AWS Well-Architected Framework

Hi, I'm developping a node js site in EB and inside i use Google API. For this i have a large private key ``` -----BEGIN PRIVATE KEY-----\nihriohioerhfierjfirejfi=\n-----END PRIVATE KEY-----\n ``` I tried to store it inside environment variable but it's limited with 256 characters. EC2 key pair value has the same size limit So my question is: Where do i have to store this key and how can i use it inside my node js app? I found this link but i'm not sure if it's the right way and it's not enough explain (https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/https-storingprivatekeys.html) Thanks for your helplg...

Is there an API for fetching Access Level for the AWS service actions. For Example: iam:ChangePassword has a write Level access. Ref: https://docs.aws.amazon.com/service-authorization/latest/reference/list_identityandaccessmanagement.htmllg...

Is there any expiry date of the security token present in the URL which I got through: ``` Amplify.Storage.getUrl( "ExampleKey", result -> Log.i("MyAmplifyApp", "Successfully generated: " + result.getUrl()), error -> Log.e("MyAmplifyApp", "URL generation failure", error) ); ``` I'm asking this because I want to hardcode the URL in my post model of graphql schema Second question: is it good to hardcode the URL? I'm worried because recently the s3 object URL format got deprecated. Update (September 23, 2020) – Over the last year, we’ve heard feedback from many customers who have asked us to extend the deprecation date. Based on this feedback we have decided to delay the deprecation of path-style URLs to ensure that customers have the time that they need to transition to virtual hosted-style URLs. Like this one day, virtual hosted-style URLs might be deprecatedlg...

Our infrastructure is in AWS. We use AWS Security Group to define inbound/outbound traffic rules. Our servers are ip restricted, as in only traffic from one particular ip is allowed as per the Security Group rule. Say, we have 2 EC2 apps that serve web traffic. And, as per the Security Group rule, only traffic from that one ip is allowed to these servers on port 80 and 443. We now need for these apps to communicate with each other, i.e. send each other HTTP requests. We want the 2 apps to communicate with each other internally because they belong to the same Public Subnet and VPC. If the communication is not internal, traffic from one app would reach the other app via the internet, and this would not be allowed by the existing Security Group rules. Is trying to keep the communication internal between the 2 apps the standard way? I need some guidance on how to best implement this idea.lg...

Does AWS Infrastructure such as AppFlow automatically trust AWS Private CA certs? [This ](https://aws.amazon.com/blogs/awsforsap/share-sap-odata-services-securely-through-aws-privatelink-and-the-amazon-appflow-sap-connector/) page seems to suggest that it does: > The SAP instance must have a certificate installed for end-to-end TLS communication. You can use Amazon private CA for obtaining server certificates and installing them on the SAP system via transaction code STRUST. If you want to terminate the SSL at the load balancer, then you can skip this step and just forward the traffic to the target group on a port where SAP does not require a certificate for SSL communication.lg...

Working on Cost Optimization- **Is it safe to delete the Volume State - Available State - Production Environment?** please suggest.lg...

**What is the advantage of AWS organization management over the account management ? Why take the leap****** Every Company has users and resources they interact with. End of the day - management of these users and resources (allowing the intended and blocking the un-intended usage) is the purpose of our job. Answer is to use an account level strategy or organizational level strategy. In AWS , few years back , focus was on securing an account and VPCs did the separation for production, development and testing stages. [Please understand Separate VPC is as good as a separate datacenter ]. Now idea is promoted that practically each developer or team will have an account and the department will work as an OU and Enterprise will run as a AWS organization - handling this multi account strategy. So along comes SCPs (at the end of the day they are DENY rules). Control Tower and Landing Zone. But the same things can be run on account level. *Are we Securing the blast radius by limiting to an account ? incase of an account compromise ? **I do not agree as firstly* when your running a multi-account system similar cross account access are also in place which needs to be secure along with the basic level account security management. Also top-managing account in organization can be compromised . In fact the attack surface largely increasing onto an other level. Causes difficulties to visibility and monitoring - ( Guard Duty can be enabled for multi accounts and Cloud Trails Aggregator can be used )- but it is getting complicated. Secondly, anyways one has to keep the account secure also. Clear demarcation is possible and good environment can be provided with VPC , Conditional statements , tagging. In case of merger there can be cross account access enabled with external ID. **I am not here to challenge but I want to gain an understanding in why the shift was undertaken. Also any resources in this regard will be great help. Even a comment might help. ****** **lg...

Trusted Advisor is listing that Idle Load Balancers (1) - Reason (Low request count) and Monthly savings($18.00) and LB State is "-" is it safe to delete the LB? please suggest?lg...

I'm new to AWS and NoSQL/DynamoDB. I was wondering if having a GSI with projection type KEYS_ONLY whould use WRU or incur in extra cost when modifying non-key attributes in the original table. For example if a table with PK "id" and GSI-PK "email" would get extra WRU used or cost added when modifying the attribute "city" in the original table. Thank you in advance.lg...

Does Amazon certificate manager Distribute across regions, are they globally available even when internet connections between regions fail?lg...

Hi, want to create an ec2 instance with nitroTPM 2.0 enabled. I followed the instructions from this site: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/enable-nitrotpm-support-on-ami.html ``` { "Images": [ { "Architecture": "x86_64", "CreationDate": "2022-11-21T20:07:43.000Z", "ImageId": "ami-05683f60db56ff1b5", "ImageLocation": "293786889684/DebianImage", "ImageType": "machine", "Public": false, "OwnerId": "293786889684", "PlatformDetails": "Linux/UNIX", "UsageOperation": "RunInstances", "State": "available", "BlockDeviceMappings": [ { "DeviceName": "/dev/xvda", "Ebs": { "DeleteOnTermination": true, "SnapshotId": "snap-0c493ccaccd018881", "VolumeSize": 8, "VolumeType": "gp2", "Encrypted": false } }, { "DeviceName": "/dev/xvdf", "Ebs": { "DeleteOnTermination": true, "VolumeSize": 10, "VolumeType": "gp2", "Encrypted": false } } ], "EnaSupport": true, "Hypervisor": "xen", "Name": "DebianImage", "RootDeviceName": "/dev/xvda", "RootDeviceType": "ebs", "SriovNetSupport": "simple", "VirtualizationType": "hvm", "BootMode": "uefi", "TpmSupport": "v2.0" } ] } ``` So far it looks good, but if I try to launch an instance of this AMI, I cannot connect to the machine. If I create an instance from the management console without nitroTPM support I can connect to the machine via my Key. Also, I would like to get some measurements from the TPM, but I don't see any of the hashes in the response. I appreciate any help you can offer. Heres my ec2 description ``` { "Reservations": [ { "Groups": [], "Instances": [ { "AmiLaunchIndex": 0, "ImageId": "ami-05683f60db56ff1b5", "InstanceId": "i-03435c99e5a3a83b5", "InstanceType": "m6a.xlarge", "KeyName": "OPTI_PLEX_KEY_PAIR", "LaunchTime": "2022-11-21T20:53:29.000Z", "Monitoring": { "State": "disabled" }, "Placement": { "AvailabilityZone": "eu-central-1a", "GroupName": "", "Tenancy": "default" }, "PrivateDnsName": "ip-172-31-16-168.eu-central-1.compute.internal", "PrivateIpAddress": "172.31.16.168", "ProductCodes": [], "PublicDnsName": "ec2-18-159-62-7.eu-central-1.compute.amazonaws.com", "PublicIpAddress": "18.159.62.7", "State": { "Code": 16, "Name": "running" }, "StateTransitionReason": "", "SubnetId": "subnet-12bdf778", "VpcId": "vpc-d90e6cb3", "Architecture": "x86_64", "BlockDeviceMappings": [ { "DeviceName": "/dev/xvda", "Ebs": { "AttachTime": "2022-11-21T20:53:30.000Z", "DeleteOnTermination": true, "Status": "attached", "VolumeId": "vol-05814aff540510c1f" } }, { "DeviceName": "/dev/xvdf", "Ebs": { "AttachTime": "2022-11-21T20:53:30.000Z", "DeleteOnTermination": true, "Status": "attached", "VolumeId": "vol-03027ae670649544f" } } ], "ClientToken": "45856522-8833-4e31-985f-f5209b014fa1", "EbsOptimized": true, "EnaSupport": true, "Hypervisor": "xen", "ElasticGpuAssociations": [], "ElasticInferenceAcceleratorAssociations": [], "NetworkInterfaces": [ { "Association": { "IpOwnerId": "amazon", "PublicDnsName": "ec2-18-159-62-7.eu-central-1.compute.amazonaws.com", "PublicIp": "18.159.62.7" }, "Attachment": { "AttachTime": "2022-11-21T20:53:29.000Z", "AttachmentId": "eni-attach-01e82b7e623e8e9da", "DeleteOnTermination": true, "DeviceIndex": 0, "Status": "attached", "NetworkCardIndex": 0 }, "Description": "", "Groups": [ { "GroupName": "launch-wizard-10", "GroupId": "sg-05676ad26b7f6ed13" } ], "Ipv6Addresses": [], "MacAddress": "02:b8:28:63:4f:fc", "NetworkInterfaceId": "eni-095492d80db0313b8", "OwnerId": "293786889684", "PrivateDnsName": "ip-172-31-16-168.eu-central-1.compute.internal", "PrivateIpAddress": "172.31.16.168", "PrivateIpAddresses": [ { "Association": { "IpOwnerId": "amazon", "PublicDnsName": "ec2-18-159-62-7.eu-central-1.compute.amazonaws.com", "PublicIp": "18.159.62.7" }, "Primary": true, "PrivateDnsName": "ip-172-31-16-168.eu-central-1.compute.internal", "PrivateIpAddress": "172.31.16.168" } ], "SourceDestCheck": true, "Status": "in-use", "SubnetId": "subnet-12bdf778", "VpcId": "vpc-d90e6cb3", "InterfaceType": "interface", "Ipv4Prefixes": [], "Ipv6Prefixes": [] } ], "RootDeviceName": "/dev/xvda", "RootDeviceType": "ebs", "SecurityGroups": [ { "GroupName": "launch-wizard-10", "GroupId": "sg-05676ad26b7f6ed13" } ], "SourceDestCheck": true, "Tags": [ { "Key": "Name", "Value": "Ubuntu bla" } ], "VirtualizationType": "hvm", "CpuOptions": { "CoreCount": 2, "ThreadsPerCore": 2 }, "CapacityReservationSpecification": { "CapacityReservationPreference": "open" }, "HibernationOptions": { "Configured": false }, "Licenses": [], "MetadataOptions": { "State": "applied", "HttpTokens": "optional", "HttpPutResponseHopLimit": 1, "HttpEndpoint": "enabled", "HttpProtocolIpv6": "disabled", "InstanceMetadataTags": "enabled" }, "EnclaveOptions": { "Enabled": true }, "BootMode": "uefi", "PlatformDetails": "Linux/UNIX", "UsageOperation": "RunInstances", "UsageOperationUpdateTime": "2022-11-21T20:53:29.000Z", "PrivateDnsNameOptions": { "HostnameType": "ip-name", "EnableResourceNameDnsARecord": true, "EnableResourceNameDnsAAAARecord": false }, "TpmSupport": "v2.0", "MaintenanceOptions": { "AutoRecovery": "default" } } ], "OwnerId": "293786889684", "ReservationId": "r-0089af1cf650fc657" } ] } ```lg...

We have implemented rest api using api-gateway and lambdas. The user gets authenticated using AWS Cognito and we have role based authorization configured for users. For one specific role we want the user to allow access to the resources based on their source IP address. In order to do that, we are using $context.identity.sourceIp in lambda to determine the request source ip and then proceeding with the authorization. My question is, is it the best way to implement that and can it be easily spoofed?lg...

Hi, with the release of EKS 1.23 and 1.24 we are moving ever closer to the full removal of the PodSecurityPolicy. To replace this the PodSecurity admission controller has been graduated to the beta branch and is now enabled by default. To enforce security we now need to add labels to namespaces, but Kubernetes also allows you to have full control over the AdmissionController's default settings or at least it should according to [this article](https://kubernetes.io/docs/tutorials/security/cluster-level-pss/). My question is: how do I edit the AdmissionController to change the default settings to be more or less restrictive? I am not a super advanced Kubernetes nerd yet, but I think this AdmissionController configuration is supposed to be done on the Kubernetes API server? If that's true, how do I edit it since EKS hides that from me. Thankslg...

When I mount my EFS to a user directory, the directory policy becomes `system_u:object_r:nfs_t:s0`, which is too restrictive - I need it to behave more like a typical user directory, which is `unconfined_u:object_r:user_home_dir_t:s0`. How do I change this?lg...

I have a web application with tomcat, and I configured the jsessionid cookie for samesite=lax, and it prevents CSRF attacks. When I put the application behind an ALB with OIDC authenticator, I encounter the following issue: * ALB cookies explicitly set samesite=none. * The CSRF attack is a form POST submit from an external page. It sends the ALB cookies together with the request, but doesn't send my jsessionid cookie (as expected). * The ALB lets the request pass into the my application. The application sees this is a new session with an authenticated user and treats it as a legitimate request (typically it is the first request of the user after login and redirect from the IDP). It loads the user details and then proceeds with the request. Thus, the CSRF attack succeeds. How can I solve this? Is there a way to change the cookies in the ALB to use samesite=lax?lg...

I am using Ubuntu 20.04 EC2 Instances and was investigating the difference between AWS Inspector Classic and AWS Inspector V2. There seemed to be many differences but the main one was the actual findings. With Inspector Classic a number of CVE would be found while with Inspector V2 the same instance once scanned would say `No Findings`. ### Inspector Classic finds 53 CVE's  ### Same instance with InspectorV2 Just show `No findings`  ------- With Inspector Classic I did attach a rule called `Common Vulnerabilities and Exposures-1.1`. I'm not sure what Inspector V2 actually checks against either. During my search to make this work did find that I needed the following Systems Managers manager Association needed to work `InspectorInventoryCollection-do-not-delete`. It's working now and show success for all ec2 instances. I am unsure if the `InvokeInspectorSsmPlugin-do-not-delete` Association needs to work as well. Not quite sure what this is used for but it shows skipped for all instances and when I look at the detailed status output on a specific instances is just says `InvalidPlatform`. Not sure if this is related. Can InspectorV2 actually be used to check Ubuntu 20.04 CVE's. If so how. Is there some special IAM or SSM config/setup that needs to be applied?lg...

I'm building an HTTP JSON API using API Gateway with a Lambda authoriser that verifies a passed id token (and checks some other properties of the request) and sends info about the user to the backend. I now need a server that acts on behalf of users. Users message that server using a third party (think Signal or WhatsApp) and the server calls some API methods on their behalf. That server knows which third party account the message is coming from and should check whether there is a Cognito user with that account in the user pool. (The third party isn't an identity provider, so we aren't using identity pools but are just storing an account id.) How can I authenticate the server towards the API? Can I get an id token without the users credentials and without a refresh token but just with admin access to Cognito or do I have to add another custom authorisation path to the API? Is this way of authentication secure?lg...

I am using AWS Cognito in my application. I am providing email ID as username. I am able to do registration process for my application. But, while signing through API getting following error:  Previously, I was using username for registration & login. So, its working fine. Now, we have created different user pool in that added 2 client apps 1 which having secret access & another 1 which don't have secret access which we are using through front end for MFA after login process. So, by using this user pool I am getting this error. (Note : Using same Secret & access key for both. Because, both user pools are from same account.) So, Now, I need solution on this, is email ID not valid to set as username in registration process? How can I use email as username?lg...