aws ec2 create-volume --size 40 --availability-zone eu-west-1a --volume-type gp2|grep -Eo 'vol-[^"]+'|xargs -I % aws ec2 create-tags --resources % --tags Key=Name,Value=my_name
bin/customiseInstance.sh - This script is run on startup of an elastic instance. We recommend that you do not customize this script, as it is overwritten when rewarmEbsSnapshot.sh is run.
Shaarli now uses Composer to handle its dependencies: master branch tarball no longer works out of the box. Use our release archives, or follow the install documentation.
:(
EB
IAM
EC2
ELB
ECS
ELB
ECS
S3
RDS(Aurora)
VPC
Subnets
Routing
NAT
ACLs
Security groups
Group policy
Cloudwatch
Flowlogs
aws logs get-log-events --log-group-name XX --log-stream-name YY --start-time 1476350746000
Je commence à bien aimer aws.
Q: What is a DB Subnet Group and why do I need one?
A DB Subnet Group is a collection of subnets that you may want to designate for your RDS DB Instances in a VPC. Each DB Subnet Group should have at least one subnet for every Availability Zone in a given Region. When creating a DB Instance in VPC, you will need to select a DB Subnet Group. Amazon RDS then uses that DB Subnet Group and your preferred Availability Zone to select a subnet and an IP address within that subnet. Amazon RDS creates and associates an Elastic Network Interface to your DB Instance with that IP address.
Please note that, we strongly recommend you use the DNS Name to connect to your DB Instance as the underlying IP address can change (e.g., during a failover).
For Multi-AZ deployments, defining a subnet for all Availability Zones in a Region will allow Amazon RDS to create a new standby in another Availability Zone should the need arise. You need to do this even for Single-AZ deployments, just in case you want to convert them to Multi-AZ deployments at some point.
ngrep pas glop quand https, du coup :
sudo apt install mitmproxy
mitmdump -v -d
Dans l'application, configurer la lib (curl ou autre..) pour utiliser un proxy http/https sur 127.0.0.1:8080 (mitmdump écoute sur ce port)
ou bien plus violent :
sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080
Dans tous les cas, la lib va raler car certif pas ok : utiliser insecure si possible dans l'app ou bien generer certif et le trust au niveau de l'os
à partir de là on peut voir les call/response avec mitmdump
eh bah, 25000$ de redevance annuelle pour un tld
ya interet à en vendre du domaine pour rentabiliser cette redevance
So, an elastic ip and an igw in the routing table are two criterion for an instance to be available directly from the internet. Subnets with such routing tables attached to them are also known as public subnets (non-local traffic routed to internet gateway), as any instance with an elastic ip can be publicly available from this subnet.
Options interessantes : --quick --single-transaction
Intéressant comme workflow, l'objectif est de laisser les users/soft créer des EC2 comme ils veulent et avoir les droits seulement sur les EC2 qu'ils ont créé.
Comment ça marche ? auto tagging des EC2 avec l'userid à la création couplé avec une policy qui autorise les action seulement si le tag avec l'userid est présent.
pacon
Dans le meme genre sans l'auto tagging :
http://blogs.aws.amazon.com/security/post/Tx29HCT3ABL7LP3/Resource-level-Permissions-for-EC2-Controlling-Management-Access-on-Specific-Ins
woot nice! ça peut être bien utile
via Doo
ça a l'air un peu plus compliqué qu'avec irc à première vue