Building a new AMI is only part of updating EC2 instances. We still need to tell the Auto Scaling group to use it and replace the instances running the old image. EC2 Image Builder can write the output AMI ID to a parameter during distribution. A launch template can reference that parameter directly. The remaining part is to start an instance refresh when the value changes, which is not something natively supported by AWS. ...
When terragrunt plan on a single module takes over two minutes before showing a single AWS API call, something is wrong. This post covers two distinct performance problems I found and fixed in a large multi-account Terragrunt setup (~15 AWS accounts, 400+ modules). The Problem Running terragrunt plan on our EKS cluster module was taking 2 minutes 27 seconds just to start. With debug logging enabled, the culprit was clear: ...
Earlier this year, AWS had a major Availability Zone outage in us-east-1. Only one AZ went down, but if your workloads were running there, you know how it went: alerts firing, runbooks open, manual fixes, and a race to move traffic before customers noticed. For those who were not lucky enough to be in a different AZ, it raised an obvious question: why isn’t there a button for this? There is. It’s called ARC Zonal Shift. ...
Identity-Driven Access via Bastion Host and Active Directory Note Part 1 covers SSM port forwarding as a zero-trust replacement for VPN - identity-driven access to internal AWS resources without VPN or SSH keys. ...
Identity-Driven Access to Internal Resources Using AWS SSM Port Forwarding and ABAC Traditional access to private AWS infrastructure usually relies on VPN connectivity and direct subnet reachability. It works, but it also increases attack surface, enables lateral movement, and makes auditing harder. This article describes a different approach: An identity-driven, zero-trust access model built on: AWS IAM Identity Center (SSO + MFA) (Optional) AWS Systems Manager Session Manager port forwarding Attribute-Based Access Control (ABAC) No direct subnet access. No shared passwords. No SSH key distribution. ...
There is a great article on the AWS Blog: How to use AWS Secrets Manager and ABAC for enhanced secrets management in Amazon EKS . The only downside of that approach is that it uses OpenID Connect (OIDC) and IRSA for authentication. But there is now a better and simpler option: Amazon EKS Pod Identity . ...
AWS infrastructure changes notifications with Slack CloudTrail is a powerful service that helps audit the actions of users and roles in your AWS account. It can be integrated with other services to improve the way you react to infrastructure changes. This is especially useful for large projects. In this article, we’ll describe both a basic and an improved way to track infrastructure changes in your AWS account and send notifications to Slack. ...
Reducing Cross-AZ Traffic in AWS and Avoiding NAT Loopback Pitfalls Recently, we decided to reduce cross-AZ traffic in our AWS environment to save on data transfer costs and improve latency. Current Setup Here’s a simplified view of our setup: NLB -> ingress-nginx -> containers Inside our EKS cluster, we enabled Topology Aware Routing . On the NLB and its target group, we: ...
Do you want a secure and convenient way to access internal AWS resources - like RDS databases or EC2 instances - from your local machine? Me too! Thanks to AWS Systems Manager (SSM), you can get shell access to EC2 instances without opening any inbound ports. Even better, since 2022, AWS also supports port forwarding over SSM, allowing access to nearly any internal AWS resource from your laptop - without requiring a bastion host with internet access. ...
A well-designed network architecture is the backbone of any cloud infrastructure. It ensures better performance, security, resilience, and easier troubleshooting. Additionally, choosing the right networking solutions can optimize costs by leveraging AWS services that align with your application’s needs. This article focuses on complex, large-scale setups where multiple teams operate across multiple AWS accounts and regions. Let’s dive into AWS’s networking offerings and explore the best options for connecting Virtual Private Clouds (VPCs) and external networks. This guide compares VPC Sharing, VPC Peering, AWS Transit Gateway (TGW), and AWS Cloud WAN, highlighting their use cases, advantages, and limitations. ...