DEV Community: Arijita Mitra

Even wondered how attending AWS re:invent would be like? Hear it from the ones who attended the conference for the very first time! Was it worth it or not? ....check it out!

Arijita Mitra — Mon, 13 Jan 2025 21:23:15 +0000

AWS Re:Invent 2024 - Through the lens of first-time attendees

Arijita Mitra for AWS Community Builders ・ Jan 13

#aws #community #reinvent2024

AWS Re:Invent 2024 - Through the lens of first-time attendees

Arijita Mitra — Mon, 13 Jan 2025 20:57:01 +0000

AWS re:Invent 2024 is over and it was a conference like no other. But what made it so special? What expectations did we have from the conference, and how far did it fulfil that? I feel the best ones to answer this are the first-time attendees of re:invent 2024.
Let's have a look at what few of the first timers have to say about their experiences at re:Invent 2024, and their key takeaways.

Stephen Sennett

"Talking and spending time with people was the most valuable part of re:Invent for me - especially those from other parts of the world who I've interacted and collaborated with, but never get the chance to see. Your time is the single most valuable resource at re:Invent - optimize it to make meaningful connections."

Karina Alvarado

"I've always wanted to attend re:invent. For years I have been an AWS User Group leader, and an AWS community builder, and I felt that attending re:invent will give me a boost on learning AWS on a deeper level. But it was far more than what I expected. It was inspiring to meet all the people I only see names written on blogs, doing talks on videos, or being influential on articles in LinkedIn. Asking them questions face to face is an opportunity of a lifetime and adds a human factor to the interaction. With discussions of problems, we hear potential solutions, and seeing the future being slowly built. Lastly, there is a boost of inspiration to continue to level up and do something with everything you learned. The conference is jam-packed with technology that there is at least one thing that will get you curious to try and experiment when you go back to work on product. AWS not too recently added sustainability as one of the pillars of architecture, and re:invent is continuously an event that fosters sustainability with re-invention and making the world a better place."

Thelma Laryea

"Re:Invent was a life-changing experience for me! I had the opportunity to attend educational sessions that enlightened and added a refreshing perspective to the AWS services I currently use. I also had the opportunity of networking with cloud enthusiasts across the globe and attending fun events at night! Although re:Invent was inspiring, it was sometimes overwhelming, I must admit, and I am super grateful for all the advice I got from alumni on how to pace myself and not feel pressured to attend every event. There are just way too many sessions and events! I absolutely enjoyed re:Invent, paced it out to my preference, and was impacted."

Sevim Durmus

"Attending AWS re:Invent 2024 was an incredible experience. Being surrounded by the AWS community and having the chance to network with so many accomplished individuals was inspiring. Seeing their passion for helping others grow motivated me to continue my journey and bring others along with me. This experience has not only opened my eyes to new opportunities but has also reinforced the importance of collaboration and community in achieving success and driving innovation."

Rajani Ekunde☁️

"AWS re:Invent was an amazing experience! Meeting my mentors in person felt surreal, and learning about the latest tech advancements was inspiring. I got to network with so many brilliant minds, and the sessions gave me fresh ideas to explore. It truly boosted my enthusiasm for the cloud journey."

Shriram Wasule

"Ever since I started working on AWS technology, attending AWS re:Invent has been a dream of mine. In 2024, that dream became a reality, and it was an experience I'll never forget. This incredible experience was made possible by the AWS All Builders Welcome Grant Program, which sponsored for my entire trip. This conference wasn't just about tech; it was about inspiration, growth, and making lifelong connections. I'm back home now, reflecting on the whirlwind of experiences and memories. One thing is certain: AWS re:Invent is more than just an event - it's a transformational opportunity for those who embrace it."

Nova Lailatul Rizkiyah

"My journey to re:Invent in Las Vegas is something I have been looking forward to since 2021. When I finally attended re:Invent in 2024, I was beyond excited. I'm incredibly grateful to the All Builder Welcome (ABW) grant for making my dream come true. At re:Invent 2024, I had the chance to meet AWS experts I've long admired, connect with my AWS colleagues, with whom I've collaborated on multiple projects, and meet new people who instantly felt like family. The experience of being present at the keynote was so much more powerful than watching it on a screen. The impact I hope for after attending re:Invent and receiving the ABW grant is to inspire more Indonesians, especially women, to apply for the ABW grant. Indonesia has so much outstanding talent, including its women. As a mother and a woman, I want to encourage more women to dream big and make those dreams a reality, with a strategic and measurable approach. By attending re:Invent, we gain access to a vast network and an extraordinary community. With such connections, the chances of achieving our dreams are much higher because we have countless role models and incredible people as our friends and mentors."

Samia Khan

"My experience at re:Invent has been nothing short of amazing! I'm so grateful to have had the chance to meet and learn from so many inspiring people from AWS women-in-tech to community builders and Heroes. Attending chalk talks, practical workshops and taking part in a game-day has really shown me areas of interest like Kubernetes and Containerisation and I am now motivated to learning more about these and feel inspired to go down the path of building up my skills through training and certifications to increase my knowledge. I can also use what I've learned and apply it to my current role."

Sharon Faith M

"Re:Invent 2024 was an absolute game-changer - a true God-given opportunity! I got to meet and listen to some of the brightest tech minds, all in one place. Massive thanks to AWS and the ABW Grant for this once-in-a-lifetime experience and for supporting us every step of the way on this incredible journey. Now officially promoted to Alumni 😜, I'm still buzzing from the epic mentoring sessions, mind-blowing insights, endless goodies, mouthwatering food, and yes, the unforgettable parties! It was truly a dream come true - networking, new friends, cultures colliding, and pure tech magic. I can't wait to give back to the community, keep growing and learning, and return next year to Re:Invent for another round of innovation, inspiration, and excitement! 🚀"

My personal takeaways:

AWS re-invent is a platter full of knowledgeable sessions, workshops and experiences which give us the opportunity to learn and increase our knowledge. Only thing we need to do is to manage the time. 5 days feels less when in Re:Invent!! This is not just a tech conference, it is much much more. The connections one can build there by interacting with fellow attendees and AWS employees are without doubt precious for their cloud journey.

So if you wish to experience the re:invent affair in 2025, keep a check on https://reinvent.awsevents.com/ and subscribe for updates. Also, if you are a technologist with less than 5 years of experience, do apply for the AWS All Builders Welcome Grant Program. It's totally worth it!!

AWS re-invent 2025 is bound to surpass all your expectations!

How to migrate data between two S3 buckets in different accounts with SSO user access?

Arijita Mitra — Thu, 14 Dec 2023 11:01:05 +0000

In this blog, I am going to explain how to transfer objects from one S3 bucket present in one AWS account to another S3 bucket in another account, with SSO user privilege. Both the buckets are created in different regions.

Prerequisites

Two AWS accounts (One with the source S3 bucket and another with the destination S3 bucket)
SSO user access.

What is SSO?

Single sign-on (SSO) is defined to be an authentication solution which allows users to log-in to multiple applications and websites with a one-time user authentication.

Once the user has been given the access, the log-in page will look something like this -

Step — 1

Sign-in to the AWS account with the source bucket.

Go to the bucket that has to be copied(source bucket), and then we have to edit the bucket policy.

The policy to be used is as follows -

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DelegateS3Access",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::destinationaccountnumber:root"
            },
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::sourcebucketname/*",
                "arn:aws:s3:::sourcebucketname"
            ]
        }
    ]
}

Step — 2

Log-in to the AWS account where the data will be transferred to, and create a policy -

The policy to be used is as follows -

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::sourcebucketname",
                "arn:aws:s3:::sourcebucketname/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::destinationbucketname",
                "arn:aws:s3:::destinationbucketname/*"
            ]
        }
    ]
}

Step — 3

Add this policy to a role, and add the role to a user.

Step — 4

Next, go to your terminal, and configure your terminal with the required credentials of the newly created user from your SSO log-in page.

Check if you are able to access the AWS account with the destination bucket with the following command -

aws sts get-caller-identity

Once you are able to access your AWS account, the next step is to check if you are able to access the source bucket from this AWS account.

aws s3 ls s3://sourcebucketname

Step — 5

Next, we have to copy the data from the source bucket into the destination bucket. We have to use the following command —

aws s3 sync s3://sourcebucketname s3://destinationbucketname — source-region sourceregion — region destinationregion

Conclusion —

Thus, in a few steps, we will be able to copy data from one S3 bucket to another S3 bucket belonging to a completely different account and a different region.

One concern for this method of data transfer is the size of the bucket. If the bucket size is large, then this way of data transfer will require a much longer time.

Hope you find this blog helpful.

Happy learning!!

Amazon Inspector for Lambda standard and code scanning

Arijita Mitra — Tue, 21 Nov 2023 09:48:02 +0000

Amazon Inspector, as the name suggests, is a vulnerability management service which scans AWS workloads continuously for software vulnerabilities and unwanted network exposures.

It is equipped to automatically discover and scan the running EC2 instances, container images in Amazon ECR and AWS Lambda functions.

It creates a finding when it encounters a vulnerability or network configuration issue.

What is a finding?

Describes a vulnerability
Identifies the affected resources
Provides a rating for the vulnerability
Provides guidance for remediation

Key Features of Amazon Inspector

Centrally manages multiple Amazon Inspector accounts
Regional service
Continuously scans software vulnerability and network exposures
Assesses the risk accurately and provide a risk score
The findings can be customized and downloaded as JSON or CSV format
When Amazon Inspector is activated for the first time in any region, it creates a service-linked role globally for the account — AWSServiceRoleforAmazonInspector2. This role will include the trust policies and permissions required for the scanning.
Amazon Inspector can be accessed from -

AWS management console, AWS CLI, AWS SDKs & Amazon Inspector REST API

This is the page we will see when we first go to Amazon Inspector activation:

After we activate the Inspector in any region, we see the following dashboard:

Scanning AWS Lambda functions with Amazon inspector

Amazon Inspector for Lambda scanning was released for use by AWS in November 2022. It is a fairly new service, and has proved to be a useful one too!

When Lambda scanning is activated, Amazon Inspector creates AWS CloudTrail service-linked channels in the account -

cloudtrail:CreateServiceLinkedChannel, cloudtrail:DeleteServiceLinkedChannel

Amazon Inspector itself manages these channels and uses them for monitoring the CloudTrail events for scans.

The Lambda functions need to meet few criteria to be eligible for scans -

Must have been created or updated in the last 90 days
Are not excluded from scans by tags
Are marked $LATEST
Have a supported runtime

It offers two types of scanning for Lambda -

Amazon Inspector Lambda Standard Scanning
Amazon Inspector Lambda Code Scanning

From the Account Management page, we need to activate the type of scanning we require -

So, let’s chalk down the key differences between Standard scanning and Code scanning:

Currently Lambda code scanning is available for these regions as it is in preview stage -

Once activated for Lambda scanning, the Inspector will be actively scanning the Lambdas for vulnerabilities in the packages, and in the code(for code scanning).

For the Lambdas which do not support the scans, the reasons will be displayed like this-

To exclude a lambda function from standard scanning, we have to tag the function with the following key -

Key : InspectorExclusion

Value : LambdaStandardScanning

To exclude a lambda function from code scanning, we have to tag the function with the following key -

Key : InspectorCodeExclusion

Value : LambdaCodeScanning

Understanding findings in Amazon Inspector

Amazon Inspector stores the findings and it is displayed in the Findings dashboard.

Findings are one of the following types:

Active

The finding is identified by Amazon Inspector and has not been remediated. Active findings are subject to suppression rules.

Suppressed

The finding meets one or more criteria of one or more suppression rules. Suppressed findings are hidden from most views, except for the Suppressed findings list.

Closed

After a vulnerability is remediated, Amazon Inspector automatically detects it and changes the state of the finding to closed. Closed findings are deleted after 30 days if there are no other changes.

For each finding, the file includes details such as -

Amazon Resource Name (ARN) of the affected resource, the date and time when the finding was created, the associated Common Vulnerabilities and Exposures (CVE) ID, and the finding’s severity, status, and Amazon Inspector and CVSS scores.

Here, one of my Lambda functions has been scanned and the scanning shows that it is in critical state due to hardcoded credentials in the code. Amazon Inspector will locate the part of the code where the issue lies and also provide a remediation for it.

Disclaimer: Code scanning captures code snippets from the lambda functions to highlight the detected vulnerabilities. These may show hardcoded credentials or other sensitive information in plain text.
_

Exporting the findings to S3 Bucket

We can export the findings into an S3 bucket and also download in JSON or CSV format. The steps to be followed are described below:

Create a bucket, and edit the bucket policy. Add this policy:

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "allow-inspector",
 "Effect": "Allow",
 "Principal": {
 "Service": "inspector2.amazonaws.com"
 },
 "Action": [
 "s3:PutObject",
 "s3:PutObjectAcl",
 "s3:AbortMultipartUpload"
 ],
 "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",
 "Condition": {
 "StringEquals": {
 "aws:SourceAccount": "111122223333"
 },
 "ArnLike": {
 "aws:SourceArn": "arn:aws:inspector2:Region:111122223333:report/*"
 }
 }
 }
 ]
}

Create a key with symmetric encryption and then update the key policy. Add this policy :

{
 "Sid": "Allow Amazon Inspector to use the key",
 "Effect": "Allow",
 "Principal": {
 "Service": "inspector2.amazonaws.com"
 },
 "Action": [
 "kms:Decrypt",
 "kms:GenerateDataKey*"
 ],
 "Resource": "*",
 "Condition": {
 "StringEquals": {
 "aws:SourceAccount": "111122223333"
 },
 "ArnLike": {
 "aws:SourceArn": "arn:aws:inspector2:Region:111122223333:report/*"
 }
 }
}

Then, go to All Findings, and filter out the desired finding that you would like to export. Fill in the required fields and then click on Export.

Thus, we can see that the object Inspector-findings now has the json report of the finding from Amazon Inspector.

Pricing

When we activate an Amazon Inspector scan type, we are automatically enrolled for a 15 day free trial for that scan type. After that, the price is calculated by the total Amazon Inspector coverage hours for the scanned functions within a month. The number of hours means the duration from when the function was discovered by Amazon Inspector until the function was deleted or excluded from scanning.

With Amazon Inspector, we pay only for what we use, with no minimum fees and no upfront commitments!

Thus, we can see that using AWS Inspector helps us to have a secure cloud architecture and this service serves the purpose very efficiently indeed.

Happy learning!

It's Party(Rock) time: Let's build an app in a few clicks!!

Arijita Mitra — Thu, 16 Nov 2023 17:22:35 +0000

PartyRock, an Amazon Bedrock Playground, is a generative AI app building playground. It is built to help us experiment hands-on with prompt engineering in an easy way. And let me tell you, it's a lot of fun too! Just a few clicks and we have built an app to play with generative AI in a variety of ways.

Anyone can access PartyRock through its simple web-based UI, which is separate from the AWS console and does not even require an AWS account to get started. PartyRock provides every new user with free trial usage for a limited time and there is no credit card required to sign up.

So let's use this opportunity and get started!
When we open the URL, we will land into the PartyRock console. We need to login and proceed.

Let's click on "Build your own app".

I wanted to create a daily diet plan for my friend who is currently pregnant.

Next, you will be taken to the app creation page, where you have to give the inputs required and you can select the various widgets you want in your app.

In the User Input, we have to give some details, whatever we wish to. I gave the name, age and stage of pregnancy.

As soon as I gave the input, PartyRock started generating results as "Diet Recommendations".

The following is the recommendations generated by PartyRock -

Here is a suggested healthy, balanced daily diet plan for Tabitha, a 30 year old woman who is 22 weeks pregnant:

Breakfast:
- 1 cup Greek yogurt with 1/2 cup berries and 1 tbsp chia seeds
- 1 slice whole grain toast with 1 tbsp natural peanut butter
- 1 cup green tea

Mid-morning Snack: 
- 1 medium apple with 1 oz cheddar cheese

Lunch:
- Tuna salad sandwich on whole wheat bread with lettuce, tomato, avocado
- 1 cup vegetable soup 
- 1 cup skim milk

Afternoon Snack:
- 1 oz mixed nuts
- 1 cup carrots and celery sticks with 2 tbsp hummus

Dinner: 
- 4 oz grilled salmon with lemon
- 1 cup cooked brown rice
- 1 cup steamed broccoli  
- Side salad with vinaigrette dressing

Evening Snack:
- 1 cup low-fat cottage cheese
- 1/2 whole wheat English muffin
- 8 oz decaf green tea

Key nutrition focuses for a pregnant woman are getting enough protein, omega-3s, iron, folate, calcium, fiber and fluids. This meal plan incorporates lean proteins, complex carbs, healthy fats, fruits, vegetables, dairy, nuts and seeds to help meet nutritional needs for pregnancy. Tabitha should focus on eating until satisfied, not overly full. She should also stay well hydrated by sipping water throughout the day. Light exercises like walking are also recommended during pregnancy. Consulting with an OBGYN or dietitian can help personalize and adjust this meal plan as needed.

Smart, right?

There's a Feedback widget added automatically, where as I asked questions, it gave replies instantaneously.

Next I wanted to explore more. I wanted to add more widgets to my app.

There are few options available. Let's select the Image Generation and see what's in store!

So we can use the User input and create the image. We can make changes to the user input and the simultaneous image will be updated. For example, as I asked to generate a cartoon image of the user input i.e. a pregnant lady, PartyRock generated the following image.

Isn't it cool!! It's that easy!!
We can create as many images as we wish to by changing the inputs.

We can add a Chatbot too with our desired settings.

Thus, in this fun way, we have actually created a cool app, which can be improvised more and more.

There are two modes of the apps we create - Private or Public. If we select the private mode, the app will remain private. But if we select the public mode, the app can be shared with anyone and can be accessed by them through the link.

Thus my app is public now, and can be accessed through this link.

Out of interest I have created another app to help my diabetic dad with his diet. (Don't know why I am creating apps for diet plans though!). You can have a look at that app too here.

My dashboard currently looks like this.

AWS is providing a free trial period for PartyRock users. Let's use this opportunity and get creative!

Thus, let's dive into the world of generative AI app building with this smart Amazon Bedrock Playground - PartyRock!!!

"Everyone can build AI apps with PartyRock, an Amazon Bedrock Playground"

Use AWS Systems Manager Run Command to install CloudWatch Agent in EC2 instances

Arijita Mitra — Thu, 09 Nov 2023 09:51:06 +0000

Amazon CloudWatch is a service which monitors our AWS resources and the applications running in real time. With CloudWatch, we have system-wide visibility into resource utilization, application performance, and operational health.

With CloudWatch, we can create alarms that watch metrics and send notifications or automatically make changes to the resources when a threshold is breached. However, the memory and disk metrics are not logged by default. Thus, in order for the memory and disk to be monitored and logged, we have to install the CloudWatch agent.

CloudWatch Agent helps to collect metrics and logs from EC2 instances and on-premises servers and push them to CloudWatch.

In this blog, I will be explaining the steps to be followed to create a CloudWatch alarm for EC2 instances by deploying the CloudWatch Configuration File. Below is the process to install cloudwatch agent and configure custom metrics by leveraging AWS Systems Manager.

Prerequisites:

AWS SSM Agent Installed on EC2
AmazonCloudWatchAgent installed on EC2
IAM Role(I named it “SSMagent”) with the following permissions - CloudWatchAgentServerPolicy and AmazonSSMManagedInstanceCore

Attach IAM Role

To configure each Windows EC2 instance through Systems Manager, you need to attach an IAM role with the above permissions to each EC2 instance.

Select the EC2 instance and click on Actions>Instance Settings>Attach/Replace IAM role. Then select the IAM role “SSMagent” which we have created.

Installing CloudWatch Agent on your Instances
Navigate to the ‘Systems Manager’ service under the account and region you would like to configure

In the navigation pane, choose Run Command and then click on Run a Command

In the Command document list, choose AWS-ConfigureAWSPackage

In the Name field, type AmazonCloudWatchAgent

In the Targets area, choose the instance or multiple instances on which to install the CloudWatch agent. We could see the instances in the target list as instances that have SSM agent installed by default and we attached the role(SSMagent) with necessary permissions.

Leave Version set to latest to install the latest version of the agent.

We can uncheck the output options for S3 if you don’t want to store in an S3 bucket.
Click on Run.
In the next screen, you should see a confirmation message that the command was sent successfully and the status should be Success after a few seconds.

Creating a Parameter Store with CloudWatchAgent configuration Script

Next, you will need to create a parameter store for the CWA configuration so it can be deployed across multiple EC2 instances.

Navigate to the ‘Systems Manager’ service under the account and region you’d like to configure
In the navigation pane, choose Parameter Store and then click Create Parameter

Under the Name field, you can enter any name, but you must use the same name in the next step, for example, I used CWA_config
Create and paste the JSON agent configuration created in the below into the Value field (leave all options at default).

The CW Agent will be configured to define which metric(s) are being sent to a CW Namespace, and other data required. The following JSON represents the minimum requirements.
Also, you can configure optional parameters of the CW Namespace (CWAgent is the default when not defined), and region (default region where data is located in the region where the instance runs).

{
    "metrics": {
        "namespace": "Custom_EC2_CWA",
        "metrics_collected": {
            "cpu": {
                "resources": [
                    "*"
                ],
                "measurement": [
                    {
                        "name": "usage_active",
                        "rename": "CPU_USAGE",
                        "unit": "Percent"
                    }
                ]
            },
            "disk": {
                "measurement": [
                    {
                        "name": "used_percent"
                    }
                ],
                "resources": [
                    "*"
                ]
            },
            "mem": {
                "resources": [
                    "*"
                ],
                "measurement": [
                    {
                        "name": "used_percent",
                        "rename": "MEM_USED_PERCENT",
                        "unit": "Percent"
                    }
                ]
            }
        }
    }
}

Now click Create Parameter — you should see a message saying it has been created and the parameter listed.

Deploying The CloudWatch Configuration File

In the ‘Systems Manager’ navigation pane, choose Run Command and then click on Run a Command
In the Command document list, choose AmazonCloudWatch-ManageAgent
Under Action select configure
Under Mode leave it as ec2
Change the Optional Configuration Source to ssm
Under Optional Configuration Location enter the same name of the parameter you created in the Parameter Store (previous section). In this the parameter is named CWA_config
Optional Restart should be set to Yes (This will restart the CloudWatch agent, not the instance)
In the Targets area, choose the instance or multiple instances on which you want to deploy CloudWatch Configuration on.
Now click on Run, We can see command ID status is success
To confirm that the instance is sending the Memory Metrics, head to the CloudWatch page, click on Metrics and locate the Custom_EC2_CWA (only be created if the process worked successfully). Click on InstanceId — there should be Metrics per instance for all the instances, and thus confirm that the data is collected.

When you click on Custom_EC2_CWA, you can see the different metrics.

Alarms Creation:

We can follow below AWS documentation to create alarms for the custom metrics.

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ConsoleAlarms.html

Below are the snippets to guide you through.

Click on Next and preview, create an alarm.

If we need more custom metrics for the instances, then edit the CWA_config in the parameter store.

Below is the reference link to check manually create and edit CloudWatchAgent config file.

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html?source=post_page-----11138051fb43--------------------------------