cloudonaut
cloudonaut.io · Company blog · on HN since 2015
Andreas and Michael Wittig write practical guides on AWS architecture, security, serverless and cost.
What HN saysCommenters link its AWS how-tos on SSM, Fargate and IAM, though one disputes its claim about SSM security, and the author joins threads.
35HN people shared it
10linked it in comments
185stories submitted
1.8Kstory points
2 years agolast shared
2015people per year2026
Most-shared posts
- 1AWS SSM is a trojan horse: fix it now5 people · 6 points · first shared 2019 · discussion on HN
- 2AWS Security Primer4 people · 272 points · first shared 2017 · 40 comments on HN
- 3Serverless chatbot lessons learned4 people · 8 points · first shared 2017 · discussion on HN
- 4Burst credits of t2 EC2 instances need monitoring4 people · 5 points · first shared 2018 · discussion on HN
- 5Integrate SQS and Lambda: serverless architecture for asynchronous workloads3 people · 10 points · first shared 2016 · discussion on HN
- 6ECS vs. Kubernets: same same but different3 people · 9 points · first shared 2017 · discussion on HN
- 7Updated: EC2 Network Performance Cheat Sheet3 people · 6 points · first shared 2018 · discussion on HN
- 8Using a single AWS account is a serious risk2 people · 322 points · first shared 2015 · 138 comments on HN
- 9Wordpress on AWS: smooth and pain free2 people · 195 points · first shared 2016 · 111 comments on HN
- 10Monitor your AWS account to detect suspicious behavior in real time2 people · 9 points · first shared 2015 · discussion on HN
- 11AWS Machine Learning with Iris Flowers2 people · 7 points · first shared 2016 · discussion on HN
- 12Serverless image resizing2 people · 7 points · first shared 2015 · 2 comments on HN
- 13A brief history of AWS architectures2 people · 7 points · first shared 2019 · discussion on HN
- 14AWS Monitoring Primer2 people · 7 points · first shared 2018 · 2 comments on HN
- 15Your Lambda function might execute twice. Deal with it2 people · 6 points · first shared 2017 · discussion on HN
What HN people wrote when they linked it
rtisdale · 2018-04-26
Howdy, I'm the author :)
I definitely agree, for high traffic applications a compute or memory optimized instance are more optimal choices due to the consistent performance, especially when price isn't as much of a concern.
In situations where cost is more of a concern and the application has "bursty" requirements for performance, I still believe the T2 instance has it's place.
The guys over at Cloudonaut have an excellent article on the importance of T2 burst credits to maintain application performance.
https://cloudonaut.io/burst-credits-of-t2-ec2-instances-need-monitorin…
EDIT: The new T2 Unlimited option mentioned at the above article is also worth considering.
rad_gruchalski · 2024-07-10
You can easily get the first part of via the sdk https://cloudonaut.io/record-aws-api-calls-to-improve-iam-policies/.
emmanueloga_ · 2024-01-28
In case you are using AWS, I learned that you can close port 22 on your EC2 instances, and connect trough the Systems Manager (SSM):
https://cloudonaut.io/connect-to-your-ec2-instance-using-ssh-the-moder…
intrasight · 2022-11-11
I know this is an old thread now, but I just came back to it and thought to dig in a bit. First thing my Googling hit was this, which provides a good comparison of App Runner and Fargate
https://cloudonaut.io/fargate-vs-apprunner/
That lack of WAF support stood out. So Googling that:
https://github.com/aws/apprunner-roadmap/issues/58
"Hello, we are looking at supporting WAF in App Runner and will have more updates on this thread going forward. "
gunapologist99 · 2021-07-13
> For a good wee while now, AWS SSM (or AWS Systems Manager as I see they are calling it nowadays) has arguably been the most secure way to permit controlled and audited access to an EC2 instance.
SSM is definitely not the most secure way[0]. SSM is super complex and super-integrated into the rest of AWS, and also isn't cross-cloud to GCP, Azure, DO, etc, so now everyone needs an account just to log into a Linux server.
Worse, IAM roles are powerful but easy to misconfigure, and that's before getting into how hard they are to apply with any granularity because of the policy length limitations[1], so you're likely giving everyone access to log into every instance without even knowing it.
0. https://cloudonaut.io/aws-ssm-is-a-trojan-horse-fix-it-now/
1. https://aws.amazon.com/premiumsupport/knowledge-center/iam-increase-po…
rhodin · 2021-06-21
I'd say the most important part is knowing the tools and that comes with practice. Here's a good summary [0].
[0] https://cloudonaut.io/5-good-reasons-not-to-get-aws-certified/
based2 · 2020-09-26
mishappen · 2020-03-16
Be careful with SSM in general. The documentation suggests adding the AmazonEC2RoleforSSM policy to the role of the EC2 instances you want to access via Session Manager. This role grants read/write to all S3 buckets in your account (amongst other things). See this article for better steps and unavoidable risky things: https://cloudonaut.io/aws-ssm-is-a-trojan-horse-fix-it-now/
tyingq · 2017-09-29
There's an SQS/Lamba integration. Push 10k messages in a queue as jobs. The lambdas pull them off and delete them once done.
https://cloudonaut.io/integrate-sqs-and-lambda-serverless-architecture…
argon81 · 2017-06-25
Oh and by the way it was actually your https://cloudonaut.io/your-single-aws-account-is-a-serious-risk/ post that indirectly inspired this tool, so thanks!
We consolidated users into a bastion account, ran into annoyances with CFN, and have been using iamy ever since for change management across all our accounts (more of a writeup at https://99designs.com.au/tech-blog/blog/2015/10/26/aws-vault/)