Hot answers tagged

14

Resolution 1 So I solved this with the following script. I originally posted the question just in case there was an easier way that I was not aware of. #!/bin/bash aws_profile=('profile1' 'profile2' 'profile3'); #loop AWS profiles for i in "${aws_profile[@]}"; do echo "${i}" buckets=($(aws --profile "${i}" --region your_region s3 ls s3:// --recursive |...


13

To run ipconfig from the AWS Systems Manager Run Command: $ aws ssm send-command --document-name "AWS-RunPowerShellScript" --instance-ids "<your instance id>" --parameters commands=ipconfig Note: If you've got the error, consider specifying the right --region. This assumes you have your AWS credentials and CLI configured properly. See Systems ...


8

Environment variables are defined inside the container and some are passed in the task definition. So you can use describe-task-definition to see the extra variables. To get the default environment of the container image, you can register-task-definition for task with command 'env' and the specific container image for which you want to find out and then run-...


7

That's on my backlog but still on early stage, I just surfaced the idea, so here's are my findings so far: Using Trusted Advisor as a Web Service Mainly: Poll a Trusted Advisor Check for Status Changes This documentation example can be implemented with aws cli with the support subset of commands and targetting the 'us-east-1' region, you'll then have to ...


7

For a given instance, you would first use aws ec2 describe-instances to get the information JSON for your instance. The information also contains the keypair name used to create that instance. E.g. for an instance i-0e2x8xd7xxx (Note: I use the awesome tool jq to do JSON parsing but you can use any other solution) aws ec2 describe-instances --instance-...


5

Amazon CloudTrail tracks all API use In CloudTrail create a new trail You can configure each trail to send log events to CloudWatch: Edit the trail and choose to send Logs to CloudWatch. It will offer you to create a Role for this https://docs.aws.amazon.com/awscloudtrail/latest/userguide/monitor-cloudtrail-log-files-with-cloudwatch-logs.html Then, run ...


4

Based on @Vish answer, I've created the following shell script: #/usr/bin/env bash # Script to show password data of the EC2 instance. [ $# -eq 0 ] && { echo "Usage: $0 instance_id ..."; exit; } keyname=$(aws ec2 describe-instances --query 'Reservations[].Instances[].KeyName' --output text --instance-ids $1) pemfile=$(find ~/.ssh -name "*$keyname*....


4

EBS Snapshots aren't really disk image files. They're logical containers of pointers to chunks of compressed and deduplicated backup data that EBS stores in S3 when you create snapshots -- but these are stored in buckets that EBS owns and controls. They are user-accessible via only one mechanism -- creating a new EBS volume from the snapshot. When you do ...


4

According to this ssm tutorial, SSM send-command output is truncated at 2500 characters. To work around that, you must send your output to an S3 bucket using the --output-s3-bucket-name parameter.


4

Here is a helper Bash script which uses aws ssm send-command to run the commands: #/usr/bin/env bash -x # Script to run PowerShell script on the Windows instance. instanceId="$1" cmdId=$(aws ssm send-command --instance-ids "$instanceId" --document-name "AWS-RunPowerShellScript" --query "Command.CommandId" --output text --parameters commands="'${@:2}'") [ $? ...


4

You can use aws ec2 describe-instances instead, you can specify the id --instance-ids <value> and it will output the security group.


3

Here is something super cool I do with AWS SSM Send-Command! Using Apache Airflow I create a brand new EC2-Instance using a Cloud Formation Template (or CFT for short) that's just a JSON file with all the configuration values for my EC2-Instance that I want; also note that in this CFT I also have a bootstrap command that copies a Python script from an S3 ...


3

Yes, you can do this with AWS Systems manager. AWS Systems Manager Run Command allows you to remotely and securely run set of commands on EC2 as well on-premise server. Below are high-level steps to achieve this. Attach Instance IAM role: The ec2 instance must have IAM role with policy AmazonSSMFullAccess. This role enables the instance to communicate with ...


3

Either use the --query attribute aws rds describe-db-snapshots --query "DBSnapshots[?Encrypted].DBSnapshotIdentifier" If the [?Encrypted] does not work, try [?Encrypted == 'true'] as the first is from JMESPath improved filters. The quotes might need to be backticks in some case. It all depends. Second way: aws rds describe-db-snapshots --output json | jq ...


3

You will need to write a script that parses and queries this data because as far as I'm aware, there is not a tool or cli function that performs this. Luckily, you can gather all of this information with the CLI. List and parse all of the accounts in your org. aws organizations list-accounts For each account, list and parse all of the buckets. aws ...


3

This is possible using AWS SDKs. I was cleaning my tabs after finishing this task and decided I would write an answer to help other people. Versions: aws-cli/2.0.61 go1.15.3 linux/amd64 Let's do this in Golang with the right imports. import ( "fmt" "github.com/aws/aws-sdk-go/aws" "context" "github....


3

Supposing the scenario with two accounts A & B the explanatory steps should be: In account A, I created a role (e.g RoleForB) to trust account B, and attach to the before created role a IAM policy to allow it to perform some read operations in account A. e.g ReadOnlyAccess In account B, I created a role (e.g AssumeRoleInA) and attach a policy to allow ...


3

The best way to have AWS CLI tooling installed to your custom agent is by installing from Visual Studio Marketplace. AWS CLI is part of AWS Tools for Azure DevOps Service and Azure DevOps Server (the on-premise Azure DevOps) under the name of "AWS Tools for Microsoft Visual Studio Team Services". Installing this AWS Tools will enable AWS tooling on CI (...


3

AWS secrets are still accessible via the CLI. The link you provided goes to an old version of the AWS CLI. Check out the latest version and commands here: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/secretsmanager/index.html


2

You're going to have to write a script to do this unless there's a tool to do it that I can't find. If you're working with multiple aws accounts you'll need to be switching between accounts to get the bucket sizes. To get all of the buckets and their total size you can use 'aws s3api'. Using list-buckets you can get all of the buckets in one account and ...


2

Here is what I ended up using. Enjoy. for instance in $instances; do count=`aws ec2 describe-volumes --filters Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[]" | jq -r '. | length';` name=`aws ec2 describe-tags --filters Name=resource-id,Values=$instance Name=key,Values=Name --query Tags[].Value |...


2

The following one-liner in shell works for me: aws ec2 describe-security-groups --group-ids $(aws ec2 describe-instances --instance-id $id --query "Reservations[].Instances[].SecurityGroups[].GroupId[]" --output text) --output text Where $id is my instance-id.


2

Here is a helper Bash script which uses aws ssm send-command with --output-s3-bucket-name parameter to run the command and the result is stored in the S3 bucket, then displayed to the standard output. #/usr/bin/env bash -xe # Script to run PowerShell script on the Windows instance, then uploads the output to S3 bucket. instanceId="$1" bucketName="$2" ...


2

Btw: I managed to fix this problem by using aws-mfa (https://github.com/broamski/aws-mfa), which I have configured to cache my aws credentials for an hour.


2

Indeed, this is a pain. I've been fighting with it for the whole day yesterday, but managed to get it working, let's see if our cases are similar enough. My guess is that the usual aws configure configuration with a MFA ARN + the AWS SDK used to develop kubectl are not entirely compatible: I have two profiles set for this, one that has its mfa_serial_arn ...


2

Have you tried setting the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables? By setting these variables before you run your cli commands, you should not have to run the aws configure command. Environment Variables Environment variables override configuration and credential files and can be useful for scripting or temporarily ...


2

Ok I got the answer after exploring few things and looking at the error more attentively. Here is the way: aws ec2 authorize-security-group-ingress --group-id sg-07xxxx24d --protocol tcp --port 22 --source-group sg-d7dyyyy5


2

There currently is no method using SDKs for the AWS CLI to get the last accessed time of an IAM role. Currently, the only way is to use the AWS Management Console. Select your IAM role and explore it Click the "Access Advisor" tab. The contents of this tab will display the last access time for each of the various services.


2

I've been meaning to come back to this. After consulting with AWS support it would seem that this is possible using some functions of the AWS CLI, that I was not aware of. Specifically they recommended using aws iam generate-service-last-accessed-details and aws iam get-service-last-accessed-details-with-entities, and they referred me to https://docs.aws....


2

Sure, if the EC2 role allows STS::AssumeRole you can assume a role in the other account and get temporary credentials to do whatever you need to do in the other account. See for example here: Cross Account Access with AWS-CLI


Only top voted, non community-wiki answers of a minimum length are eligible