AWS is, at best, complicated. Part of that complexity is that there are often seems to be more than one way to accomplish a goal. Service policies and IAM permissions are a great example of this. Both seem to accomplish the same thing (permissions), but serve different purposes. Service policies is probably not an official… Continue reading AWS Service Policies vs IAM Permissions
Category: AWS
A Recommended VPC Subnet Configuration
This is a recommendation on how to organize subnets inside an AWS VPC. Before continuing, it's important to understand the difference between a public and private subnet. There are three broad classes of subnets to run inside your VPC: Public Private Internal Internal subnets aren't really a thing, but it's a convenient way to talk… Continue reading A Recommended VPC Subnet Configuration
What’s the Difference Between a Public and Private Subnet in an AWS VPC?
This is a brief intro to quite a few of the AWS VPC components and how they fit together with the goal of describing the difference between a public and private subnet. Amazon has this line in some VPC docs that hints at the difference: The instances in the public subnet can send outbound traffic… Continue reading What’s the Difference Between a Public and Private Subnet in an AWS VPC?
How to Create New Autoscaling Groups on Lauch Configuration Change
Updating an auto scaling group's (ASG) launch config exposes a little quirk: the old instances are not automatically taken out of service. Sometimes that's not a bad thing. Running a distributed database in an ASG would make taking old instances out of service all at once a bad idea. Other times removing the old servers… Continue reading How to Create New Autoscaling Groups on Lauch Configuration Change
How to Update a Route53 Record on Instance Boot
I've been experimenting with running single instances in an autoscaling group. These single instances tend to be backing services that, while important, contain only ephemeral data that's okay being lost. A good example would be something like beanstalkd for a queue. Part of that process is registering the new instance with a Route 53 hosted… Continue reading How to Update a Route53 Record on Instance Boot
AWS Key Management Service Envelope Encryption in PHP
This is a PHP example of what AWS calls envelope encryption. Really this is just a way to use a key hierarchy rooted at a key management service (KMS) key. We'll use PHP 7.2's libsodium support (via paragonie/sodium_compat). The idea is that you have a customer master key that lives in KMS - this never… Continue reading AWS Key Management Service Envelope Encryption in PHP
Christopher Davis 