DEV Community: Quang Nam Nguyen

AWS workshop #2: Leveraging Amazon Bedrock to enhance customer service with AI-powered Automated Email Response

Quang Nam Nguyen — Sat, 21 Dec 2024 17:32:48 +0000

Leveraging Amazon Bedrock to enhance customer service with AI-powered Automated Email Response: Using serverless infrastructure to create an auto-reply email system.

Benefits:

Improved Customer Experience
24/7 Support⏰: Immediate assistance, even outside business hours.
Personalized Responses🎯 Tailored responses to individual needs.
Faster Response Times🚀 Instant delivery, reducing customer wait times.
Increased Efficiency & Cost-Effectiveness
Scalability & Cost-Efficiency
- 📈 Automatic scaling, optimizing costs.
- 💲 Pay-as-you-go pricing.
Reduced Manual Workload🤖 : Automates responses, freeing staff for strategic tasks.
Increased Productivity📈: Efficiently handles high volumes of inquiries.
Enhanced Operational Excellence
Consistent Response Quality✅ : Ensures consistent and accurate responses.
Data-Driven Insights📊: Gathers valuable data on customer behavior.
Optimized Responses📈: Continuously improves response quality.

By utilizing Amazon Bedrock's powerful AI capabilities within a serverless architecture, businesses can create efficient, cost-effective, and efficient customer service solutions and deliver exceptional customer experiences.

Techstack:

Amazon Bedrock
SES
Lambda function (NodeJS - Typescript SAM)
SQS
S3
DynamoDB
IaC (Terraform)

Visit my workshop at:
https://002.tsukpa.blog/

AWS workshop #1: Deploy static website to S3 using Github Action

Quang Nam Nguyen — Tue, 17 Sep 2024 08:06:17 +0000

In this workshop, you’ll learn the basics and practice of Amazon S3, Cloudfront, using IAM OIDC STS with Github Action. Perform creating NextJs App with low latency.

Check out my first workshop at:
https://d9akteslg4v3w.cloudfront.net/001-deploy-static-site-to-s3/

If you like this workshop, please comment for more content <3

How to Revoke STS Credentials for Leaked EC2 Instances

Quang Nam Nguyen — Sat, 03 Aug 2024 07:07:59 +0000

This section will delve into the critical steps to take when an EC2 instance is compromised and its STS credentials are at risk. I'll cover methods to identify compromised instances, extract potential STS credentials, and most importantly, revoke those credentials to mitigate further damage.

Part 1: Understanding STS

What is STS?

Security Token Service (STS) is a component of AWS that provides temporary security credentials. These credentials can be used to access AWS resources without exposing long-term credentials. STS is crucial for enhancing security and flexibility in managing access to your AWS environment.

Unlike IAM, which manages long-term credentials and permissions, STS focuses on generating short-lived credentials for specific use cases.

Use Cases for STS

STS offers a wide range of applications within the AWS ecosystem:

Similar to access keys
Generates temporary credentials (sts:AssumeRole)
Limited access
Used to access AWS resources
Requested by an identity (AWS or External)

Part 2: What happens if an EC2 instance is taken control by someone else?

The best practice for running AWS Resource is using IAM Roles. This function attaches an IAM Role for a resource and provides them permission to access other AWS resources instead of using IAM Credentials

In this blog, I will show you how to get credentials from an EC2 instance and use them with the cli.

How to get credentials from EC2 instance

In this example, for simple i created a EC2 instance in a public subnet and allow anything in the security group.

Please specified needed policy with limited permissions in real world.

And from the session console i use curl to get information about EC2 metadata. After created an EC2, i access to EC2 by that local IP address 169.254.169.254

# Get role name from metadata
curl http://169.254.169.254/latest/meta-data/iam/security-credentials

# Get the credentials with role name
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/REPLACE_ME

The credentials is something like this

{
  "Code" : "Success",
  "LastUpdated" : "2024-08-03T06:06:45Z",
  "Type" : "AWS-HMAC",
  "AccessKeyId" : "ASIAWDEGI6ESSSXVEBFW",
  "SecretAccessKey" : "KwN5anzRvzoxtqzW6k6poMSc0T8zVIk1lnAmr",
  "Token" : "IQoJb3JpZ2luX2VjELf//////////Wgh/dD4mbF4wRNTeW/qWkOWil0FuI6t5pcnBy/kUO7eOCQ==",
  "Expiration" : "2024-08-03T12:40:56Z"
}

After get credentials, you can passing it into the local credentials of the AWS CLI using command aws configure. Then you can use Terraform to create a maximum instance type for mining bitcoin 👿.

Solutions

Remember, you can not manually invalidate temporary credentials. They only expire when they expire. But because changing the permissions policy affects everyone, you can add a condition element to it denying anyone access to AWS who assumed the role before a certain date and time.

And then you can go to the IAM Role then choose the last tab Revoke sessions and revoke them.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "*"
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "DateLessThan": {
                    "aws:TokenIssueTime": "[policy creation time]"
                }
            }
        }
    ]
}

After that, all temporary credentials will be invalid, you can go back to EC2, and now you can not access to the EC2 instance. To resolve this, we can stop and start the ec2 instance again to get the new temporary credentials.

Deploy Laravel project to Amazon EC2

Quang Nam Nguyen — Sun, 04 Jun 2023 03:11:23 +0000

Deploy Laravel project to Amazon EC2

Hello guys, today i'll show you how to deploy Laravel project to Amazon EC2

1. Prerequisite

EC2 instance (installed Ubuntu, Nginx)
VPC setup for EC2 instance can access ssh
RDS for mysql (check to the option "Connect to exist EC2 instance")

2. Install environment for Laravel

2.1. Connect to EC2 instance via ssh

ssh -i "<examplekey.pem>" <username>@<EC2 Address>

2.2. Copy source code to EC2 instance

Clone from github repository

  git clone <link github repository>

(Optional) Copy source from local using scp
- Install zip, unzip from local machine
```
sudo apt install zip
```
- Compress source files using zip command:
```
zip -r <zipfilename.zip> <folderpath>
```
- Copy source from local to EC2 instance using scp command:
```
scp -i "<examplekey.pem>" <zipfilename.zip> <username>@<EC2 Address>:<pathtosave>
```
- Extract source files using unzip command:
```
unzip <zipfilename.zip>
```

2.3. Install PHP dependencies based on your project. For example

sudo add-apt-repository ppa:ondrej/php
sudo apt-get update
sudo apt-get install -y php7.3

2.4. Install mysql client to connect RDS instance

sudo apt install mysql-client-core-8.0

Connect to RDS instance from EC2 via mysql client by following command and type your password

  mysql -h <RDS Address Instance> -P <port | 3306> -u <masteruser> -p

Create your database name based on the project

  CREATE DATABASE <databasename>;
  EXIT;

2.5. Config your environment file to match your RDS server

...
APP_URL=<URL of your EC2 instance>
APP_DEBUG=false

DB_CONNECTION=mysql
DB_HOST=<RDS Address link>
DB_PORT=3306
DB_DATABASE=<databasename>
DB_USERNAME=<master username>
DB_PASSWORD=<password>
...

2.6. Install Composer

sudo apt-get install -y composer

2.7. Go to project directory and install dependencies

composer update 
composer install

2.8. Generate application key

php artisan key:generate

2.9. Copy directory to /var/www/

cp <foldername> /var/www/

2.10. Update permissions

sudo chown -R www-data:www-data /var/www/<foldername>
sudo chmod -R 755 <foldername>

3. Setting up Nginx

3.1. Configure Nginx to serve the content

sudo vi /etc/nginx/sites-available/<foldername>

Then you can enter the following setting:

server {
    listen 80;
    server_name <server_domain_or_IP>;
    root /var/www/<foldername>/public;

    // Focus this log if you see error
    access_log /var/log/nginx/laravel-access.log;
    error_log /var/log/nginx/laravel-error.log;


    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options "nosniff";

    index index.html index.htm index.php;

    charset utf-8;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    error_page 404 /index.php;

    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }
}

3.2. To activate the new virtual host configuration file, create a symbolic link to foldername in sites-enabled

sudo ln -s /etc/nginx/sites-available/<foldername> /etc/nginx/sites-enabled/

3.3. To confirm that the configuration doesn’t contain any syntax errors, you can use

sudo nginx -t

3.4. To apply the changes, reload Nginx with

sudo systemctl reload nginx

4. (Optional) Fix some error when configuring

4.1. By default, EC2 ubuntu not enabled php-fpm, run following command to enable

sudo a2enmod proxy_fcgi setenvif
sudo service nginx restart

Check that package PHP-FPM is exist

sudo vi /etc/php/<version>/fpm/pool.d/www.conf

Then you find this line and check that path is correct (file .sock must exists in the folder /var/run/php/)

listen = /var/run/php/php<version>-fpm.sock

Restart the service

sudo service php<version>-fpm restart

Setting EC2, RDS

1. Create EC2

AMI: Ubuntu
Instance type: t2.micro (free tier)

Select existing security group or you can change later

2. Create Security Group

We allow SSH, ICMP and TCP from anywhere and in Outbound we allow anything

3. Create Route table

Route the traffic to the internet gateway (igw)

4. Create RDS

Create database for our application

Choose your DB instance type

Check the option connection to the EC2 instance

DEV Community: Quang Nam Nguyen

AWS workshop #2: Leveraging Amazon Bedrock to enhance customer service with AI-powered Automated Email Response

AWS workshop #1: Deploy static website to S3 using Github Action

How to Revoke STS Credentials for Leaked EC2 Instances

Part 1: Understanding STS

What is STS?

Use Cases for STS

Part 2: What happens if an EC2 instance is taken control by someone else?

How to get credentials from EC2 instance

Solutions

Deploy Laravel project to Amazon EC2

Deploy Laravel project to Amazon EC2

1. Prerequisite

2. Install environment for Laravel

2.1. Connect to EC2 instance via ssh

2.2. Copy source code to EC2 instance

2.3. Install PHP dependencies based on your project. For example

2.4. Install mysql client to connect RDS instance

2.5. Config your environment file to match your RDS server

2.6. Install Composer

2.7. Go to project directory and install dependencies

2.8. Generate application key

2.9. Copy directory to /var/www/

2.10. Update permissions

3. Setting up Nginx

3.1. Configure Nginx to serve the content

3.2. To activate the new virtual host configuration file, create a symbolic link to foldername in sites-enabled

3.3. To confirm that the configuration doesn’t contain any syntax errors, you can use

3.4. To apply the changes, reload Nginx with

4. (Optional) Fix some error when configuring

4.1. By default, EC2 ubuntu not enabled php-fpm, run following command to enable

Setting EC2, RDS

1. Create EC2

2. Create Security Group

3. Create Route table

4. Create RDS

After all you can access your application by enter your public IP EC2 address in the browser. Enjoy it 😉