Cheat Sheet
Useful AWS tricks.
Last updated
Useful AWS tricks.
Last updated
Make sure your IAM user has the following policy attached to it.
Go to your AWS console, Services, Elastic Container Service.
Click on Create Repository.
Input your repository name and click on Next Step. AWS console will show pretty much the same instructions bellow.
Export your AWS credentials.
To retieve AWS ECR login command, run:
The return will be something like this:
Copy and run your login command.
Tag your Docker image (replace with your info):
Then push it to AWS ECR.
Create a Security Group that will be used for your lambda function.
Go to your lambda function setup on the AWS console.
Put the Lambda function in the same RDS VPC.
Add the Lambda function in all subnets.
Add the Security Group you just created.
In your RDS security group, allow your lambda function security group.
Go to Services -> VPC -> Endpoints -> Create Endpoint.
Select AWS Services as the Service category, and then, in the Service Name list, select the Secrets Manager endpoint service named com.amazonaws.us-west-2.secretsmanager
Specify the VPC you want to create the endpoint in. For this post, I chose the VPC named vpc-5ad42b3c where my RDS instance and application are running.
To create a VPC endpoint, you need to specify the private IP address range in which the endpoint will be accessible. To do this, select the subnet for each Availability Zone (AZ). This restricts the VPC endpoint to the private IP address range specific to each AZ and also creates an AZ-specific VPC endpoint. Specifying more than one subnet-AZ combination helps improve fault tolerance and make the endpoint accessible from a different AZ in case of an AZ failure. Here, I specify subnet IDs for availability zones us-west-2a, us-west-2b, and us-west-2c:
Associate a security group with this endpoint. The security group enables you to control the traffic to the endpoint from resources in your VPC. For this post, I chose to associate the security group named sg-07e4197d that I created earlier. This security group has been set up to allow all instances running within VPC vpc-5ad42b3c to access the Secrets Manager VPC endpoint. Select Create endpoint to finish creating the endpoint.
To view the details of the endpoint you created, select the link on the console.
The Details tab shows all the DNS hostnames generated while creating the Amazon VPC endpoint that can be used to connect to Secrets Manager. I can now use the standard endpoint secretsmanager.us-west-2.amazonaws.com or one of the VPC-specific endpoints to connect to Secrets Manager within vpc-5ad42b3c where my RDS instance and application also resides.
Now that I have created the VPC endpoint, all traffic between my application running on an EC2 instance hosted within VPC named vpc-5ad42b3c and Secrets Manager will be within VPC. This connection will use the VPC endpoint and I can use it to retrieve my RDS database secret stored in Secrets Manager. I can retrieve the secret via the AWS SDK or CLI. As an example, I can use the CLI command shown below to retrieve the current version of my RDS database secret:
Go to AWS Secrets Manager -> Secrets -> YOUR SECRET
Get the examples in "Sample code" and add to your lambda function code.
Head over to EC2 –> Volumes and create a new volume of your preferred size and type.
Select the created volume, right click and select the "attach volume" option.
Select the instance from the instance text box as shown below.
Now, login to your ec2 instance and list the available disks using the following command.
Example output:
In this case, the device name is xvdf
Make sure the volume has no data:
Example output:
Format the disk:
Label the disk:
Mount the disk:
Configure fstab:
Add:
Test fstab:
Create a snapshot of the volume you want to increase size.
Create a new volume from the snapshot.
Attach the new volume.
SSH to the instance an run:
Umount current volume:
Edit fstab, comment out the old volume and add the new one:
Mount it:
Select the Enable Private DNS Name checkbox for the VPC endpoint. Private DNS resolves the standard Secrets Manager DNS hostname ..amazonaws.com. to the private IP addresses associated with the VPC endpoint specific DNS hostname. As a result, you can access the Secrets Manager VPC Endpoint via the AWS Command Line Interface (AWS CLI) or AWS SDKs without making any code or configuration changes to update the Secrets Manager endpoint URL.
Since my AWS CLI is configured for us-west-2 region, it uses the standard Secrets Manager endpoint URL . This standard endpoint automatically routes to the VPC endpoint since I enabled support for Private DNS hostname while creating the VPC endpoint. The above command will result in the following output:
s4cmd:
