Hot answers tagged

4 votes
Accepted

Access S3 files from Datacenter over VPN to VPC

You need to use... the Internet, from your data center, to access S3 directly (not via the endpoint) or an AWS DirectConnect connection to access S3 directly (not via the endpoint) or an HTTP proxy ...
user avatar
4 votes

How do I launch Lambda in my own VPC?

I have also asked the AWS Support folks for help too, as Lambda's security was crucial for us [HIPAA compliancy]. This was their response: Lambda has two options, you can have your lambda ...
user avatar
  • 2,756
4 votes

Configure VPC for ECR access

This error CannotPullContainerError usually occurs when you have no access to the Internet from ECS and thus it doesn't able to pull an image from registry. Make sure you have networking configured ...
user avatar
4 votes

One NAT attachment for two private subnets

Remember that you should be engineering to your requirements around cost, resilience and performance. If your constraint is around cost, then yes, a single NAT gateway, with both subnets having ...
user avatar
4 votes
Accepted

How to automatically remove a dead node from RabbitMQ cluster

Consider using the rabbitmq/rabbitmq-autocluster plugin: A RabbitMQ plugin that clusters nodes automatically using a number of peer discovery mechanisms: Consul, etcd2 DNS A records ...
user avatar
3 votes
Accepted

Why do I need a Nat Gateway for ECS containers using AWSVPC?

While this is completely possible, it would mean that your instance would be accessible from the internet. Public subnet means that your instances are accessible directly from the outside. Private ...
user avatar
  • 325
3 votes

How to auto generate a diagram out of my AWS VPC?

Yes and it costs 400$ a month. https://docs.aws.amazon.com/solutions/latest/aws-perspective/welcome.html It's a live diagram of all the resource in your organization, which means that it's capable of ...
user avatar
  • 345
3 votes

How to get VPC id in Terraform module?

Without seeing the contents of your two modules I'm guessing a bit, but it looks like you have an AWS VPC declared in your vpc module and some subnets declared in your prod_subnets module and you are ...
user avatar
3 votes
Accepted

How to Block Traffic From a Single IP in AWS

Yes, we can block traffic from single IP or IP range. Please follow below steps to do this Open VPC dashboard Open the Network ACLs view Open the ACL editor Select the subnet to which your EC2 ...
user avatar
  • 1,351
3 votes
Accepted

How do I launch Lambda in my own VPC?

The API for creating a function includes a section to choose which VPC to use for running that function. source: https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunction.html#SSS-...
user avatar
3 votes

Placing an AWS Lambda in a public subnet

No, it's not possible to place an AWS Lambda in a public subnet and thus avoid paying for NAT. Lambda functions cannot have public IPs so they cannot route to the internet without a NAT (gateway or ...
user avatar
  • 131
2 votes

Placing an AWS Lambda in a public subnet

Provided the Public Subnet where you're launching your Lambda is configured with Auto-assign public IPv4 address: Yes it should work in public a subnet without NAT. Whether or not it's a good idea is ...
user avatar
  • 971
2 votes
Accepted

Using Amazon VPC provided DNS trough AWS Site-to-Site VPN

Is it possible to query Amazon DNS server from our corporate network trough the VPN tunnel? Directly? No. The recursive resolver available by default when you create a VPC can only be accessed by an ...
user avatar
  • 1,345
2 votes

One NAT attachment for two private subnets

This is not a good practice. AWS docs explicitly mentions that Each NAT gateway is created in a specific Availability Zone and implemented with redundancy in that zone That means that if all of ...
user avatar
  • 604
1 vote
Accepted

Terraform get subnet id by it's CIDR block

It seems that you already know which CIDR ranges you wish to look up, and that you are trying to find the corresponding subnet id for each of them. You can achieve that by using the aws_subnet data ...
user avatar
1 vote

Get a list of remote VPCs on AWS using Terraform?

You'll have to use the output of the list in a for loop to get the subnet ids for_each, but it would look something like this: data "aws_vpcs" "foo" {} output "vpcs" { ...
user avatar
1 vote
Accepted

Common permissions for EC2 usage and VPC Security Groups in enterprise use

Not technically, I understand your need to create and destroy EC2 instances, whether it's done via automation or not. About having permissions at the security group level, this can often be limited to ...
user avatar
1 vote

Why do I need a Nat Gateway for ECS containers using AWSVPC?

When you use awsvpc for your ECS containers, those containers can't connect to a internet gateway directly since awsvpc can't provide public IP addresses to the ENIs of the containers despite them ...
user avatar
1 vote

Troubleshooting VPC flow logs with an S3 bucket using SSE-KMS encryption with CMK

Turns out I was missing one very important line in my KMS key policy: resources = ["*"] Now it works fine, and my full policy looks like this: { "Version": "2012-10-17", "Statement": [ ...
user avatar
  • 301
1 vote

How to get VPC id in Terraform module?

It should be written as: output "vpc_id" { value = aws_vpc.production_vpc.id }
user avatar
1 vote

Unable to connect to remote service using AWS VPC Peering

How are you trying to connect to the remote service? - IP address, default internal/external DNS name or custom DNS name private/public hosted zone? Please compare the output of nslookup to the remote ...
user avatar
1 vote

Configure VPC for ECR access

ECR needs authentication and authorization before you can pull an image. In your ansible ecs_taskdefinition, please make sure you have parameter task_role_arn or execution_role_arn pointing to a role ...
user avatar
  • 11
1 vote
Accepted

can't access my instances by public IP in a VPC (aka: what is wrong with my terraform)?

Your default security groups and newly created security groups include default rules that do not enable you to access your instance from the Internet. Add this: resource "aws_security_group" "allow-...
user avatar
  • 101
1 vote
Accepted

Ansible ec2_vpc_net and ec2_vpc_subnet - where to set subnet default public ip

map_public parameter set to true in the second link should do this.
user avatar
  • 26
1 vote
Accepted

Which option do I select for Security Group Source?

Use Custom and then start typing sg-... and it should pop up a list of available groups.
user avatar
  • 971
1 vote
Accepted

How to Allow AWS S3 Access From only Specific IPs

please attach below policy to your AWS S3 Bucket. Allow Access to Specific IP Addresses <div class="code"> { "Id": "S3PolicyId1", "Statement": [ { "Sid": "...
user avatar
  • 1,351
1 vote

Jenkins in private subnet

If you want to make it private either you need to setup a vpn so that you can access jenkins gui using http://private-subnet-ip:jenkins_port or you can move jenkins behind a load balancer and use load-...
user avatar
  • 243
1 vote
Accepted

Communication between VPCs and a transit VPC hosting VPN Server without Masking source IP

VPC peering does not support transit traffic. Unsupported VPC Peering Configurations described several scenarious that are not supported. This case is not specifically mentioned, but is implicit ...
user avatar
1 vote
Accepted

Why don't the instances in the auto-scaling group get assigned public ip addresses unless it's a default vpc?

i got the answer from aws support: he reason why you are seeing that notification is because it is in accordance to your launch configuration (staging-1-deploy) settings. During the creation of a ...
user avatar
  • 453
1 vote

Migrate Rancher host from server to server

First of all you need to support HA mode. You will need: external MySQL DB (e.g. AWS RDS Aurora) external load balancer (e.g. AWS ELB) 2 additional Rancher Server Nodes (to support quorum of 3) Once ...
user avatar
  • 329

Only top scored, non community-wiki answers of a minimum length are eligible