Benjamen Pyle’s Post

A Real-tech Lesson on the Importance of Diversifying Your Technology Stack & platform One of my clients had their entire infrastructure on AWS for almost 4 years. Everything was running smoothly until one day, disaster struck. The business team notified me that the sites and associated applications were down. When we investigated further, we found that every checkpoint notification on the AWS console had failed. Shockingly, the AWS account had been suspended without any prior notice—no emails, no warnings, nothing. We immediately opened a support ticket, but the first response came 24 hours later. The reason? Another AWS account had been opened with the same name (by someone else), and due to AWS policy, no further details could be shared. This situation was beyond frustrating: 1. Lack of Transparency: AWS provided no actionable information, leaving us in the dark. It felt like booking a flight and being denied boarding because someone else booked a ticket under your name—but due to policy, the airline refuses to tell you who did it. 2. Worst Support: Despite opening multiple support tickets, each was put on hold. The only advice we received was to identify and resolve the issue with the other account, with no further guidance due to policy restrictions. How could someone else open an account with same business name? Also, the steps to verify this from AWS Side is still unknown. Toppings to frustration: 1. No support over Email/Phone, the only option was using web support. 2. Although RM was already assigned, there was no option to connect with them. The AWS Support executive who was responding to the web tickets sent out a link to request call back from the RM, but less that he knew was that it was a sales call back form :| 3. Even the option to purchase priority support was disabled due to the account suspension. Imagine this: You log into the AWS console only to be greeted by a message that your account has been suspended. Following the advice to contact support, you find that general support offers no useful information. Frustrated, you try to upgrade to paid support, only to be blocked with a message that the page is inaccessible—because your account is suspended. Key Takeaways: No matter how robust and sophisticated your backup strategy is, it’s meaningless if everything is tied to a single vendor. This incident was a harsh reminder of the critical importance of decentralization and diversified backup policies, even for small to mid-sized organizations.

Root user and IAM users 1.The main owner of an AWS account is referred to as Root Account.Root account user authenticate himself and login using email id and password. 2.IAM(Identity and Access Management) service is provided by AWS for creating multiple IAM users.For example your company is a Root account user and all other employees of your company are IAM users. 3.Root users create IAM users and attach policies to them .These policies are basically permissions related to what tasks or activities can be carried out by an individual IAM user in the Root account . 4.Root user or any IAM user with an IAM service policy (permission) attached to them can create IAM users and attach policies to these new IAM users.

Hello all. I have just finished my first hands-on project in a real-world scenario using AWS CLI to add 100 users to IAM and assigned them to a group from a company's Excel spreadsheet. In the script, I required the users to change their password on first login. I also created a custom policy attached to each user group that would also require the user to set up Multi-factor Authentication (MFA) after their first login. #cloudcomputing #amazonwebservices

#BuildInPublic update: (In case you missed it, I'm working on NSDominion, a SaaS tool to manage your customers' DNS records.) I've created an implementation for the authoritative name server resolution service. What is this and why is it necessary? When your computer looks up the name 'something.example.com', it asks a DNS server to resolve this name. That DNS server contacts another DNS server. In fact, there can be an entire chain up till the root DNS server. The root DNS server then contacts the DNS server for 'com'. The DNS server for 'com' contacts the DNS server for 'example.com'. That's a lot of requests, and if they had to be repeated each time a name was to be looked up, it would be very inefficient! To solve this, most DNS servers maintain a local cache where they store the result of any lookup they had previously performed. If a request matches something in the cache, they return the response directly without having to go up the chain. That's great for performance. But it's not so great when you want to tell, in real time, when a domain has been updated. And to do this, you can directly query the authoritative name server for a given domain, skipping the middlemen. Sort of. You still need the middlemen to look up the authoritative name server itself, but once that's done, you can ask it directly for a copy of the records you need. #SaaS #BuildInPublic #DNS

Decided to post here a brief summary about what I've learned from course on this day. I suppose writing down will discipline me, and posting it here will make the process less boring 😊 So, 1st day summary: Passed module regarding AWS IAM. - Learned that you should not to use root account - Get familiar with a creating users, adding them to groups and setting permissions - Tested grant and revoke permissions - Setup and work with AWS CLI - Worked with a CloudShell as CLI alternative (great feature there that you are able to upload\download files to AWS easily) Played around with service specific IAM Roles (best practice to set permission for Role not for User and then assign Role to the User with all underline permissions) - Learned about security tools. Credential Reports: that allow to see users usage from security perspective: who and when changed password who has MFA access keys and when used password. And Access Advisor: to know what permissions granted and when services was last accessed or not used (which allow to analyze and revoke redundant permissions for specific user). *After this day it's left 469 point to go

IAM Roles vs. IAM users. Identity and Access Management in AWS can be complex with the existence of profiles such as users, roles and groups. We will dive into one of the core differences between AWS roles, AWS users. IAM users represent the person or workload that will perform operations within the AWS environment. They have persistent or long-term access credentials. We use IAM users to log into the management console. IAM roles are used when giving trusted entities such as trusted 3rd party access to your environment but do not want to generate persistent credentials. You can define which entities can adopt the security credentials or policies for a role by using the account_id. IAM Roles and IAM Users can have IAM Access Policies attached to them.  

Reason number <i lost count> to not mix your Commercial and FedRAMP/IL* offerings. If you utilize AWS, there are some Organization specific configurations that are one size fits all. For example, both Org Trail (Cloudtrail at the Org level) and Identity Center are one and done. In Org Trail, all Cloudtrail logs go to one bucket. There's no way to set rules for this. This is fine, just something to know about. So if you're starting out in FedRAMP, make sure to create a new MPA (Master Payer Account) now known as "Management Account". Keep this completely separate from your commercial accounts. In Identity Center, this is important as well. You currently cannot configure multiple IDPs. When doing FedRAMP, your IDP needs to be FedRAMP authorized as well. So if you're using a non authorized IDP for your commercial environment, you'll find yourself in a bind with Identity Center. And before you ask, delegated auth doesn't count. Don't do it. So put your Identity Center is a new FedRAMP/Federal only MPA.

Following on from my post yesterday I have finally got access to my AWS account after my 2FA key died on me. I can't entirely blame Amazon as some simple steps by me would have made the process much easier: 1. Have a backup 2FA key 2. Review your supplier recovery process. In this case it involved calling us, but we had a digit wrong in our registered phone number and this effectively blocked the process going forwards. In my defence, this account was set up years ago, probably before 2FA was even a thing - and I wouldn't be the first person (or last I suspect) to think all is well until it isn't. Whilst there were clearly lessons to be learned there, this process massively reinforced to me what is important to me and the relationships we have with our clients. The biggest challenge I had in resolving my issue was actually speaking to a human, I was trapped in a loop which directed me to guides I had read a million times which did not resolve my issue. It took me - literally - months before I could find a way through. I am all for automation and efficiency, but not at the cost of customer experience. The bigger the company, the harder it seems to be to speak to someone. We have our security procedures, but we know our clients, months of wasted time and having a client locked out will never happen. Is it worth reviewing your suppliers? Most telecoms, internet and hosting is still contracted through the big corporations, while smaller companies often have access to the same infrastructure but have a more accessible support team. If you have to deal with a global corporation, triple check your details and recovery process - or maybe consider a smaller company where you can build a relationship and actually speak to a human. For the record, my experience with AWS did not impact our clients in any way.

What is dns and how its configured. . . . DNS (Domain Name System) is a system that translates human-readable domain names into IP addresses, allowing computers to locate and connect to each other on a network. DNS is crucial for the internet's functionality, enabling users to access websites and services using easily remembered domain names instead of numerical IP addresses. Choose a DNS Provider: Select a DNS provider that suits your needs. Common providers include Cloudflare, Google Cloud DNS, Amazon Route 53, and others. Domain Registration: Register a domain name through a domain registrar. This involves selecting and purchasing a unique domain name for your website or service. Configure DNS Records: Access your DNS provider's management interface and configure various DNS records, such as: A Records (Address Records): Associates a domain with an IPv4 address. AAAA Records (IPv6 Address Records): Associates a domain with an IPv6 address. CNAME Records (Canonical Name): Creates an alias for a domain. MX Records (Mail Exchange): Specifies mail servers for the domain. TXT Records (Text): Used for various purposes, including domain verification and SPF records for email. Name Servers: Update your domain registrar's settings to point to the name servers provided by your chosen DNS provider. These name servers are responsible for handling DNS queries for your domain. Propagation: Changes to DNS records may take some time to propagate throughout the internet. During this period, DNS servers around the world update their caches with the new information. . . . #linux #sysadmin #systemadministrator #linuxadministrator #linuxsystemadministration #dns #devopsengineer #devops

🔐 Day 30 - Part 2 of my #60DayCloudChallenge! 🔐 After setting up my IAM user with admin privileges and MFA, I continued to dive deeper into AWS IAM practices. Here's what I focused on today: 1️⃣ Created another sample IAM user (testuser1) and tested attaching and detaching policies (attached 11 managed policies). 2️⃣ Group Management: Created two groups and assigned users to them, later removing the users to explore user management flexibility. 3️⃣ Access Control: Disabled console access for the sample user and tested login to see the access restrictions in action. 🛑 4️⃣ Credential Management: Reset the IAM user password, logged in with the reset password, created Access Keys and Secret Keys, then made the keys inactive and deleted them for security. 5️⃣ Cleanup: Deleted the sample IAM user (but kept my primary IAM user intact!). This extended practice helped me get hands-on experience with managing IAM policies, user access, and credentials. I'm gaining more confidence in securing AWS environments and managing access efficiently. 💼🔑 #AWS #CloudSecurity #IAM #AccessControl #60DayChallenge #CloudPractitioner #SecurityBestPractices