141–150 of 152 posts
Disabling SSH is an interesting tip. I guess the OP doesn't do any automation via SSH.
Be very careful with assigning IAM roles to EC2 instances. Many web applications have some kind of implicit proxying, e.g. a function to download an image from a user-defined URL. You might have remembered to block 127.0.0.*, but did you remember 169.254.169.254? Are you aware why 169.254.169.254 is relevant to IAM roles? Did you consider hostnames pointed to to 169.254.169.254? Did you consider that your HTTP client…
> you pay the much cheaper CloudFront outbound bandwidth costs, instead of the S3 outbound bandwidth costs. What? CloudFront bandwidth costs are, at best, the same as S3 outbound costs, and at worse much more expensive. S3 outbound costs are 12 cents per GB worldwide. [1] CloudFont outbound costs are 12-25 cents per GB, depending on the region. [2] Not only that, but your cost-per-request on CloudFront way more than…
Doh, I feel stupid now. I only looked at bandwidth costs, not the request prices. That's what I get for editing my post late at night based on reading, instead of based on personal experience. For low bandwidth, you're absolutely right, the costs are at best the same. For high bandwidth however (once you get above 10TB), CloudFront works out cheaper (by about $0.010/GB, depending on region). But that wasn't taking in…
Also, S3 buckets cannot scale infinitely. They have to have their key names managed appropriately to do it. http://aws.typepad.com/aws/2012/03/amazon-s3-performance-tip...
Finally :) I like SSH. But I'm the founder of Userify! http://userify.com
Fantastic list with much more depth than I expected. Some surprises that others might be interested in from this article and comments below: [1] Keeping buckets locked down and allowing direct client -> S3 uploads [2] Using ALIAS records for easier redirection to core AWS resources instead of CNAMES. [3] What's an ALIAS? [-] Using IAM Roles [4] Benefits of using a VPC [-] Use '-' instead of '.' in S3 bucket names tha…
Also, S3 buckets cannot scale infinitely. This is a huge myth http://aws.typepad.com/aws/2012/03/amazon-s3-performance-tip...
Can you (or somebody else) elaborate on disabling ssh access? Is this a dogma of "automation should do everything" or is there a specific security concern you are worried about? What is the downside of letting your ops people ssh into boxes, or for that matter of their needing to do so?
Really useful article, though I don't agree with not using a CDN instead of S3. There are multiple articles which proves the performance of S3 being quite bad, and not useful for serving assets, comparing to CloudFront.
One painful to learn issue with AWS is the limits of services, which some of them are not so obvious. Everything has a hard limit and unless you have the support plan, it can take you days and weeks to get those lifted. They are all handled by the respective departments and lifted (or rejected) one by one. Many times we've encountered a Security Group limit right before a production push or other similar things. Last…
Disabling SSH is an interesting tip. I guess the OP doesn't do any automation via SSH.
Userify is awesome for this - disable SSH user accounts at any time and then re-enable when you realize you still need SSH to find out why your instance stopped sending logs!! ;)