Access AWS Lambda Environment Variables using Ruby

AWS Lambda Environment Variables are a useful way to input configuration values to your AWS Lambda runtime. Especially, when there are configurations that are different in your Development environment compared to your Production environment. Like name of DynamoDB tables or MySQL databases.

Below we discuss how we can retrieve the values of Environment Variables in AWS Lambda using Ruby.


Ruby Code to Access Environment Variables

The code for accessing Environment Variables on AWS Lambda is just the same code for accessing environment variables in your local computer or server.

Here is the code to access environment variables using Ruby.

env_var = ENV['ENVIRONMENT_VARIABLE']

If we want to get the value of an environment variable with the key of DB_HOST then we will use the code below.

Continue reading Access AWS Lambda Environment Variables using Ruby

How to get the AWS Region where Node.js Lambda Function is running

To get the AWS Region where your Lambda Function is running we need to access the Environment Variable AWS_REGION.

To access the environment variable AWS_REGION using Node.js Lambda Function we can use process.env.AWS_REGION.

Continue reading How to get the AWS Region where Node.js Lambda Function is running

Access AWS Lambda Environment Variables using Node.js

If you want to get the values of Environment Variables in AWS Lambda using Node.js runtime follow the instructions below.

Node.js Code to Access Environment Variables

To access the Environment Variables of Lambda Functions using Node.js or javascript simply use the code below.

const environmentVariable = process.env.ENVIRONMENT_VARIABLE

Let’s say that my environment variable has a name of DB_USER, I will use the code below to get its value.

Continue reading Access AWS Lambda Environment Variables using Node.js

How to access the C: Drive in Amazon Workspaces

The C: Drive or root volume in AWS Workspaces cannot be seen if you open File Explorer.

This post will show how you can access the C: Drive when it is not shown.

If you want the C: Drive to be shown permanently then reading my post about it here will help.

Below are three ways you can access the C: Drive.


Access C: Drive with Windows File Explorer

To access C: Drive with Windows File Explorer, go to the address bar and enter C:. This will bring you to the C: Drive.

Continue reading How to access the C: Drive in Amazon Workspaces

How to show C: Drive in Amazon Workspaces

If you have been using AWS Workspaces then you might have noticed that the C: Drive cannot be seen when you open Windows File Explorer.

File Explorer not showing C: Drive in an Amazon Workspace

The reason why the C: Drive is hidden in Workspaces is because it is the root volume. Users are discouraged from storing files in the root volume because when you need to Rebuild a workspace any changes that you made in the C: Drive will be wiped out. Only the D: Drive or the User Volume will be restored to what its previous snapshot.

There are some use cases when you need to access the C: Drive. It might also be possible that you just want to have the C: Drive visible.

Follow the steps below to make the C: Drive visible in Windows File Explorer in your Amazon Workspaces.



Steps in showing the C: Drive in Amazon Workspaces

Click on Search icon and type regedit. Then click on regedit.

Continue reading How to show C: Drive in Amazon Workspaces

Require Multi-Factor Authentication (MFA) for IAM User in AWS

As a Security Best Practice we should always require IAM Users to have Multi-Factor Authentication (MFA) enabled when accessing the AWS Console.

The problem is how do we require users to configure MFA?

The IAM policy below can be used to require users to enable their MFA. If they do not have MFA, all their permissions will be denied. This will make access to your AWS Account more secure.



IAM Policy that requires IAM Users to have Multi-Factor Authentication (MFA)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowViewAccountInfo",
            "Effect": "Allow",
            "Action": [
                "iam:ListUsers",
                "iam:ListMFADevices",
                "iam:GetAccountPasswordPolicy",
                "iam:GetAccountSummary"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AllowChangeOwnPasswordsOnFirstLogin",
            "Effect": "Allow",
            "Action": [
                "iam:ChangePassword",
                "iam:GetUser"
            ],
            "Resource": "arn:aws:iam::*:user/${aws:username}"
        },
        {
            "Sid": "AllowChangeOwnPasswordsAfterMFAEnabled",
            "Effect": "Allow",
            "Action": [
                "iam:GetLoginProfile",
                "iam:UpdateLoginProfile"
            ],
            "Resource": "arn:aws:iam::*:user/${aws:username}"
        },
        {
            "Sid": "AllowManageOwnVirtualMFADevice",
            "Effect": "Allow",
            "Action": [
                "iam:CreateVirtualMFADevice",
                "iam:DeleteVirtualMFADevice"
            ],
            "Resource": "arn:aws:iam::*:mfa/${aws:username}"
        },
        {
            "Sid": "AllowManageOwnUserMFA",
            "Effect": "Allow",
            "Action": [
                "iam:DeactivateMFADevice",
                "iam:EnableMFADevice",
                "iam:ListMFADevices",
                "iam:ResyncMFADevice"
            ],
            "Resource": "arn:aws:iam::*:user/${aws:username}"
        },
        {
            "Sid": "DenyAllExceptListedIfNoMFA",
            "Effect": "Deny",
            "NotAction": [
                "iam:ListUsers",
                "iam:ChangePassword",
                "iam:GetUser",
                "iam:CreateVirtualMFADevice",
                "iam:DeleteVirtualMFADevice",
                "iam:DeactivateMFADevice",
                "iam:EnableMFADevice",
                "iam:ListMFADevices",
                "iam:ResyncMFADevice"
            ],
            "Resource": "*",
            "Condition": {
                "BoolIfExists": {
                    "aws:MultiFactorAuthPresent": "false"
                }
            }
        }
    ],
    "Id": "RadishLogic.com MFA Required IAM Policy"
}

The name of my IAM Policy is MFA-Required, you may use whatever name you desire to use.

Continue reading Require Multi-Factor Authentication (MFA) for IAM User in AWS

Copying a Key Pair Generated by AWS to Another Region (with Screenshots)

I have an existing key pair that was generated via AWS Console. Since I do not want to create another set of Key Pair for the other regions, I would like to use the same Key Pair. Is it possible to copy the Key Pair to another Region? How can I do this?

Dany


Hi Dany, the short answer to your question is yes, it is possible to copy your existing AWS generated Key Pair to another region and even copy this to another AWS account.


The Challenge with AWS Generated Key Pairs

Generating the Key Pairs via AWS Console is easy, it gives you the Private Key and you can launch EC2 instances and associate it with your instance by adjusting the settings during EC2 Instance Launch. Then you can SSH to your EC2 Instance via the Private Key.

The issue here is the Public Key. AWS does not provide the Public Key during creation or any time after that.

Do not worry, we can still get the Public Key. It is not easy as clicking on the console then selecting copy to other region, but it is still doable.

See the steps below.


Step-by-step guide on copying a Key Pair to another region.

For this tutorial, I have created an AWS Key Pair in N. Virginia Region (us-east-1) – radishlogic_key.

The goal is to copy the Key Pair to Oregon Region (us-west-2).

Here are screenshots of my Key Pair.

Key Pair in AWS Console
Private Key

1. Retrieving the Private Key in N. Virginia Region (us-east-1)

Launch a temporary Linux EC2 Instance in where the Key Pair is located (us-east-1). Any Linux Image will do.

Continue reading Copying a Key Pair Generated by AWS to Another Region (with Screenshots)