What’s the Difference Between a Public and Private Subnet in an AWS VPC?

AWS Public vs Private Subnet

This is a brief intro to quite a few of the AWS VPC components and how they fit together with the goal of describing the difference between a public and private subnet. Amazon has this line in some VPC docs that hints at the difference: The instances in the public subnet can send outbound traffic… Continue reading What’s the Difference Between a Public and Private Subnet in an AWS VPC?

How to Create New Autoscaling Groups on Lauch Configuration Change

Updating an auto scaling group's (ASG) launch config exposes a little quirk: the old instances are not automatically taken out of service. Sometimes that's not a bad thing. Running a distributed database in an ASG would make taking old instances out of service all at once a bad idea. Other times removing the old servers… Continue reading How to Create New Autoscaling Groups on Lauch Configuration Change

How to Update a Route53 Record on Instance Boot

I've been experimenting with running single instances in an autoscaling group. These single instances tend to be backing services that, while important, contain only ephemeral data that's okay being lost. A good example would be something like beanstalkd for a queue. Part of that process is registering the new instance with a Route 53 hosted… Continue reading How to Update a Route53 Record on Instance Boot

AWS Key Management Service Envelope Encryption in PHP

This is a PHP example of what AWS calls envelope encryption. Really this is just a way to use a key hierarchy rooted at a key management service (KMS) key. We'll use PHP 7.2's libsodium support (via paragonie/sodium_compat). The idea is that you have a customer master key that lives in KMS - this never… Continue reading AWS Key Management Service Envelope Encryption in PHP