avoidik

About

AWS provides a mechanism for temporarily assuming another role within their API system. While it is not a technically hard process it can be convoluted and hard to understand. This document aims to both make it easier to follow along with as well as give an in depth explanation of some of the underpinnings of the Bourne Again Shell (aka BASH) which can make this easier to utilize on a day to day basis.

Explanation

Below is an overexplained version of the following process:

1. Using credentials stored in ~/.aws/credentials as a "profile" which are then understood by the AWS command line tools
2. Using those AWS credentials, temporarily assume a role using the AWS Security Token Service (STS) to get temporary

avoidik

A Walk through of Key Rotation of a HashiCorp VAULT cluster using AWS KMS to AutoUnseal

PGP (Keybase) is used to encrypt the recovery keys

Built base environment using HashiCorp's Learn Website

ubuntu@ip-192-168-100-194:~$ export VAULT_ADDR=http://127.0.0.1:8200

ubuntu@ip-192-168-100-194:~$ vault status

avoidik

#!/usr/bin/env bash

function walk() {
  for secret in $(vault list $1 | tail -n +3)
  do
    if [[ ${secret} == *"/" ]] ; then
      walk "${1}${secret}"
    else
      echo "${1}${secret}"
    fi

avoidik

using System;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using Fiddler;

[assembly: Fiddler.RequiredVersion("2.5.0.0")]
namespace ClientCertPicker
{
    public class ClientCertPicker: IFiddlerExtension
    {

avoidik

Rationale

This snippet is a sample showing how to implement CloudWatch Logs streaming to ElasticSearch using terraform. I wrote this gist because I didn't found a clear, end-to-end example on how to achieve this task. In particular, I understood the resource "aws_lambda_permission" "cloudwatch_allow" part by reading a couple of bug reports plus this stackoverflow post.

The js file is actually the Lambda function automatically created by AWS when creating this pipeline through the web console. I only added a endpoint variable handling so it is configurable from terraform.

avoidik

AWS EC2 Memory and Disk monitoring/alert

AWS kind of sucks when it comes to monitoring Memory and Disk usage on EC2, as in they don't provide it out of the box. AWS instead gives you a set of perl scripts to do this via CloudWatch custom metrics.

Details are here:

Monitoring Memory and Disk Metrics for Amazon EC2 Linux Instances

The following is the actual steps used to get Disk/Memory stats into CloudWatch

avoidik

# Create an IAM role
aws iam create-role --role-name Laravel-EC2-Role \
  --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Sid":"","Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"},"Action":"sts:AssumeRole"}]}'

# Add an IAM policy granting access to CloudWatch
aws iam put-role-policy --role-name Laravel-EC2-Role --policy-name Laravel-CloudWatch-EC2-Permissions \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["logs:CreateLogStream","cloudwatch:PutMetricData","ec2:DescribeTags","logs:DescribeLogStreams","logs:CreateLogGroup","logs:PutLogEvents","ssm:GetParameter"],"Resource":"*"}]}'

# Add an IAM policy granting access to your S3 bucket
aws iam put-role-policy --role-name Laravel-EC2-Role --policy-name Laravel-S3-EC2-Permissions \

avoidik

This gist will drive you through creating a Docker 1.12 Swarm cluster (with Swarm mode) on AWS infrastructure.

Prerequisites

You need a few things already prepared in order to get started. You need at least Docker 1.12 set up. I was using the stable version of Docker for mac for preparing this guide.

$ docker --version
Docker version 1.12.0, build 8eab29e

You also need Docker machine installed.

avoidik

import ssl
from requests.adapters import HTTPAdapter

CFG_FILE = '<path_to_cfg>'
secure_hosts = [
  'https://<host>'
]

class SSLAdapter(HTTPAdapter):
    def __init__(self, certfile, keyfile, password=None, *args, **kwargs):

avoidik

import contextlib
import OpenSSL.crypto
import os
import requests
import ssl
import tempfile

@contextlib.contextmanager
def pfx_to_pem(pfx_path, pfx_password):
    ''' Decrypts the .pfx file to be used with requests. '''