Max Williams

So apparently if someone knows / guesses the name of your S3 bucket - even if it's private (!) - they can just bankrupt you by sending infinite PUT requests and there is nothing you can do about it. > requests get rejected > but AWS still counts it as a write operation against your account for which you have to pay at a rate of $0.005 per 1000 requests This seems insane to me. Especially because a lot of services rely on presigned URLs for uploads / downloads which exposes your bucket name to the client. In this case the author got their bill waved, but AWS support made it clear it's an exception not the rule. https://lnkd.in/dR9_duy8 #aws #s3 #medium #bankrupt

6

1 Kommentar

How did it go when you switched from cloud to on prem, reduced cloud bill by 50% but increased engineering team costs by 200%? Not to mention the new range of potential incidents you're now exposed to. #onprem #cloud #aws #azure

46

14 Kommentare

How about some Technical Reading for a Monday afternoon? Our CTO James Ridgway recently wrote an interesting piece around AWS Lambda and a common problem known as "a cold start" - the initial delay experienced when invoking a serverless function for the first time. Learn more about the Cold Start problem and how you can avoid it impacting your cloud system and serverless functions in the blog here - https://lnkd.in/ekVeucNZ #AWS #TechnicalGuides #Cloud

6

Kubernetes overview and uses published on the Cohezion blog. It love to hear your feedback or experience if you have been using K8 #cloudnative #kubernetes #k8 #devops

2

Having a hard time allocating costs in your k8s clusters? 🌟 AWS just launched AWS Split Cost Allocation for Amazon EKS! 🚀 Key Features: - Detailed Cost Tracking: Granular visibility into EC2 CPU and memory usage by Kubernetes pods. - Cost Aggregation: Aggregate costs by cluster, namespace, and other Kubernetes primitives for precise allocation to business units or teams. - Optimization Opportunities: Pinpoint and reduce underutilized resources. - Effective Chargeback: Allocate costs accurately across business units or teams. 🔧 How to Enable: 1. Opt-in via AWS Billing and Cost Management preferences. 2. Configure your AWS Cost and Usage Reports (CUR) to include the new data. 3. Data is available within 24 hours post-activation. 📢 Also Boost Your ECS Insights: AWS Split Cost Allocation Data is not just for Kubernetes. You get the same detailed cost management for Amazon ECS tasks using both EC2 and Fargate launch types. 🔗 https://lnkd.in/etMWx5qH #AWS #CostOptimization #CloudSavings

7

How does kubelet fetch images from private ECR repos on EKS (v1.26+)? Can we stop for a second to appreciate how come we don't specify any credentials/secrets (imagePullSecrets) whatsoever and yet we can launch Pods in our EKS cluster without any problems? how does this magic work? Let's break it down. kubelet doesn't know at the time of compilation on which cluster it is provisioned, so just like the old adage from David A. Wheeler, it shells it to an external plugin. The kubelet credential provider plugin has become GA in Kubernetes v1.26. And to validate what I just said, if you poke at how kubelet is launched on EKS worker nodes, you will see 2 interesting parameters: --image-credential-provider-config /etc/eks/image-credential-provider/config.json --image-credential-provider-bin-dir /etc/eks/image-credential-provider But that's just only half of the story. So how does the EKS credential provider securely fetch the credentials? Let's see how it works end to end: 1. When a Pod is scheduled to run on a Pod, kubelet looks for a matching credentials helper 2. A match is found and kubelet executes the ECR credentials helper 3. The ecr-credential-provider uses the AWS SDK (aws-sdk-go, under the hood) to obtain AWS auth token, which in turn contacts the link-local IMDSv2 to actually obtain that token 4. It uses the obtained AWS token to obtain yet another auth token from ECR using GetAuthorizationToken 5. It returns a CredentialProviderResponse JSON (on stdout) to kubelet with a Username and Password 6. The kubelet uses the credentials from the CredentialProviderResponse document and passes it to its registry client 7. The image is fetched to the node To me it's mind boggling how so many moving pieces are perfectly orchestrated together at a stroke of a pen (with either eksctl or CF or TF). In the next post we'll break down how similarly Pods and workload identities work in concert to access container registries without requiring any secrets whatsoever. Resources: https://lnkd.in/du7Ks--q https://lnkd.in/dhZgZGz4 #eks #cloudsecurity #kubernetes #kubernetessecurity #cloudnativesecurity #sigauth

33

2 Kommentare

I have a story for you today. ⚡ Imagine someone accidentally setting a bucket policy on S3 to S3:* deny without specifying conditions. You can't do much with that bucket through the AWS console. The same applies to CLI and SDK. And it's the worst-case scenario if you don't have any backups - because, someone treated it as a "nice-to-have." 😅 I hope none of you have experienced this mishap! 😨 I almost did it once one time during a PoC by hand in AWS console. But thankfully, I left myself VPC access. So, I simply spun up an EC2 instance and changed the policy using AWS CLI. But what if you completely lock yourself out? 🔒 Here's a tip: 💡 use your root account to delete bucket policy. Even if you have an account within an organization, a root account gets created in the background when setting up the organizational account. This is why providing an email address at the account creation stage is mandatory. Just reset the root account password to log in and gain access to the root account of your organization's sub-account. ⚠ Be careful and remember to use your root account only when necessary, and enable two-factor authentication for it. Image generated by Dalle

9

Happy Saturday, good people! ☀ I hope all is well. I went out for my usual Saturday morning run and came back to tackle this project. This one in particular was fun because I'm addressing an issue that I personally dealt with. It gave me a chance to work with more on-prem services. Because I'm well versed in dealing with everything in the cloud, especially virtual machines such as EC2 instances, I have an appreciation for the growth and learning that took place debugging this 502 Gateway error. It took me a couple of days to come to a solution, but it was a great learning experience all the way through. Knowing how to ensure 24/7 application availability using Task Scheduler is significant because it directly impacts the reliability and uptime of critical applications. By automating the startup process, we can prevent downtime caused by terminal closures and ensure continuous operation. S.N: It's a major confidence boost when you come into a new role and resolve tickets, no matter how minute they may seem. Each resolution, whether pertaining to an outstanding issue or a quick fix, serves as further confirmation that you belong and you are great at what you do! Here's to more progress and challenging that comfort zone! #techtalk #cloud #devops #devopsengineer #onprem #cloudengineer #devopsengineer #medium

7

Terraform with AWS CodeCatalyst reminds me of the way I've used Azure DevOps in the past. Looks like something cool to try. https://lnkd.in/eyA8z_9K

1

Create and manage datasets and monitors in Axiom programmatically, without the need to know where to click manually in the UI, with Axiom's new Terraform Provider. Learn how you can provision and manage Axiom resources — datasets, notifiers, monitors, and users—with Terraform: https://axi.sh/3JIxi2U

17

Check out Infostrux Engineering latest blog post https://lnkd.in/gT63tydN, where Balkaran Brar covers a Layered Terraform Architecture. Our Engineering team continues to publish weekly articles in our engineering blog around many different topics, including Data Engineering and Platform Engineering, and Snowflake #terraform #infostrux #cloudarchitecture #snowflake

13

AWS Lambda is an almost instinctual choice when it comes to building on AWS Cloud (and why not? It's awesome!). But are Lambda functions - and the custom libraries and code that comes with them - always the right choice? Particularly for gluing components together? I spend some time exploring the potential of working with native AWS services to produce an event-driven solution with no Lambda or custom code in sight. #aws #eventbridge #software #architecture #serverless

38

6 Kommentare

Kubernetes has completed its largest code cleanup to date, removing over 1 million lines of Cloud Provider code! 🎉 The new PR is part of KEP-2395 which has been in-the-works since 2017. Congratulations to everyone who worked on this important project! The removal of Cloud Provider code is part of a series of efforts to move vendor-specific code “out-of-tree,” meaning those features won’t come with Kubernetes out-of-the-box. The functionality may continue to be available via optional controllers. The team did a session about the change at KubeCon EU 2024: Additional resources about this exciting change include: KEP-2395: https://lnkd.in/gFgRUZhx The PR itself: https://lnkd.in/gU7ZcTxN Blog from 2019 about the reasoning behind the change: https://lnkd.in/gpZpcKQd Blog about setting cloud provider code to disabled by default in v1.29: https://lnkd.in/dShqgYG3 The March 2024 Spotlight blog on SIG Cloud Provider: https://lnkd.in/gqXze2jK

142

1 Kommentar

For those of you new to Terraform, check out this video from my colleague Sarah Lean. It’s a good place to start for an aspiring Azure Terraformer!!! 😊 https://lnkd.in/eTaZF738

36

This looks like a nice new rollback feature for AWS CodePipelines. I really need to make some time and work with the V2 CodePipelines. https://lnkd.in/e9f9akjp #aws #codepipeline #cicd #devops #gitops

2

What happens when timeouts and performance issues creep in after migrating applications from VMs to Kubernetes? Our tech team encountered a similar issue that affected application performance to a great extent. While we were able to restore the application's performance to VM levels, our team followed a strategic approach to identify culprits to fix the issue. Check out our latest blog post to know more about the troubleshooting steps and key takeaways to ensure a smooth transition. https://lnkd.in/gD-dXPi6  ---------- Shankar Prasad Jha Sandeep Rawat Arpit Jain Yogesh Batish RAJAT VATS Alok Upadhyay Abhishek Dubey Ashwani Singh Sandeep Mahto Sajal Jain ------------- #blogpost #techforgood #techies #techblog #blogger #techcommunity #engineersoutthere #engineeringteams

19