Moving to wordpress!

Rolling websphere will be moving to word press!

Please come read our content here:

https://rollingwebsphere.home.blog/

Loving Docker as a Windows guy: August 2019

Over the last few years I've slowly made the transition from "docker detractor" through "docker accepter" all the way to "docker enthusiast" where I am now. Docker isn't the only container tool out there, but it's certainly one of the most popular. It gives a spin on application management and deployment that's honestly pretty refreshing.

At the same time, I've been a windows enthusiast my whole life. I'm not opposed to Ubuntu, RHEL, or OSX, and I'm not a stranger to grep, find, and ls, but I'll defend the use of Windows Server, "where-object" and "get-childitem" any day.

Using Docker as an Admin tool on Windows

Have you ever tried to download openssl on Windows? You need to convert a cert, or just do some crypto work, so you google "openssl windows" and find the source forge entry. After a few minutes of scrolling around confused you finally accept that the page doesn't have a release more recent than several years ago.

So you go back to google and click on the link for openssl.org, and realize that they don't distribute any binaries at all (windows or otherwise).

You scroll a few entries further down, still looking for an executable or guide to get openssl on windows, and you click on a promising article heading. Perusing it tells you that it's actually just a guide for Cygwin (and it would work, but then you have Cygwin sitting on your machine, and you'll probably never use it again). You think to yourself, "There has to be an executable somewhere."

Next you jump to page 2 of the google results (personally it's the first time I've jumped to that page two in years) and scrolling you find more of the same. Linux fanatics using Cygwin, source code you could compile yourself, and obscure religious wars like schannel vs every other cryptography provider.

All you really want is to go from a .pfx to a .pem, and you're running in circles looking for the most popular tool in the world to do it.

Enter Docker.

Using Unit Tests for Communication

Expressing software requirements is hard. Software is abstract and intangible, you can't touch it see it or feel it, so talking about it can become very difficult.

There are plenty of tools and techniques that people use to make communicating about software easier like UML diagrams or software state diagrams. Today I'd like to talk about a software development technique my team has been using for communication: Test Driven Development.

I was featured on the AWS Blog!

Hello everyone,

Shameless self plug here, I was recently featured on the AWS blog:

https://aws.amazon.com/blogs/mt/how-docutap-automates-cloud-operations-using-aws-management-tools/

The post covers some of the techniques we use for configuration management at my company, many of which I helped design.

Thanks for giving it a read through!

Docker Windows container for Pester Tests

I recently wrote an intro to unit testing your powershell modules with Pester, and I wanted to give a walk through for our method of running these unit tests inside of a Docker for Windows container.

AWS S3 Lifecycle Policies - Prep for Deep Archive

AWS recently released a new S3 storage class called Deep Archive. It's an archival data service with pretty low cost for data you need to hold onto, but don't access very often.

Deep Archive is about half the cost of Glacier at $0.00099 per GB per month, but you sacrifice the option to get your data back in minutes, your only retrieval option is hours.

Unit Testing PowerShell Modules with Pester

Pester is a unit testing framework for Powershell. There are some good tutorials for it on their github page, and a few other places, but I'd like to pull together some of the key motivating use cases I've found and a couple of the gotchas.

Graph Your RI Commitment Over Time (subtitle: HOW LONG AM I PAYING FOR THIS?!?!?)

In my last post I talked about distributing your committed RI spend over time. The goal being to avoid buying too many 1 year RIs (front loading your spend), and missing out on the savings of committing to 3 years, but not buying too many 3 year RIs (back loading your spend) and risking having a bill you have to foot if your organization has major changes.

Our RI Purchase Guidelines

I've talked about it a couple of times, but AWS's recommendation engine is free and borderline magic.

It's a part of AWS Cost Explorer and ingests your AWS usage data, and spits back reserved instance recommendations

Getting Started with AWS Reserved Instances

If you've been using AWS for a while you've probably built up some excess spend. The "pay as you go" nature of AWS is a double edged sword: It's easy to get a PoC up and running, but you can wind up with waste if you aren't disciplined with your cleanup.

Diving Into (and reducing) Your AWS Costs!

AWS uses a "pay as you go" model for most of it's services. You can start using them at any time, you often get a runway of free usage to get up to speed on the service, then they charge you for what you use. No contract negotiations, no figuring out bulk discounts, and you don't have to provision for max capacity.

AWS Powershell Tools: Get Specific Tags

A quick AWS Powershell tools snippet post here. When you call Get-EC2Instance from the AWS Powershell tools it returns an instance object that has a Tags attribute, which is a Powershell list of EC2 Tag Objects.

I'm usually a fan of how the AWS Powershell Tools object models are setup, but this is one case where I feel there could be some improvement. Instead of using a list and forcing users to iterate the list to find the right tag, the EC2 objects "Tags" property should be a hashtable with the tag Key as the hash key so you can index directly to the object. But, this is was we have to work with for now.

Is My Traffic Being Blocked? (or Using Wireshark to Unanswered SYN Packets)

One of the most frustrating things in network troubleshooting can be finding out if traffic is being blocked. Blocked traffic can keep applications or a services from running correctly. A lot of applications will throw unhelpful or vague error messages.

Until relatively recently the average network was a pretty open and trusting place. Most computers were allowed to receive and send traffic on any port they pleased, any protocol was allowed to use any port with no explanation required.

VPC Flowlogs through Cloudwatch Logs Insights

You know all those times you think to yourself, "I wish there were a faster way to search all these logs I keep putting in Cloudwatch?"

Well apparently Alexa was reading your mind at one of those times because at AWS re:Invent 2018 released CloudWatch Logs Insights. It's advertised as a more interactive, helpful log analytics solution than the log search option we already have.

AWS Powershell Tools Snippets: S3 Multipart Upload Cleanup

My company does quite a bit with AWS S3. We use it to store static files and images, we push backups to it, we use it to deliver application artifacts, and the list goes on.

When you push a significant amount of data to and from S3, you're bound to experience some network interruptions that could stop an upload. Most of the time S3 clients will recover on their own, but there are some cases where it might struggle.

WannaCry: Finding where SMB is allowed in AWS

WannaCry is the latest ransomware to sweep the internet and cause lots of excitement. As occasionally happens with well publicized security events like this I got to hear a former firewall admins favorite words: "Can you please take away a bunch of network access?" What fun!

I love blocking traffic as much as the next guy, but it's not a great idea to just change firewall rules willy nilly. You should always spend a little time thinking about the impacting and looking at what access it's prudent to remove. In this post I'll list a couple of the commands I used to poke around our AWS Security groups and find where SMB was allowed.

Auditing AWS IAM Users

Like any other company with sensitive data we go through audits pretty regularly. The latest one included some questions about accounts that have access to sensitive data, and the number of auth factors required to log into them.

As usual I started digging around in the AWS Powershell Tools to find a way to make this job easier than just manually looking through accounts, and I quickly found Request-IAMCredentialReport and Get-IAMCredentialReport.

AWS Powershell Tools Snippets: Powershell Pipes

I'm on another AWS Powershell tools rant. Hopefully after reading this blog post you'll share my appreciation for how useful they are.

Powershell takes the idea of piping commands together (sending that output of one command directly to the input of another) to a whole new level of useful. If you aren't familiar with the concept, it's a great way to make your commands dynamic and intricate. Let's walk through an example.

Building a Docker container for easy SSH into Opsworks Stacks

Part of the concept behind Opsworks is the ability to create and destroy instances dynamically. If your instances are configured by Chef recipes all the way from AMI to processing production workload, this is probably something you do pretty regularly.

But this probably means that the IP addresses behind your instances change regularly. At some point you might get tired of constantly going back to the Opsworks console to get an IP address, I know I did.