Pawan Udassi @udasssi

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟴𝟮 Working on terraform drift for a usecase. While this is a classic problem, we are looking at a few different solutions. We have to decide whether to let terraform manage existing infra or manage that outside.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟴𝟭 Working on EMR version upgrade for Data Processing Workloads. There are lots of breaking changes and so therefore the task is uphill. So many moving components and they all need to sync well for it all to work properly.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟴𝟬 𝗤𝘂𝗶𝗰𝗸𝗦𝗶𝗴𝗵𝘁 𝗗𝗮𝘀𝗵𝗯𝗼𝗮𝗿𝗱 𝗩𝗶𝘀𝗶𝗯𝗶𝗹𝗶𝘁𝘆 Working on controlling public visibility for AWS QuickSight dashboards within the account. The goal is to prevent users from sharing dashboards with everyone at once.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟳𝟵 Working on AWS API Gateway configuration. Security is always the topmost priority and henceforth requires lots of architectural thinking. API type, authoriser and resource policy are some of the important things security-wise.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟳𝟳 Working on setup of New Relic Dashboard for an application. I have not worked on APM much and so looking forward to learn some new things. Apart from infrastructure monitoring, they need application level metrics and traces as well.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟳𝟲 Compared RDS instance types for cost optimization, I assumed serverless would be ideal due to low baseline load. But the autoscaling overhead made serverless more expensive than a fixed-size instance.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟳𝟱 Worked on docker compose manifests today after a long time. For smaller scales, docker compose alone is simply a better fit actually. I have seen Kubernetes being an overkill in a lot of scenarios.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟳𝟰 One of the ec2 servers running docker containers ran out of space today. So I just cleared up unused docker images and in minutes got more than 30gigs of storage freed.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟳𝟯 Was working on fixing up vulnerable docker images today. One highlight way that does the job pretty well is actually updating the packages to the latest version. This alone fixed bulk of the vulnerabilities.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟳𝟭 EKS workloads use service account with explicit IAM role association to access AWS resources. If not specified, pods utilise the IAM Role attached to the Node running it. The best approach nevertheless is service accounts.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟳𝟬 Was working on a network request getting rejected from DMS to RDS. I checked everything from security groups to Subnet Route Tables to NACLs. The issue was with the outbound rules in security group missing allow rule.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟲𝟴 One of the Kubernetes Nodes went into Not Ready state today. Some pods errored out and were getting restarted again and again. Which led to the containerd process to get burst of load and ultimately node was marked Not Ready.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟲𝟳 Kubernetes Secrets are not by default encrypted at rest. But EKS actually encrypts the secrets and also other API objects by default using KMS. This is in addition to the raw encryption of EBS volumes which store the etcd data.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟲𝟲 Over time, I’ve started to really understand how useful AWS CloudShell is. Anything you can do on the console, you can do with the CLI — but not everything you do with the CLI can be done on the console.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟲𝟱 IP based Access policies can be used to restrict access to certain resources in AWS. The interesting thing is that if you exclude your own IP from the Allow list, you lose console access to resource yourself.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟲𝟰 AWS Quicksight is a great data visualization tool. But it lacks view of the exact usage statistics at user level which can help bring down costs. So working on a custom QuickSight Dashboard which tracks the usage of the platform.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟲𝟯 Deleted a LoadBalancer-type Service in Kubernetes today, but it got stuck in Terminating. The root cause was deletion protection being enabled on the AWS load balancer, which blocked its removal.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟲𝟮 Working on s3 buckets security. There is one setting which overrules them all, "Block all public access". If set to true, no one can access the objects over the public internet without explicit credentials.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟲𝟭 IAM users can be restricted based on the source IP the request is coming from. I did not know that before today. And it actually limits the scope of any risk in case credentials gett into wrong hands. Working on one such usecase.

𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗗𝗲𝘃𝗢𝗽𝘀 𝗗𝗮𝘆 𝟭𝟲𝟬 A newly migrated application was facing user session management issues. The sessions were set/unset on a DB which ends connections after a while. The fix was application code handling connection pools to RDS in graceful manner.