AWS Trasnfer FEDRAMP

 

Federal Risk and Authorization Management Program (FedRAMP) is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

AWS Transfer Family provides fully managed file transfers over SFTP, FTPS, and FTP for Amazon S3 and Amazon EFS. The Federal Risk and Authorization Management Program (FedRAMP) is a US government-wide program that delivers a standard approach to the security assessment, authorization, and continuous monitoring for cloud products and services

AWS Transfer Family is now authorized as FedRAMP Moderate in US East (N. Virginia), US East (Ohio), US West (N. California), US West (Oregon) and as FedRAMP High in GovCloud(US-West) and GovCloud(US-East).

 US Federal agencies and commercial customers working with the US Federal government can now utilize AWS Transfer Family to run sensitive and highly regulated file transfer workloads.
 
 AWS compliance reference is available at https://aws.amazon.com/compliance/services-in-scope/

AWS Log4j Vulnerability

We know Log4j security vulnerability hits the world recently and everyone is reacting to resolve immediately.  AWS is not an exception and their fixes are listed below.

More information about the Java hot patch is available at https://aws.amazon.com/blogs/security/open-source-hotpatch-for-apache-log4j-vulnerability/

Amazon Connect
Amazon Connect has been updated to mitigate the issues identified in CVE-2021-44228. 

Amazon Chime
Amazon Chime SDK services have been updated to mitigate the issues identified in CVE-2021-44228 and CVE-2021-45046.

Amazon EMR
CVE-2021-44228 impacts Apache Log4j versions between 2.0 and 2.14.1 when processing inputs from untrusted sources. EMR clusters launched with EMR 5 and EMR 6 releases include open source frameworks such as Apache Hive, Apache Flink, HUDI, Presto, and Trino, which use these versions of Apache Log4j. When you launch a cluster with EMR’s default configuration, it does not process inputs from untrusted sources. Many customers use the open source frameworks installed on their EMR clusters to process and log inputs from untrusted sources. Therefore, AWS recommends that you apply the solution described here.

Amazon Fraud Detector
Amazon Fraud Detector services have been updated to mitigate the issues identified in CVE-2021-44228.

Amazon Kendra
Amazon Kendra has been updated to mitigate CVE-2021-44228.

Amazon Lex
Amazon Lex has been updated to mitigate the issues identified in CVE-2021-44228.

Amazon Macie
The Amazon Macie service has been updated to mitigate the issues identified in CVE-2021-44228.

Amazon Macie Classic
The Amazon Macie Classic service has been updated to mitigate the issues identified in CVE-2021-44228.

Amazon Monitron
Amazon Monitron has been updated to mitigate the issues identified in CVE-2021-44228.

Amazon RDS
Amazon RDS and Amazon Aurora have been updated to mitigate the issues identified in CVE-2021-44228.

Amazon Rekognition
Amazon Rekognition services have been updated to mitigate the issues identified in CVE-2021-44228.

Amazon VPC
Amazon VPC, including Internet Gateway and Virtual Gateway services, have been updated to mitigate the Log4j issue referenced in CVE-2021-44228.

AWS AppSync
AWS AppSync has been updated to mitigate the issues identified in CVE-2021-44228 and CVE-2021-45046.

AWS Certificate Manager
AWS Certificate Manager services have been updated to mitigate the issues identified in CVE-2021-44228.

AWS Service Catalog
AWS Service Catalog has been updated to mitigate the issues identified in CVE-2021-44228.

AWS Systems Manager
AWS Systems Manager service has been updated to mitigate the issues identified in CVE-2021-44228. The Systems Manager agent itself is not affected by this issue.

Software Resilience

 

This week blog is based on my work experience in AWS.  On Tuesday 7 Dec 2021, our products got affected due to AWS multi hours global outage. 

The first phase of outage began at approximately 15:35 UTC (7:35 am PT), when multiple Amazon sites and services began to show significant performance degradation. While site loading appeared to mostly normalize by 16:50 UTC (8:50 am PT), we observed AWS API service failures that caused API transactions to experience dramatically higher completion times or simply time out.

Second wave of the outage lasted for over 7 hours, not fully resolving until approximately 0:44 UTC (4:44 pm PT) . We managed our products with Disaster Recovery (DR) strategy.

Amazon confirmed that service issues with AWS main US-East-1 region, located in Northern Virginia, were causing problems for its warehouse and delivery network.

On reading the various industry news, it was an opportunity to learn AWS influences in the industry.

AWS controlled 33% of the global cloud infrastructure market in the second quarter, according to Synergy Research Group, followed by Microsoft at 20% and Google at 10%.

As the result, key industry observations are

• brought down many popular websites and services.
• some of Amazon’s delivery operations ground to a halt, and third-party sellers couldn’t ship products.
• Colleges that rely on software to host content had to postpone exams during finals week.
  

As software engineer, personal learning/improvement (recollecting golden words of my mentor Suresh) - resilience is to re-adapt to any crisis situation intelligently

ECS container health

 Amazon Elastic Container Service (Amazon ECS) now provides customers enhanced visibility into the health of their compute infrastructure.  It helps customers improve application resiliency.

Customers running containerized workloads using Amazon ECS on Amazon Elastic Compute Cloud  (Amazon EC2) or on-premises with Amazon ECS Anywhere can now query the health status of the container runtime (i.e Docker) for their container instances directly from the Amazon ECS API.

mazon ECS automatically monitors the container runtime for responsiveness on customers’ behalf. Customers can use the ECS Describe-Instances API with the include Health Status option to view the health information for their Amazon ECS Tasks.

Customers can view the instance health status for all their Amazon ECS container instances running version 1.57.0 of the Amazon ECS container Agent or higher.

Athena CPU cost

 Last week, AWS launched a new featured in Amazon Athena.  Now, it displays the computational cost of your queries alongside their execution plans.

With the release of the EXPLAIN ANALYZE statement, Athena can now execute your specified query and return a detailed breakdown of its execution plan along with the CPU usage of each stage and the number of rows processed.

In addition to understanding a query’s execution plan, you can now see the time spent within each operator to better assess the performance profiles of query clauses and their chosen ordering. With row input and output counts, you can also validate the impact of query predicates, especially over large datasets.

Administrators will also find the scanned data counts useful in planning the financial impact of their users’ workloads and identifying queries that could benefit from further optimization or that should be governed to control costs using Athena’s data usage controls.

Babelfish for Aurora

Babelfish for PostgreSQL is an open source project available under the Apache 2.0 and PostgreSQL licenses. It provides the capability for PostgreSQL to understand queries from applications written for Microsoft SQL Server.

Babelfish understands the SQL Server wire-protocol and T-SQL, the Microsoft SQL Server query language, so you don’t have to switch database drivers or re-write all of your application queries. With Babelfish, applications currently running on SQL Server can now run directly on PostgreSQL with fewer code changes.

The source code of open source project Babelfish is available at https://www.babelfishpg.org/getstarted/#source

This allows users to leverage Babelfish on their own PostgreSQL servers. Babelfish includes support for stored procedures, save points, static cursors, nested transactions, the variant data type and much more.

Last week, AWS announced Babelfish for Aurora PostgreSQL as Generally Available (GA).

Fault Injection Simulator

AWS Fault Injection Simulator is a fully managed fault injection service that makes it easier for teams to discover an application’s weaknesses at scale in order to improve performance, observability, and resiliency.

Fault Injection Simulator simplifies the process of setting up and running controlled fault injection experiments across a range of AWS services so teams can build confidence in their application behavior.

With Fault Injection Simulator, teams can quickly set up experiments using pre-built templates that generate the desired disruptions. Fault Injection Simulator provides the controls and guardrails that teams need to run experiments in production, such as automatically rolling back or stopping the experiment if specific conditions are met. 

With a few clicks in the console, teams can run complex scenarios with common distributed system failures happening in parallel or building sequentially over time, enabling them to create the real world conditions necessary to find hidden weaknesses.

Documentation ref: https://docs.aws.amazon.com/fis/latest/userguide/fis-actions-reference.html#fis-actions-reference-fis