New answers tagged amazon-web-services
2
Your CloudFormation template currently has the following resources:
A Launch Configuration
An Auto Scaling Group
A Load Balancer
Follow these steps in sequence to attach the auto scaling group to the load balancer:
Add a listener resource to your CloudFormation template, as described here. Set its LoadBalancerArn property to the load balancer's ARN.
Add ...
1
For anyone came here to solve this problem without any workarounds - the solution is simple.
We need to add switch --cache to the kubeconfig for a user used to access a Kubernetes cluster.
users:
- name: <redacted>
user:
exec:
apiVersion: client.authentication.k8s.io/v1alpha1
args:
- token
- --cache
- -i
- prod
...
1
First, @Meir beat me to the punch on awsvpc network mode, so give him a +1 and read his linked document about task networking.
I'm going to expand on that and include an description of how to route to your containers from both a public-facing ALB, as well as from another container.
To simplify things, we're going to pretend we're running on ECS Fargate to ...
2
There are a couple of things that you can rule out, thanks to the testing that you have already done. You know your container port has an active network socket, that is listening for and accepting connections. You also know that your EC2 instance has working networking.
I can think of three obvious problems:
Your host is using local DNS resolution to ...
0
Regardless of instance count, you can publish only the port of publicly available app by adding security rule which will allow external traffic into that port's bound host's port, and for the second one just bridge to the first app
3
Have you tried using awsvpc mode? https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking.html
You can follow this tutorial - https://docs.aws.amazon.com/AmazonECS/latest/userguide/create-public-private-vpc.html
You need a VPC, with at least two subnets, one private and one public. After that the sky is the limit ...
If you need internet ...
3
Yes, Terraform will detect drift in IAM policies.
Here is my starting point, a policy that allows full S3 and SQS access to specific resources.
data "aws_iam_policy_document" "task" {
statement {
effect = "Allow"
actions = ["sqs:*"]
resources = [
aws_sqs_queue.my-queue.arn
]
}
statement {
...
0
It would be better to use the official docs as trusted source :)
AWS Official Docs
0
Create an IAM role in prod with all the permissions you'd like the devs to have.
When you want devs to have prod access, add the sts:AssumeRole permission to their IAM group.
When it's time to revoke access, remove the sts:AssumeRole permission.
More details in my blog article here.
2
Yes, you can start ECS Fargate tasks from Step Functions in the way you've described.
Step Functions allows you to pass Parameters to the underlying service API.
https://docs.aws.amazon.com/step-functions/latest/dg/connect-parameters.html
[sidebar: that doc also specifies how to pass state inputs, which you've stated is a requirement]
For ECS Fargate, a ...
0
How are you trying to connect to the remote service? - IP address, default internal/external DNS name or custom DNS name private/public hosted zone?
Please compare the output of nslookup to the remote service in both the VPCs. If the IPs resolving are different, the traffic is trying to go through the public internet and not the peering connection.
It would ...
0
I faced the same problem while using different SSH key pairs for different deployment environment. Usually I used to create different ssm variables per environment and then changed the name of ssm per git branch in buildspec.yml. That worked perfectly for me. For example, for deploying to stage environment i used the git branch "dev" which had ...
1
If I'm getting this right; Maybe you can just create on your old account's Route53 public hosted zone a CNAME record (if you have a load balancer on your new account) or an A record for the instance on your new account. Just don't use the Alias functionality from Route53 as you wont find the resources from the new account.
Top 50 recent answers are included
