filipeandre

import boto3
from os import getenv
from json import loads

# AutoScalingGroups Region
REGION = getenv("REGION", "us-east-1")
# Name of On-Demand failover AutoScalingGroup
ON_DEMAND_ASG = getenv("ON_DEMAND_ASG", None)
# Name of Spot AutoScalingGroup
SPOT_ASG = getenv("SPOT_ASG", None)

filipeandre

# Enable autoscaling for the service
ScalableTarget:
  Type: AWS::ApplicationAutoScaling::ScalableTarget
  DependsOn: Service
  Properties:
    ServiceNamespace: 'ecs'
    ScalableDimension: 'ecs:service:DesiredCount'
    ResourceId:
      Fn::Join:
        - '/'

filipeandre

^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\.[0-9]+)?(([Zz])|([\+|\-]([01][0-9]|2[0-3]):[0-5][0-9]))$

filipeandre

# Systems Manager
aws ssm describe-instance-information  --query "InstanceInformationList[*]"
aws ssm get-document --name "AmazonInspector-ManageAWSAgent" --output text > AmazonInspector-ManageAWSAgent.doc
less AmazonInspector-ManageAWSAgent.doc
aws ssm send-command --targets Key=tag:SecurityScan,Values=true --document-name "AmazonInspector-ManageAWSAgent" --query Command.CommandId --output-s3-bucket-name <LoggingBucket>
aws ssm list-command-invocations --details --query "CommandInvocations[*].[InstanceId,DocumentName,Status]" --command-id <CommandId>

# Inspector
aws inspector create-resource-group --resource-group-tags key=SecurityScan,value=true
aws inspector create-assessment-target --assessment-target-name GamesDevTargetGroup --resource-group-arn aws inspector create-assessment-target --assessment-target-name GamesDevTargetGroup --resource-group-arn <ResourceGroupARN>

filipeandre

# How to encrypt/decrypt your text/blob secret with AWS KMS with AWS cli

KEY_ID=alias/my-key
SECRET_BLOB_PATH=fileb://my-secret-blob
SECRET_TEXT="my secret text"

ENCRYPTED_SECRET_AS_BLOB=encrypted_secret_blob
DECRYPTED_SECRET_AS_BLOB=decrypted_secret_blob  # Result of decrypt-blob target

encrypt-text:

filipeandre

admin:
  access_log_path: /tmp/admin_access.log
  address:
    socket_address:
      protocol: TCP
      address: 0.0.0.0
      port_value: 9901
static_resources:
  listeners:
  - name: tcp_listener

filipeandre

static_resources:
  listeners:
  - address:
      socket_address:
        address: 0.0.0.0
        port_value: 80
    filter_chains:
    - filters:
      - name: envoy.tcp_proxy
        config:

filipeandre

import boto3
import botocore
import time


def handler(event=None, context=None):
    client = boto3.client('ssm')

    instance_id = 'i-07362a00952fca213' # hard-code for example
    response = client.send_command(

filipeandre

# coding:utf-8
import boto3
import logging

logging.basicConfig(
    format='%(levelname)s %(asctime)s\n%(message)s',
    datefmt='%Y-%m-%d %H:%M:%S',
    filename='./clean_security_groups.log',
    level=logging.INFO,
    filemode='a'

filipeandre

#!/usr/bin/env python

import boto3, argparse, sys, time

parser = argparse.ArgumentParser(description="Remove default VPC in specified account and region")
parser.add_argument('--account', 
  type=str )
parser.add_argument('--region', 
  type=str )
parser.add_argument('--role',