Hot answers tagged

4

Consider using the rabbitmq/rabbitmq-autocluster plugin: A RabbitMQ plugin that clusters nodes automatically using a number of peer discovery mechanisms: Consul, etcd2 DNS A records AWS EC2 tags AWS Autoscaling Groups There is a fair bit of configuration to plug in to get this setup including setting IAM policies and adding EC2 tags to ...


4

Remember that you should be engineering to your requirements around cost, resilience and performance. If your constraint is around cost, then yes, a single NAT gateway, with both subnets having routing tables that route public IP traffic to the NAT gateway is a viable approach. If you are this cost sensitive, are you sure that AWS is the right hosting ...


4

I have also asked the AWS Support folks for help too, as Lambda's security was crucial for us [HIPAA compliancy]. This was their response: Lambda has two options, you can have your lambda functions without a VPC or you could place your lambda function within a VPC. If you want to put your lambda function within VPC, then the most important thing to ...


4

This error CannotPullContainerError usually occurs when you have no access to the Internet from ECS and thus it doesn't able to pull an image from registry. Make sure you have networking configured in such a way to have an access to Internet https://stackoverflow.com/questions/48226547/aws-fargate-cannotpullcontainererror-500 Manually you can confirm ...


3

Without seeing the contents of your two modules I'm guessing a bit, but it looks like you have an AWS VPC declared in your vpc module and some subnets declared in your prod_subnets module and you are asking how the configuration of the subnets can get access to the VPC ID. If so, the answer is that the vpc module must export the VPC ID as an output value ...


3

Yes, we can block traffic from single IP or IP range. Please follow below steps to do this Open VPC dashboard Open the Network ACLs view Open the ACL editor Select the subnet to which your EC2 instances or load balancers are connected. Click Inbound Rules Click Edit Add a rule to block the traffic/IP You will now see the ACL editor. On the last row, ...


3

The API for creating a function includes a section to choose which VPC to use for running that function. source: https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunction.html#SSS-CreateFunction-request-VpcConfig It doesn't have to be the default VPC, it can be any VPC. Consider that "EC2 server inside a VPC" only means that it is some virtual ...


3

You need to use... the Internet, from your data center, to access S3 directly (not via the endpoint) or an AWS DirectConnect connection to access S3 directly (not via the endpoint) or an HTTP proxy server inside this VPC to access S3 (via the endpoint) ...because S3 endpoints are not designed to be used across VPN connections. They are only accessible ...


2

Provided the Public Subnet where you're launching your Lambda is configured with Auto-assign public IPv4 address: Yes it should work in public a subnet without NAT. Whether or not it's a good idea is another question. In general you shouldn't launch any backend services in the public subnets, the public subnets are for things like API Gateways, NAT Gateways,...


2

Is it possible to query Amazon DNS server from our corporate network trough the VPN tunnel? Directly? No. The recursive resolver available by default when you create a VPC can only be accessed by an IP address in that VPC. This is a restriction that Amazon imposes. What you can do is create a forwarder using the Route 53 Resolver service or software like ...


2

This is not a good practice. AWS docs explicitly mentions that Each NAT gateway is created in a specific Availability Zone and implemented with redundancy in that zone That means that if all of your private subnets share traffic to a same NAT gateway, in case the AZ where the NAT is located goes down you are loosing your whole 'private environment'.


1

While this is completely possible, it would mean that your instance would be accessible from the internet. Public subnet means that your instances are accessible directly from the outside. Private subnet are not accessible from the outside as instances do not have a publicly routable IP. In short, security


1

Turns out I was missing one very important line in my KMS key policy: resources = ["*"] Now it works fine, and my full policy looks like this: { "Version": "2012-10-17", "Statement": [ { "Sid": "Allow VPC Flow Logs to use the key", "Effect": "Allow", "Principal": { "Service": "...


1

ECR needs authentication and authorization before you can pull an image. In your ansible ecs_taskdefinition, please make sure you have parameter task_role_arn or execution_role_arn pointing to a role (i.e. you need to create a role my-task-role1). Attach the AWS managed policy AmazonECSTaskExecutionRolePolicy to the role (for Fargate tasks, the policy ...


1

Your default security groups and newly created security groups include default rules that do not enable you to access your instance from the Internet. Add this: resource "aws_security_group" "allow-ssh" { vpc_id = "${aws_vpc.vpc.id}" ingress { from_port = 0 to_port = 22 protocol = "tcp" } } Then add the line vpc_security_group_ids = [...


1

map_public parameter set to true in the second link should do this.


1

Use Custom and then start typing sg-... and it should pop up a list of available groups.


1

please attach below policy to your AWS S3 Bucket. Allow Access to Specific IP Addresses <div class="code"> { "Id": "S3PolicyId1", "Statement": [ { "Sid": "IPDeny", "Effect": "Deny", "Principal": { "AWS": "*" }, "Action": "s3:*", "Resource": "arn:aws:s3:::bucket/*",...


1

If you want to make it private either you need to setup a vpn so that you can access jenkins gui using http://private-subnet-ip:jenkins_port or you can move jenkins behind a load balancer and use load-balancer-dns to access jenkins gui. If it is in public subnet then use NACL/Security Groups to restrict access only to trusted sources. For more security, do ...


1

VPC peering does not support transit traffic. Unsupported VPC Peering Configurations described several scenarious that are not supported. This case is not specifically mentioned, but is implicit from the other limitations. Note also that it is impossible to fully configure the setup you are attempting, because when you route a given destination towards ...


1

No, it's not possible to place an AWS Lambda in a public subnet and thus avoid paying for NAT. Lambda functions cannot have public IPs so they cannot route to the internet without a NAT (gateway or instance). Put them in a private subnet, ensure the private subnet's default route is a NAT in a public subnet, that the NAT has a public IP, and that the VPC ...


1

i got the answer from aws support: he reason why you are seeing that notification is because it is in accordance to your launch configuration (staging-1-deploy) settings. During the creation of a launch configuration, the assignment of public IP addresses to EC2 instances defaults to Only assign a public IP address to instances launched in the default VPC ...


1

First of all you need to support HA mode. You will need: external MySQL DB (e.g. AWS RDS Aurora) external load balancer (e.g. AWS ELB) 2 additional Rancher Server Nodes (to support quorum of 3) Once you will be ready with external DB Rancher would ask you to backup & restore his database in it. After that you'll be asked to redeploy Rancher Server with ...


1

Yes, you just need a Read Only Domaine Controler (search for RODC) in the vpc and you'll be able to have a one way replication as the read only controler won't need to send datas back. This bring limitation for clients in the vpc, as they won't be able to reach a writable DC they can't change passwords and you'll need a careful site architecture in your ...


Only top voted, non community-wiki answers of a minimum length are eligible