caffeinetiger

Updating TLS Settings for AWS Classic Load Balancers

This is a simple how-to on updating an AWS Classic Load Balancer with a specific TLS Negotiaion Policy. Just read the script to see how the update works.

To get a list of available predefined policies that are available execute

aws elb describe-load-balancer-policies --query 'PolicyDescriptions[?PolicyTypeName==`SSLNegotiationPolicyType`].{PolicyName:PolicyName}' --output table

caffeinetiger

FROM amazonlinux:2.0.20210219.0

ARG PYTHON_VERSION=3.8.5
ARG BOTO3_VERSION=1.17.38
ARG BOTOCORE_VERSION=1.20.38
ARG APPUSER=app

RUN yum -y update &&\
    yum install -y shadow-utils findutils gcc sqlite-devel zlib-devel wget tar.x86_64 gzip make unzip \
                   bzip2-devel openssl-devel readline-devel libffi-devel && \

caffeinetiger

#!/bin/bash

function exit_if_command_not_installed() {
    local some_command_to_check=$1
    if ! command -v $some_command_to_check &> /dev/null
    then
        echo "$some_command_to_check could not be found"
        exit
    fi
}

caffeinetiger

#!/bin/bash 

exit_on_error() {
    exit_code=$1
    last_command=${@:2}
    if [ $exit_code -ne 0 ]; then
        >&2 echo "\"${last_command}\" command failed with exit code ${exit_code}."
        exit $exit_code
    fi
}

caffeinetiger

#See https://aka.ms/containerfastmode to understand how Visual Studio uses this Dockerfile to build your images for faster debugging.

#Depending on the operating system of the host machines(s) that will build or run the containers, the image specified in the FROM statement may need to be changed.
#For more information, please see https://aka.ms/containercompat

FROM mcr.microsoft.com/dotnet/aspnet:3.1-alpine AS base
WORKDIR /app
EXPOSE 80
EXPOSE 443

caffeinetiger

Install-Module -Name AWS.Tools.AccessAnalyzer -Confirm:$false
Install-Module -Name AWS.Tools.Account -Confirm:$false
Install-Module -Name AWS.Tools.ACMPCA -Confirm:$false
Install-Module -Name AWS.Tools.AlexaForBusiness -Confirm:$false
Install-Module -Name AWS.Tools.Amplify -Confirm:$false
Install-Module -Name AWS.Tools.AmplifyBackend -Confirm:$false
Install-Module -Name AWS.Tools.AmplifyUIBuilder -Confirm:$false
Install-Module -Name AWS.Tools.APIGateway -Confirm:$false
Install-Module -Name AWS.Tools.ApiGatewayManagementApi -Confirm:$false
Install-Module -Name AWS.Tools.ApiGatewayV2 -Confirm:$false

caffeinetiger

#!/bin/bash

(
  set -x; cd "$(mktemp -d)" &&
  OS="$(uname | tr '[:upper:]' '[:lower:]')" &&
  ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/')" &&
  KREW="krew-${OS}_${ARCH}" &&
  curl -fsSLO "https://github.com/kubernetes-sigs/krew/releases/latest/download/${KREW}.tar.gz" &&
  tar zxvf "${KREW}.tar.gz" &&
  ./"${KREW}" install krew

caffeinetiger

# Replace string with the Device Instance Path of your choice
pnputil /disable-device "PCI\VEN_10DE&DEV_1FBC&SUBSYS_0A691028&REV_A1\4&30232E66&0&0008"

caffeinetiger

Application Load Balancer Access Log Headers
type time elb client:port target:port request_processing_time target_processing_time response_processing_time elb_status_code target_status_code received_bytes sent_bytes "request" "user_agent" ssl_cipher ssl_protocol target_group_arn "trace_id" "domain_name" "chosen_cert_arn" matched_rule_priority request_creation_time "actions_executed" "redirect_url" "error_reason" "target:port_list" "target_status_code_list" "classification" "classification_reason"

Network Load Balancer Access Log Headers

type version time elb listener client:port destination:port connection_time tls_handshake_time received_bytes sent_bytes incoming_tls_alert chosen_cert_arn chosen_cert_serial tls_cipher tls_protocol_version tls_named_group domain_name alpn_fe_protocol alpn_be_protocol alpn_client_preference_list


Classic Load Balancer Access Log Headers

caffeinetiger

select AURORA_VERSION();
select @@aurora_version;
show variables like '%version';