Are you aware when someone uses your AWS account credentials to perform some activity? Are you notified in time?

When you first create an AWS account, you begin only with a single sign-in identity that has complete access to all AWS services and resources in the account. This identity is called the root user and is accessed by signing in with the email address and password that you used to create the account.

An AWS account root user has full access to all your resources for all AWS services, including billing information. It is critical to prevent root user access from getting into the wrong hands and to be aware whenever root user activity occurs in your AWS account. For more information about AWS recommendations, see IAM Best Practices. Some of the key recommendations include:

• Enabling multi factor authentication (MFA)
• Setting complex passwords
• Avoiding creating access key for root
• Creating an admin level IAM user to perform any high privilege activities

However, there are certain actions that can only be performed by the root user. To be certain that all root user activity is authorized and expected, it is important to monitor root API calls to a given AWS account and to notify when this type of activity is detected. This notification gives you the ability to take any necessary steps when an illegitimate root API activity is detected or it can simply be used as a record for any future auditing needs.

In this post, I walk through a solution that monitors and notifies on root API activity for an AWS account.

(more…)

AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. Hence, it’s crucial to monitor any changes to CloudTrail and make sure that logging is always enabled.

With CloudTrail, you can log, continuously monitor, and retain events related to API calls across your AWS infrastructure. CloudTrail provides a history of API calls for your account, including API calls made through the console, AWS SDKs, command line tools, and other AWS services. This history simplifies security analysis, resource change tracking, and troubleshooting.

In this post, I describe a solution to notify on changes to CloudTrail and re-enable logging whenever logging is disabled.

(more…)

With the launch of the new CloudWatch Dashboards API and CloudFormation support it is now easy to automate your CloudWatch Dashboards and make sure they monitor all the resources that you launched when creating your CloudFormation stacks.

Let’s now see how you can use the new CloudWatch Dashboards API to dynamically update your dashboard as EC2 instances are added or removed. When you use auto-scaled EC2 instances for example, EC2 instances may be launched or terminated at any time and if you have a CloudWatch Dashboard monitoring your EC2 resources it can suddenly be monitoring instances that do not exist anymore, and may be missing ones that do exist.

Use AWS Lambda to keep EC2 instances up to date

A simple solution is to run the script below periodically in AWS Lambda. The script loads your CloudWatch Dashboards that monitors your instances and updates the EC2 graph widgets if needed.

(more…)

The process of configuration management can be difficult, in particular when performed at scale. An example could be an application, running on your fleet, which uses configuration values like database connection strings or passwords.

For deployment best practices, isolate application configuration portions so that you can separately deploy configuration values specific to each environment, for example development and production environments. To ameliorate the security posture of your application, encrypt sensitive configuration values like passwords. From a management standpoint, store configuration values in a central and secure location, instead of storing and maintaining such information on your fleet. Central storage has the advantage of easily maintaining and rotating configuration values in one single place, and it also facilitates auditing changes and access to such configuration values.

Amazon EC2 Systems Manager is a management service that helps you configure and manage Amazon EC2 instances and on-premises servers. Parameter Store is a Systems Manager feature that makes it easier to reference your configuration data, securely stored in a central location. Parameter Store integrates with other AWS services like AWS Identity and Access Management (IAM) and AWS Key Management Service (AWS KMS). With IAM, you define access control to Systems Manager parameters. With KMS, you can encrypt sensitive information, such as SecureString parameters. API calls made to Systems Manager parameters can be recorded with AWS CloudTrail, so you can audit access or changes to your parameters, for example.

In this post, I show you a scenario for centralized configuration management, with an example of joining EC2 instances to a Microsoft Active Directory. You launch an EC2 instance that consumes and uses configuration values stored as Systems Manager parameters to join your Active Directory domain. For more information about creating an Active Directory with AWS Directory Service instead, see the Seamlessly Join EC2 Instances to a Domain blog post.

(more…)

AWS now supports tagging of AWS OpsWorks Stacks application environments. Tags that you add to a stack and layer now automatically propagate down to all underlying AWS resources, including Amazon EC2 instances, Elastic Load Balancing load balancers, Amazon RDS databases, Amazon EBS volumes, and Amazon ECS clusters. This benefits everyone who wants to track their AWS usage for OpsWorks Stacks infrastructure and components.

(more…)

Amazon EC2 Systems Manager is a management service that helps you automatically collect software inventory, apply OS patches, create system images, and configure Windows and Linux operating systems. These capabilities help you define and track system configurations, prevent drift, and maintain software compliance of your EC2 and on-premises configurations.

By providing a management approach that is designed for the scale and agility of the cloud but extends into your on-premises data center, Systems Manager makes it easier for you to seamlessly bridge your existing infrastructure with AWS.

In this post, I show you how you can remotely manage your EC2 Windows instances using a declarative based model for instance configuration management at cloud scale. You use Microsoft PowerShell Desired State Configuration (DSC) to define a configuration and then apply it to your instances using Systems Manager.

Benefits

• Systems Manager is built for cloud scale. It can handle applying your PowerShell DSC configuration to thousands of instances at one time.
• Systems Manager allows you to send logs (stdout/stderr) offline. When you apply your configuration to an instance, you can have the logs sent directly to an Amazon S3 bucket. There is no need to log in to instances to retrieve logs.
• Systems Manager works on your on-premises servers. There are some prerequisites required to get this to work. For more information, see Setting Up Systems Manager.

(more…)

On June 1st, AWS Config announced support for Amazon CloudWatch alarms. CloudWatch alarms are used on any of your CloudWatch metrics to send notifications or take other automated actions.

You can now start tracking the current as well as historical configuration of your alarms and get notified via Amazon SNS when your alarm configuration changes. You can also use three new Config rules to verify the following:

• Your resources have CloudWatch alarms for the specified metric
• Alarm metrics have the right settings
• All alarms have at least one action configured

You can get started via the AWS Config console, AWS CLI, or AWS SDKs.

With this integration, you can view the historical configuration of your CloudWatch alarms and review all changes that occurred to them. This information is valuable in determining why certain CloudWatch alarms did not get triggered and how their configuration was modified. In this post, we show you two example scenarios in detail.

AWS Config

Config enables you to assess, audit, and evaluate the configurations of your AWS resources. It continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. With Config, you can review changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine your overall compliance against the configurations specified in your internal guidelines. (more…)

In Amazon EC2 Systems Manager, a maintenance window defines a specific set of tasks, along with a set of managed instances where those tasks should be run and the schedule for when the tasks should run. Each task also has a velocity and error threshold defined (for example, run the task on at most four instances at a time and stop if there are one or more errors). You can use this to automate running many common systems administration tasks to ensure they run when needed and that you get notified about any problems running the tasks.

In this post, I discuss how maintenance windows work and provide a walkthrough for setting one up.

Maintenance window overview

You can consider the Maintenance Window capability of Systems Manager to be a replacement for tools like cron or Windows Task Scheduler. Instead of scheduling tasks on individual instances, you can use a feature that’s fully integrated with AWS and the rest of Systems Manager that also provides a central access point for task history and notification support.

Here are some of the benefits:

• Schedule and duration
• Targets
• Tasks
• History

(more…)

At last year’s re:Invent, AWS launched Amazon EC2 Systems Manager, which helps you automatically apply OS patches within customized maintenance windows, collect software inventory, and configure Windows and Linux operating systems. These capabilities enable automated configuration and ongoing management of systems at scale and help maintain software compliance for instances running in Amazon EC2 or on-premises.

One of the capabilities of Systems Manager is Patch Manager, which can automate the process of patching Windows managed instances at scale. With Patch Manager, you can scan instances for missing patches, or scan and install missing patches to individual instances or large groups of instances by using EC2 tags. Patch Manager can also be used with Systems Manager Maintenance Windows, so you can create a schedule to perform patch operations on your instances within a customized maintenance window.

In this post, I guide you through using Patch Manager to patch your Windows instances. If you run the demo, you are charged for the EC2 resources, but Systems Manager is free of charge.

Walkthrough

To get on the fast track of experiencing Patch Manager, these examples use newly created Windows EC2 instances. Here are the steps: (more…)

If you are running complex workloads on AWS and managing large groups of instances, chances are you are using some form of configuration management. Configuration management tools are effective in automating the deployment and configuration of applications on hybrid instances. However, efficiently managing the distribution and execution of the playbooks or recipes, centrally managing the code, having a secure and scalable deployment mechanism and properly logging system changes is a challenge. To address this, some of our customers use tools like cron, Rundeck or others provided by configuration management vendors.

State Manager and Run Command, part of EC2 Systems Manager, automate management tasks by providing a secure, and easy to use platform to maintain state and remotely execute commands on large groups of instances. Using these tools also addresses many of the common challenges of managing infrastructure at scale. Here are some of the benefits of these tools:

• Better security
  • There is no need to open incoming ports to remotely execute the directives. This eliminates the need for using SSH
  • You can use IAM to restrict and control access to the platform
  • All command execution is audited via AWS Cloudtrail
• Performance and reliability
  • Asynchronous execution of commands
  • Commands are delivered and executed even when the system comes back from being offline
  • Execute at scale by taking advantage of velocity control
  • Control deployment rate if errors increase during deployment

In this blog post, I will show you how to execute configuration management directives using Ansible on your instances using State Manager and Run Command, and the new “AWS-RunAnsiblePlaybook” public document. This document runs Ansible locally on your instances.

(more…)