Silly Dude's questions

I wanted to setup web deployment from Visual Studio into an AWS EC2 instance.

First, I launched a EC2 instance of Windows Server 2019 Base. I added IIS and ASP.NET Windows features. Then I downloaded Web Deploy 3.6 msi and chose to install "complete features".

After that, I started IIS manager, and went to "Default web site". Under the "Management" group, I expect to see a "IIS Manager Permissions" icon, but it was not there. I need it to enter the user name/password, which will be used by my Visual Studio to connect to this IIS.

Where did I get it wrong?

I have an application load balancer (ALB) and a number of web servers behind it. Apart from HTTP and HTTPS, the web servers also serve long-lasting TCP socket connections on port 52345.

When a client socket tries to connect to the ALB on port 52345, it fails, because ALB does not have a listener on this port.

When I tried to add a listener on this port, I realized that ALB only allows listeners on HTTP and HTTPS. So I tried to add a HTTP listener on port 52345. It still didn't work.

Error message:

A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 34.199.41.181:52345

How do I get over this hurdle? Why doesn't AWS allow TCP listener on ALB?

When a human logs into a website with 2FA, the human reads the generated TOTP code from the google authenticator app on his phone and enters it onto the website which he is trying to login.

I am designing a backend integration between two systems via web API. I am not comfortable just to let the two systems hold on to the same encryption password. I want to involve something like 2FA in this process. Obviously there is no human involved in this process to read the code from the authenticator app. So what are the industry-standard/recommended approach?

We plan to have an Application Load Balancer (ALB) and a number of EC2 web servers behind it. All web servers listen on port 443 for HTTPS. On top of this, each web server listens on a different port for HTTPS.

For example:

• Instance 1 listens on 443 & 8001
• Instance 2 listens on 443 & 8002
• Instance 3 listens on 443 & 8003.

The number of servers are decided by the auto scaling group, and what port (8001, 8002, 8003, 8004, etc.) each server gets is dynamically allocated after the server boots up, by consulting a third arbitrator.

The desired way of the ALB is:

• When a client requests "www.mysite.com", the ALB forwards this request to one of the instances randomly or round-robin or using any other standard load-balancing algorithm.
• When a client requests "www.mysite.com:8001", the request is ALWAYS forwarded to instance 1.
• When a client requests "www.mysite.com:8002", the request is ALWAYS forwarded to instance 2.
• When a client requests "www.mysite.com:8003", the request is ALWAYS forwarded to instance 3.

MY QUESTION IS:

Is ALB currently doing this by default, or do we need some kind of special configuration, or do we need a different kind of ALB?

This system is currently hosted in Azure and Azure load balancer readily does that. Now I need to replicate it in AWS.

I wish to setup Route53 using Geolocation routing policy.

This means that a browser in Paris asking for "www.mysite.com" will go to the Berlin website, while a browser in Melbourne asking for the same "www.mysite.com" will go to the Sydney website.

But there is a need that when a user is in Sydney but he specifically wants to browse the Berlin website. How does he do it?

I have two root websites on the same IIS server. I tried to create two HTTPS bindings for each of them:

(1) HTTPS, All unassigned, 443, www.site1.com, SSL issed to www.site1.com

(2) HTTPS, All unassigned, 443, www.site2.com, SSL issed to www.site2.com

I realised that it doesn't work. The two websites always end up using the same certificate. I was told that the two HTTPS bindings must use different port numbers. But this means that the clients of one of the websites will have to enter the port number in their URL. Very ugly.

How do I get over this problem?

I tried to create a WAF for our Sydney ALB and found it is not available so I have to create cloudfront to be able to use WAF. Am I right?

We built up a web server, created an AMI from it, then created a launch configuration which launches instances from this AMI, and our ASG uses this launch configuration.

We regularly install Windows updates on the web server. Every time after we do it, we create a new AMI. Then we had to recreate the launch configuration to use the new AMI, then change the ASG to use the new launch configuration.

Is there a way not having to do this?

I have an IIS web server behind a ELB. The web server uses security cookie to keep user signed in during the session. I have CloudFront for the purpose of redirecting HTTP to HTTPS.

If I directly access the ELB using its own DNS name, everything works fine. But if I access the CloudFront using "www.eyecloud.net.au", after I sign in, it keeps bouncing me back to the login page.

It is my first time using CloudFront. What went wrong?

I have a number of IIS web servers behind an App Load Balancer (ALB). The web servers all have self-signed SSL certificate installed and redirect from HTTP to HTTPS using URL rewrite module properly setup:

If I directly access these web servers, HTTP will be redirected to HTTPS.

The protocol used by the target group is HTTPS.The ALB listens on both HTTP and HTTPS. It has a SSL certificate on "www.mysite.com".

However, when I tried to access the ALB using HTTP, it is not redirected to HTTPS. Now that the servers does redirect properly, why doesn't the ALB?

I have a EC2 instance that is a Window Server 2016 running an ASP.NET website. I got an AWS-issued SSL certificate. How do I install this certificate on this EC2 instance? It is Windows environment so I need a PFX or PEM file. How do I get this file from AWS Certificate Manager?

Our website needs HIPAA compliance so everything needs to be encrypted. I don't want client to get an error message when they put in "http://mysite.com", so I need to support both HTTP and HTTPS, and redirect HTTP to HTTPS. Am I right?

I did it correctly on the web servers. So if I directly connect to the web servers, HTTP is automatically redirected to HTTPS. All good.

But the web servers are sitting behind an AWS Application Load Balancer. I don't know how to redirect HTTP to HTTPS on the ELB. So client browsers can still connect to the ELB through HTTP.

How to set up HTTP => HTTPS on an AWS Application Load Balancer?

In other words, I am sure the connection between the ELB and web servers are HTTPS, but how to make sure the connection between the client browsers and the ELB are HTTPS?

I have two windows Serer 2016 web servers in the public subnets:

1. Each web server have their own public IP addresses.
2. Each web server has self-signed SSL certificate, has both HTTP and HTTPS bindings, and redirecting HTTP to HTTPS.
3. They are in a Target Group. There is an Application Load Balancer using that Target Group.

I could request the pages from the web servers directly or from the ELBs. Response is instant. All good.

Once I removed the public IP addresses from the web servers, the response from the ELB becomes very unreliable. It times out every now and then with error 504 Gateway Timeout. But sometimes it does work.

Why?

I created a MySQL RDS instance. When I connected to this instance using the master user which I specified when creating this instance, I realized I do not have DBA role and obviously I do not have the permission to make this master user the DBA. This produces all sorts of problems. Why can't I be the DBA? Don't I own my own AWS account and my database?

I created an AMI from my web server. Then I copied the snapshot, checking the "encrypted" checkbox. Then I created an AMI from this encrypted snapshot. Then I tried to launch a new instance from this new encrypted AMI. I was stunned to find that t2 instance types are are disabled, and only m3.medium or above are allowed.

Is it supposed to be the case, or I have done something wrong?

Initially I launched a brand-new Windows Server 2016 server EC2. I assigned a S3 full admin IAM role to this instance when launching it. I installed CLI on it. I started a CMD window, and typed in "aws s3 ls". It lists all my buckets. All working fine.

I then created an AMI from this instance. I launched a new instance from this instance with that S3 full admin IAM role. "aws s3 ls" still works.

Then, after a number of days, when I repeat the above process (launching an instance from the same AMI), "aws s3 ls" will stop working, with the following error:

Unable to locate credentials. You can configure credentials by running "aws configure".

It happened many times. Every time I rebuilt a new Windows Server, install CLI, assign the S3 full admin role to the instance, it works. After a number of days, when I launch a new instance from the exact same AMI, "aws s3 ls" will stop working.

It is so mysterious! Can someone shed some light on this please?

Suppose the primary RDS instance dies and it automatically fails over to the standby instance. At that point, do I need to do anything? Or does AWS automatically create a new standby instance, so that the whole situation recovers to the status before the fail over happened?