Using AWS IOT To Arm Blink Cameras

Posted on Sat 16 December 2017 in iot • Tagged with iot, lambda, security, tutorial, awsLeave a comment

Blink security cameras are an affordable home security camera system. Although they lack a formal public API, inventive devs have reverse-engineered their private API to allow for better integration.

Here we'll use AWS IOT Core, Lambda and node-blink-security to arm and disarm Blink security cameras using an AWS IOT Button.

Activating Your IOT Button

The IOT Button must be configured to your account, which includes joining it to your wifi access point, and installing the client certificates.

The easiest way to perform activation is by using the AWS IOT Button App for Android or IOS. Complete instructions are found on …

Continue reading

Free SSL Certificates using ACM (AWS Certificate Manager)

Posted on Tue 16 February 2016 in aws • Tagged with aws, ssl, securityLeave a comment

2016 may be the year of free SSL, and AWS ACM (AWS Certificate Manager) is a great offering for Cloudfront & ELB users (most web apps).

Not only is it free, but it's also the simplest certificate management platform

  • request a new certificate in minutes
  • no server config needed
  • no certificate , chain or private key management
  • automatic certificate rotation

Here's how to create a certificate and then install it onto your cloudfront distribution.

Requesting a New Certificate

aws acm request-certificate --domain-name \* --subject-alternative-names
    "CertificateArn": "arn:aws:acm:us-east-1:OOOOOOOOOOOO:certificate/c3d15000-230c-4000-8000-a600000"

Activating the Certificate on Cloudfront

This part …

Continue reading

Using the AWS EC2 Container Registry with EC2 Container Service

Posted on Wed 06 January 2016 in aws • Tagged with aws, docker, ecr, ecsLeave a comment

AWS announced recently that it's EC2 Container Registry (ECR) is now available. ECR simplifies hosting private images. Previously, you had to manually push your credentials to each EC2 instance -- likely a deliberate pain-point encouraging you to use ECR. With ECR, EC2 container hosts can easily fetch private images using IAM authentication.

Here are some of the gotchyas and stumbling blocks to help you get your repository up quickly and painlessly.


1. aws-cli should be 1.9.15 or greater.

# check Version
$ aws --version
# update via homebrew (osx) if needed
$ brew update
$ brew upgrade …
Continue reading

Securing Your Network Using Auto-Updating Security Groups

Posted on Thu 17 December 2015 in aws • Tagged with aws, security, security-groupsLeave a comment

We all know that no ports should be open to the internet for development purposes, but for convenience it's common to find a security group with port 22 (SSH) open to . Even narrower ingress rules can create backdoors.

Here we'll show you how to create an auto-updating security group that adds your active WAN IP address when you connect. This way, only your active IP is authorized.

Create the "development" security group with no ingress

aws ec2 create-security-group --group-name=development --group-description="ssh access for my dev machine"

Create a limited role that can only update …

Continue reading

Delegating Admin Credentials using IAM Roles and Cloudwatch Alerts

Posted on Sat 12 December 2015 in aws • Tagged with aws, cloudwatch, alerts, monitoringLeave a comment

It's hard to strike the right balance with admin rights--either the rights are too strict and people can't get work done or they're too lenient and you have security issues.

As a compromise, AWS provides the AssumeRole feature which lets admins temporarily escalate their role to perform a task.

It's important when setting this up that you alert the team when it's used. Here we'll talk about how to set up the roles, give teams access to the roles and create an alert system when the roles are assumed.

Create The Temporary Admin Role

Use the IAM console to create …

Continue reading

HTTP Redirects with Cloudfront & S3

Posted on Tue 18 August 2015 in aws • Tagged with aws, cloudfront, s3, httpLeave a comment

Redirects can account for a significant share of direct traffic so taking a few minutes to optimize them is worthwhile.

Using Cloudfront & S3 for redirects will improve responsiveness, reduce server load and improve management (since they are managed via aws-cli or the console).

Let's say you have a typical .htaccess redirect like this.

RewriteEngine On
### re-direct to www
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^(.*)$ http://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Or worse, it could look like this in your index.php

$protocol = (@$_SERVER["HTTPS"] == "on") ? "https://" : "http://";

if (substr($_SERVER['HTTP_HOST'], 0, 4) !== 'www.') {
    header('Location: '.$protocol.'www.'.$_SERVER['HTTP_HOST …
Continue reading

Opsworks -- Quickly Listing Hosts on the Command Line

Posted on Tue 11 August 2015 in aws • Tagged with aws, opsworks, cliLeave a comment

Here's a great example of using the aws-cli to speed up your life. Uses jq and aws-cli

  # bash / zsh function
  function opsworks-hosts-prod () {
    aws opsworks describe-instances --stack-id=fffff-fffff-ffff-fff-fffffff | jq '.Instances[].PublicDns' | grep -v null | sed s/\"//g
  # usage
  $ opsworks-hosts-prod
Continue reading

First Things First, on AWS

Posted on Fri 07 August 2015 in android • Tagged with aws, secuity, tutorialLeave a comment

I was chatting with a buddy who was moving his web sites from dedicated hosting to AWS. Let's just say the FTUE isn't great. That triggered a quick brain-dump of what you should do when you first get started with AWS.

  • understand pets v cattle. In aws all resources should be "cattle", not pets. Periodically terminate instances to test this.
  • activate cloudtrail (in all regions). Use Loggly to index cloudtrail (free or ~$20/mo)
  • create restricted IAM users. Never use your root acct. Activate MFA.
  • Use IAM ec2-instance roles instead of stored credentials whenever possible.
  • Get familiar with IAM management …
Continue reading

Opsworks before-migrate.rb

Posted on Tue 09 June 2015 in aws • Tagged with chef, opsworks, aws, devopsLeave a comment

Opsworks is a convenient, powerful and free service provided by AWS to simplify the management of EC2 nodes.  The real power of the system is exposed through customizing various stages of the instance lifecycle by creating custom-tailored chef-solo recipes.

While Amazon provides a powerful deployment layer for PHP applications, it stops short once the PHP code has been checked out of git.  For Laravel or other composer apps, you’ll have to customize your deployment.  The most elegant and straightforward method is through custom deployment hooks.  Here’s how to build a before_migration.rb script to build a Laravel app …

Continue reading