AWS Notes

​​🆕 Amazon EC2 M7a instances, powered by 4th generation AMD EPYC processors, deliver up to 50% higher performance compared to M6a instances:

https://aws.amazon.com/ec2/instance-types/m7a/

▫️ 4th Gen AMD EPYC™ 9004 Genoa
▫️ 96 CPU Cores / 192 Threads
▫️ Base Freq 2.4GHz / Boost Up to 3.7GHz
▫️ DDR5 4800
▫️ L3 Cache 384MB
▪️ AVX3-512
▪️ BFloat16 

#EC2 #AMD

Главный спонсор сегодняшнего выпуска:

https://aws.amazon.com/solutions/implementations/multi-region-application-architecture

Increased Error Rates and Latencies

Jun 13 1:38 PM PDT We are beginning to see an improvement in the Lambda function error rates. We are continuing to work towards full recovery.

Jun 13 1:14 PM PDT We are continuing to work to resolve the error rates invoking Lambda functions. We're also observing elevated errors obtaining temporary credentials from the AWS Security Token Service, and are working in parallel to resolve these errors.

Jun 13 12:36 PM PDT We are continuing to experience increased error rates and latencies for multiple AWS Services in the US-EAST-1 Region. We have identified the root cause as an issue with AWS Lambda, and are actively working toward resolution. For customers attempting to access the AWS Management Console, we recommend using a region-specific endpoint (such as: https://us-west-2.console.aws.amazon.com). We are actively working on full mitigation and will continue to provide regular updates.

Jun 13 12:26 PM PDT We have identified the root cause of the elevated errors invoking AWS Lambda functions, and are actively working to resolve this issue.

Jun 13 12:19 PM PDT AWS Lambda function invocation is experiencing elevated error rates. We are working to identify the root cause of this issue.

Jun 13 12:08 PM PDT We are investigating increased error rates and latencies in the US-EAST-1 Region.

Degradation (4 services)
AWS CloudFormation
AWS Lambda
Amazon API Gateway
Amazon Connect

Total affected services: 72

AWS outage in progress...

​​The world's most advanced cloud security conference — fwd:cloudsec 2023

Day 1
• https://www.youtube.com/watch?v=JCphc30kFSw
• https://www.youtube.com/watch?v=up4nfzeXYlU
Day 2
• https://www.youtube.com/watch?v=ZvdYgL6b9xE
• https://www.youtube.com/watch?v=B3t-mUU_fRU

#security #video

🏆 В чемпионате по исправлению старых багов был повержен рекорд ECS по удалению ECS Task Definitions (8 лет и 3 месяца). Новый чемпион — Config и исключение записываемых ресурсов:

https://aws.amazon.com/about-aws/whats-new/2023/06/aws-config-recording-exclusions-resource-type/

Итого: 8 лет и 7 месяцев, ура! 🎉

#Config

​​⚒️ lambda-debug is a tool that enables you to invoke Lambda functions in the cloud from any event source and intercept the requests with breakpoints locally.

https://github.com/ljacobsson/lambda-debug

🏠 Local debugging: Set breakpoints in your code and step through your functions invocations locally on native events triggered in the cloud.
👍 No code changes: No need to modify your code to enable debugging. Just add some dev dependencies and some configuration.
🔐 Same IAM permissions: Your functions will run with the same IAM permissions as they do in the cloud.
⚡ Fast iterations: No need to deploy your code to the cloud to test changes. Just save your code and invoke your functions in the cloud.

#Lambda

↑↑↑ Опрос ↑↑↑ возник на фоне обсуждение статьи https://leanercloud.beehiiv.com/p/recommended-ecs-instead-kubernetes-latest-customer на Reddit — интересно узнать разброс мнений.

☁️. Issue #75 – 11 June 2023

🟠 Athena for Apache Spark
     ▫️ Apache Hudi, Apache Iceberg, and Delta Lake
     ▫️ custom Java libraries
🟠 Billing and Cost Management scripts to bulk updates policies | scripts
🟠 CloudFormation StackSets
     ▫️ programmatic trust access with AWS Organizations
     ▫️ skips suspended accounts
🟠 CloudTrail Lake selective start or stop ingestion of CloudTrail events
🟠 CloudWatch Logs
     ▫️ data protection account level policy configuration
     ▫️ Live Tail
🟠 Config
     ▫️ advanced queries support +30 resource types
     ▫️ recording exclusions by resource type
🟠 Connect Customer Profiles  exports profile updates in real-time
🟠 Control Tower
     ▫️ account access configuration flexibility
     ▫️ Account Factory Single Region Terraform
🟠 Database Migration Service enhanced homogeneous migration capabilities
🟠 DocumentDB 5.0 t3.medium and r5 instances
🟠 EMEA SARL daily invoice consolidation
🟠 EMR on EKS Spark Operator and spark-submit
🟠 FinSpace Managed kdb Insights | GA
🟠 Glue Data Quality is now generally available
🟠 Glue for Ray is now generally available
🟠 IoT Device Management Software Package Catalog
🟠 Keyspaces (for Apache Cassandra) Multi-Region Replication
🟠 KMS importing asymmetric and HMAC keys
🟠 Lambda
     ▫️ Ruby 3.2 runtime
     ▫️ SnapStart for Java +7 regions
🟠 Lex Test Workbench
🟠 Mainframe Modernization HIPAA eligible
🟠 Managed Microsoft AD simplifies administrative tools access
🟠 Marketplace FedRAMP auth for Vendor Insights security profiles
🟠 Migration Hub Refactor Spaces flexibility routing with path parameters
🟠 MWAA in-place version upgrades
🟠 Polly +female NTTS voice in Belgian Dutch (Flemish)
🟠 QuickSight
     ▫️ APIs to automate and accelerate assets deployment
     ▫️ geospatial heatmap for points on maps
     ▫️ standardized user level cost and usage data
🟠 RDS Custom for SQL Server Bring Your Own Media
🟠 RDS for Oracle April 2023 Release Update for 21c
🟠 Redshift Serverless query scheduling and SSO
🟠 SageMaker Automatic Model Tuning automatically chooses tuning configs
🟠 SageMaker Canvas retraining ML models, automating prediction workflows
🟠 SageMaker JumpStart Falcon 40B model
🟠 SageMaker Pipelines Selective Executions
🟠 SQS dead-letter queue redrive
🟠 Timestream Customer Defined Partition Keys
🟠 Trusted Advisor new checks for EFS
🟠 WAF Header Order match statement for request inspection

📖 Что почитать в дороге?
AWS Prescriptive Guidance — Patterns

50% скидка на Associate экзамены AWS (Architect Associate, Developer Associate, SysOps Administrator Associate)
https://pages.awscloud.com/GLOBAL-ln-GC-Traincert-Associate-Certification-Challenge-Registration-2023.html

🆕 Container Image Signing for ECR with AWS Signer:

https://aws.amazon.com/blogs/containers/announcing-container-image-signing-with-aws-signer-and-amazon-eks/

▫️ Using the Notation client with the AWS Signer plugin, you can implement a simple client-based workflow for signing and verifying your container images.
▫️ Using the Kyverno-Notation-AWS Signer solution, you can validate container images in Kubernetes.

#ECR #Signer #EKS

​​AWS & Telegram

Belarus:

@aws_minsk AWS Minsk Community

Kazakhstan:

@aws_kz AWS User Group Kazakhstan Announcements
https://t.me/+olvuuRvutxUwNDAy AWS User group Kazakhstan

Poland:

@aws_polska AWS Polska
@aws_pl AWS Notes Polska

Russia:

@aws_ru ☁️ AWS_RU
@aws_community AWS Community

Ukraine:

@AWS_UG_Ukraine AWS User Group Ukraine
@aws_ua AWS Україна
@aws_ua_notes AWS Notes Україна

Uzbekistan:

@AWSUserGroupTashkent AWS User Group | Tashkent
@AWSUserGroup AWS User Group Tashkent | Chat

General:

@awsamazon (English) AWS User Group ☁️
@awsweekly AWS Weekly
@aws_cdk AWS CDK
@aws_notes_chat AWS Notes chat
@aws_notes AWS Notes

Related to AWS:

@manandthemachine Человек и машина
@cloudandcybersecurity Cloud and Cybersecurity
@webapparch ⌨️ From Finance to SDE at Amazon

All AWS channels:
🔹 https://t.me/addlist/BBAsMb5MiYZmYWRi

All AWS chats:
🔸 https://t.me/addlist/DtTNUONzpUZjYTEy

#машины_aws

Для CloudFormation был разработан линтер cfn-lint, который на базе разных правил проверял шаблон на вшивость. Одной из моих любимых фишек этого линтера была возможность написать свое правило на том же языке, что и сам линтер, т.е. на Python.

А раз для написания правила используется верхнеуровневый язык программирования, то положить в это правило можно буквально все что угодно. Автор помнит времена, когда он злоупотреблял Boto3, чтобы в рамках правила делать вызовы на AWS API и делать более точечные проверки, например, если hardcoded ARN ссылается на существующий ресурс.

У таких свистоплясок есть очевидный недостаток. Например, если линт проходит в рамках CI, то у сборочного агента должен быть доступ в AWS, не говоря уже о том, что мы нагружаем линтер функциональностью, для которой он никогда не предназначался.

И вот я в очередном туре по кишкам CFN, изучая расширения, нашел расширение Hooks. Hooks проверяют разные типы ресурсов на соответствие определенным правилам, но в этот раз правила проверяются на стороне самого CloudFormation. Может показаться, что это бесполезное дело, ресурс дешевле проверить до развертывания, а не во время развертывания.

С другой стороны можно застраховаться от тех, кто катит CFN вручную и не применяет линтер, или если приходящие изменения в вашу инфраструктуру не под вашим контролем. Hooks это такой способ защититься от неприемлемых изменений, поскольку они не допускают абьюза со стороны ленивых девопсов.

Но для этого нужно побороть сначала свою лень и написать много правил на все случаи жизни. 🙂

​​⚠️ Attention — EKS 1.22 support ended on June 4.

https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html#kubernetes-release-calendar

EKS 1.23 will end support on October 11, 2023 — worth thinking about upgrading.

#EKS

Sensitive IAM Actions

https://github.com/primeharbor/sensitive_iam_actions

This repo contains a list of IAM Actions that fall into one of four risk categories:

• Credential Exposure
• Data Access
• Privilege Escalation
• Resource Exposure

#IAM #security

☁️ Issue #74 – 4 June 2023

🟠 AppStream 2.0 DCV Extension SDK
🟠 Billing and Cost Management Invoice Summary
🟠 Database Migration Service Serverless general availability
🟠 Detective investigations for new threat detections
🟠 Direct Connect
     ▫️ location in Bogotá, Colombia
     ▫️ location in Inzai, Japan
     ▫️ location in Santiago, Chile
🟠 EC2 IMDS Packet Analyzer simplifies migration to IMDSv2
🟠 ECR pull through cache for registry.k8s.io as upstream
🟠 Elemental MediaTailor delivery of client-side overlay ads
🟠 EventBridge open-source connector for Kafka Connect
🟠 Fault Injection Simulator new actions for EKS and ECS
🟠 Fraud Detector Event Orchestration with EventBridge
🟠 HealthLake interoperability-related ONC and CMS patient access rules
🟠 Interactive Video Service advanced channel types for flexible input encoding
🟠 IoT FleetWise S3 support
🟠 Lambda Kafka and Amazon MQ event sources in four additional regions
🟠 Managed Grafana is now System and Organization Controls (SOC) compliant
🟠 Marketplace Management Portal fine-grained seller permissions access
🟠 Personalize now offers more flexibility in model training
🟠 Polly +2 female NTTS voices in Irish English and Danish
🟠 Pricing Calculator visibility of point in time cost estimations
🟠 RDS for MySQL Optimized Reads on Multi-AZ with 2 readable standby-s
🟠 RDS for Oracle converting instances to CDB architecture
🟠 RDS for PostgreSQL HypoPG for creating hypothetical indexes
🟠 Route 53 GuardDuty threat intelligence
🟠 SageMaker Ground Truth Plus human feedback and fine-tuning data for Generative AI
🟠 Security Lake is now generally available
🟠 Service Catalog wildcards in IAM principal name associations
🟠 Shield Advanced CloudFormation support
🟠 Snow Family quickens multi-PB data migration with new 210TB device
🟠 SNS X-Ray active tracing for FIFO topics
🟠 VPC IP Address Manager customizable dashboard with new insights
🟠 WorkSpaces NICE DCV Extension SDK

​​📙 AWS Lambda Container Architecture

https://arxiv.org/pdf/2305.13162.pdf

#Lambda