Skip to main content

Posts

AWS - WAF

WAF: WAF is a global service like CloudFront, Route 53, SES, IAM.  It’s a Web Application Firewall to protect Web apps/APIs.  You can allow/block requests based on request properties.  WAF can be administered using AWS Firewall Manager (across multiple accounts and resources).  AWS Shield Advanced can be integrated with AWS WAF.  WAF comes free with Shield Advanced.  With WAF + CloudFront, the rules will run in Edge locations (security + performance).  With WAF + regional resources like ALB/APIGW/AppSync/Cognito User Pools, the rules will run in the region (internet-facing/internal resources are protected).  WAF can block XSS and SQL Injection attacks but can’t withstand DDoS attacks (use WAF’s Web ACL rate-based rules + AWS Shield Advanced for DDoS attacks).  WAF can mitigate application layer DDoS attacks.  WAF’s Web ACL has two types of rules – regular and rate-based.  You can’t do rate limit in the regular rule (but can add cond...
Post a Comment
Read more

How to renew AWS SSO temporary credentials through CLI?

Run the following commands (from Ubuntu): 1. Add the following in ~/.aws/config file: [profile sso] sso_start_url = <SSO-Start-URL> sso_region = <AWS-Region> sso_account_id = <12-digit-AWS-Account-Number> sso_role_name = <SSO-Role-Name> 2. Run the following command: aws sso login --profile sso 3. You will be redirected to the browser --> Login --> Allow --> Close the browser 4. Install aws-sso-creds : brew tap jaxxstorm/tap brew install aws-sso-creds 5. Run the following command: eval $(aws-sso-creds export --profile sso) 6. Check the current profile: aws sts get-caller-identity .
Post a Comment
Read more

How to connect to EC2 instance (without private key) using SSM Session Manager?

Run the following AWS CLI commands: $ aws ec2 run-instances --image-id <Id-of-AMI-with-SSM-Agent-pre-installed> --subnet-id <subnet-id> --instance-type <instance-type> --associate-public-ip-address $ aws iam create-role --role-name <role-name> --assume-role-policy-document '{"Version":"2012-10-17","Statement":{"Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"},"Action":"sts:AssumeRole"}}' Note: The command above has inline JSON. Run such commands only from bash (not from cmd/powershell). $ aws iam attach-role-policy --role-name <role-name> --policy-arn <ARN-of-AmazonSSMManagedInstanceCore-Policy> $ aws iam create-instance-profile --instance-profile-name <instance-profile-name> $ aws iam add-role-to-instance-profile --role-name <role-name> --instance-profile-name <instance-profile-name> $ aws ec2 associate-iam-instanc...
Post a Comment
Read more

Think of these AWS services when you hear these terms

Terms - Services No duplicates - SQS FIFO / Simple WorkFlow (SWF) / Kinesis Data Streams At least once delivery - SQS Standard Exactly once processing - SQS FIFO Instance level firewall - Security Group Subnet level firewall - NACL Infrastructure provisioning - CloudFormation Real-time guidance to resouce provisioning - AWS Trusted Advisor Recommendations for cost optimization / security / fault tolerance / performance / service limits - AWS Trusted Advisor View & analyze costs/usage - AWS Cost Explorer Automated security assessment service - Amazon Inspector Improve security & compliance of applications -  Amazon Inspector Automatically assess applications for exposure, vulnerabilities and deviations from best practices -  Amazon Inspector Set custom budget alerts / reservation utilization / coverage targets / receive alerts - AWS Budgets Integrate LDAP Directory Service to IAM - SAML / STS / Custom identity broker Record of S3 actions - CloudTrail logs IT audits and ...
Post a Comment
Read more

AWS RDS IAM DB Authentication

Create AWS RDS MySQL DB: aws rds create-db-instance \ --db-instance-identifier test-mysql-instance \ --db-instance-class db.t3.micro \ --engine mysql \ --master-username admin \ --master-user-password secret99 \ --allocated-storage 20 \ --enable-iam-database-authentication Create user in DB as follows: CREATE USER jane_doe IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS'; Connect to MySQL DB using IAM DB Authentication: RDSHOST="test-mysql-instance.abcdef123456.us-west-2.rds.amazonaws.com" TOKEN="$(aws rds generate-db-auth-token --hostname $RDSHOST --port 3306 --region us-west-2 --username jane_doe )" mysql --host=$RDSHOST --port=3306 --ssl-ca=[file_path]/global-bundle.pem --enable-cleartext-plugin --user=jane_doe --password=$TOKEN Link to download certificate: https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem N...
Post a Comment
Read more