If you created a presigned URL by using a temporary token, then the URL expires when the token expires, even if you created the URL with a later expiration time. For more information about how the credentials you use affect the expiration time, see Who can create a presigned URL.

So you have to use regular IAM user instead of IAM role for service generating presigned urls..? :-/

• https://tier.engineering/Dependabot-CodeArtifact-Sync

draw.io aws shapes

"Create Amazon MemoryDB Cluster Instances#

You can create Amazon MemoryDB Clusters using the Cluster custom resource"

They really name their CRD "Cluster" ?? :facepalm:

Note à moi même : il faut faire attention aux headers qu'on forward à l'origine dans ce cas précis car ça peut poser des problemes d'authent' entre cloudfront et le bucket s3

Intéressant pour rapatrier plus vite les metrics aws cloudwatch dans datadog

docker exec into fargate container

vs https://registry.terraform.io/modules/cloudposse/eks-workers/aws/latest

cluster : https://registry.terraform.io/modules/cloudposse/eks-cluster/aws/latest

Un container pour émuler en local l'api metadata et ainsi endosser un role
https://github.com/awslabs/amazon-ecs-local-container-endpoints

Another simple solution would be to write a custom MIDDLEWARE which will give the response to ELB before the ALLOWED_HOSTS is checked. So now you don't have to load ALLOWED_HOSTS dynamically.

The middleware can be as simple as:

project/app/middleware.py

from django.http import HttpResponse
from django.utils.deprecation import MiddlewareMixin

class HealthCheckMiddleware(MiddlewareMixin):
def process_request(self, request):
if request.META["PATH_INFO"] == "/ping/":
return HttpResponse("pong")

settings.py

MIDDLEWARE = [
'corsheaders.middleware.CorsMiddleware',
'app.middleware.HealthCheckMiddleware',
'django.middleware.security.SecurityMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
...
]

Django Middleware reference https://docs.djangoproject.com/en/dev/topics/http/middleware/

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-scaling-target-tracking.html
https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-instance-monitoring.html#enable-as-instance-metrics
https://www.terraform.io/docs/providers/aws/r/appautoscaling_policy.html
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-auto-scaling.html

For UDP traffic, the load balancer selects a target using a flow hash algorithm based on the protocol, source IP address, source port, destination IP address, and destination port. A UDP flow has the same source and destination, so it is consistently routed to a single target throughout its lifetime. Different UDP flows have different source IP addresses and ports, so they can be routed to different targets.

people are crazy

SQS first service :|

A faire en superuser:

-- Revoke privileges from 'public' role
REVOKE CREATE ON SCHEMA public FROM PUBLIC;
REVOKE ALL ON DATABASE mydatabase FROM PUBLIC;

-- Create schema
CREATE SCHEMA myschema

-- Read-only role
CREATE ROLE readonly;
GRANT CONNECT ON DATABASE mydatabase TO readonly;
GRANT USAGE ON SCHEMA myschema TO readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA myschema TO readonly;
ALTER DEFAULT PRIVILEGES IN SCHEMA myschema GRANT SELECT ON TABLES TO readonly;

-- Read/write role
CREATE ROLE readwrite;
GRANT CONNECT ON DATABASE mydatabase TO readwrite;
GRANT USAGE, CREATE ON SCHEMA myschema TO readwrite;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA myschema TO readwrite;
ALTER DEFAULT PRIVILEGES IN SCHEMA myschema GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO readwrite;
GRANT USAGE ON ALL SEQUENCES IN SCHEMA myschema TO readwrite;
ALTER DEFAULT PRIVILEGES IN SCHEMA myschema GRANT USAGE ON SEQUENCES TO readwrite;

-- Users creation
CREATE USER reporting_user1 WITH PASSWORD 'some_secret_passwd';
CREATE USER reporting_user2 WITH PASSWORD 'some_secret_passwd';
CREATE USER app_user1 WITH PASSWORD 'some_secret_passwd';
CREATE USER app_user2 WITH PASSWORD 'some_secret_passwd';

-- Grant privileges to users
GRANT readonly TO reporting_user1;
GRANT readonly TO reporting_user2;
GRANT readwrite TO app_user1;
GRANT readwrite TO app_user2;

interessant

Gestion multi compte aws

olded by https://docs.aws.amazon.com/fr_fr/AmazonECS/latest/developerguide/specifying-sensitive-data.html

from ifttt pocket

• https://www.youtube.com/watch?v=52G2T1V_UJ4

Use role in script

SYNOPSIS
get-login
[--registry-ids <value> [<value>...]]
[--include-email | --no-include-email]

OPTIONS
--registry-ids (string) A list of AWS account IDs that correspond to
the Amazon ECR registries that you want to log in to.

   --include-email | --no-include-email (boolean) Specify if the '-e' flag
   should  be  included in the 'docker login' command. The '-e' option has
   been deprecated and is removed in docker version 17.06 and  later.  You
   must specify --no-include-email if you're using docker version 17.06 or
   later. The default behavior is to include the '-e' flag in the  'docker
   login' output.

To apply this lifecycle rule to all objects in the bucket, choose Next.

That's why wildcard was not working :D

aws dynamodb scan --table-name foo

--path

aws s3 ls s3://bucket/path/ --recursive --summarize | grep "Total Objects:"

So you can put your data into glacier with 2 differents ways:
1) directly to glacier via API
2) Store them to s3 then with a management policy, it'll go to Glacier

Warning : Huge cost when you download from glacier and when you delete before 3 months

aws efs describe-file-systems| jq '.FileSystems|.[]|[.Name, .SizeInBytes.Timestamp, .SizeInBytes.Value]' -c

Retourne une ligne par EFS
Sur chaque ligne, un array avec :
[0] = nom de l'efs
[1] = timestamp du moment où la taille a été calculée
[2] = la taille en bytes

Pour avoir la taille en GB :

aws efs describe-file-systems| jq '.FileSystems|.[]|[.Name, .SizeInBytes.Timestamp, .SizeInBytes.Value / 1024 /1024 / 1024]' -c

aws efs describe-file-systems| jq '.FileSystems|.[]|[.Name, .SizeInBytes.Value / 1024 /1024 / 1024]' -c

why EFS sucks