Questions[elastic-beanstalk](server)

We're trying to migrate our Java applications from from the current Elastic Beanstalk JDK 8 platforms to the new ones running Corretto 11 on Amazon Linux 2. The app works well, but the way logs are handled changed. The output from the web process is now stored in /var/log/web.stdout.log and every line is prefixed with the timestamp and process name, ie:

May 20 17:00:00 ip-10-48-41-129 web: {"timestamp":"2020-05-20T17:00:00.035Z","message":"...","logger":"...","thread":"MessageBroker-2","level":"INFO"}

How can we get rid of the prefix? These logs are streamed into CloudWatch and we're outputting them to stdout in JSON so that we can later query them with Logs Insights. But with the prefix, Insights doesn't "see" the JSON and just treats the whole line as a text blob.

I cannot find any documentation for that on AWS. Almost all of Elastic Beanstalk's documentation refers to the first version of Amazon Linux.

I have a basic-ish ELB v2 site. No clustering or anything yet. I'm pretty inexperienced with AWS.

My stack is nginx/uwsgi/django + some other services.

I was wondering if anyone had thoughts about making a "sorry, the website is currently down..."-style page (custom text I can update planned downtime is a bonus!) whenever there is downtime for whatever reason, and the health of the instance is red. It doesn't seem that Amazon offers this capability - am I missing anything? Is there a way to create a separate, super-tiny instance that is ONLY served if the main one is red, or something?

Thanks!

Is there any way to stop an elastic beanstalk environment as opposed to terminating it? There are times during testing that I would prefer to stop the environment so that I'm not being charged. However, I'm not seeing a way to do this via the GUI. It is very inconvenient to have to terminate and re-create my environment.

We are creating a Content Management System for our company. It is important that this CMS support dynamic domain names on a dynamic number of servers. After many hours of research we felt that Amazon's Elastic Beanstalk was the way to go. One thing that we also require is the ability to dynamically enable SSL for the domains associated with our system.

So in our system, we can create a "site" which will be associated with a domain. When the site is created, we should also have the ability to choose if the domain will be hosted over SSL/TLS. We plan on white-labeling the system and anticipate a large number of domains being associate with it.

I have been exploring the different possibilities for being able to get SSL set up on the servers (or the load balancer) and be able to change what domains are secured on the fly. Here is where I am at:

• Using Amazon's Certificate Manager: this would be the most desired way to go about it. It is integrated with AWS and very easy to use. However, it has several debilitating limitations: 1. You have to verify every domain by email every time you request a new certificate. No big deal except that 2. It cannot apply certs to EC2 instances, only load balancers and load balancers can only be assigned one cert. This means you have to re-verify every domain whenever you want another domain to be secured. No good.
• Using Let's Encrypt on the Load Balancer: this would be the next best way (that I can see) to secure our sites. Whenever a new site needs to be secured we will request a new certificate for all the domains that need SSL. Once the cert is created, we push it to IAM and tell EBS to associate the Load Balancer with the new Cert. The only problem I see with this is that LetsEncrypt limits their certs to 100 domains, as does the non-free but relatively inexpensive SSL provider, SSLMate. Might work for now, but it doesn't scale. Is there an automated SSL provider that has no limit on the number of domains on the cert?
• Using Passthrough SSL: Amazon's Elastic Beanstalk allows you to set it up in such a way so that the load balancer will pass the encrypted traffic straight to the EC2 instances. Then you can allow the EC2 instances to handle the certificates. I can then utilize LetsEncrypt and assign an individual cert for each domain. I run into an issue when considering autoscaling: we will need to duplicate the certs across instances. My solution would be to store the certs in a secured S3 bucket, then have a cron running on all the EC2 instances to pull the new/updated certs over.

Are there any concerns with the last idea? Is there a better solution to what I am trying to do? Am I missing something? A concern? Or maybe a super simple solution to my problem?

Note that I am using docker, so I can set anything up on the server that I need to.

I'm creating a tool to deploy Docker images to EC2 via ElasticBeanstalk, so the dev team can quickly demo their work without having to merge. I don't want Elastic IP to be enabled for these apps as they are short lived.

The reason I'm asking this is because if my tool builds more than 5 apps (and it has quite quickly) any new app will fail because no Elastic IP can be assigned to the new app. This is because an AWS account typically has a max of 5 Elastic IPs available. I can go to the aws web console and choose 'Disassociate Elastic IP Address' (see below) on an instance, after which the ec2 instance will get a new ip (after a few minutes). This is what I want, but I want to do it programmatically, and would prefer to boot the app without it instead of doing it once the instance is created.

Is there a configuration option I can use to use to disable Elastic IP for the new instance?

I'm using the node aws-sdk, but any tips in any language will do.

I'm creating m1.small single instances.

If this isn't possible when launching, I'll have to disassociate the Elastic IP from the instance using the EC2.disassociateAddress function.