#securitygroups

[govindhtech]

How to set up an EMR studio in AWS? Standards for EMR Studio

To ensure users can access and use the environment properly, Amazon EMR Studio setup involves many steps. Once you meet prerequisites, the process begins.

Setting up an EMR studio

Setup requirements for EMR Studio Before setting up, you need:

An AWS account

Establishing and running an EMR Studio.

A dedicated Amazon S3 bucket for EMR Studio notebook and workspace backups.

Five subnets and an Amazon VPC are recommended for Git repositories and connecting to Amazon EMR on EC2 or EKS clusters. EMR Studio works with EMR Serverless without VPC.

Setup steps Setup often involves these steps:

Choose an Authentication Mode: Choose IAM Identity Centre or IAM for your studio. User and permission management is affected by this decision. AWS IAM authenticates and IAM Identity Centre stores identities. Like IAM authentication or federation, IAM mode is compatible with many identity providers and straightforward to set up for identity management. IAM Identity Centre mode simplifies user and group assignment for Amazon EMR and AWS beginners. SAML 2.0 and Microsoft Active Directory integration simplifies multi-account federation.

Create the EMR Studio Service Role: An EMR Studio needs an IAM service role to create a secure network channel between Workspaces and clusters, store notebook files in Amazon S3, and access AWS Secrets Manager for Git repositories. This service role should describe all Amazon S3 notebook storage and AWS Secrets Manager Git repository access rights.

This role requires a trust policy from AWS to allow elasticmapreduce.amazonaws.com to play:AWS:SourceArn and SourceAccount settings for confused deputy prevention. After trust policy creation, you link an IAM permissions policy to the role. This policy must include permissions for Amazon EC2 tag-based access control and specific S3 read/write operations for your assigned S3 bucket. If your S3 bucket is encrypted, you need AWS KMS permissions. Some policy claims concerning tagging network interfaces and default security groups must remain unaltered for the service role to work.

Set EMR Studio user permissions: Set up user access policies to fine-tune Studio user access.

Create an EMR Studio user role to leverage IAM Identity Centre authentication. Sts:SetContext and AssumeRole allow elasticmapreduce.amazonaws.com to assume this role's trust relationship policy. You assign EMR Studio session policies to this user role before assigning users. Session policies provide Studio users fine-grained rights like creating new EMR clusters. The final permissions of a user depend on their session policy and EMR Studio user role. If a person belongs to multiple Studio groups, their permissions are a mix of group policies.

IAM authentication mode grants studio access via ABAC and IAM permissions policies. Allowing elasticmapreduce:CreateStudioPresignedUrl in a user's IAM permissions policy lets you use ARN or ABAC tags to limit the user to a Studio.

You specify one or more IAM permissions policies to describe user behaviours regardless of authentication mode. Workspace creation, cluster attachment and detachment, Git repository management, and cluster formation are basic, intermediate, and advanced rules with different authority. Clusters set data access control rights, not Studio user permissions.

(Optional) Create custom security groups to handle EMR Studio network traffic. If no custom security groups are selected, Studio uses defaults. When using custom security groups, specify a Workspace security group for outgoing access to clusters and Git repositories and an engine security group for inbound access.

Create an EMR Studio using the AWS CLI or Amazon EMR console. The interface creates an EMR Serverless application and offers simple configurations for interactive or batch workloads. ‘Custom’ gives full control over settings. Custom parameters include studio name, S3 location, workspace count, IAM or IAM Identity Centre authentication, VPC, subnets, and security groups. IAM authentication for federated users can include an IdP login URL and RelayState parameter name.

You must select EMR Studio Service and User Roles for IAM Identity Centre authentication. For speedier sign-on, enable trusted identity propagation. The AWS CLI tool create-studio requires programmatic creation options based on authentication method.

After building an EMR Studio, you may assign users and groups. Approach depends on authentication mode.

In IAM authentication mode, user assignment and permissions may require your identity provider. Limiting Studio access with ARN or ABAC tags and configuring the user's IAM rights policy to allow CreateStudioPresignedUrl does this.

The AWS CLI or Amazon EMR administration console can handle IAM Identity Centre authentication mode users. The console lets you assign users or groups from the Identity Centre directory. The AWS CLI command create-studio-session-mapping requires the Studio ID, identity name, identity type (USER or GROUP), and ARN of the session policy to associate. At assignment, you set a session policy. Altering the session policy lets you adjust user permissions later.

[otaviogilbert]

Difference and Advantages of VPC, ACL and SG | CyberSecurityTV

Unlock the secrets of network security with our latest video on VPC, ACL, and SG! 🌐🔒 Dive deep into the world of cybersecurity as we unravel the key differences and advantages of Virtual Private Clouds (VPC), Access Control Lists (ACL), and Security Groups (SG). 💻🔐 Don't miss out on essential insights to fortify your digital defenses. Watch now to stay one step ahead in the cyber battlefield!

[otaviogilbert]

Difference and Advantages of VPC, ACL and SG | CyberSecurityTV

Explore the Ultimate Shield 🛡️ Showdown! In this exclusive CyberSecurityTV episode, they dissect the key differences and unbeatable advantages of VPC, ACL, and SG.

Don't miss this in-depth dive into the world of network security!

[joelekm]

Difference and Advantages of VPC, ACL and SG | CyberSecurityTV

Navigating Network Security: VPC, ACL, and SG Explained! 🌐🔒 In this insightful video by CyberSecurityTV, uncover the distinctions and benefits of Virtual Private Cloud (VPC), Access Control Lists (ACL), and Security Groups (SG). Elevate your understanding of network security measures with expert insights.

[tetsuwo]

Vagrant AWS: The parameter groupName cannot be used with the parameter subnet の対処

Vagrant で EC2 を起動しようとしたときのエラーです。

確認環境

Mac OS X 10.9.5-x86_64

vagrant 1.6.5

vagrant-aws 0.5.0

Vagrantfile で aws.security_groups に ["ssh-fixed", "test"] を設定しました。

// Vagrantfile . . . config.vm.provider "aws" do |aws, override| aws.access_key_id = AWS_ACCESS_KEY aws.secret_access_key = AWS_SECRET_KEY aws.keypair_name = AWS_KEYPAIR_NAME aws.region = "ap-northeast-1" # Tokyo aws.availability_zone = "ap-northeast-1c" aws.ami = "ami-4985b048" # Amazon Linux AMI 2014.09.1 (HVM) aws.instance_type = "t2.small" aws.tags = { "Name" => "vagrant-aws" } aws.security_groups = ["ssh-fixed", "test"] aws.subnet_id = AWS_SUBNET_ID override.ssh.username = AWS_SSH_USERNAME override.ssh.private_key_path = AWS_SSH_KEY_PATH end . . .

この設定で vagrant up する。

$ bundle exec vagrant up --provider=aws Bringing machine 'default' up with 'aws' provider... ==> default: HandleBoxUrl middleware is deprecated. Use HandleBox instead. ==> default: This is a bug with the provider. Please contact the creator ==> default: of the provider you use to fix this. ==> default: Warning! The AWS provider doesn't support any of the Vagrant ==> default: high-level network configurations (`config.vm.network`). They ==> default: will be silently ignored. ==> default: Warning! You're launching this instance into a VPC without an ==> default: elastic IP. Please verify you're properly connected to a VPN so ==> default: you can access this machine, otherwise Vagrant will not be able ==> default: to SSH into it. ==> default: Launching an instance with the following settings... ==> default: -- Type: m1.micro ==> default: -- AMI: ami-29dc9228 ==> default: -- Region: ap-northeast-1 ==> default: -- Availability Zone: ap-northeast-1c ==> default: -- Keypair: **** ==> default: -- Subnet ID: subnet-***** ==> default: -- Security Groups: ["ssh-fixed", "test"] ==> default: -- Block Device Mapping: [] ==> default: -- Terminate On Shutdown: false ==> default: -- Monitoring: false ==> default: -- EBS optimized: false ==> default: -- Assigning a public IP address in a VPC: false ==> default: Warning! Vagrant might not be able to SSH into the instance. ==> default: Please check your security groups settings. There was an error talking to AWS. The error message is shown below: InvalidParameterCombination => The parameter groupName cannot be used with the parameter subnet

そして、エラー「InvalidParameterCombination => The parameter groupName cannot be used with the parameter subnet」が発生。

もしやと思いセキュリティグループの指定をグループ名からグループ ID に変更して再実行したら通りました。 どうやら Security Groups の指定が Group Name ではなく、Group ID だったということです。

ドキュメントは確か Group Name 使ってたと思うのだが...。

参考 URL

mitchellh/vagrant-aws

[maximopro]

MAXADMINに対してすべての権限を割り当てる

　標準のMAXADMIN権限は必要最小限の権限のみ割り当てられています。しかし、開発環境や評価などで権限の設定が必要な場合、セキュリティー・グループから一括して設定できるのはREAD, INSERT, UPDATE, DELETEのみなので手間がかかります。

　以下のSQLを実行することですべての権限を一括で設定できます。APサーバーを停止して実行してください。

DB2の場合

https://gist.github.com/nishi2go/c35fdb3f4dffd187e123

Oracle DBの場合

https://gist.github.com/nishi2go/231e6be3fc63e083cf04