Sergei 🇺🇦

Ukrainian-born 🇺🇦 Canadian 🇨🇦, living in Indonesia 🇮🇩. Recovering BOFH with 20+ years of IT experience. The posts are my own.

[Sergei 🇺🇦 @sshvetsov]

@iann0036 Cool. Now I want that for NAT Gateways.

[Aidan W Steele @__steele]

The AWS CLI (v2.12.0+) can be used to create a tunnel to connect to RDS DBs now, but I created a tool that tries to make it more convenient.

1. Create EIC endpoint
2. Download tool
3. Run `rdsconn p`
4. Run `psql -h 127.0.0.1 ...`

https://t.co/kItMSmKvn1

[Sergei 🇺🇦 @sshvetsov]

@__steele @deleugyn @ben11kehoe @benbridts Here's hoping 🤞

[Sergei 🇺🇦 @sshvetsov]

@__steele @deleugyn @ben11kehoe @benbridts There also an option to use EIC endpoint and privat IP range instead of using instance ID: --instance-connect-endpoint-id, --private-ip-address.

[Sergei 🇺🇦 @sshvetsov]

This is awesome and should have been the main announcement instead of AWS touting new way to use SSH.

[Aidan W Steele @__steele]

@ben11kehoe @benbridts I've dug through the AWS CLI code and reimplemented it. This API *can* be used to connect to an RDS instance, I just queried my Aurora Postgres DB with it.

So that's one reason to like this over Session Manager (zero EC2 instances required)

[Aidan W Steele @__steele]

@ben11kehoe @benbridts I've dug through the AWS CLI code and reimplemented it. This API *can* be used to connect to an RDS instance, I just queried my Aurora Postgres DB with it.

So that's one reason to like this over Session Manager (zero EC2 instances required)

[Sergei 🇺🇦 @sshvetsov]

@__steele Are you trying to see of you can make it work for RDS and such? That wa smy first thought when I saw the announcement.

[Sergei 🇺🇦 @sshvetsov]

#AWS #Config can finally exclude specific resource types from change tracking https://t.co/VRQ7QMZeSP. Unfortunately, no #CloudFormation support, meaning customers are left to configure exclusions manually for each account and default and opted-in region in their organization.

[Sergei 🇺🇦 @sshvetsov]

@mikejulian No counter arguments from me. In fact, been doing exactly this since 2020 - using public on-demand pricing from CUR to show usage to each team/project/environment and managing all discounts centrally. Only wish Cost Explorer had this option built-in. #awswishlist

[Nick Smit @nickste]

I'm excited to announce the Amazon EventBridge Event Bus latency improvements are now live in all AWS Regions 🚀! We're observing p50 of 90ms and p90 of 140ms - an 80% improvement in latency. 🧵
https://t.co/f7lx1fks1O

[Aidan W Steele @__steele]

Last batch of tickets for the best conference of the year goes on sale in a few days. I’ll be there!

[Olaf Conijn @OConijn]

Calling all Security Hub and IaC geeks to join me at: https://t.co/GJ9xVJAXDD

[Sergei 🇺🇦 @sshvetsov]

@iann0036 @shmick @awscloud OMG, this is a such a ridiculous quota... @awscloud, this makes no sense and needs to change. #awswishlist

[Aidan W Steele @__steele]

To answer @QuinnyPig's question: I implemented something like this, and I want to implement it again. IMO, enriched VPC flow logs are an untapped source of extremely valuable data. I just don't have access to realistic training data and need help. Blog:
https://t.co/yef7Lh6N8W

[Sergei 🇺🇦 @sshvetsov]

@ChrisShort Yeah. Instead of
automatically using default and backup payment methods, we have to configure autorenewal for each product. If you change CC, you have to remember to reconfigure. Very error prone.

[Sergei 🇺🇦 @sshvetsov]

@ChrisShort Similar thing nearly happened to me recently. Apparently namecheap has a weird, somewhat hidden setting for domain autorenewal, where you have to chose the card to be used per domain, instead of relying on default payment method on file. Not sure when they introduced this.

[Sergei 🇺🇦 @sshvetsov]

@__steele Well deserved!

[Aidan W Steele @__steele]

tl;dr you can now generate CloudWatch metrics via EMF simply by formatting the logs correctly - no need to screw around with request headers. This makes it much easier to use with ECS

[Troy Hunt @troyhunt]

Please RT! Help @LogMeIn understand the impact of allowing scammers to easily use their product: http://t.co/46B0AlRq

[Sergei 🇺🇦 @sshvetsov]

Finally! I remember arguing with AWS reps about this 3 or so years back. What sucks is that this metric still isn't in CloudWatch by default.

[Nick Matthews @nickpowpow]

If you use both inbound and outbound security group rules in AWS, you only have a certain amount of connections you can maintain until new connections are rejected. Previously a technicality only in the docs, there is now a user facing metric: https://t.co/HFPETiarsd