terraform plan

Planning failed. Terraform encountered an error while generating this plan.

╷
│ Error: configuring Terraform AWS Provider: IAM Role (arn:aws:iam::111222333444:role/YourRole) cannot be assumed.
│
│ There are a number of possible causes of this - the most common are:
│   * The credentials used in order to assume the role are invalid
│   * The credentials do not have appropriate permission to assume the role
│   * The role ARN is not valid
│
│ AWS Error: operation error STS: AssumeRole, https response error StatusCode: 0, RequestID: , request send failed, Post "https://sts.eu-central-1.amazonaws.com/": dial tcp: lookup sts.eu-central-1.amazonaws.com on [2001:8a0:6727:d900::1]:53: no such host
│
│
│   with provider["registry.terraform.io/hashicorp/aws"],
│   on _provider.tf line 1, in provider "aws":
│    1: provider "aws" {
│
╵
╷
│ Error: configuring Terraform AWS Provider: IAM Role (arn:aws:iam::111222333444:role/YourRole) cannot be assumed.
│
│ There are a number of possible causes of this - the most common are:
│   * The credentials used in order to assume the role are invalid
│   * The credentials do not have appropriate permission to assume the role
│   * The role ARN is not valid
│
│ AWS Error: operation error STS: AssumeRole, https response error StatusCode: 0, RequestID: , request send failed, Post "https://sts.eu-central-1.amazonaws.com/": dial tcp: lookup sts.eu-central-1.amazonaws.com on [2001:8a0:6727:d900::1]:53: no such host
│
│
│   with provider["registry.terraform.io/hashicorp/aws"].dev,
│   on _provider.tf line 18, in provider "aws":
│   18: provider "aws" {

All my logins where right, I was using them all along, even more, I have a differnt CLI window open on my computer with the same login working just fine.

Then my eyes glased at something:

dial tcp: lookup sts.eu-central-1.amazonaws.com on [2001:8a0:6727:d900::1]:53: no such host

Hum, no such host? port 53 ? is this a DNS error?

I quickly changed my DNS from the default ISP (shame on you Altice) to CloudFlare ones:

1.1.1.1
1.0.0.1
2606:4700:4700::1111
2606:4700:4700::1001

Guess what, problem solved, my Terraform is working again, it was not an IAM error at all, it was all about the DNS caches on my ISP.

Next time you see a STS error, consider changing your DNS to a different provider and may save you some unicorn hunt.x

So every time I start a new project I hope to find some simple module that gives some extra protection as the S3 version enabled, deletion protection policy, object lock, DynamoDB table with point-in-time recovery, kms encryption, and so on.

Today I decided to make yet another attempt at solving this well, hope it is beneficial for others as well and that we can over time keep improving this module.

https://registry.terraform.io/modules/tigpt/remote-state-s3-dynamodb-backend/aws/latest

Let's break it down on how to use it:

module "remote-state-s3-dynamodb-backend" {
  source  = "tigpt/remote-state-s3-dynamodb-backend/aws"
  version = "1.0.1"

  name = "my-terraform-backend"

  tags = {
    terraform = "true"
  }
}

So you call the module with source and pin a version, of course.
Then you name it, this should have some project related name, example business unit or account, I like to name something like landingzone or network-production, even application-dev.

You can as well pass some tags because everyone loves tags and they are an important asset.

Let's break out the module into parts:

├── dynamodb.tf
├── outputs.tf
├── random.tf
├── s3.tf
├── variables.tf
└── versions.tf

Each file should be self-explanatory, but let's dig into them, DynamoDB first.

#############################
#--- DynamoDB State Lock ---#
#############################

module "dynamodb_table" {
  source  = "terraform-aws-modules/dynamodb-table/aws"
  version = "4.0.0"

  name     = "tf-${var.name}-${random_integer.random.id}-locktable"
  hash_key = "LockID"

  attributes = [
    {
      name = "LockID"
      type = "S"
    }
  ]

  deletion_protection_enabled    = true
  point_in_time_recovery_enabled = true

  server_side_encryption_enabled     = true
  server_side_encryption_kms_key_arn = aws_kms_key.dynamodb.arn

  tags = merge(
    var.tags,
    {
      "Name" = format("%s", var.name)
    },
  )
}

resource "aws_kms_key" "dynamodb" {
  description             = "KMS key is used to encrypt bucket objects"
  deletion_window_in_days = 7

  tags = merge(
    var.tags,
    {
      "Name" = format("%s", var.name)
    },
  )
}

I love the Terraform AWS modules so we leverage them as much as possible to make the DynamoDB table, we then add some naming conventions to the input name that comes from the variables.tf as well as a random generated from random.tf to make sure names are unique (especially important for S3).

Then it's time to configure deletion_protection, point_in_time_recovery as well as encritpions with KMS key that we create.

Next the s3.tf

###########################
#--- S3 Backend Bucket ---#
###########################

module "s3_bucket" {
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "4.1.0"

  bucket = "tf-${var.name}-${random_integer.random.id}-state"
  acl    = "private"

  object_lock_enabled = true
  control_object_ownership          = true
  object_ownership                  = "ObjectWriter"
  attach_deny_incorrect_kms_key_sse = true
  allowed_kms_key_arn               = aws_kms_key.objects.arn

  server_side_encryption_configuration = {
    rule = {
      apply_server_side_encryption_by_default = {
        kms_master_key_id = aws_kms_key.objects.arn
        sse_algorithm     = "aws:kms"
      }
    }
  }

  force_destroy = true

  versioning = {
    enabled = true
  }
  attach_policy = true
  policy        = <<POLICY
{
  "Statement": [
    {
      "Sid": "bucket-delete-protection",
      "Action": [
        "s3:DeleteBucket"
      ],
      "Effect": "Deny",
      "Resource": "arn:aws:s3:::tf-${var.name}-${random_integer.random.id}-state",
      "Principal": {
        "AWS": [
          "*"
        ]
      }
    }
  ]
}
POLICY

  tags = merge(
    var.tags,
    {
      "Name" = format("%s", var.name)
    },
  )
}

resource "aws_kms_key" "objects" {
  description             = "KMS key is used to encrypt bucket objects"
  deletion_window_in_days = 7

  tags = merge(
    var.tags,
    {
      "Name" = format("%s", var.name)
    },
  )
}

Once again we start with the Terraform AWS modules of S3 and configure the bucket as private as well as activate object_lock, versioning, kms encryption but what I want and don't see a lot in other modules out there is a S3:DeleteBucket a policy that prevents all principals from deleting the bucket.

Well, I could do more, like an S3 bucket replication policy to a bucket on another account, but some people consider this overkill, so I do it specifically only for the projects/clients that want it.

Feel free to fork it and do a pull request for any change you consider necessary, I will keep this going as my default AWS S3 backend and keep evolving it as feel necessary.

The other day I was looking at my CloudFront Popular objects and was supper curious, this is pointing to an S3 bucket with some static images and polly mp3 that are serving the mobile app.

What wp-login.php and server-status or login.action.

The internet is a true place without many laws and if you have any IP or domain up and running, some crawler or bot will immediately try to find vulnerabilities and brute-force / exploit them.

Be aware, build safe infrastructure, hide vulnerabilities, and leverage AWS services like S3 and CloudFront, WAF and AWS Shield, load balancers, and private subnets. open as little as possible the ports and let the outlaws out of your walled garden. They are there and are not your friends.

Stay safe!

‎AWSary - AWS Dictionary

‎AWSary is the ultimate resource for AWS Cloud Consultants, students, and anyone looking to stay up-to-date with AWS services. With this app, you’ll have access to a comprehensive AWS dictionary, allowing you to easily search and learn about various AWS services. With this app, you’ll have access t…

App StoreTiago Rodrigues

Release v1.3.0 · AWSary/AWSary-iOS

New Features You can now enable a label bellow the service logo, making your AWS Architecture Diagrams more readable.Also added Polly reading out AWS service names, because why not ?

GitHubAWSary

Major update to the App, I've been working on how to get compressed icons (smaller app footprint) without loss of image quality, I also fine-tuned the icon sizes once dragged into a diagram before the images were too big.

On top of that now there is a toggle in settings that allows you to label the icons with the service name on your diagrams to make your diagrams more readable, see the example image below:

This was not an easy task but the result is just awesome.

I also added Amazon Polly to pronounce the service names, it is much better than I expected, congrats to Polly for the great pronunciation, please try it yourself in the App.

By the way, these Polly audio files are being served by AWS S3 with CloudFront CDN and it works like a charm.

I immediately said: Careful RDP is typically a target port, and you should use AWS SSM (AWS Systems Manager) to access the machine, you can even enable RDP through session manager by configuring a proxy on the localhost if needed.

No no, that's too complicated, this is just for a few days, then we kill the machine.

Long story short, the machine stayed running and they assumed this was already production ready... Clients...

A few days in, this message came out of the blue, thanks GuardDuty once again saving the day.

Hello.

We recieved the following GuardDuty Alarm.

94.232.42.99 is performing RDP brute force attacks against i-XXXXXXXXXX.","description":"94.232.42.99 is performing RDP brute force attacks against i-XXXXXXXXXX. Brute force attacks are used to gain unauthorized access to your instance by guessing the RDP password.
UnauthorizedAccess:EC2/RDPBruteForce
Resource affected
Resource role TARGET
Resource type Instance
Port 3389
Port name RDP

Instance details
Instance ID i-XXXXXXXXXX (XXXXXXXXXX_dev)
Instance type t3.medium
Instance state running
Availability zone eu-west-1a

If we check the Security Rules for this Instance, it showsthat Port 3389 is open for the world.
This Alarm reocures every few days.
Is it necesary for this port to be open? Can we regulate Acces with a Whitelist (IP based) or can it be closed?
If nothing of the suggested solutions is aplicable, can we block this kind of alarm to minimized unnesecary communikation?

A malicious IP was brute forcing the RDP port of the machine and it was a matter of time until they eventually got access to the machine. If it was not for GuardDuty we could not have noticed the issue until it was too late and someone gained access to the infrastructure and did all the possible damage.

Thanks to GuardDuty I immediately called the client, hey this is happening, do you wanna try SSM now?

The answer was... ah not really, what's the other options?

Well, don't whitelist this port to the world (0.0.0.0/0) at least have a single public IP able to target the port and restrict the security group on this port to a /32.

Ok, but this is an external consultant company, we want them to update the IP when they access it, but not touch the rest of the infrastructure.

No problem, AWS IAM Policy to the resque.

Create a user, create, create a prefix list, associate the prefix list to the security group, and create a policy to allow the user to update only its prefix list and nothing else.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:GetManagedPrefixListAssociations",
                "ec2:GetManagedPrefixListEntries",
                "ec2:ModifyManagedPrefixList",
                "ec2:RestoreManagedPrefixListVersion"
            ],
            "Resource": [
                "arn:aws:ec2:eu-west-1:ACCOUNT_ID:prefix-list/pl-XXXXXXXXX"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "ec2:DescribeManagedPrefixLists",
            "Resource": "*"
        }
    ]
}

15 minutes later, the RDP port was at least closed to a single IP and reduced the security vector to a minimal target. I still believe that the best way is just to not open ports to the internet and use AWS SSM, but I'm not scared this machine will be a target anymore.

I also sleep well knowing that AWS GuardDutty has my back covered 24 hours per day and will probably email me in case something is about to go wrong. Thanks, AWS for making my life on the internet much easier.

‎AWSary - AWS Dictionary

‎AWSary is the ultimate resource for AWS Cloud Consultants, students, and anyone looking to stay up-to-date with AWS services. With this app, you’ll have access to a comprehensive AWS dictionary, allowing you to easily search and learn about various AWS services. With this app, you’ll have access t…

App StoreTiago Rodrigues

Release v1.2.2 · AWSary/AWSary-iOS

What’s Changed Link to appstore rating by @tigpt in #99accentColor orange by @tigpt in #102Cta improve by @tigpt in #104 and #106 Full Changelog: v1.2.1...v1.2.2

GitHubAWSary

Add an option for users to send feedback by email.

What if we could generate sound out of text, what if I could "magically" have AWS generate all AWS Services names in voice format so I know how to pronounce them?

First we importo boto3 the AWS SDK for Python.

import boto3

Then we load initiate a DynamoDB client as well as a Polly client.

dynamodb = boto3.resource('dynamodb', region_name='eu-west-1')
table = dynamodb.Table('AWSary-services')
polly_client = boto3.client('polly')

Now that we have the clients, let's scan the table for some items, since we want all of them

response = table.scan()
items = response['Items']

For each item in the table that we scanned, let's print out to the CLI just for feedback, then call polly client and save the result on a file in the local disk, we will use this later to copy for our S3 to serve with CloudFront on the iOS Mobile Application.

for item in items:
    print("Start working on: " + item['name'])
    service_name = item['longName']
    response = polly_client.synthesize_speech(VoiceId='Brian', OutputFormat='mp3', Text=service_name)

    file = open('speech/' + item['name'].replace(' ','_') + '_Brian_' + 'en-GB' + '.mp3', 'wb')
    file.write(response['AudioStream'].read())
    file.close()
    print("Done with: " + item['name'])

Let's look at everything together:

AWSary-iOS/utils/polly.py at main · AWSary/AWSary-iOS

AWS Dictionary iOS App. Contribute to AWSary/AWSary-iOS development by creating an account on GitHub.

GitHubAWSary

import boto3

dynamodb = boto3.resource('dynamodb', region_name='eu-west-1')
table = dynamodb.Table('AWSary-services')
polly_client = boto3.client('polly')

response = table.scan()
items = response['Items']

for item in items:
    print("Start working on: " + item['name'])
    service_name = item['longName']
    response = polly_client.synthesize_speech(VoiceId='Brian', OutputFormat='mp3', Text=service_name)

    file = open('speech/' + item['name'].replace(' ','_') + '_Brian_' + 'en-GB' + '.mp3', 'wb')
    file.write(response['AudioStream'].read())
    file.close()
    print("Done with: " + item['name'])

What should I do next, open an issue and let me know your ideas:

Issues · AWSary/AWSary-iOS

AWS Dictionary iOS App. Contribute to AWSary/AWSary-iOS development by creating an account on GitHub.

GitHubAWSary

‎AWSary - AWS Dictionary

‎AWSary is the ultimate resource for AWS Cloud Consultants, students, and anyone looking to stay up-to-date with AWS services. With this app, you’ll have access to a comprehensive AWS dictionary, allowing you to easily search and learn about various AWS services. With this app, you’ll have access t…

App StoreTiago Rodrigues

Release v1.2.1 · AWSary/AWSary-iOS

AWS Dictionary iOS App. Contribute to AWSary/AWSary-iOS development by creating an account on GitHub.

GitHubAWSary

Bug fixes and compliance with Apple requirements with in app purchase for the Tip Jar, we hope that Apple aproves this app update.

‎AWSary - AWS Dictionary

‎AWSary is the ultimate resource for AWS Cloud Consultants, students, and anyone looking to stay up-to-date with AWS services. With this app, you’ll have access to a comprehensive AWS dictionary, allowing you to easily search and learn about various AWS services. With this app, you’ll have access t…

App StoreTiago Rodrigues

Release v1.2.0 · AWSary/AWSary-iOS

revenuecat subscription

GitHubAWSary

We improved the AWS Services descriptions and pricings, as well as added a way for users to help me financially with the app development and servers costs, now with a Tip Jar users are able to send some money this way with no aditional peark, the same app with the same features but you feel awesome because you help me prioritize this app. Hope some of you decide to leave a Tip 😅.