Recent content on Tibor Hercz - Writing about Cloud, architecture, AWS, GCP and software engineering.
Still using sensitive service account keys in your GitLab repository? Want to enhance the security of your CI/CD pipelines? In this blog post, I will show you the process of authenticating your GitLab CI/CD pipelines to Google Cloud using OpenID Connect (OIDC).
When I first started using AWS ECS, I was a bit confused about how to scale the service. I thought (and hoped) it was one simple setting, but it turned out to be a bit more complicated and requires various settings to be configured. This article summarizes the settings needed to enable auto-scaling for an ECS service.
When using AWS API Gateway you can use the AWS Lambda authorizer for HTTP APIs to authorize the requests. In this blog I will show you how to validate a JWT token signed with KMS in a Lambda using the Golang runtime. For the examples I am using API Gateway V2 with HTTP APIs with the v2 authorizer payload format version and for the resources I am using Terraform.
In the past it was very common to use AWS credentials (access token and secret) in your GitHub actions pipeline. This poses a security risk because most of the time these AWS credentials are long-lived credentials with a lot of permissions. If these credentials get leaked or misused the damage done could be huge.
I have seen a lot AWS environments and noticed that it is very common that companies use AWS IAM users to log in and access the API. This can cause security issues and is time-consuming to manage but is very easy to improve by setting up AWS IAM Identity Center (Successor to AWS Single Sign-On).
So you leaked your AWS credentials onto the world wide web, and you are wondering what to do to minimize the damage. There are multiple steps that should be taken, but I do think that the order of these steps matter.
I heard multiple times that AWS scans public GitHub repositories for AWS credentials and informs its users of the leaked credentials. So I am curious to see this for myself, so I decided to intentionally leak AWS credentials to a Public GitHub repository. And show you the steps I took and how I got informed about the leaked credentials.
Creating a large network, connecting multiple VPC and an on-premises data center together can be done in multiple ways. In this article I will explain how to do this by using Transit Gateway and Direct Connect on a high-level.
The AWS IAM Identity Center (Successor to AWS Single Sign-On) web console can be hard to navigate when trying to view the AWS accounts attached to an AWS IAM Identity Center (Successor to AWS Single Sign-On) group. This involves a lot of going back and forth between pages to get this seemingly simple information. Having done this multiple times and wasting an equal amount of time. I took the time…
A Transit Gateway Peering Attachment must be accepted by the owner of the attachment. Even if both Transit Gateways are in the same account. To automate this with CloudFormation I have created a custom resource.
About WebAssembly WebAssembly ( WASM ) is a portable binary instruction format which runs in the browser or on a server. It is designed with performance and security in mind. WebAssembly can be compiled from other programming languages like C/C++, C#, Rust, Go and many more.
There are a lot of very good resources explaining how to set up a S3 website. But not explaining why you should choose one option over the other. In this article I will not explain step by step how to set up a S3 website. If you are looking for that, I have added some links at the bottom of this article. Instead I will give you the best practices and support those with an explanation.
When setting up S3 website hosting you can use a Route53 alias for connecting the domain to the website bucket. This approach forces you to set identical names for the S3 bucket and domain name. In this article I will explain to you why the domain name and bucket names must be identical.
Scheduled scaling for EC2 Auto Scaling can help out with predicable load by specifying capacity changes on a schedule. For example when a busy period is expected or to save money for your development environment scaling them down outside office hours.
You can sign your Git commits cryptographically by using a GPG key. This will prove the commit came from you. And can act as a reliable audit trail. Also, you will get a cool ‘Verified’ badge next to your commits.
If you want to create an infrastructure CI/CD pipeline for AWS using Terraform, you want to keep the state in a remote backend. When provisioning an environment with Terraform that includes the state backend resources, you will need two actions to set up the remote state backend. In this blog I will present you with a CloudFormation template with which you can bootstrap the AWS account. This will…
By using the Kubernetes Secrets Store CSI Driver you can provide pods with secrets from the AWS Secret Manager. This allows you to use the features the Secrets Manager has to offer within your EKS cluster.
archive