DEV Community: Nada Ahmed

Deploying a Flask Web App on an AWS EC2 Instance using Docker and Terraform

Nada Ahmed — Sat, 09 Nov 2024 18:17:30 +0000

This project combines Terraform for infrastructure automation and Docker for containerizing a simple Flask web application. You’ll create a basic Flask application, containerize it using Docker, and then use Terraform to provision an AWS EC2 instance, deploy the Docker container, and expose the Flask application over the web.

Project Overview

Flask Application: A simple Flask web app.
Docker: Containerize the app so it runs consistently on any machine.
Terraform: Provision AWS resources to host the Dockerized application on an EC2 instance.

Steps to Set Up the Project

1. Create a Simple Flask Application with Docker

Create a New Directory: This will be your project folder.
Create the Flask Application (app.py):
In your project folder, create a file called app.py with the following content:

from flask import Flask
app = Flask(__name__)

@app.route('/')
def hello_world():
    return "Hello, world from Flask in Docker on AWS!"

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000)

This Flask application simply returns a "Hello World" message when you access the root URL.

Create a Dockerfile: In the same directory, create a Dockerfile to containerize the Flask application.

# Use the official Python image
FROM python:3.9-slim

# Set the working directory
WORKDIR /app

# Copy the application files
COPY app.py /app

# Install Flask
RUN pip install Flask

# Run the application
CMD ["python", "app.py"]

The Dockerfile defines the environment for your Flask app and installs Flask inside the container.

2. Build and Test the Docker Image Locally

To ensure the app works locally, build and run the Docker image:

docker build -t flask-app .
docker run -p 5000:5000 flask-app

Now, open a browser and visit http://localhost:5000 to check if the Flask app is running locally.

3. Terraform configuration

Terraform configuration, including resource.tf, ec2.tf, main.tf, backend.tf, output.tf, and variables.tf, would look for deploying a Dockerized Flask app on an EC2 instance:

main.tf (Provider Configuration)

provider "aws" {
  region     = "us-west-2"
  access_key = "xxxxxxxxxxxxxxxxxxxxxx"
  secret_key = "xxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

resource.tf (Network, VPC, Security Group, and Internet Gateway)

# VPC
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = {
    Name = "Project terraform"
  }
}

# Internet Gateway
resource "aws_internet_gateway" "gw" {
  vpc_id = aws_vpc.main.id

  tags = {
    Name = "MainInternetGateway"
  }
}

# Route Table for Public Subnet
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.gw.id
  }

  tags = {
    Name = "PublicRouteTable"
  }
}

# Subnet
resource "aws_subnet" "demosubnet" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = var.subnet_cidr
  availability_zone       = "us-west-2a"
  map_public_ip_on_launch = true

  tags = {
    Name = "Public Subnet"
  }
}

# Associate the Route Table with the Public Subnet
resource "aws_route_table_association" "public_subnet" {
  subnet_id      = aws_subnet.demosubnet.id
  route_table_id = aws_route_table.public.id
}

# Security Group
resource "aws_security_group" "allow_http" {
  name        = "allow_http_${random_id.unique_id.hex}"  # Use a random ID to make the name unique
  description = "Allow HTTP traffic"
  vpc_id      = aws_vpc.main.id

  # Ingress rule to allow HTTP traffic
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 5000
    to_port     = 5000
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # Egress rule to allow all outbound traffic
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "AllowHTTP"
  }
}

resource "random_id" "unique_id" {
  byte_length = 4
}

ec2.tf (EC2 Configuration to Run Flask App)

# EC2 Instance
resource "aws_instance" "flask_ec2" {
  ami           = var.ami_id
  instance_type = var.instance_type
  vpc_security_group_ids = [aws_security_group.allow_http.id]  # Dynamically use created security group ID
  subnet_id     = var.public_subnet_id
  associate_public_ip_address = true

  user_data = <<-EOF
              #!/bin/bash
              # Update the system
              yum update -y

              # Install Docker manually (alternative to amazon-linux-extras)
              yum install -y docker

              # Start Docker service
              service docker start

              # Enable Docker service on boot
              service docker enable

              # Add ec2-user to Docker group
              usermod -a -G docker ec2-user

              # Run the Flask app container
              docker run -d -p 5000:5000 nadasaad/flask-app:latest
            EOF

  tags = {
    Name = "FlaskDockerEC2"
  }

  depends_on = [aws_security_group.allow_http]  # Ensure security group is created first
}

backend.tf (Backend Configuration for Terraform State)

terraform {
  backend "s3" {
    bucket         = "mybucket09a"
    key            = "terraform.tfstate"
    region         = "us-west-2"
    dynamodb_table = "lockstate"
  }
}

output.tf (Outputs for Public IP)

output "public_ip" {
  value = aws_instance.flask_ec2.public_ip
}

variables.tf (Variable Definitions)

variable "ami_id" {
  description = "The AMI ID to use for the EC2 instance"
  default     = "ami-066a7fbea5161f451"  # Replace with the correct AMI ID for your region
}

variable "instance_type" {
  description = "The type of instance to use for the EC2 instance"
  default     = "t2.micro"  # Modify as needed
}

variable "subnet_cidr" {
  description = "The CIDR block for the subnet"
  default     = "10.0.1.0/24"  # Modify as needed
}

variable "security_group_id" {
  description = "The security group ID to associate with EC2 instance"
  default     = "sg-06e61ad57b5d3d5d0"  # Modify with your security group ID
}

variable "public_subnet_id" {
  description = "The subnet ID where EC2 will be created"
  default     = "subnet-0f84f2821d4f682bb"  # Modify with your subnet ID
}

Explanation:

Security Group: Allows inbound traffic on port 5000 for HTTP and port 22 for SSH.
EC2 Instance: Launches an EC2 instance with Docker installed using a user-data script that also runs the Flask app in a Docker container.

Replace:

your_vpc_id with your actual VPC ID.
your_key_pair_name with your EC2 key pair name.
your_dockerhub_username with your Docker Hub username.

4. Push the Docker Image to Docker Hub

Before Terraform can deploy the Flask app to the EC2 instance, you need to push the Docker image to a registry (such as Docker Hub).

Tag the Docker Image:

   docker tag flask-app your_dockerhub_username/flask-app:latest

Push the Image to Docker Hub:

   docker push your_dockerhub_username/flask-app:latest

Make sure your Docker Hub account is logged in using docker login.

5. Deploy the Project with Terraform

Now, let’s deploy the resources with Terraform:

Initialize the Terraform Configuration:

   terraform init

Apply the Terraform Configuration:

   terraform apply

Terraform will prompt you for confirmation before provisioning the infrastructure. Type yes to proceed. It will then create an EC2 instance, security group, and other necessary resources.

6. Access Your Flask Application

Once the Terraform apply is successful, it will output the public IP of the EC2 instance.

Obtain the EC2 Public IP: You can find it in the Terraform output or AWS Management Console.
Access the Flask App: Open a web browser and go to:

   http://<EC2_PUBLIC_IP>:5000

Replace <EC2_PUBLIC_IP> with the actual public IP of your EC2 instance. You should see the message "Hello, world from Flask in Docker on AWS!" displayed in the browser.

Conclusion

In this project, we successfully:

Created a simple Flask web application.
Containerized the application with Docker.
Used Terraform to provision AWS infrastructure and deploy the Dockerized app to an EC2 instance.
Ensured the app was accessible via a public IP.

By combining Docker for containerization and Terraform for infrastructure automation, we can deploy applications consistently and efficiently in the cloud.
This project can be expanded further by adding more complex applications, integrating databases, and setting up monitoring solutions to make it a fully-featured production environment.

Securing Customer Support with AWS Services and Slack Integration

Nada Ahmed — Wed, 30 Oct 2024 15:01:41 +0000

In this post, I’ll guide you through the creation of a secure customer support system leveraging various AWS services, integrated with Slack for streamlined communication. This architecture effectively manages support tickets while ensuring data security and efficient workflow.

Project Overview

The system facilitates customer ticket creation and management through a robust backend, utilizing the following components:

Ticket Creation: Customers initiate support requests via a user-friendly interface, which sends the data to AWS API Gateway.
Data Storage: Upon receiving the request, API Gateway triggers a Lambda function that processes the ticket information and stores it in DynamoDB.
Notifications: An SNS (Simple Notification Service) notification is dispatched to alert support agents of the new ticket, ensuring they can respond promptly.
Ticket Retrieval: Support agents can retrieve tickets by sending a request to another API Gateway endpoint. This request invokes a Lambda function that fetches ticket details from DynamoDB using the ticket ID.
Customer Messaging: To communicate with customers, another Lambda function is invoked, sending messages through Slack's API.
Ticket Closure: When the status of a ticket changes to "closed," a Lambda function triggers to transfer the ticket data from DynamoDB to S3 and to an archival DynamoDB table.

Step-by-Step Implementation

1. Create DynamoDB for Ticket Storage

a. Set Up a New Table

In the AWS Management Console, navigate to DynamoDB and select “Create table.”
Configure:
- Table Name: SupportTickets
- Primary Key: TicketID (String)
Capacity: Keep default settings for initial testing.
Save the table.

b. Add Attributes

Consider adding these fields:

CustomerName (String)
IssueDescription (String)
Status (String) - Default: "Open"

1.1 Create an Archival DynamoDB Table

Repeat the above steps to create another table:

Table Name: ArchivedTickets
Primary Key: TicketID (String)

Note: Enable DynamoDB Streams on both tables. This feature provides a real-time data stream of item-level changes in a DynamoDB table. This feature is beneficial for tracking changes to your customer support tickets

2. Configure Amazon SNS for Notifications

a. Create a New Topic

Go to SNS in the AWS Console.
Select “Create topic” and name it SupportTicketNotifications.

b. Subscribe Agents

Open SupportTicketNotifications.
Create a subscription for each agent using Email/SMS and input their details.

3. Create AWS Lambda Functions

This function handles incoming ticket creation requests. It processes the ticket information, stores it in DynamoDB, and sends a notification through SNS to inform relevant parties of the new ticket.

a. Function Setup

Navigate to Lambda in the AWS Console.
Create New Function: Click "Create function."
Configuration:
- Name: CreateTicket
- Runtime: Python (or Node.js)
- Permissions: Create a new role with Lambda permissions.
Save: Click “Create.”

b. Code the CreateTicket Function

Replace the default code with this:

import json
import boto3
from uuid import uuid4

dynamodb = boto3.resource('dynamodb')
sns = boto3.client('sns')
table = dynamodb.Table('SupportTickets')

def lambda_handler(event, context):
    body = json.loads(event['body'])
    ticket_id = str(uuid4())
    response = table.put_item(
        Item={
            'TicketID': ticket_id,
            'CustomerName': body['customerName'],
            'IssueDescription': body['issueDescription'],
            'Status': 'Open'
        }
    )
    message = f"New ticket created: {ticket_id} - {body['customerName']}"
    sns.publish(TopicArn='arn:aws:sns:eu-north-1:533267368463:SupportTicketNotifications', Message=message)
    return {
        'statusCode': 201,
        'body': json.dumps({'TicketID': ticket_id})
    }

Note
Make sure to select and attach the required policy to the Lambda execution role to ensure it has the necessary permissions for your function's operations.

3.1 Create Another AWS Lambda Functions for retrieve

 messages

Create a new function called GetTicket by following the same steps used to set up the Lambda function for creating a ticket.

This function retrieves ticket details based on the ticket ID provided by the support agent. It queries the DynamoDB table to fetch and return the ticket information.

c. Code the GetTicket Function

import json
import boto3

dynamodb = boto3.resource('dynamodb')
table = dynamodb.Table('SupportTickets')

def lambda_handler(event, context):
    ticket_id = event['pathParameters']['ticketId']
    response = table.get_item(Key={'TicketID': ticket_id})
    item = response.get('Item')

    if item:
        return {
            'statusCode': 200,
            'body': json.dumps(item)
        }
    else:
        return {
            'statusCode': 404,
            'body': json.dumps({'error': 'Ticket not found'})
        }

Note
Make sure to select and attach the required policy to the Lambda execution role to ensure it has the necessary permissions for your function's operations.

4. Slack Integration for Real-Time Messaging

Step 1: Set Up Incoming Webhook in Slack

Visit Slack API and sign in.
Create a new app and enable Incoming Webhooks.
Generate a Webhook URL to use within Lambda for message sending.

Step 2 Create Another Lambda function for sendmessage

This function sends real-time messages to the designated Slack channel, facilitating communication with customers. It ensures that updates or responses related to the ticket are communicated promptly.

c. Code the sendmessage function Function

import json
import requests
import os

def lambda_handler(event, context):
    # Extract the message from the API Gateway event body
    try:
        message = json.loads(event['body']).get('text', 'Default message to Slack')
    except json.JSONDecodeError:
        message = 'Default message to Slack'

    # Define Slack webhook URL from environment variable
    slack_webhook_url = os.environ['SLACK_WEBHOOK_URL']

    # Prepare the payload to send to Slack
    slack_payload = {
        'text': message
    }

    # Send the message to Slack
    response = requests.post(slack_webhook_url, json=slack_payload)

    # Check for success or error in the Slack response
    if response.status_code == 200:
        return {
            'statusCode': 200,
            'body': json.dumps('Message sent to Slack successfully!')
        }
    else:
        return {
            'statusCode': 500,
            'body': json.dumps(f'Failed to send message to Slack: {response.text}')
        }

Note
Ensure that you use environment variables to securely store this information. You can utilize Secrets Manager for added security. Additionally, install the Requests library locally and create a ZIP file for deployment.

5. Set Up API Gateway

a. Create API

Open API Gateway in the AWS Console.
New API: Select "Create API."
Type: Choose "HTTP API."
API Name: CustomerSupportAPI
Save: Click “Create.”

b. Define Endpoints

Create Ticket Endpoint:
- Path: /createticket
- Method: POST
- Integration: Connect to a Lambda function for createticket
Retrieve Ticket Endpoint:
- Path: /tickets/{ticketId}
- Method: GET
- Integration: Connect to another Lambda function for retrieving details.
- Send Message Endpoint:
- Path: /sendmessage
- Method: post
- Integration: Connect to another Lambda function for sending messages.

6. Set Up Amazon S3 for Document Storage

a. Create S3 Bucket

Open S3 in AWS Console.
New Bucket: Click “Create bucket.”
Name: support-documents
Region: Same as other resources
Save: Click “Create.”

b. Set Permissions

Adjust S3 bucket policy to allow Lambda function access.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::533267368463:role/service-role/ArchiveClosedTickets-role-qbc73yay" }, "Action": [ "s3:PutObject", "s3:GetObject", "s3:DeleteObject" ], "Resource": "arn:aws:s3:::support-ticket-archive/*" } ] }

7 Create the final lambda function for ArchiveClosedTickets

This function is triggered when a ticket status changes to closed. It archives the ticket by moving it from the DynamoDB table to an S3 bucket and updating the archived tickets table.

code for this lambda

import json
import boto3
import datetime
import logging

# Set up logging
logger = logging.getLogger()
logger.setLevel(logging.INFO)

s3 = boto3.client('s3')
dynamodb = boto3.resource('dynamodb')
archive_table = dynamodb.Table('ArchivedTickets')
archive_bucket = 'support-ticket-archive'
tickets_table = dynamodb.Table('SupportTickets')

def lambda_handler(event, context):
    for record in event['Records']:
        if record['eventName'] == 'MODIFY':
            new_image = record['dynamodb']['NewImage']
            old_image = record['dynamodb']['OldImage']

            if new_image['Status']['S'] == 'closed' and old_image['Status']['S'] != 'closed':
                ticket_id = new_image['TicketID']['S']

                # Log ticket ID
                logger.info(f'Processing ticket: {ticket_id}')

                # Create JSON object for the archived ticket
                ticket_data = {
                    'TicketID': ticket_id,
                    'CustomerName': new_image.get('CustomerName', {}).get('S', 'Unknown'),
                    'IssueDescription': new_image.get('IssueDescription', {}).get('S', 'No description'),
                    'Status': new_image['Status']['S'],
                    'Comments': new_image.get('Comments', {}).get('S', ''),
                }

                # Define file path in S3
                file_name = f"{ticket_id}.json"

                # Upload JSON to S3
                s3.put_object(
                    Bucket=archive_bucket,
                    Key=file_name,
                    Body=json.dumps(ticket_data)
                )

                # Get S3 URL
                s3_url = f"s3://{archive_bucket}/{file_name}"

                # Save archive metadata to DynamoDB
                archive_table.put_item(
                    Item={
                        'TicketID': ticket_id,
                        'DateArchived': datetime.datetime.utcnow().isoformat(),
                        'S3URL': s3_url
                    }
                )

                # Log before deletion
                logger.info(f'Deleting ticket from SupportTickets: {ticket_id}')

                # Delete the original ticket from DynamoDB
                response = tickets_table.delete_item(
                    Key={
                        'TicketID': ticket_id
                    }
                )

                # Log the response from the delete operation
                logger.info(f'Delete response: {response}')

    return {'status': 'success'}

Test All Components

Test createticket lambda function

-Create test event

Test the GetTicket Lambda Function

Create a test event to validate the code functionality. ###Test archiveticket lambda

test api from postman

Conclusion

In conclusion, the Secure Customer Support System leveraging AWS services and Slack provides a robust framework for managing customer inquiries and enhancing communication. By integrating API Gateway, Lambda functions, DynamoDB, SNS, and S3, we have created a scalable and efficient solution that ensures real-time responses and secure handling of customer data. The system's architecture allows for easy ticket creation, retrieval, and closure while facilitating seamless interactions with customers via Slack. This project not only streamlines support operations but also highlights the potential of cloud technologies in delivering high-quality customer service. As businesses increasingly seek to enhance their customer support capabilities, adopting such innovative solutions will be crucial in meeting customer expectations and driving satisfaction.

Deploying a Dockerized Web App on AWS Using ECS and Fargate: A Step-by-Step Guide

Nada Ahmed — Wed, 23 Oct 2024 11:58:14 +0000

In this tutorial, I'll walk you through the process of deploying a simple Dockerized web app on AWS using Elastic Container Service (ECS) and Fargate.

Step 1: Create a Dockerized Web App

Write a Simple HTML Web App Create an index.html file

<html>
<head>
   <t1>This is simple website</t1>

</head>
<body>

    <h1>Hello Users</h1>

    <p>This is a simple website hosted using Docker on AWS ECS</p>

</body>

</html>

Create a Dockerfile This file tells Docker how to package your web app into a container.

FROM nginx:alpine

COPY ./index.html /usr/share/nginx/html/index.html

EXPOSE 80

Build the Docker Image Run the following command in your terminal:

   docker build -t my-webapp .

Step 2: Push Your Docker Image to AWS ECR (Elastic Container Registry)

Requirements:
-Make sure you have AWS CLI installed.
-Configure the AWS CLI with your credentials by running:

aws configure

This command will prompt you to enter your AWS Access Key ID, Secret Access Key, default region, and output format.

Create a Repository in Amazon ECR Go to Amazon ECR in the AWS Console and create a new repository called my-simple-website.You can choose to make this repository private or public based on your needs.
Authenticate Docker to AWS ECR Use the following command to log in:

   aws ecr get-login-password --region <your-region> | docker login --username AWS --password-stdin <ECR_URI>

Tag the Docker Image Tag your image for ECR:

   docker tag my-webapp:latest <ECR_URI>/my-webapp:latest

Push the Docker Image to ECR Finally, push your image:

   docker push <ECR_URI>/my-simple-website:latest

Step 3: Set Up ECS and Fargate

Create an ECS Cluster Go to the Amazon ECS Console and create a new Fargate cluster where your Docker containers will run.

Create a Task Definition In ECS, create a Task Definition for Fargate using the image you just pushed to ECR (<ECR_URI>/my-simple-website:latest). Set memory and CPU configurations as needed.

Create an ECS Service After defining the task, create an ECS Service to manage the running tasks (containers).

You can configure the ALB with a target group for your ECS service.
Make sure that the security group associated with your ALB has a rule that allows inbound traffic on the desired ports (e.g., HTTP port 80 or HTTPS port 443).

Step 4: Access Your Web App

Get the Public URL or dns of the Load Balancer

This URL is how you will access your web app.
Open the URL in Your Browser

When you navigate to the URL, you should see your web app running with the message "Hello World!" displayed.

Conclusion

Deploying a Dockerized web app on AWS using Elastic Container Service (ECS) and Fargate is an efficient way to manage your applications. This tutorial walked you through creating a simple HTML web app, building a Docker image, pushing it to Amazon Elastic Container Registry (ECR), and setting up an Application Load Balancer (ALB) for internet access. With ECS and Fargate, you can easily scale and manage your services, allowing you to focus on development without the hassle of server management.

How to Convert Between Encrypted and Unencrypted EBS Volumes on AWS: A Step-by-Step Guide

Nada Ahmed — Tue, 22 Oct 2024 19:25:22 +0000

When working with Amazon Elastic Block Store (EBS), you may need to convert between encrypted and unencrypted volumes depending on performance, security, or compliance needs. This post provides a comprehensive guide on how to convert encrypted EBS volumes to unencrypted and vice versa, using simple, step-by-step instructions.

What You’ll Learn:

Converting an encrypted EBS volume to unencrypted.
Converting an unencrypted EBS volume to encrypted.

Section 1: Converting Encrypted EBS Volumes to Unencrypted

Step 1: Backup Your Data

Create a snapshot of the encrypted root volume, this acts as a backup before performing any major changes.

Step 2: Stop the Instance

Stop the EC2 instance that has the encrypted root volume attached.

Step 3: Detach the Encrypted Volume

In the EC2 console, go to the **Volumes section, select the encrypted volume, and choose **Detach Volume.

Step 4: Launch a Rescue Instance

Launch a rescue instance with the same OS in the same Availability Zone as your original instance.

Step 5: Attach the Encrypted Volume

Attach the detached encrypted volume to the rescue instance.

Step 6: Create a New Unencrypted Volume

Create a new unencrypted EBS volume in the same Availability Zone as the original volume. Make sure it’s at least as large as the encrypted volume to prevent loss data.

Step 7: Attach the Unencrypted Volume

Attach the unencrypted volume to the rescue instance.

Step 8: Copy the Data

Use the dd command to copy the data from the encrypted volume to the unencrypted volume Note: To be able to access this command, make sure you have authorization to run it and that the instance is in a public subnet.

Step 9: Detach the New Unencrypted Volume

Detach the unencrypted volume from the rescue instance.

Step 10: Attach the Unencrypted Volume to the Original Instance

Attach the unencrypted volume back to your original instance, using the original device name (e.g., /dev/xvda) as a root volume.

Step 11: Verify the Volume

Restart your instance and confirm that it now reads from the unencrypted volume.

Section 2: Converting Unencrypted EBS Volumes to Encrypted

Now, let’s cover the process of encrypting an unencrypted EBS volume.

Step 1: Create a Snapshot of the Unencrypted Volume

Create a snapshot of your unencrypted volume in the AWS EC2 console.

Step 2: Copy the Snapshot with Encryption

Copy the snapshot and select the option to encrypt it during the copy process. This creates an encrypted version of the snapshot.

Step 3: Create a New Encrypted Volume

After the encrypted snapshot is created, use it to create a new encrypted EBS volume.

Step 4: Stop the Instance

Stop your EC2 instance that is using the unencrypted volume.

Step 5: Detach the Unencrypted Volume

Detach the unencrypted volume from the instance.

Step 6: Attach the New Encrypted Volume

Attach the encrypted volume to your original instance, using the original device name (e.g., /dev/xvda).

Step 7: Verify the Volume

Restart the instance and verify that it is using the encrypted volume.

Conclusion:

Converting between encrypted and unencrypted EBS volumes allows you to manage both security and performance requirements efficiently. Whether you’re encrypting volumes for data protection or removing encryption to boost performance, AWS provides flexible options for managing your data with minimal disruption.

How to Generate Self-signed Certificate in CentOS 7

Nada Ahmed — Wed, 02 Oct 2024 19:40:23 +0000

Securing communication over the web is critical, and SSL certificates play a huge role in encrypting data between a server and a client. In this post, I'll walk you through the steps of generating a self-signed SSL certificate in CentOS 7 using OpenSSL

Why Use a Self-Signed Certificate?
Self-signed certificates are ideal for internal projects, development, or testing environments. They enable you to secure communications without needing to purchase a certificate from a Certificate Authority (CA). However, browsers won't trust these certificates by default, and you'll get a warning, but for internal purposes, this is perfectly fine.

Prerequisites

1.CentOS 7 system with root access.
2.OpenSSL and Apache installed.

You can install them with the following commands:

sudo yum install mod_ssl openssl

Create a Directory for the Certificate

Create a directory to store the certificate and key:

sudo mkdir /etc/ssl/mycert
cd /etc/ssl/mycert

Step 1: Generate a Private Key

The first step is to create a private key, which will be used to encrypt the SSL communications.

sudo openssl genrsa -out mydomain.key 2048

Explanation:
This command generates a 2048-bit RSA private key named mydomain.key. This key will be used later to sign the certificate.

Note
When generating the private key, you can add the -des3 option to encrypt the key with a passphrase. This adds an extra layer of security.

sudo openssl genrsa -des3 -out mydomain.key 2048

You'll be prompted to set a passphrase. Every time you use the private key, you'll need to enter this passphrase.

Step 2: Create a Certificate Signing Request (CSR)

Next, you'll create a CSR, which contains information about your organization and the domain you're securing.

sudo openssl req -new -key mydomain.key -out mydomain.csr

You'll be prompted to enter information, such as:
-Country Name
-State
-City
-Organization
-Common Name (FQDN like www.example.com)
-Email
Explanation:
This CSR will later be used to create the self-signed certificate. The information provided is included in the certificate metadata.

Step 3: Generate the Self-Signed Certificate

Now, we use the CSR and private key to generate a self-signed certificate.

sudo openssl x509 -req -days 365 -in mydomain.csr -signkey mydomain.key -out mydomain.crt

Explanation:
The certificate is valid for 365 days and will be named mydomain.crt. This certificate, combined with the private key, will allow us to secure our server.

Step 4: Configure Apache to Use the Certificate*

To secure your web server, we need to configure Apache to use the newly created certificate.

Open the SSL configuration file:

sudo vim /etc/httpd/conf.d/ssl.conf

-Locate and update the following lines

SSLCertificateFile /etc/ssl/mycert/mydomain.crt
SSLCertificateKeyFile /etc/ssl/mycert/mydomain.key

Then Save and exit.

Step 5: Restart Apache

Restart Apache to apply the changes and enable SSL.

sudo systemctl restart httpd

Step 6: Testing the SSL Certificate

Visit your website using https://your-domain.com. Since this is a self-signed certificate, your browser will display a warning. For testing and internal purposes, you can proceed

curl -i https://www.sectom.com

Conclusion
Congratulations! You’ve successfully generated a self-signed SSL certificate on CentOS 7. This method is perfect for development, testing, or internal use. For production environments, you should obtain a certificate from a trusted CA to avoid browser warnings.

Feel free to ask questions or share your experiences in the comments!

Automating Image Thumbnails with AWS Lambda and S3: A Step-by-Step Guide

Nada Ahmed — Sun, 22 Sep 2024 15:16:48 +0000

Introduction:

I recently completed an exciting project automating image thumbnail generation using AWS Lambda and Amazon S3. The best part? It's entirely serverless, meaning I didn’t have to worry about managing infrastructure—just focused on building the solution. This workflow is ideal for dynamically processing large-scale images without any overhead!

In this guide, I’ll walk you through the steps to build this system from scratch, sharing insights and challenges I faced along the way. Let's get started!

Step 1: Setting Up the S3 Buckets
To begin, we need two Amazon S3 buckets:
-Source Bucket: This is where users will upload the original images.
-Destination Bucket: Thumbnails will be stored here after Lambda processes the images.

Here’s a quick breakdown:

Go to the AWS Management Console and create the two S3 buckets.
Configure access permissions, ensuring the correct bucket policies are applied.

Figure1 Access S3 console.
Figure 1.1 create bucket.
Figure 2 Complete create bucket

Step 2: Configuring IAM Role for Lambda Execution

Security is crucial. We need a role that allows Lambda to:

Access the S3 buckets for reading/writing images.
Log events to CloudWatch for monitoring.

I used a managed policy (AmazonS3FullAccess) alongside custom permissions for logging in CloudWatch.

Create and attach the necessary policies for S3 and CloudWatch.

Figure 3 IAM dashboard
Figure 3.1 Create policy
Figure 3.1.1 Complete create policy
Figure 3.1.2 Complete create policy
Figure 3.1.3 Policy created

In the IAM Console, create a new role with basic Lambda execution permissions.

Figure 4 Create role

Figure 4.1 Choose service
Figure 4.1.1 Select lambda service

Figure 4.1.2 Add permission

Figure 4.1.3 Review
Figure 4.1.4 Complete configure role
Figure 4.1.5 Complete configure role
Figure 4.1.6 Role created

Step 3: Creating the Lambda Function

Now, let's move on to the Lambda function itself.

Navigate to AWS Lambda, and click "Create Function."
Select Python 3.9 as the runtime (you can use other languages, but I used Python for this project).

The function listens for an S3 event, processes the image, generates a thumbnail using the Pillow library, and uploads it to the second bucket.

figure 5 Lambda function console
Figure 5.1 Create lambda function
Figure 5.1.1 Complete create lambda
Figure 5.1.2 Add code to lambda function

Here’s a snippet of the code I used:

import boto3
import os
import sys
import uuid
from urllib.parse import unquote_plus
from PIL import Image

s3_client = boto3.client('s3')

def resize_image(image_path, resized_path):
    with Image.open(image_path) as image:
        image.thumbnail(tuple(x / 2 for x in image.size))
        image.save(resized_path)

def lambda_handler(event, context):
    for record in event['Records']:
        bucket = record['s3']['bucket']['name']
        key = unquote_plus(record['s3']['object']['key'])
        tmpkey = key.replace('/', '')
        download_path = '/tmp/{}{}'.format(uuid.uuid4(), tmpkey)
        upload_path = '/tmp/resized-{}'.format(tmpkey)
        s3_client.download_file(bucket, key, download_path)
        resize_image(download_path, upload_path)
        s3_client.upload_file(upload_path, '{}-resized'.format(bucket), 'resized-{}'.format(key))

Step 4: Adding an S3 Trigger

The Lambda function is triggered automatically whenever an image is uploaded to the source bucket.

In the Lambda function's configuration, scroll down to "Add Trigger" and select S3.

Figure 6 Add trigger (s3 source bucket)
Figure 6.1 Complete add trigger
Figure 6.1.1 Function overview

Configure it to trigger on PUT events, meaning any new image upload will start the function.

Figure 6.2 create test event

Here's example of test event

{
  "Records": [
    {
      "eventVersion": "2.0",
      "eventSource": "aws:s3",
      "awsRegion": "us-east-1",
      "eventTime": "1970-01-01T00:00:00.000Z",
      "eventName": "ObjectCreated:Put",
      "userIdentity": {
        "principalId": "xxxxxxxxxx"
      },
      "requestParameters": {
        "sourceIPAddress": "127.0.0.1"
      },
      "responseElements": {
        "x-amz-request-id": "EXAMPLE123456789",
        "x-amz-id-2": "EXAMPLE123/5678abcdefghijklambdaisawesome/mnopqrstuvwxyzABCDEFGH"
      },
      "s3": {
        "s3SchemaVersion": "1.0",
        "configurationId": "testConfigRule",
        "bucket": {
          "name": "photo-project1",
          "ownerIdentity": {
            "principalId": "xxxxxxxx"
          },
          "arn": "arn:aws:s3:::photo-project1"
        },
        "object": {
          "key": "cute-kitten-4k-im-1600x900.jpg",
          "size": 1024,
          "eTag": "0123456789abcdef0123456789abcdef",
          "sequencer": "0A1B2C3D4E5F678901"
        }
      }
    }
  ]
}

Step 5: Testing the Solution

Now, upload a sample image to the source S3 bucket. The Lambda function should:

Automatically get triggered.
Process the image and create a thumbnail.
Store the thumbnail in the destination bucket.

Figure 7 upload two photos in source bucket
Figure 7.1 Two photos after resizing
Figure 7.2 Photo resized
Figure 7.3 Photo resized

💡 Challenge:
I initially encountered issues with image formats and timeouts. Optimizing the image processing code to handle larger images and using the appropriate timeout settings resolved these.

Step 6: Monitoring with CloudWatch

Once the function is up and running, you can use CloudWatch to monitor the executions and logs. It’s essential for checking if the function ran successfully or troubleshooting issues like failures.

Conclusion:

This project demonstrated the power of serverless architecture and how easily AWS services like Lambda and S3 can handle dynamic tasks such as image processing at scale. By leveraging AWS’s scalability, this solution is efficient and cost-effective, especially for large-scale workloads. I also gained valuable insights into optimizing Lambda functions and managing event-driven architectures.

Key AWS Services:

AWS Lambda
Amazon S3
IAM for security
CloudWatch for monitoring

If you're working on automating processes in the cloud, AWS Lambda is a game-changer! Feel free to try this solution and let me know how it goes.