Tips for Getting Started With AWS • Hacker News Board

Re: Tips for Getting Started With AWS

#11

Post by dice » Tue, Dec 31, 2013, 6:54 PM UTC

ceejayoz wrote: post #2

> For the love of all that is good, save your .pem file to some kind of cloud storage so you’ll never be without it. For the love of all that is good, don't do this for anything beyond random hobbyist screwing around. A Dropbox compromise shouldn't risk your entire company's server infrastructure. > If you only have need for one free tier instance leave it running. No, because the 750 hours/month can be used by more…

>The AWS Console is perfectly usable for 99% of what you'll need to do. Most users won't need anything beyond it.

I believe the author was referring to navigating the filesystem and running commands via CLI (e.g. `cd` and `ls`, not `ec2-describe-instances`).

Re: Tips for Getting Started With AWS

#12

Post by ceejayoz » Tue, Dec 31, 2013, 6:56 PM UTC

dice wrote: post #11

ceejayoz wrote: post #2

> For the love of all that is good, save your .pem file to some kind of cloud storage so you’ll never be without it. For the love of all that is good, don't do this for anything beyond random hobbyist screwing around. A Dropbox compromise shouldn't risk your entire company's server infrastructure. > If you only have need for one free tier instance leave it running. No, because the 750 hours/month can be used by more…

>The AWS Console is perfectly usable for 99% of what you'll need to do. Most users won't need anything beyond it. I believe the author was referring to navigating the filesystem and running commands via CLI (e.g. `cd` and `ls`, not `ec2-describe-instances`).

If that's the case, it's kinda pointless advice - none of the commonly used Linux AMIs have GUIs installed, and someone who can install X on one probably knows the CLI already.

Re: Tips for Getting Started With AWS

#13

Post by gfodor » Tue, Dec 31, 2013, 6:58 PM UTC

justinwr wrote: post #5

oneeyedpigeon wrote: post #3

Earlier quoted context omitted.

> For the love of all that is good, don't do this ... I, too, was astounded that anybody would be recommending keeping your keys 'public' like this. By all means, keep it on a few USB sticks that are nicely secure - and have a good plan in place in case you lose one.

Here's a better idea. Learn to use IAM properly and rotate your keys on a schedule.

You're thinking of AWS access keys. Not the same thing.

Re: Tips for Getting Started With AWS

#14

Post by MichaelBurge » Tue, Dec 31, 2013, 7:06 PM UTC

toomuchtodo wrote: post #8

WestCoastJustin wrote: post #4

If you choose to upload .pem to cloud storage, make sure you secure (encrypt) your .pem file, since it allows total access to the boxes! You should also secure remote access via the "security groups" firewall by only allowing known ip addresses (you can edit this via the aws console as needed). Since he mentioned the "The Command Line Crash Course" [1]. I might chime in with a couple into screencasts I've created. Cr…

I suggest using a TrueCrypt volume with your credentials, stored on Dropbox.

I email myself my encryption passwords so that I - and any interested government agencies - can log in without me needing to remember them all the time.

Re: Tips for Getting Started With AWS

#15

Post by euphemize » Tue, Dec 31, 2013, 7:10 PM UTC

A bit disappointed by this. As mentioned by ceejayoz, don't upload your .pem file anywhere!

AWS has tons of weird/interesting quirks - I thought this article was going to be about those.

Here's my 5 tips for AWS...

- SQS: encodes messages by default! plan accordingly if you are going to be sending large bodies (265K max).

- ELBs: they need time to warm up if you get a huge traffic spike. ELBs won't start scaling unless that traffic is sustained for a certain time (usually minutes).

- S3: watch out for "eventual consistency" if you're going to upload lots of files and try to access them right away - they might not be available immediately.

- Cloudwatch: set up alarms to make sure your billing never goes over threshold X in time Y. If someone compromised your account (because you uploaded your .pem file in cleartext to dropbox) and is mining bitcoins on your machines, you'll be notified.

- VPC: if you're going to build a services-oriented infrastructure, consider using a VPC! Unless you need to have all your services exposed to the public internet, it could save you a lot of time and security configuration trouble.

Re: Tips for Getting Started With AWS

#16

Post by toomuchtodo » Tue, Dec 31, 2013, 7:11 PM UTC

MichaelBurge wrote: post #14

toomuchtodo wrote: post #8

Earlier quoted context omitted.

I suggest using a TrueCrypt volume with your credentials, stored on Dropbox.

I email myself my encryption passwords so that I - and any interested government agencies - can log in without me needing to remember them all the time.

Worry not, I'm sure the US government would just go straight to AWS. No need to get your private key from you.

Edit: Please don't just downvote when I rebut sarcasm/snark with fact. Discuss!

Re: Tips for Getting Started With AWS

#17

Post by ceejayoz » Tue, Dec 31, 2013, 7:11 PM UTC

euphemize wrote: post #15

A bit disappointed by this. As mentioned by ceejayoz, don't upload your .pem file anywhere! AWS has tons of weird/interesting quirks - I thought this article was going to be about those. Here's my 5 tips for AWS... - SQS: encodes messages by default! plan accordingly if you are going to be sending large bodies (265K max). - ELBs: they need time to warm up if you get a huge traffic spike. ELBs won't start scaling unle…

On the last point, just use a VPC, period. I believe Amazon has now made this the default for new accounts, in fact. They come with no downsides and lots of benefits - being able to change security groups on the fly, elastic IPs that stay with the instance when stopped, etc.

Re: Tips for Getting Started With AWS

#18

Post by jamescarl » Tue, Dec 31, 2013, 7:14 PM UTC

WestCoastJustin wrote: post #4

If you choose to upload .pem to cloud storage, make sure you secure (encrypt) your .pem file, since it allows total access to the boxes! You should also secure remote access via the "security groups" firewall by only allowing known ip addresses (you can edit this via the aws console as needed). Since he mentioned the "The Command Line Crash Course" [1]. I might chime in with a couple into screencasts I've created. Cr…

Cool thanks for the advice I'm still learning so this info is really appreciated.

Re: Tips for Getting Started With AWS

#19

Post by falcolas » Tue, Dec 31, 2013, 7:15 PM UTC

My tip number 0: Use a CMS. It's a beautiful thing to start an ec2 instance, run Ansible, get a drink of water, and return to a fully provisioned and configured machine.

Tip 0.1: Use Vagrant with an EC2 box, and just 'vagrant up' yourself a fully operational machine.

Re: Tips for Getting Started With AWS

#20

Post by cpucycling » Tue, Dec 31, 2013, 7:17 PM UTC

positr0n wrote: post #10

ceejayoz wrote: post #2

> For the love of all that is good, save your .pem file to some kind of cloud storage so you’ll never be without it. For the love of all that is good, don't do this for anything beyond random hobbyist screwing around. A Dropbox compromise shouldn't risk your entire company's server infrastructure. > If you only have need for one free tier instance leave it running. No, because the 750 hours/month can be used by more…

What about encrypting your pem file with AES (using 7zip on a Windows or OpenSSL on *nix) and then backing it up to the cloud?

If you keep one key per device, you can revoke it if/when that device is compromised, stolen, etc..

That key is for initial access to provision your machine, after which you should have a more sophisticated means of managing users, as certainly, if you are doing anything of much importance, you will eventually need at least 2.