Aws
what does it mean?
alb Application Load Balancer acm AWS Certificate Manager CloudFormation Iac Infrastructure as code cloudfront cdn Content Delivery Network cloudwatch monitoring and management service that provides data and actionable insights. cwagent cloud watch agent. DynamoDB NoSQL database ebs elastic block storage ecr Elastic Container Registry ecs Elastic Container Service. efs Elastic File System eks Elastic Kubernetes Service elb Elastic Load Balancing fargate Fargate is a serverless compute service that can run containers on ECS or EKS. iam Identity and Access Management imds Instance Metadata Service. kenesis analyzing real-time streaming data kms key management Service lambda is an event-driven, serverless computing platform provided lbc Load Balancer Controller nlb Network Load Balancer peering connection Networking connection established between two VPC. sg Security group sid "statement ID" as an optional identifier for the policy statement. Must be uniq in the json statement. sns Simple Notification Service. message bus. sqs Simple Queue Service ssm "Amazon Simple Systems Manager" "Amazon EC2 Systems Manager" Now known as AWS Systems Manager ssm agent Systems Manager Agent runs on EC2 makes it possible for Systems Manager to manage,resources. sts Security Token Service transit gateway service that simplifies and centralises the management of connectivity between multiple VPCs, VPN connections, and on-premises networks. waf web application firewall vpc Virtual Private Cloud vgw Virtual Private Gateway. VPN endpoint on the AWS side of a Site-to-Site VPN connection.
documentation
https://awscli.amazonaws.com/v2/documentation/api/latest/reference/index.html
aws completion
complete -C '/usr/bin/aws_completer' aws
version
aws --version
configure aws
aws help config-vars
whoami
aws sts get-caller-identity
which groups do I belong to
aws iam list-groups
list databases
aws rds describe-db-instances
List databases short version
aws rds describe-db-instances --region=eu-west-1 --query 'DBInstances[*].[DBInstanceArn,Engine,DBInstanceIdentifier]'
List databases in all regions
aws account list-regions | jq -r '.Regions[]| select(."RegionOptStatus" == "ENABLED_BY_DEFAULT")|.RegionName' | while read REGION ; do echo '*' ${REGION} ; aws rds describe-db-instances --region=${REGION} | jq -r '.DBInstances[]| .DBInstanceIdentifier +"\t"+ .DBInstanceClass +"\t"+ .Engine +"\t"+ .DBName' | column -t -s $'\t' ; done
list events
aws rds describe-events aws rds describe-events --duration 10080 aws rds describe-events --duration 10080 --region=eu-west-1 --source-identifier admin-db-test-01 --source-type db-instance
list logfiles
aws rds describe-db-log-files --region=eu-west-1 --db-instance-identifier admin
view logfiles
aws rds download-db-log-file-portion --region=eu-west-1 --db-instance-identifier admin --log-file-name error/mysql-error-running.log.2022-05-05.14 --output text
List files in s3
aws s3 ls
Create bucket
aws --endpoint-url http://localhost:9000 s3 mb s3://minsio make_bucket: minsio
Push files to bucket.
aws --endpoint-url http://localhost:9000 s3 sync . s3://minsio
remove files from s3 bucket
aws s3 rm s3://<bucket> --recursive --exclude '*' --include '<path>-*.gz'
Do files expire
aws s3api get-bucket-lifecycle-configuration --bucket <bucket>
undelete revision controlled files
export BUCKET=ginatricot-iac-terraform-state-eu-north-1 ; export PREFIX=ginatricot/eu-north-1/kafka/observability/terraform.tfstate ; aws s3api list-object-versions --bucket "${BUCKET}" --prefix "${PREFIX}" --output json --query 'DeleteMarkers[?IsLatest==`true`].VersionId' | jq '.[]' -r | xargs echo aws s3api delete-object --bucket "${BUCKET}" --key "${PREFIX}" --version-id
eksctl install
curl --silent --location "https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$(uname -s)_amd64.tar.gz" | sudo tar xz -C /usr/local/bin
list users
eksctl get iamidentitymapping --cluster kafka-cluster
list eks clusters
aws eks list-clusters --region eu-north-1
grant access to eks cluster
eksctl create iamidentitymapping --cluster kafka-cluster --arn <arn> --group system:masters --username ops-user
configure for kubectl
aws eks update-kubeconfig --name kafka-prod-cluster aws eks update-kubeconfig --name kafka-prod-cluster --role-arn arn:aws:iam::288898264342:role/eks-cluster-role-kafka-prod-cluster
list roles
aws iam list-roles | jq -r '.Roles[].RoleName'
List roles with specific attribute
aws iam list-roles --query "Roles[?RoleName=='Administrator']"
assume role
aws sts assume-role --role-arn arn:aws:iam::288898264342:role/eks-cluster-role-kafka-prod-cluster --role-session-name eks-cluster-role-kafka-prod-cluster
save assume role policy
aws iam list-roles --query "Roles[?RoleName=='Administrator']" | jq '.[].AssumeRolePolicyDocument' > /temp/aws_iam_list-roles.$(date_file).json
grant access to assume role
aws iam update-assume-role-policy --role-name Administrator --policy-document file:///<full_path_to_file>.json { "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Principal": {"AWS": [ "arn:aws:iam::442031788965:root", "arn:aws:sts::203144576027:assumed-role/rb-sso/abjorklund" ]}, "Action": "sts:AssumeRole" } }
list users
aws iam list-users | jq -r '.Users[].UserName'
get info about certain user
aws iam get-user --user-name abjorklund
list ec2 instances
aws ec2 describe-instances | jq -r '.Reservations[].Instances[] | [.PrivateIpAddress, .InstanceType, .KeyName, .PublicIpAddress, (.Tags[] | .Key, .Value)] | join("\t")' | column_tab | less
list vpcs
aws ec2 describe-vpcs $@ | jq -r '.Vpcs[] | [.CidrBlock, .VpcId, (.Tags[]?|join(":"))] | @tsv'
vpc peering
List connections between vpc:s
aws ec2 describe-vpc-peering-connections | jq -r '.VpcPeeringConnections[] | .AccepterVpcInfo.CidrBlock +" "+ .AccepterVpcInfo.VpcId +" "+ .AccepterVpcInfo.Region +" "+ .RequesterVpcInfo.CidrBlock +" "+ .RequesterVpcInfo.VpcId +" "+ (.Tags[] | select(.Key=="Name").Value)'
list securitygroups
aws ec2 describe-security-groups | jq -r .SecurityGroups[].GroupName aws ec2 describe-security-groups | jq -r '.SecurityGroups[]|{GroupName: .GroupName,VpcId: .VpcId, Description: .Description, IpPermissions:.IpPermissions[],IpPermissionsEgress:.IpPermissionsEgress[]}, (.Tags[]?|join(":"))'
list accounts
aws organizations list-accounts --query 'Accounts[*].[Name, Id]' --output table
List info about Account.
aws organizations list-accounts | jq '.Accounts[]|select(.Id=="974752708905")'
vip/irule
cloudfront -> distribution -> behaviour
origin
Where to shoot request.
list load balancers
aws elbv2 describe-load-balancers | jq -r '.LoadBalancers[].LoadBalancerName'
try to access listeners
aws elbv2 describe-load-balancers | jq -r '.LoadBalancers[] | .DNSName +" "+ .VpcId +" "+ .LoadBalancerArn' | while read DNSName VpcId LoadBalancerArn ; do PORTS=$(aws elbv2 describe-listeners --load-balancer-arn $LoadBalancerArn | jq -r '.Listeners[]?|.Port') ; for Port in $PORTS ; do echo $DNSName $VpcId $(nc -w1 -zv $DNSName $Port 2>&1 ) ; done ; done
route53
List names of hosted zones.
aws route53 list-hosted-zones-by-name | jq -r '.HostedZones[]|.Name +"\t"+ .Id'
List info about recored
aws route53 list-resource-record-sets --hosted-zone-id ZLFXGSK6FVL46 ... { "Name": "akhq.inter.net.", "Type": "CNAME", "TTL": 300, "ResourceRecords": [ { "Value": "internal-k8s-kafka-akhq-30d3a6b6ec-1273651003.eu-north-1.elb.amazonaws.com" } ] }, ...
Update cname.
aws route53 change-resource-record-sets \ --hosted-zone-id AAAABBBBB \ --change-batch '{"Changes":[{"Action":"UPSERT","ResourceRecordSet":{"Name":"akhq.inter.net.","Type":"CNAME","TTL":300,"ResourceRecords":[{"Value":"internal-k8s-kafka-akhq-30d3a6b6ec-1805732719.eu-north-1.elb.amazonaws.com."}]}}]}'
subnets
List subnets
aws ec2 describe-subnets | jq -r '.Subnets[] | [.SubnetId, .CidrBlock, .VpcId, (.Tags[]?|join(":"))] | @tsv' | column -t -s $'\t' | less -ISRM
direct connect
List direct connect links
aws directconnect describe-connections
ipsec vpn
aws ec2 describe-vpn-connections | jq -r '.VpnConnections[] | .VpnConnectionId +" "+ (.Tags[] | select(.Key=="Name").Value)'
list vpc endpoints interface/gateway
aws ec2 describe-vpc-endpoints | jq -r '.VpcEndpoints[] | .VpcEndpointId +" "+ .VpcEndpointType +" "+ .VpcId +" "+ (.Tags[]? | select(.Key=="Name").Value)'
imds
Instance Metadata Service
TOKEN=`curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` && curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/
List ecs services
# List cms services. Count the tasks. aws ecs list-clusters aws ecs describe-clusters --clusters <cluster> aws ecs list-services --cluster <cluster> aws ecs describe-services --cluster <cluster> --services <service> | jq '.services[].desiredCount'
cloud trail
aws cloudtrail describe-trails
cloudwatch
# View metrics on aws in namespace. aws cloudwatch list-metrics --namespace=ContainerInsights/Prometheus # List alarms aws cloudwatch describe-alarms aws cloudwatch describe-alarms | jq -r '.MetricAlarms[]| [.AlarmName, .MetricName, .Namespace, .AlarmDescription]|@tsv' |column_tab | less aws cloudwatch describe-alarms | jq -r '.MetricAlarms[]| [.AlarmName, .MetricName, .EvaluationPeriods, .DatapointsToAlarm, .AlarmDescription]|@tsv' | column -t -s $'\t' | less # Get alarm history aws cloudwatch describe-alarm-history --alarm-name <ALARM_NAME>
ssm/parameters
Get parameter
aws ssm get-parameters --with-decryption --region eu-west-1 --name /<name>
Get parameters recursive
aws ssm get-parameters-by-path --recursive --region eu-west-1 --path /