No SSD drives in us-east-1b, looks like a constrained zone issue again

For instances started in us-east-1b, we cannot choose SSD volumes for disk:

Surprising that m3 instance type is not available in a constrained zone us-east-1b

In region, there is a constrained zone (which can vary per AWS a/c) and some of the instances types are not available. In this particular case, us-east-1b does not have even m3 type instances:-

Looks like m1.xlarge instance types are no-longer available in us-east-1c zone

It appears that Amazon have started phasing out some of the first generation machines from some of zones in the older regions like us-east-1c. If you try to launch a first generation machine like m1.xlarge, you will see a launch error like below:-

Creating an IAM user policy to restrict user to add only ingress ports

The AWS CLI is not the most intuitive in terms of mandatory switches that it needs. To make matters worse, the IAM policy simulator is rudimentary in terms of functionally checking the policies. Recently, I had to enable a user to allow adding ingress rules to a particular security group in a vpc, the user policy looked like

*************
{
"Version": "2012-10-17",
  "Statement":[{
    "Effect":"Allow",
    "Action": [
       "ec2:AuthorizeSecurityGroupIngress",
       ],
     "Resource": "arn:aws:ec2:<region>:<aws_account>:security-group/<sg-group-name>",
        "Condition": {
        "StringEquals": {
          "ec2:Vpc": "arn:aws:ec2:<region>:<aws_account>:vpc/<vpc-id>"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "ec2:DescribeSecurityGroups",
      "Resource": "*"
    }
  ]
}
*************

The above policy passed in the IAM policy simulator just fine. However, during runtime, using the below command

*************
$aws ec2 authorize-security-group-ingress --group-name <sg-group-name> --protocol tcp --port 80 --cidr <block ip> --profile <profile-name>

A client error (InvalidGroup.NotFound) occurred when calling the AuthorizeSecurityGroupIngress operation: The security group '<sg-group-name>' does not exist in default VPC '<default-vpc-id>'
*************

Since the user policy was created with resource arn pointing to <sg-group-name>, the above was assumed to work, but it does not. As per AWS doc, it is required to give security group id instead of name

So the above policy had to be modified to include security group id:

*************
....
"Resource": "arn:aws:ec2:<region>:<aws_account>:security-group/<sg-group-id>",
....
*************

Correspondingly, the aws cli command needs to pass security group id as well:

*************
$aws ec2 authorize-security-group-ingress --group-id <sg-group-id> --protocol tcp --port 80 --cidr <block ip> --profile <profile-name>
{
    "return": "true"
}
*************

Had to spend sometime troubleshooting this subtle difference in group id and group name, whereas policy simulator or aws cli can save folks some time if this difference is made obvious.

Disable Apache and PHP signature on external facing websites

For security reasons, you will want to disable Apache and PHP signature (versions) in external facing sites. When signature is not hidden you will see headers like

*************

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: text/html; charset=utf-8

Date: Mon, 20 Oct 2014 19:35:43 GMT

Pragma: no-cache

Server: Apache/2.4.9 (Unix) PHP/5.5.11

X-Powered-By: PHP/5.5.11

*************

To hide the signatures, you can make the following changes in your apache's httpd.conf and php.ini file

httpd.conf

**************
ServerSignature Off
ServerTokens Prod
TraceEnable Off
**************

php.ini

**************
expose_php = Off
**************

After the above changes, you will have to restart your httpd server. 

CVE-2014-3513 - SSLv3 (poodle attack) Openssl memory leak can cause DoS attack

The new SSLv3 vulnerability found by Google researchers:-

http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html

has widespread implications for the servers that are ssl termination points. For now, they have to disable SSLv3 ciphers or protocol itself. Additionally, they have to check the reverse proxies to see if strong ciphers (TLS) can only be allowed.

Amazon have also released patches for Amazon Linux and instructions for ELB:-

http://aws.amazon.com/security/security-bulletins/CVE-2014-3566-advisory/

https://alas.aws.amazon.com/index.html

****************

Amazon Linux AMI:
The Amazon Linux AMI repositories now include patches for POODLE (CVE-2014-3566) as well as for the additional OpenSSL issues (CVE-2014-3513, CVE-2014-3568, CVE-2014-3567) that were released on 2014-10-15. Please see https://alas.aws.amazon.com/ALAS-2014-426.html and https://alas.aws.amazon.com/ALAS-2014-427.html for additional information.

Amazon Elastic Load Balancing:
All load balancers created after 10/14/2014 5:00 PM PDT will use a new SSL Negotiation Policy that will by default no longer enable SSLv3.
Customers that require SSLv3 can reenable it by selecting the 2014-01 SSL Negotiation Policy or manually configuring the SSL ciphers and protocols used by the load balancer. For existing load balancers, please follow the steps below to disable SSLv3 via the ELB Management
Console:
    1. Select your load balancer (EC2 > Load Balancers).
    2. In the Listeners tab, click "Change" in the Cipher column.
    3. Ensure that the radio button for "Predefined Security Policy" is selected
    4. In the dropdown, select the "ELBSecurityPolicy-2014-10" policy.
    5. Click "Save" to apply the settings to the listener.
    6. Repeat these steps for each listener that is using HTTPS or SSL for each load balancer.

For more information, please see http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-ssl-security-policy.html.

****************************

You can also change the cipher suite policy in the ELB configuration by selecting the version "ELBSecurityPolicy-2014-10" below:-

GCE vs AWS Instance Pricing Charts

Straight out of RightScale blog link:-

On-Demand pricing comparison:-

1 yr Sustained use vs Reserved Instance pricing comparison:-

3 yr Sustained use vs Reserved Instance pricing comparison:-