tkuchiki

CloudFront の Origin Custom Headers に秘密の鍵を設定する
- X-Pre-Shared-Key : aen1caixahCha4Eb1aeKohpeeshii7quaiz7eT9Aequae3hophah0uh3lecoquoo みたいな
Nginx に以下の設定を入れる

        location / {
            if ($http_x_pre_shared_key = "aen1caixahCha4Eb1aeKohpeeshii7quaiz7eT9Aequae3hophah0uh3lecoquoo") {
                return 200 "OK";
            }
 return 403;

CloudFront の IP レンジを出力

$ curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | jq '.prefixes[]|select(.service == "CLOUDFRONT").ip_prefix'
"13.32.0.0/15"
"13.54.63.128/26"
"13.59.250.0/26"
"34.195.252.0/24"
"35.162.63.192/26"
"35.167.191.128/26"

http://localhost:9292 は sleep 10 しているので 10秒経たないとレスポンスを返さないとする。

$ time go run main.go
done
requested

real    0m1.319s
user    0m1.270s
sys 0m0.113s

KMS について

参考: 10分でわかる！Key Management Serviceの仕組み

KMS の使い方メモ

KMS の CMK(Customer Master Key) を作る
- terraform だと aws_kms_key と aws_kms_alias
KMS の alias も作っておく

Nameタグが test- で始まりステータスが running のインスタンスを出力する

$ aws ec2 describe-instances --filters "Name=instance-state-code,Values=16" "Name=tag:Name,Values=test-*" | less | jq .Reservatio
ns[].Instances[]
{
  "Monitoring": {
...
}

$ cat /tmp/testdir/test.php
<?php
foo
if ($foo === null) {
    return null;
}

bar
$ find /tmp/testdir/ -name '*.php' -type f -print0 | xargs -0 sed -i -e '/foo === null/,+2d'

	FROM ubuntu:16.04

	RUN apt-get install -y g++ libboost-all-dev libtool make pkg-config libmysqlclient-dev libssl-dev git dh-autoreconf bison flex ragel pandoc
	RUN git clone https://github.com/PowerDNS/pdns /usr/local/src/pdns

	WORDFIR /usr/local/src/pdns
	RUN ./bootstrap
	RUN ./configure
	RUN make
	RUN make install

	#!/bin/bash

	set -ue

	SG_ID=${1}

	old_ips=$(aws ec2 describe-security-groups --group-ids ${SG_ID} \| jq '.SecurityGroups[].IpPermissions[].IpRanges[]' \| jq -sSc .)
	ips=$(curl -s http://d7uri8nf7uskq.cloudfront.net/tools/list-cloudfront-ips)
	new_ips=$((echo $ips \| jq '.CLOUDFRONT_GLOBAL_IP_LIST[] \| { CidrIp: . }'; echo $ips \| jq '.CLOUDFRONT_REGIONAL_EDGE_IP_LIST[] \| { CidrIp: . }' ) \| jq -Ssc .)
	json=$(cat <<EOC

	AWSTemplateFormatVersion: '2010-09-09'
	Description:
	VPC & subnet create
	Parameters:
	EnvType:
	Description: Environment type.
	Type: String
	Default: test
	ProjectName:
	Description: Project name.

	variable "foo" {
	type = "string"
	default = "baz"
	}

	data "external" "example" {
	program = ["bash", "test.sh"]

	query = {
	foo = "${var.foo}"