Do you want a secure and convenient way to access internal AWS resources - like RDS databases or EC2 instances - from your local machine? Me too! Thanks to AWS Systems Manager (SSM), you can get shell access to EC2 instances without opening any inbound ports. Even better, since 2022, AWS also supports port forwarding over SSM, allowing access to nearly any internal AWS resource from your laptop - without requiring a bastion host with internet access. ...

A well-designed network architecture is the backbone of any cloud infrastructure. It ensures better performance, security, resilience, and easier troubleshooting. Additionally, choosing the right networking solutions can optimize costs by leveraging AWS services that align with your application’s needs. This article focuses on complex, large-scale setups where multiple teams operate across multiple AWS accounts and regions. Let’s dive into AWS’s networking offerings and explore the best options for connecting Virtual Private Clouds (VPCs) and external networks. This guide compares VPC Sharing, VPC Peering, AWS Transit Gateway (TGW), and AWS Cloud WAN, highlighting their use cases, advantages, and limitations. ...

Introduction Pre-commit is a framework for managing and enforcing Git pre-commit hooks. It helps automating code quality checks before committing changes, ensuring that issues like formatting, linting, and security vulnerabilities are caught early. Essentially, pre-commit runs a range of checks automatically before each Git commit. Not only does it highlight issues, but it can also fix them before they even make it into your repository. ...

I’ve just earned all three AI/ML AWS certifications and want to share my subjective thoughts about each certificate in particular. Inspiration I decided to pursue these three AWS AI/ML certifications after attending re:Invent 2024 in Las Vegas. Nearly every talk revolved around AI - how to integrate AI into workloads or how AI is already transforming solutions both within and beyond AWS. ...

Introduction Topology Aware Routing (TAR) is a Kubernetes feature designed to keep traffic within the same availability zone (AZ). This can reduce cross-AZ traffic costs on cloud providers like AWS and GCP, where inter-AZ traffic incurs charges. Additionally, it can lower latency by keeping network requests local. However, TAR is not a silver bullet. While it helps optimize costs and performance, it strictly prohibits cross-zone traffic, regardless of the system’s health or workload distribution. This limitation can lead to unintended service disruptions. ...

Public IP Address You can always use your own nginx instead of using 3rd party services when you need to know your public IP. Like this: # Public IP location = /ip { default_type text/plain; return 200 $remote_addr; } Or if you need it in JSON format like this: # Public IP JSON location = /ip_json { default_type application/json; return 200 "{\"ip\":\"$remote_addr\"}"; }

WebP is a modern image format that offers better compression while maintaining high image quality. By using WebP, websites can reduce image file sizes significantly, improving page load speed and overall performance. Installing cwebp To convert PNG images to WebP, we need to install cwebp, a tool that compresses images into the WebP format. It supports input formats like PNG, JPEG, TIFF, WebP, and raw Y’CbCr samples, but does not support animated PNG or WebP files. ...

When you need to get a certificate from a service like Let’s Encrypt, you must validate ownership of the domains for which you are issuing a certificate. This is achieved using challenges. But what types of challenges are available? 1. HTTP-01 Challenge The most common and widely used type is the HTTP-01 challenge. With this method, you receive a token that must be placed in your web server at the following path: ...

When configuring new receivers or testing templates in Alertmanager, you might need to generate dummy alerts to see how everything works. Instead of manually creating and sending alerts, I use a simple bash script to streamline the process. The Script Below is the script I use to generate and resolve dummy alerts. It sends a POST request to Alertmanager’s API to simulate an alert. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 #!/bin/bash name=$RANDOM url='http://localhost:9093/api/v2/alerts' default_severity='warning' instance='127.0.0.1' instance_name='test-instance' send_alert() { local status=$1 local custom_severity=$2 local current_severity=${custom_severity:-$default_severity} curl -XPOST $url -H "Content-Type: application/json" -d "[ { \"status\": \"$status\", \"labels\": { \"alertname\": \"$name\", \"service\": \"my-service\", \"severity\":\"$current_severity\", \"instance\": \"$instance\", \"instance_name\": \"$instance_name\" }, \"annotations\": { \"summary\": \"This is a test alert\", \"title\": \"Test Alert\", \"description\": \"Test alert has been triggered.\" }, \"generatorURL\": \"https://prometheus.local/<generating_expression>\" } ]" echo "" } # Main script echo "Firing up alert $name" send_alert "firing" "$1" read -p "Press enter to resolve alert" echo "Sending resolve" send_alert "resolved" "$1" How It Works The script starts by generating a random alert name ($RANDOM) to ensure each alert is unique. It sets a default severity (warning) and other labels such as instance and instance_name. The send_alert function sends a POST request to Alertmanager’s API endpoint (http://localhost:9093/api/v2/alerts) with a payload containing the alert’s status, labels, and annotations. The script fires an alert, waits for user input, and then resolves the alert. Example Output Running the script will output something like this: ...

When running a website behind a load balancer and Cloudflare, handling client IPs in Nginx can be tricky. Different setups use different headers to pass the real IP: Custom Domains via Cloudflare: Cloudflare sends the real client IP in the CF-Connecting-IP header. Direct CNAME to Load Balancer: The load balancer sets the real client IP in the X-Forwarded-For header. What is the challenge? Nginx’s real_ip_header directive doesn’t support variables. This limitation means you can’t conditionally choose between headers like X-Forwarded-For and CF-Connecting-IP. ...