Viacheslav Vasilyev avoidik

Add a filter to git config by running the following command in bash inside the repo:

git config filter.strip-notebook-output.clean 'jupyter nbconvert --ClearOutputPreprocessor.enabled=True --to=notebook --stdin --stdout --log-level=ERROR'

Or

git config --global filter.strip-notebook-output.clean 'docker run --rm -i -v \"${pwd}:/home/jovyan\" jupyter/datascience-notebook jupyter nbconvert --clear-output --to=notebook --stdin --stdout --log-level=ERROR'

Create a .gitattributes file inside the directory with the notebooks

Amazon Cognito for Amazon Elasticsearch Kibana access using SAML

That is a mouthful and the process could be clearer. doesn't help that there's a lot of outdated information and conflicting articles with links upon links pointing you in every which way but the right way.

I'll use Google Apps as a SAML provider for the purpose of this gist.

Overview of the steps

The process is triggered from the AES Console and required multiple steps to configure the IAM Roles and chosen IDP

Configure variables

These variables will be used for this snippet. Please substitute accordingly.

export RootCAName="root_ca"
export InterCAName="inter_ca"
export CommonName="hashidemos.io"
export InterCommonName="inter.hashidemos.io"
export Root_CA_ttl="730h"
export Inter_CA_ttl="350h"
export Cert_ttl="8h"

ECS Best Practices

Understand and check Service Quota of ECS/Fargate and other related services
Cluster
- Use IaC for setting up resources eg. CloudFormation, AWS CDK, Terraform
  - Use copilot for simple setup
  - CloudFormation reference architecture template
    - https://github.com/nathanpeck/ecs-cloudformation
    - https://github.com/awslabs/aws-cloudformation-templates/tree/master/aws/services/ECS
CDK for ECS: blog

Please check https://aws.github.io/aws-eks-best-practices/ for more comprehensive EKS best practice!

Architecture

Think about multi-tenancy, isolation for different environment or different workload
- Isolation at account level using AWS organization
- Isolation at the network layer ie. different VPC & different cluster
- Use different Nodes Group (Node pool) for different purpose/category e.g. create dedicated node groups for Operational tools such as CI/CD tool, Monitoring tool, Centralize logging system.
- Separate namespace for different workload

	#!/bin/sh

	if [[ `id -u` != 0 ]]; then
	echo "Must be root to run script"
	exit
	fi

	read -p "Enter user name and press [ENTER]: " UserName

	if [[ $UserName == `dscl . -list /Users UniqueID \| awk '{print $1}' \| grep -w $UserName` ]]; then

	# Simple script to check drivers in C:\windows\system32\drivers against the loldrivers list
	# Author: Oddvar Moe - @oddvar.moe

	$drivers = get-childitem -Path c:\windows\system32\drivers
	$web_client = new-object system.net.webclient
	$loldrivers = $web_client.DownloadString(" https://www.loldrivers.io/api/drivers.json") \| ConvertFrom-Json

	Write-output("Checking {0} drivers in C:\windows\system32\drivers against loldrivers.io json file" -f $drivers.Count)
	foreach ($lol in $loldrivers.KnownVulnerableSamples)
	{

	AWSTemplateFormatVersion: '2010-09-09'
	Description: Cognito Stack
	Parameters:
	AuthName:
	Type: String
	Description: Unique Auth Name for Cognito Resources

	Resources:
	# Creates a role that allows Cognito to send SNS messages
	SNSRole:

	PUT _template/cloudtrail
	{
	"index_patterns": ["cloudtrail-*"],
	"settings": {
	"number_of_shards": 1,
	"mapping": {
	"total_fields": {
	"limit": 10000
	}
	}

	# Generic, basic /usr/local/etc/telegraf.conf file for FreeBSD
	# Gathers some basic metrics and transmits them to cloudwatch
	# Be sure to set the region below

	[agent]
	interval = "10s"
	round_interval = true
	metric_batch_size = 1000
	metric_buffer_limit = 10000
	collection_jitter = "0s"