0

AWS ABCs: Granting A Third-Party Access to Your Account

There can be times when you’re working on the AWS Cloud where you need to grant limited access to your account to a third-party. For example:

• A contractor or a specialist needs to perform some work on your behalf
• You’re having AWS Professional Services or a partner from the Amazon Partner Network do some work in your account
• You’re conducting a pilot with AWS and you want your friendly neighborhood Solutions Architect to review something

In each of these cases you likely want to grant the permissions the third-party needs but no more. In other words, no granting of AdministratorAccess policies because it’s easy and just works. Instead, adherence to the principle of least privilege.

This post will describe two methods–IAM users and IAM roles–for proving limited access to third-parties.

Comparing the Two Approaches

The big difference with the IAM user approach vs the role-based approach is the way the credentials for each entity are handed out.

IAM users have long-term credentials that only change by a manual action (either the user or an administrator changes the credentials). Those credentials will continue to provide access to the account until they’re either changed or the user is disabled/deleted.

By contrast, roles Continue reading

0

3 Tools for Getting VMs From Your Datacenter to the AWS Cloud

Here’s a simple scenario: you have some Virtual Machines (VMs) in your on-premises environment, likely in VMware vSphere or Microsoft Hyper-V. You want to either fully migrate some or all of those VMs to the AWS Cloud or you want to copy a gold image to the AWS Cloud so you can launch compute instances from that image. Simple enough.

Now, how do you do it?

Can you just export an OVA of the VM, copy it up, and then boot it? Can you somehow import the VMDK files that hold the VM’s virtual drive contents? Regardless the eventual method, how do you do it at scale for dozens or hundreds of VMs? And lastly, how do you orchestrate the process so that VMs belonging to an application stack are brought over together, as a unit?

This post will answer these questions and more by providing an introduction to the services available on the AWS Cloud to discover, plan, migrate, and track VMs from on-prem to AWS.

This post assumes good working knowledge of technologies such as VMware vCenter and only basic knowledge of AWS.

Let’s just clarify some things first…

Remembering that this post is tailored for those that Continue reading

0

9 Things to Consider When Estimating Time

Often in my career I have to make an estimate about the so-called “level of effort” (LoE) to do a thing.

• What’s the LoE for me to do a demo for this customer?
• What’s the LoE for me to help respond to this RFP?
• What’s the LoE for me to participate in this conference?

The critical metric by which I usually have to measure the LoE is time. People, equipment, venue, materials, and location are rarely ever a limiting factor. Time is always the limiting factor because no matter the circumstance, you can’t just go and get more of it. The other factors are often elastic and can be obtained.

And oh how I suck at estimating time.

As soon as the question comes up, “What’s the LoE for…”, I immediately start to think, ok, if I am doing the work, I can do this piece and that piece, I can read up on this thing and get it done with slightly more time invested, and then yada, yada, yada… it’s done!

What I don’t account for is the human element. The unexpected. The fact that we’re all different and team members will go about their work in their Continue reading

0

Five Functional Facts About AWS Service Control Policies

Following on the heels of my previous post, Five Functional Facts about AWS Identity and Access Management, I wanted to dive into a separate, yet related way of enforcing access policies in AWS: Service Control Policies (SCPs).

SCPs and IAM policies look very similar–both being JSON documents with the same sort of syntax–and it would be easy to mistake one for the other. However, they are used in different contexts and for different purposes. In this post, I’ll explain the context where SCPs are used and why they are used (and even why you’d use SCPs and IAM policies together).

Read on, dear reader!

1 – SCPs scope the permissions an AWS account has

To properly describe SCPs, I need to introduce a new service: AWS Organizations. Organizations is a service that is used to bring multiple AWS accounts together under a common management structure. For example, if you wanted to enforce the use of encryption on S3 buckets across all the AWS accounts used within your company, you could do that via AWS Organizations. Additional benefits of Organizations include consolidated billing, integration with certain services such as AWS CloudTrail, and streamlined sharing of resources between accounts using Continue reading

0

Amazon CloudFront with WordPress as Infrastructure as Code

There are roughly a GAJILLION articles, blogs, and documents out there that explain how to setup Amazon CloudFront to work with WordPress.

Most of them are wrong in one or more ways.

• They advise a type of cache behavior that is incorrect for one or more WordPress assets.
• They fail to provide any advice for WordPress assets that need specific cache behavior.
• The article/blog/document is stale and hasn’t been updated to reflect changes in newer versions of WordPress.

Rather than fall into the trap of writing yet another article for whatever the “now current” version of WordPress is that will likely fall victim to one or more of the conditions listed above, I’m going to take a different approach.

I’m going to codify the CloudFront configuration, version it on GitHub, and adopt an “infrastructure-as-code” (IaC) mentality. This blog post will describe the overall architecture and provide some context, but the actual mechanics of setting up CloudFront to work with WordPress will live (and evolve!) in the IaC files themselves which will be under version control.

Let’s do it!

The Architecture

I’ll say this up front: this architecture may not be for everyone (but I have a sneaky Continue reading

0

Five Functional Facts about AWS Identity and Access Management

This post is part of an open-ended series I’m writing where I take a specific protocol, app, or whatever-I-feel-like and focus on five functional aspects of that thing in order to expose some of how that thing really works.

The topic in this post is the AWS Identity and Access Management (IAM) service. The IAM service holds a unique position within AWS: it doesn’t get the attention that the machine learning or AI services get, and doesn’t come to mind when buzzwords like “serverless” or “containers” are brought up, yet it’s used by–or should be used by–every single AWS customer (and if you’re not using it, you’re not following best practice, tsk, tsk) so it’s worthwhile to take the time to really get to know this service.

Let’s begin!

1 – The root user supersedes IAM policies

The main reason I threw a bit of shade about following best practice and always using IAM has to do with the root user in an account. The root user is what’s created when a new AWS account is opened. The username for the root user is always an email address and the root user is able to log into the AWS account Continue reading

0

Can IT Certifications Become a Liability?

I’ve been asking myself an uncomfortable question lately: “Can IT certifications become a liability? Have I reached a point where my IT certifications have become a liability to me?“

I earned my first certification in 2001, the next in 2002, and just kept going from there. My background and work focus since 2001 has been networking so that’s where I’ve focused my certification efforts. I’ve been fortunate enough to have multiple employers who supported my certification journey. This certainly made the journey easier by taking care of (at least some of) the financial burden and providing an environment that supported taking time to study.

Of the certifications I obtained, some required taking just a single multiple choice exam. Others required passing up to four individual exams (within a certain time window) to achieve certification. One certification in particular required passing a multiple choice exam in order to qualify for an 8-hour hands-on lab exam (which I had to take twice).

Prep time for these exams has varied from a few weeks of reading/note taking to close to two years of intense reading, notes, flashcards, and lab work.

All but 2 certifications I hold (or have held) require regularly Continue reading

0

AWS ABCs – Network Building Blocks

Given that my technical background is largely in the networking space (exhibit A, exhibit B, exhibit C(CIE)), one of the first things I tried to wrap my head around when being introduced to AWS is how networking works in the AWS cloud.

What I attempted to do was build a mental model by relating cloud networking constructs such as Virtual Private Cloud (VPC), subnets, and routing tables to on-prem, physical networking constructs. This worked pretty well but I did get tripped up at times because some of these constructs don’t map exactly one-for-one.

This post will explain the mental model I used while also calling attention to the elements or behaviors that don’t map exactly between on-prem and AWS.

The basis for building the model will be a single VM on-prem and a single compute instance in AWS. I’m going to build all the networking constructs around both of these elements, starting from the outer-most layers and working closer and closer to the VM/instance.

A Note on Layer 2

On the AWS platform there is no explicit building blocks for Layer 2 connectivity. There’s no “elastic virtual Continue reading

0

AWS ABCs – Can I Firewall My Compute Instances?

In a previous post, I reviewed what a public subnet and Internet Gateway (IGW) are and that they allowed outbound and inbound connectivity to instances (ie, virtual machines) running in the AWS cloud.

If you’re the least bit security conscious, your reaction might be, “No way! I can’t have my instances sitting right on the Internet without any protection”.

Fear not, reader. This post will explain the mechanisms that the Amazon Virtual Private Cloud (VPC) affords you to protect your instances.

Security Groups

In a nutshell: security groups (SGs) define what traffic is allowed to reach an instance.

“Security group” is a bit of a weird name for what is essentially a firewall that sits in front of an instance, however if you think about it in terms of all servers at a particular tier in an N-tier application (eg, all the web servers) or all the servers that have a common function (eg, all PostgreSQL servers) and how each group would have its own security requirements when it comes to allowed ports, protocols, and IP addresses, then it makes a bit more sense: the security rules appropriate for a group of servers are all put together within Continue reading

0

AWS ABCs – EC2 Internet Connectivity

So, you’ve created a compute instance (ie, a virtual machine) on Amazon EC2. Next question: does the instance require access to and/or from the Internet?

Protip: just because you created the instance in the public cloud, i.e. the cloud that you get to over the Internet, it doesn’t mean that your instances all need to sit on the Internet. They can have direct inbound and outbound Internet access, no Internet access, or something in between (which I’ll explain).

The basic building block for networking on AWS is the VPC (Virtual Private Cloud). Within a VPC, you define your IP space, gateways, ACLs, DHCP options, and more. Gateways will be the focus of this article.

TL;DR

• Internet Gateway == static NAT: 1-to–1 mapping between the private IP address assigned to an instance and a public IP address that gets assigned to the instance. Note this implies that NAT works in both directions (in- and outbound) and enables direct reachability to the instance from the Internet via its public IP address.
• NAT Gateway == NAT overload, aka port address translation: all instances behind the NAT Gateway are mapped to a single public IP address.
• No gateways == no NAT! No Internet Continue reading

0

AWS ABC’s – EC2 Instance Type Cheat Sheet

Continuing on with the theme of previous cheat sheet articles, this article will help decode the format for Amazon Web Services’ Elastic Compute Cloud (EC2) instance types.

An EC2 instance type provides the definition for the size and certain capabilities of the instance:

• Amount of RAM
• Number of vCPUs
• Clock speed of the vCPUs
• Presence/absence of GPUs and FPGAs
• Network connectivity speed and capabilities
• Presence/absence of local storage

Some of this information can be gleaned from the instance type name. For the information that can’t, refer to the links below in the references section.

Here is an example of an instance type name: c5d.2xlarge

c	5	d	.	2xlarge
family	generation	[optional] presence of local storage (aka instance storage)		“t-shirt size”; defines amount of RAM and number of vCPUs

• Family – Each instance type belongs to a family of instance types where the family defines what the type is optimized for.
  • General compute: m, t
  • Compute optimized: c
  • Memory optimized: r, x, z
  • Storage optimized: d, h, i
  • Accelerated computing: f, g, p
• Generation – The generation provides distinction between instance types of the same family but where the technology used for that type has been modified. As an Continue reading

0

AWS ABC’s – Logging Into a New EC2 Instance

Ok, you’ve just launched an Amazon EC2 instance (ie, a virtual machine) and you’re ready to login and get to work. Just once teeeensy problem though… you have no idea how to actually connect to the instance!

This post will walk through how to log into brand new Linux/BSD and Windows instances (the steps are slightly different for different OS families).

Regardless of the operating system, one requirement must be met: you must have connectivity into the Virtual Private Cloud (VPC) where you’ve launched the instance. This could be by giving the instance a public IP address so it’s reachable via the Internet or it could be via a VPN or other private connectivity into the VPC. The rest of the article assumes that this basic network connectivity is in place.

Linux/BSD Instances

Linux/BSD instances are accessible via SSH. When the instance is launched, the Amazon Machine Image (AMI)–which acts like the template from which your instance is cloned–is setup to generate the necessary SSH host keys on first boot. You will have to provide the user key.

The Linux/FreeBSD AMIs used to launch the instance must support the generation of SSH host keys on first boot. The AMIs from Continue reading

0

Starting a new series: AWS ABC’s

I’d be lying if I said that since starting my new job at Amazon Web Services (AWS), I wasn’t looking forward to writing about all the new things I was going to learn. Obviously there’s the technology and services that make up the platform itself. But there’s also the architectural best practices, the design patterns, and  answers to questions like “how does moving to the cloud improve my performance/security/reliability?”

Admittedly, I have a lot to learn. With my background being mostly in the network space for my entire career, stepping out of that and into a software and cloudy world means I’m ramping up on a lot of new skills and knowledge.

I believe I’m not the only one on this journey of learning and that, like me, there a lot of folks who are having to learn the basics of the cloud and specifically, AWS.

This has inspired me to start a new, open-ended series of blog posts that I’ve dubbed AWS ABC’s, targeted at people who have a lot of experiencing designing, operating, and architecting on-premesis systems but are now trying to up-skill by learning how to do the same in the cloud. These posts will Continue reading

0

On Why I’m Shifting my Career Focus to Software

For the past few months I’ve been involved in a case study project with some colleagues at Cisco where we’ve been researching what the most relevant software skills are that Cisco’s pre-sales engineers could benefit from. We’re all freaking experts at Outlook of course (that’s a joke ) but we were interested in the areas of programming, automation, orchestration, databases, analytics, and so on. The end goal of the project was to identify what those relevant skills are, have a plan to identify the current skillset in the field, do that gap analysis and then put forward recommendations on how to close the gap.

This probably sounds really boring and dry, and I don’t blame you for thinking that, but I actually chose this case study topic from a list of 8 or so. My motivation was largely selfish: I wanted to see first-hand the outcome of this project because I wanted to know how best to align my own training, study, and career in the software arena. I already believed that to stay relevant as my career moves along that software skills would be essential. It was just a question of what type of skills and in which specific areas.

Continue reading

0

The Anatomy of a Cisco Spark Bot

I spent a long time creating my first Spark bot, Zpark. The first commit was in August and the first release was posted in January. So, six months elapsed time. It’s also over-engineered. I mean, all it does is post messages back and forth between a back-end system and some Spark spaces and I ended up with something so complex that I had to draw a damn block diagram in the user guide to give people a fighting chance at comprehending how it works.

Its internals could’ve been much simpler. But that was part of the point of creating the bot: examining the proper architecture for a scalable application, learning about new technologies for building my own API, learning about message brokers, pulling my hair out over git’s eccentricities and ultimately, having enough material to write this blog post.

In this post I’m going to break down the different functional components of Zpark, discuss what each does, and why–or not–that component is necessary. If I can achieve one goal, it will be to retire to a tropical island ASAP. If I can achieve a second goal, it will be to give aspiring bot creaters (like yourself, presumably) a strong Continue reading

0

Explain Cisco ETA to Me in a Way That Even My Neighbor Can Understand It

Cisco Encrypted Traffic Analytics (ETA) sounds just a little bit like magic the first time you hear about it. Cisco is basically proposing that when you turn on ETA, your network can (magically!) detect malicious traffic (ie, malware, trojans, ransomware, etc) inside encrypted flows. Further, Cisco proposes that ETA can differentiate legitimate encrypted traffic from malicious encrypted traffic.

Uhmm, how?

The immediate mental model that springs to mind is that of a web proxy that intercepts HTTP traffic. In order to intercept TLS-encrypted HTTPS traffic, there’s a complicated dance that has to happen around building a Certificate Authority, distributing the CA’s public certificate to every device that will connect through the proxy and then actually configuring the endpoints and/or network to push the HTTPS traffic to the proxy. This is often referred to as “man-in-the-middle” (MiTM) because the proxy actually breaks into the encrypted session between the client and the server. In the end, the proxy has access to the clear-text communication.

Is ETA using a similar method and breaking into the encrypted session?

In this article, I’m going to use an analogy to describe how ETA does what it does. Afterwards, you should feel more comfortable about how Continue reading

0

Say Hello to Zpark, my Cisco Spark Bot

For a long while now I’ve been brainstorming how I could leverage the API that’s present in the Cisco Spark collaboration platform to create a bot. There are lots of goofy and fun examples of bots (ie, Gifbot) that I might be able to draw inspiration from, but I wanted to create something that would provide high value to myself and anyone else that choose to download and use it. The idea finally hit me after I started using Zabbix for system monitoring. Since Zabbix also has a feature-rich API, all the pieces were in place to create a bot that would act as a bit of middle-ware between Zabbix and Spark. I call the bot: Zpark.

Instead of relying on Zabbix to initiate an email or SMS to alert me of a new issue, I now route all notifications through Zpark and get notified right within my Cisco Spark client. And since I have the Spark client on all of my devices, I can receive alerts no matter where I am or what I’m doing.

Zpark alerts:

Features

• Relays new Zabbix alerts (which are generated from Zabbix events) to Spark Continue reading

0

2017 End of Year Blog Statistics

Didn’t I just write the 2016 statistics post like…. last week? Another year has flown by and with it another year of attempting to prioritize my writing. I’ll be honest, I’m not optimistic about what I’m going to find when I compare 2017 to 2016. It was a year filled with a lot of change and opportunity so I’ll use that as my excuse as to why I didn’t write as much or as often as I had planned.

I was thinking though: every year I set a goal of writing more posts than the previous year, but that’s only 1 metric to go by. Most of my posts are very detailed and fleshed out. It’s nothing to write a post that’s 1000 words. I regularly eclipse 2000 words and have even hit 3000 words. Perhaps I should be thinking more about word count and not post count? Certainly a 2000 word post takes more effort than a 1000 word post. On the other hand, word count says nothing about quality and could easily lead to excessive wordiness and run-on posts just to tilt the metrics.

Enough musing. Let’s review the data!

Ack. Yep, Continue reading

0

My Personal Look Back on 2017

Continuing in a tradition I started early this year where I take a look back at the year that just passed, I’ve again been very fortunate to have had an amazing year, both in my professional and personal lives. Writing this post is my way of forcing myself to stop and take notice of what I was involved in (something I’m not very good at letting myself do in the moment) and also give readers a chance to see the “me” behind the scenes.

Let’s go through the list!

New Job

In January, I joined the CPOC team at Cisco based in Raleigh, North Carolina. This was something I worked towards over the course of many months in 2016 and was offered the position in late 2016. Come January of 2017, I had fully transitioned from my prior role and was working full time for CPOC. This change set the stage for everything that happened in my professional life during 2017 and if my gut can be trusted, will end up being a major turning point in my career.

The first thing that we had to do as a result of this new job…

We’re Moving!

…was planning to uproot Continue reading

0

3 Ways to Fail at Logging with Flask

For the benefit of readers who haven’t worked with Flask or don’t know what Flask is, it’s a so-called microframework for writing web-based applications in Python. Basically, the framework takes care of all the obvious tasks that are needed to run a web app. Things like talking HTTP to clients, routing incoming requests to the appropriate handler in the app, and formatting output to send back to the client in response to their request. When you use a framework like this, you as the developer can concentrate a lot more on the application logic and worry a lot less about hooking the app into the web.

As you may have guessed from the title of this post, one of the other tasks that Flask manages is logging within the application. For example, if you want to emit a log message when a user logs in or when they upload a new photo, Flask provides a simple interface to generate those log messages.

Flask has a large community of active users built around it and as a result, there’s tons of best practice information out there on scaling, talking to a database, and even whole tutorials on how to Continue reading