Open changtimwu opened 8 years ago
using route 53 to archive global service http://www.cyberciti.biz/cloud-computing/aws/route-53-geodns-tutorial/
dynamodb is good at self-hosting but it has many limitation when compared with mongodb. kinesis https://www.quora.com/What-can-you-do-with-Amazon-Kinesis
good points on aws iot and nice integration api-gateway, lambda, dynamodb https://community.particle.io/t/mqtt-and-new-aws-iot-service/16483/13
aws iot quickstart
awscli
has iot
commandaws iot help
if not please install the lastest formulat
brew install awscli --HEAD
aws IAM is so complicated.
Security Credentials
Security Credentials
, 只有單一帳號密碼登錄, api 就是用那把單一的 access key/secret, 後來 AWS 開始建議 IAM best practice , 重點就是避免單一root帳號擁有極大權限卻只用密碼保護.permission
欄位可以 attach 多個 policies, 代表他被允許的動作arn:aws:iam::406995953077:user/timwu
~/.aws/credentials
, awscli
能下的指令就會被 policy 限制arn:aws:iam::406995953077:mfa/iotadmin
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iot:Connect", "iot:Publish", "iot:Subscribe", "iot:Receive", "iot:GetThingShadow", "iot:UpdateThingShadow"
],
"Resource": "*"
}
]
}
action
, 跟 SDK 裡的 API 或 awscli subcommand 幾乎是一對一另一個 policy
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": ["s3:GetObject"],
"Resource": "arn:aws:s3:::Hello-bucket/*",
"Condition": {"StringEquals": {"s3:prefix": "Bobs-"}}
}
可以理解成 Allow
or not to do Action
on Resource
when Condition
Resource 就是 AWS 所有服務的operation 都會有 ARN 表示法
官方文件
trust relationship
, 就是嚴格定義只有某些 identity (ex. EC2) 能套用此 role."Principal": {
"Service": "ec2.amazonaws.com"
}
user -> group -> group policies -> actions
user -> group -> group policies -> actions ->
action triggers some resource -> resource has a role-> role policies-> actions
比如
aws lambda list-functions
lambda function 簡介
aws lambda get-function --function-name xxx
查 function policy
aws lambda get-policy --output text --function-name xxx
查 function role
aws iam get-role --role-name xxxrole
EC2的 key pair 是 ssh 用的, 跟 aws credentials(key & secret) 是不一樣的
got such error when entering aws iot-data
/usr/local/Cellar/awscli/1.9.6/libexec/vendor/lib/python2.7/site-packages/botocore/handlers.py:488:
UnsupportedTLSVersionWarning: Currently installed openssl version: OpenSSL 0.9.8zg 14 July 2015
does not support TLS 1.2, which is required for use of iot-data. Please use python installed with openssl
version 1.0.1 or higher. UnsupportedTLSVersionWarning
firstly upgrade openssl. The following commands install openssl/libssl/libcrypto into /usr/local/Cellar
brew install openssl
brew link --force openssl
check if the version is 1.0.x at new shell
openssl version
problem still there.
awscli
-> python
-> ssl package
-> libssl
/usr/lib
when you manually do so, system complains about permission error
pip install --upgrade ssl
since ssl is becomes part of python distributionbrew install python
makes progress. Check the newly installed python's ssl versionimport ssl
print ssl.OPENSSL_VERSION_INFO
awscli
is implemented with python. Its main command /usr/local/Cellar/awscli/1.9.6/libexec/bin/aws
harecode #!/usr/bin/python
, which would use OSX builtin python. so modify it from #!/usr/bin/python
to #!/usr/bin/env/python
to use brew python.https://snowulf.com/2015/08/05/tutorial-aws-api-gateway-to-lambda-to-dynamodb/ go through from dynamodb, lambda, api gateway in 10 steps
RDS security group 跟 VPC security group 不一樣 http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.RDSSecurityGroups.html
~/.aws/credentials
記錄每個 profile 的 key id and secret
profile 不等於 AWS IAM 裡的 user account, 它還加上了 region, ex. 可以創造 3 profile
在 ~/.aws/config
裡面設定 region
common commands
for aws
or aws-shell
s3 ls
iam list-users
iam list-groups
iam list-roles
query role policy
iam get-role --role-name serverless-hello-world-dev-us-east-1-lambdaRole
iam list-role-policies --role-name serverless-hello-world-dev-us-east-1-lambdaRole
iam get-role-policy --role-name serverless-hello-world-dev-us-east-1-lambdaRole --policy-name dev-serverless-hello-w
list allow roles' condition & service
aws iam list-roles | jq '.Roles[] |
{
RoleName: .RoleName,
Description: .Description,
Service: .AssumeRolePolicyDocument.Statement[].Principal.Service,
Condition: .AssumeRolePolicyDocument.Statement[].Condition
}
role 也有 condition
{
"RoleName": "iotex_smsverification_MOBILEHUB_1697124871",
"Description": null,
"Service": "cognito-idp.amazonaws.com",
"Condition": {
"StringEquals": {
"sts:ExternalId": "dc65d449-6569-4fc9-8ff9-cd2c9adce052"
}
}
}
my first time using elastic beanstalk(EB). I'm like to use EB as the gateway to bridge OverC and AWS IoT.
It default turns on ELB and ELB has some issues about websocket.
http://stackoverflow.com/questions/9184895/how-do-you-get-amazons-elb-with-https-ssl-to-work-with-web-sockets