A Technical I.T./DevOps Blog
Problem scenario
From the AWS CLI you try to create a node group. But you get this error: “An error occurred (InvalidParameterException) when calling the CreateNodegroup operation: The provided nodeRole is invalid.”
Solution
The above can happen when you use a role’s name but not the ARN string (such as arn:aws:iam::123456:role/foobar). Use the ARN string of the role instead of what you were using.
…
Problem scenario
You want to create EC-2 instances using an SDK (a program that automatically generates AWS resources). How do you do this?
Solution
Prerequisites
You have Boto3 installed. If you need assistance, see this posting if you have CentOS/RHEL/Fedora or this posting for Debian/Ubuntu.
Procedures
Run this program to create a RHEL server (but you can replace the “ami-0a54aef4ef3b5f881” with the image ID of your choice):
# Replace AKIAabcdefghijk with your AWS access key ID
# Replace 1a2b3c4d5e6f7g8h9/i0j0k9l8m7n6o5p4q3r2s1tuvwxyz with your AWS Secret Access key
# Replace us-west-1 with the region of your choice
# Replace ami-0a54aef4ef3b5f881 with the image ID of your choice. …
Continue reading “How Do You Use Boto3 to Create EC-2 Instances?”
Problem scenario
Some external requests that a Lambda function is making are not working. The Lambda logs indicate that the function is timing out. You want to see what VPC your Lambda function is in. What do you do?
Solution
Log into AWS via the web UI.
Go here (but change “us-west-1” in both places to your VPC’s region: https://us-west-1.console.aws.amazon.com/lambda/home?region=us-west-1#/functions/ )
Search for “VPC”
It may be that your Lambda function is not attached to any VPC.
…
Continue reading “How Do You Find out which VPC Your Lambda Function Is In?”
Problem scenario
When trying to attach a Lambda function to a VPC, you get an error like this: “The provided execution role does not have permissions to call CreateNetworkInterface on EC2”
What should you do?
Solution
1. Go to IAM and create a policy. Use the JSON editor. Use these settings (taken from StackOverflow):
{
“Version”: “2012-10-17”, …
Continue reading “How Do You Attach a Lambda Function to a VPC?”
Problem scenario
You want to craft an AWS CLI command to return the principal services of your IAM roles. You want the name and the ARN values of the roles to be printed along with the principal services. You know the principal services data is in the AssumePolicyDocument. Your previous attempts have returned “None” for this value. What do you do?
Solution
Run a command like this:
aws iam list-roles –output text –query ‘Roles[*].[RoleName,Arn,AssumeRolePolicyDocument.Statement[*].Principal]’ …
Problem scenario
Sometimes you forget what is running in AWS. You want to be notified when you have spent a certain amount of money. How do you set up a notification in your AWS account that will apprise you when you have have spent over a certain amount of money for a given month?
Solution
…
Problem scenario
You want to rotate AWS IAM keys across a unique set of different AWS accounts. Regular rotation is a recommended practice for securing your AWS resources (per this Amazon posting). Just as passwords can be brute-forced and defeated through exhaustive attempts, access keys could be randomly generated and attempted via a malicious person or program; rotating the access keys can make hacking your AWS resources tremendously more difficult.
…
Continue reading “What Are Eight Ways of Rotating AWS IAM Keys?”
Problem scenario
You want to list IAM roles that have access to EKS. You have the AWS CLI installed and jq installed. What should you do?
Solution
Run this command:
aws iam list-roles | jq -r ‘.Roles[] | select(.AssumeRolePolicyDocument.Statement[].Principal.Service==”eks.amazonaws.com”)’ …
Continue reading “What AWS CLI Command Can You Run to List Roles with EKS Access?”
Problem scenario
You run an AWS CLI command, but you get this error message:
“An error occurred (InvalidParameterException) when calling the CreateCluster operation: Subnets specified must be in at least two different AZs”
How do you find subnets in different availability zones?
Solution
Run commands such as these (but replace the “us-west-x” and “us-east-x” with the availability zones that you use):
aws ec2 describe-subnets –query ‘Subnets[?AvailabilityZone==us-west-1a]’
aws ec2 describe-subnets –query ‘Subnets[?AvailabilityZone==us-west-1b]’
aws ec2 describe-subnets –query ‘Subnets[?AvailabilityZone==us-west-1c]’
aws ec2 describe-subnets –query ‘Subnets[?AvailabilityZone==us-east-2a]’
aws ec2 describe-subnets –query ‘Subnets[?AvailabilityZone==us-east-2b]’
aws ec2 describe-subnets –query ‘Subnets[?AvailabilityZone==us-east-2c]’
Now you will see more subnet IDs for your original command.
…
Problem scenario
You want to delete a trail from CloudTrail so you can delete an S3 bucket (to avoid AWS charges). How do you do this?
Solution
Warning: You may be able to delete the non-empty S3 bucket that the Trail was supposed to use without deleting the Trail.
Procedures
…
Continue reading “How Do You Delete a Trail from CloudTrail?”