Sam's questions

I have an IAM policy setup that I thought provided the right permissions to deploy a new version to an Elastic Beanstalk application. I'm still getting InsufficientPrivilegesException, specifically:

aws elasticbeanstalk update-environment --environment-name LearnTfsBff --version-label LearnTfsBff-30

An error occurred (InsufficientPrivilegesException) when calling the UpdateEnvironment operation: Access Denied

This is the policy set for the deployment user:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "autoscaling:*",
                "cloudformation:GetTemplate",
                "cloudformation:DescribeStackResource",
                "cloudformation:DescribeStackResources",
                "autoscaling:*",
                "cloudfront:CreateInvalidation",
                "ec2:describeVpcs",
                "ec2:DescribeImages",
                "elasticbeanstalk:CreateApplicationVersion",
                "elasticbeanstalk:DescribeApplications",
                "elasticbeanstalk:DescribeApplicationVersions",
                "elasticbeanstalk:DescribeEnvironments",
                "elasticbeanstalk:UpdateEnvironment",
                "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
                "elasticloadbalancing:DescribeInstanceHealth",
                "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
                "s3:ListAllMyBuckets",
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::learn-tfs-builds"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": "arn:aws:s3:::learn-tfs-*"
        }
    ]
}

I tried adding "elasticbeanstalk:*" as an allowed action and that did not resolve the privileges issue. I added "*" as allowed and that does resolve it, but is not a allowable solution.

How can I debug what specific permissions are needed within AWS?

Thanks,

Sam

I'm testing out AWS and Elastic Beanstalk and have Beanstalk running a version that was manually uploaded.

When I try to update the version via the command line, the command line returns ok but Beanstalk shows an error event.

[ec2-user@ip-172-31-35-38 ~]$ /usr/bin/aws elasticbeanstalk update-environment --environment-name play-app-test --version-label play-app-1051 --region us-east-1
True    play-app play-app-test.elasticbeanstalk.com       2015-09-27T04:05:25.486Z        2015-09-27T06:07:28.031Z                .....us-east-1.elb.amazonaws.com   e-jk8fyjd3dt    play-app-test    Grey    64bit Amazon Linux 2015.03 v2.play-app-1051Node.js
TIER    WebServer       Standard
[ec2-user@ip-172-31-35-38 ~]$

Service:Amazon S3, Message:You do not have permission to perform the 's3:ListBucket' action. Verify that your S3 policies and your ACLs allow you to perform these actions.

Who exactly is it that does not have permission?

My Beanstalk environment's health permissions role is aws-elasticbeanstalk-service-role to which I've attached a policy granting access to S3 (I use the same policy for the user that uploaded the build to S3 and it worked there).

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::play-app-builds"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": "arn:aws:s3:::play-app-builds/*"
        }
    ]
}

The Beanstalk environment server's instance profile role is aws-elasticbeanstalk-ec2-role which also has the above policy attached.

I turned on CloudTrail. It shows the UpdateEnvironment call but doesn't show any S3 calls after that. I'm not sure if CloudTrail shows failed calls or not.

Within S3 I turned logging on for the builds bucket but nothing has been logged.

What am I missing?

Lets say I have multiple processes running on multiple EC2 instances each on different ports. Can I map a single AWS ELB to balance to any of these processes across any instance?

For example, I'd ideally like a setup like this:

HTTPS 443 -> Instance 1 Process 1 Port 8081
       or -> Instance 1 Process 2 Port 8082
       or -> Instance 2 Process 1 Port 8081
       or -> Instance 2 Process 2 Port 8082

Is there any way to configure ELB like this? I'm trying to avoid running a load balancer on each instance to balance across that instance's processes.

What is the difference between an ActiveDirectory object with a ObjectClass of UserProxy and a ObjectClass of User? Does an application binding against these objects need to do so differently in any way?

Most of my Google searches for UserProxy refer to "ActiveDirectory Application Mode (ADAM)". Is UserProxy specific to ADAM?

Thanks.

I have a server that is failing to download files over 40mb from IIS6 on Windows Server 2003. The HTTPERR log shows Connection_Abandoned. The request does not show in the IIS log. Fiddler shows that no response was received from the server. There's no error in the event log. UrlScan is not installed.

We've tried directly linking to the files and also downloading through an ASP.NET page that serves the file (not a redirect, it uses Response.WriteFile. We've tried several files, everything under 40mb works and everything over 40mb fails.

We're reviewing Wireshark captures from a few client machines that are showing multiple duplicate ACK records which then triggers retransmit and out-of-sequence packets.

These are shown in the following screen shot. .26 is client and .252 is server.

What causes the duplicate ACK records?

More background if it helps:

We're investigating network throughput concerns at one particular client site. The perceived issue from a user interface perspective is that data is being transmitted slowly despite an underutilized 1gbps WAN connection.

Almost all of the client machines have the same issue, tested at more than 20 machines. We did find two machines that do not have the problem. We're in the process of identifying what is different in their configuration. We did notice that in the two machines that do not have the problem, we only ever saw at most one duplicate ACK record. The machines that have the problem usually have three duplicate ACK records. One notable difference is that the machines that work fine all belong to members of the network operations team and all of other machines are for "regular" employees. The machines are supposed to be standard but the network admins could have made changes on their local systems, which is another aspect we're researching.

We tried changing the TcpMaxDupAcks setting on the server but the value we really need is 5 and the valid range is only 1-3.

Server is Windows Server 2003. Clients are all enterprise managed Windows XP. All clients, including the two working ones, have Symantec anti-virus installed.

This is the only client site out of hundreds that has exhibited this problem.

pathping shows 56ms RTT and consistent 0/100 packet loss even from the problem machines.

Thanks,

Sam

We're working on a COTS product that includes e-mail integration and would like to test with several smtp servers. Which ones accept implicit SSL connections?

We manage a bunch of SQL server installations for clients and we're seeing different reported version numbers for SQL Server 2005 SP3. Some report 9.00.4035.00 and others report 9.00.4053.00. Copied/pasted, not typed, it's not a typo or transposition.

We're getting version number with this SQL:

SELECT SERVERPROPERTY('productversion') productversion, SERVERPROPERTY ('productlevel') productlevel

This KB article says the latest is 9.00.4035.00. I can't find any documentation on where 9.00.4053.00 came from but I did find lots of references from various forum posts referring to it.

Both servers were upgraded with MS Update only, no special hotfixes or anything like that.

Can anyone explain the difference?