make that work...
Thanks for your feedback!
The Cloudformation template didn't work. Do I need to provide a sub domain? I ran it with the command below bucket_name=my-unique-bucket hosted_zone=us-west-2 sub_domain=my-unique-domain stack_name=my-unique-stack-name aws s3 mb s3://$bucket_name --region us-west-2 npm i aws cloudformation package --template-file example.yaml --s3-bucket $bucket_name --output-template-file packaged.yaml aws cloudformation deploy --template-file packaged.yaml --stack-name $stack_name --parameter-overrides HostedZoneId=$hosted_zone SubDomainNameWithDot=$sub_domain --capabilities CAPABILITY_IAM aws cloudformation describe-stacks --stack-name $stack_name --query "Stacks[0].Outputs[?OutputKey=='Url'].OutputValue" --output text
aurora serverless very useful info. Serverless v2 removing scaling down to zero capability to save $ is now missing.
We miss that feature!
awesome video
Thank you!
Hey Man, can I connect with you on LinkedIn?
Absolutely! www.linkedin.com/in/andreaswittig/
Thanks, informative.
Great podcast!!
Thank you!
Real AWS news good and bad. Thanks
Thanks for your feedback!
Wonderful session, much better than normal presentation by AWS where they described things in a too much sugar way. Do you know if as a buyer you can run a marketplace solution using boto3 api call?
As far as I know, there is no API for subscribing to an AWS Marketplace product. However, after a subscription is active, you are able to deploy AMI products by launching EC2 instances or creating CloudFormation stacks.
Thanks for the info
Great demo @cloudonaut. Thank U.
Thanks for your motivating feedback!
If generating a token is the same procedure , then anyone can generate a token and use it? kindly explain me if i am wrong?
Check out aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/ for details.
heavily awesome even after 2 years <3 <3
Thank you!
is dnssec applicable for domains in which one domain redirected to another domain
That's not really the focus. See www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en
@wuffgang Check out Mike's approach for accessing DynampDB: cloudonaut.io/dynamodb-entity-store-cleaner-typescript-code/.
Great video, thanks. If I want to allow access to my EC2 server only by passing through the VPN created with AWS Client VPN, how could I do it?
Use security groups to control traffic (see docs.aws.amazon.com/vpn/latest/clientvpn-admin/client-authorization.html#security-groups).
One remark. You don't do Linting only in pipeline unless you pay for cloud costs by yourself :) Linting should be done at very early stage so you should have scripts to lint you code locally and then next step is to lint code during push and last is lint before merge. So linting in build is as well OK but before that you have bunch of tests before you will trigger build.
Yes, lint before tests. I also agree that you should be able to run all the steps locally as well.
hello and thank you for the tutorial. This method works great for me when I use SSH, but when I use SCP it throws me 'ssh: Could not resolve hostname' you know what it could be?
Is it possible, that scp is using a different config file?
@@cloudonaut thank you for the quick response <3. I was trying to copy the file to a restricted access folder, my bad! scp is working just like in your video
Fabulous analysis. Thanks so much. I like the pitfalls. We are in the midst of integraiting AWS Security Hub to ServiceNow Incidents. so if you have any great insights to that integration, please let me know.
The AWS Client Endpoint was already created, you mentioned you need 2 hours to do it (probably the 2nd time you do it you spend less time). Anyway, I was looking for a guide to create it. Thanks anyway
Thanks for your feedback!
Is there an updated version of this content. Currently there isn’t an option to enable and disable encryption. SSE-S3 is default
Correct, S3 buckets are encrypted by default those days. Up until know, we haven't recorded an updated video yet.
Hello, could you please add timecodes with topics discussed? It's hard to understand which topics are discussed and when it happens (when it starts)
i agree
Thanks for the feedback! I added timecodes
AWS now has added VPC Reachability Analyzer on Organizations to find out connectivity between multiple AWS Accounts with transit gateway in between.
That's great! Thanks for the update!
Great video, How much data did you load? How much time did it take you to finish upload?
As far as I remember it was around 1 TB of data. Took less than an hour to copy the data from my disk to the Snowcone device.
Real good job..thanks a lot
Thanks a lot for your motivating feedback!
Hi @cloudonaut, thanks for the amazing demo and really want to try this out for learning. I was unable to find the Node JS code for pushing the API data from Finhub to AWS TimestreamDB. In this video, it's mentioned that this code script is available in the community page, can you please guide on where can I find this community page?