AWS Notes

☁️. Issue #77 | 25 Jun 2023 ▪️ Amplify UI Builder Figma plugin ▪️ Application Discovery Service  EC2 recommendations ▪️ AppSync SAM AWS::Serverless::GraphQLApi abstraction ▪️ Billing Conductor service-scoped free tier pricing rules ▪️ CloudFormation accelerates dev-test cycle with new ChangeSets parameter ▪️ CloudWatch Internet Monitor +7 Regions ▪️ CloudWatch Logs  new Log Insights dedup command ▪️ Connect reduces toll free rates for Australia and New Zealand ▪️ Control Tower Security Hub integration ▪️ Corretto nightly builds ▪️ EC2      ▫️ C7gn instances general availability      ▫️ Hpc7g instances      ▫️ T4g instances are now available in additional regions ▪️ EC2 Dedicated Hosts targeted allocations in Outposts rack ▪️ EFS  up to 10 GiB/s of Provisioned Throughput ▪️ Elemental MediaConvert bandwidth reduction filter for HEVC and AVC ▪️ EMR insufficient instance capacity errors events ▪️ EMR on EKS custom job scheduling ▪️ ENA Express +10 EC2 Instances ▪️ Glue Studio data previews for Glue Streaming jobs ▪️ Kinesis Data Firehose data stream delivery to Redshift Serverless ▪️ Lake Formation Glue Data Catalog cross-Region table access ▪️ Lambda starting from timestamp for Kafka event sources ▪️ Local Zones in Manila  | GA ▪️ Managed Grafana OpenSearch Trace Analytics ▪️ MemoryDB for Redis FedRAMP Moderate compliance ▪️ MQ  cross-region data replication for ActiveMQ brokers ▪️ Personalize filtering selected items by properties of the input item ▪️ Purchase Order Management Tagging support ▪️ Redshift encrypting the data warehouse ▪️ SageMaker Feature Store feature processing ▪️ SageMaker Inference Recommender model creation recommendation ▪️ Security Hub enhanced management capabilities with CloudFormation ▪️ Step Functions Versions and Aliases ▪️ System Manger OpsCenter simplified cross-account management of operational issues ▪️ Transfer Family      ▫️ Drummond Group Applicability Statement 2 (AS2) Certification      ▫️ structured JSON log format ▪️ Trusted Advisor new fault tolerance checks ▪️ Verified Access new logging functionality to improve troubleshooting ▪️ VPC CNI IPv6 Egress for Pods in IPv4 enabled Kubernetes Clusters

​​🤖 AWS Docs GPT (unofficial version): https://www.awsdocsgpt.com/ #AI

​​Graviton 3E c7gn instances for network-intensive workloads: https://aws.amazon.com/blogs/aws/new-amazon-ec2-c7gn-instances-graviton3e-processors-and-up-to-200-gbps-network-bandwidth/ c6g.medium $0.034 c6gn.medium $0.0432 c7g.medium $0.0363 c7gn.medium $0.0624 #EC2

☁️ Issue #76 | 18 June 2023 ▪️  AppFlow 4 new data connectors ▪️  Audit Manager 3rd party risk assessments and CSV exports ▪️  Clean Rooms Cloudformation and Analysis Builder ▪️  CloudShell +12 regions ▪️  CloudTrail Lake curated dashboards for visualizing top CloudTrail trends ▪️  CodeGuru Security is now available in preview ▪️  Connect       ▫️ Contact Lens screen recording       ▫️ new contact lifecycle events for callbacks       ▫️ search APIs for three more resources ▪️  Control Tower  +10 Security Hub controls ▪️  Detective extends finding groups to Amazon Inspector ▪️  DynamoDB Database Encryption SDK  | Preview ▪️  EC2 Instance Connect supports SSH and RDP connectivity without public IP address ▪️  EC2 M7a instances | Preview ▪️  ECR Common Vulnerability Scoring System (CVSS) v3 scanning ▪️  Elastic Disaster Recovery VPC configurations recovery ▪️  EMR on EKS container log rotation for Apache Spark ▪️  EMR price-capacity-optimized allocation strategy for EC2 Spot Instances ▪️  Global Accelerator endpoint in Jakarta region ▪️  Global Partner Security Initiative ▪️  GuardDuty enhances console experience with findings summary view ▪️  IAM Identity Center automated user provisioning from Google Workspace ▪️  Inspector       ▫️ Code Scans for Lambda function | GA       ▫️ Software Bill of Materials export capability ▪️  Location Service       ▫️ geofence metadata       ▫️ place categories ▪️  Marketplace built-in partner software automates installation for customers ▪️  OpenSearch Service skip unavailable clusters during cross-cluster search ▪️  Partner Central Partner Analytics Dashboard ▪️  Payment Cryptography new service ▪️  Personalize VPC endpoints ▪️  RDS for Oracle migration via RMAN Transportable Tablespaces ▪️  Rekognition improves face search accuracy with user vectors ▪️  S3 dual-layer server-side encryption for compliance workloads ▪️  Security Hub       ▫️ +6 security controls       ▫️ automation rules ▪️  Step Functions integration with VPC Lattice and other services ▪️  Transfer Family quantum-safe key exchange for SFTP ▪️  Verified Permissions is now generally available ▪️  WAF Fraud Control account creation fraud prevention and reduced pricing ▪️  Well-Architected introduces Profiles

​​📌 Присоединяемся с помощью EC2 Instance Connect к RDS (да и вообще ко всему внутри VPC) без промежуточной виртуалки. 1️⃣ Обновляем AWS CLI до версии 2.12+ https://docs.aws.amazon.com/cli/latest/userguide/getting-started-version.html Прямая ссылка для обладателей Windows: 🔗 https://awscli.amazonaws.com/AWSCLIV2-2.12.0.msi 2️⃣ Создаём (если ещё нет) EC2 Instance Connect Endpoint https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/create-ec2-instance-connect-endpoints.html aws ec2 create-instance-connect-endpoint --region us-east-1 --subnet-id subnet-0123456789abcdef Меняем --region и --subnet-id на свои значения. После создание получим InstanceConnectEndpointId. 3️⃣ Присоединяемся к EC2 Instance Connect Endpoint В официальной документации пока есть только присоединение к EC2 по --instance-id: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-using-eice.html Однако в AWS CLI перечислены и другие: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2-instance-connect/open-tunnel.html Берём айпишник --private-ip-address нашей базы данных плюс её порт --remote-port и коннектимся: aws ec2-instance-connect open-tunnel --private-ip-address 10.44.33.119 --instance-connect-endpoint-id eice-0123456789abcdef12 --remote-port 5432 --local-port 5432 Меняем --private-ip-address, --instance-connect-endpoint-id (полученное при создании), --remote-port и --local-port на свои значения. В результате поднимется туннель: Listening for connections on port 5432. [1] Accepted new tcp connection, opening websocket tunnel. 4️⃣ Присоединяемся к локальному порту (localhost:5432 из примера выше — картинка ниже чисто для примера) и пользуемся. Точно работает для адресов из других VPC, присоединённых через VPC Peering, для другого не пробовал — напишите, если (не) получится, как для RDS/Aurora, так и для OpenSearch либо других сервисов. P.S. Кто читает лишь конец и не работает — обновите AWS CLI! #EIC

​​Свежий опрос Stack Overflow — Developer Survey 2023 : https://survey.stackoverflow.co/2023/#overview Коротко: ◽ Python вышел на второе место (HTML идёт лесом) ◽ PostgreSQL на первое ◽ AWS по-прежнему в лидерах с большим отрывом ◽ Oracle Cloud растёт и обогнал OVH ◽ IBM Cloud всё ещё не вылетел из опроса ◽ AWS CodeWhisperer в тройке главных AI devtools ◽ ChatGPT + Bing AI используют больше 100% разработчиков (проверьте сами) 😁

​​EC2 Instance Connect Endpoint — присоединяемся по SSH/RDP к виртуалкам из приватной подсети (без публичного IP): https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/Connect-using-EC2-Instance-Connect-Endpoint.html Хорошая мысль, запоздавшая на надцать лет — сколько бастионов перебастионили. К сожалению, только IPv4. И почему это будет лучше старого-доброго SSM Session Manager пока ещё не знаю. P.S. EICE денег не ест (только за Data Transfer). #EC2

​​🆕 Amazon EC2 M7a instances, powered by 4th generation AMD EPYC processors, deliver up to 50% higher performance compared to M6a instances: https://aws.amazon.com/ec2/instance-types/m7a/ ▫️ 4th Gen AMD EPYC™ 9004 Genoa ▫️ 96 CPU Cores / 192 Threads ▫️ Base Freq 2.4GHz / Boost Up to 3.7GHz ▫️ DDR5 4800 ▫️ L3 Cache 384MB ▪️ AVX3-512 ▪️ BFloat16  #EC2 #AMD

Главный спонсор сегодняшнего выпуска: https://aws.amazon.com/solutions/implementations/multi-region-application-architecture

Jun 13 12:08 PM PDT We are investigating increased error rates and latencies in the US-EAST-1 Region. AWS Lambda - Degradation Informational: AWS Management Console AWS Support Center Amazon API Gateway Amazon CloudWatch Amazon Connect Amazon Redshift

AWS outage in progress...

​​The world's most advanced cloud security conference — fwd:cloudsec 2023 Day 1 • https://www.youtube.com/watch?v=JCphc30kFSw • https://www.youtube.com/watch?v=up4nfzeXYlU Day 2 • https://www.youtube.com/watch?v=ZvdYgL6b9xE • https://www.youtube.com/watch?v=B3t-mUU_fRU #security #video

🏆 В чемпионате по исправлению старых багов был повержен рекорд ECS по удалению ECS Task Definitions (9 лет и 3 месяца). Новый чемпион — Config и исключение записываемых ресурсов: https://aws.amazon.com/about-aws/whats-new/2023/06/aws-config-recording-exclusions-resource-type/ Итого: 9 лет и 7 месяцев, ура! 🎉 #Config

​​⚒️ lambda-debug is a tool that enables you to invoke Lambda functions in the cloud from any event source and intercept the requests with breakpoints locally. https://github.com/ljacobsson/lambda-debug 🏠 Local debugging: Set breakpoints in your code and step through your functions invocations locally on native events triggered in the cloud. 👍 No code changes: No need to modify your code to enable debugging. Just add some dev dependencies and some configuration. 🔐 Same IAM permissions: Your functions will run with the same IAM permissions as they do in the cloud. ⚡ Fast iterations: No need to deploy your code to the cloud to test changes. Just save your code and invoke your functions in the cloud. #Lambda

↑↑↑ Опрос ↑↑↑ возник на фоне обсуждение статьи https://leanercloud.beehiiv.com/p/recommended-ecs-instead-kubernetes-latest-customer на Reddit — интересно узнать разброс мнений.

☁️. Issue #75 – 11 June 2023 🟠 Athena for Apache Spark      ▫️ Apache Hudi, Apache Iceberg, and Delta Lake      ▫️ custom Java libraries 🟠 Billing and Cost Management scripts to bulk updates policies | scripts 🟠 CloudFormation StackSets      ▫️ programmatic trust access with AWS Organizations      ▫️ skips suspended accounts 🟠 CloudTrail Lake selective start or stop ingestion of CloudTrail events 🟠 CloudWatch Logs      ▫️ data protection account level policy configuration      ▫️ Live Tail 🟠 Config      ▫️ advanced queries support +30 resource types      ▫️ recording exclusions by resource type 🟠 Connect Customer Profiles  exports profile updates in real-time 🟠 Control Tower      ▫️ account access configuration flexibility      ▫️ Account Factory Single Region Terraform 🟠 Database Migration Service enhanced homogeneous migration capabilities 🟠 DocumentDB 5.0 t3.medium and r5 instances 🟠 EMEA SARL daily invoice consolidation 🟠 EMR on EKS Spark Operator and spark-submit 🟠 FinSpace Managed kdb Insights | GA 🟠 Glue Data Quality is now generally available 🟠 Glue for Ray is now generally available 🟠 IoT Device Management Software Package Catalog 🟠 Keyspaces (for Apache Cassandra) Multi-Region Replication 🟠 KMS importing asymmetric and HMAC keys 🟠 Lambda      ▫️ Ruby 3.2 runtime      ▫️ SnapStart for Java +7 regions 🟠 Lex Test Workbench 🟠 Mainframe Modernization HIPAA eligible 🟠 Managed Microsoft AD simplifies administrative tools access 🟠 Marketplace FedRAMP auth for Vendor Insights security profiles 🟠 Migration Hub Refactor Spaces flexibility routing with path parameters 🟠 MWAA in-place version upgrades 🟠 Polly +female NTTS voice in Belgian Dutch (Flemish) 🟠 QuickSight      ▫️ APIs to automate and accelerate assets deployment      ▫️ geospatial heatmap for points on maps      ▫️ standardized user level cost and usage data 🟠 RDS Custom for SQL Server Bring Your Own Media 🟠 RDS for Oracle April 2023 Release Update for 21c 🟠 Redshift Serverless query scheduling and SSO 🟠 SageMaker Automatic Model Tuning automatically chooses tuning configs 🟠 SageMaker Canvas retraining ML models, automating prediction workflows 🟠 SageMaker JumpStart Falcon 40B model 🟠 SageMaker Pipelines Selective Executions 🟠 SQS dead-letter queue redrive 🟠 Timestream Customer Defined Partition Keys 🟠 Trusted Advisor new checks for EFS 🟠 WAF Header Order match statement for request inspection