AWS Archives - Page 2 of 4

How to get AWS Lambda remaining time using Python

To get the remaining time of a running AWS Lambda Function using Python you should check the context object and its get_remaining_time_in_millis function.

List of Public SSM Parameters of latest Operating System EC2 Images

We are running CI/CD pipelines that take the latest EC2 Image of Windows or Red Hat then it will automatically install the required security agents and check if they are properly installed.

At first, it was a hassle since we had to always be on the lookout for the latest EC2 Image ID of our target operating system and input this manually into our pipeline. But as it turns out AWS maintains SSM Parameters that holds the latest Image IDs of various operating systems and their versions.

Sometimes I see these in CloudFormation scripts.

How to get the Region of a Running AWS Lambda Function using Ruby

If you need to get the Region of your running Lambda Function then you should look for the AWS_REGION in the Environment Variables.

Below is the code on how to access the AWS_REGION Environment Variable using Ruby.

aws_region = ENV['AWS_REGION']

Access AWS Lambda Environment Variables using Ruby

AWS Lambda Environment Variables are a useful way to input configuration values to your AWS Lambda runtime. Especially, when there are configurations that are different in your Development environment compared to your Production environment. Like name of DynamoDB tables or MySQL databases.

Below we discuss how we can retrieve the values of Environment Variables in AWS Lambda using Ruby.

Ruby Code to Access Environment Variables

The code for accessing Environment Variables on AWS Lambda is just the same code for accessing environment variables in your local computer or server.

Here is the code to access environment variables using Ruby.

env_var = ENV['ENVIRONMENT_VARIABLE']

If we want to get the value of an environment variable with the key of DB_HOST then we will use the code below.

How to get the AWS Account ID in Lambda Node.js

To get the AWS Account ID of the currently running Lambda Function using Node.js use the code below.

exports.handler = async (event, context) => {
    
    const awsAccountId = context.invokedFunctionArn.split(':')[4]
    
    console.log(awsAccountId)
};

How to get the AWS Region where Node.js Lambda Function is running

To get the AWS Region where your Lambda Function is running we need to access the Environment Variable AWS_REGION.

To access the environment variable AWS_REGION using Node.js Lambda Function we can use process.env.AWS_REGION.

Access AWS Lambda Environment Variables using Node.js

If you want to get the values of Environment Variables in AWS Lambda using Node.js runtime follow the instructions below.

Node.js Code to Access Environment Variables

To access the Environment Variables of Lambda Functions using Node.js or javascript simply use the code below.

const environmentVariable = process.env.ENVIRONMENT_VARIABLE

Let’s say that my environment variable has a name of DB_USER, I will use the code below to get its value.

How to access the C: Drive in Amazon Workspaces

The C: Drive or root volume in AWS Workspaces cannot be seen if you open File Explorer.

This post will show how you can access the C: Drive when it is not shown.

If you want the C: Drive to be shown permanently then reading my post about it here will help.

Below are three ways you can access the C: Drive.

Access C: Drive with Windows File Explorer

To access C: Drive with Windows File Explorer, go to the address bar and enter C:. This will bring you to the C: Drive.

How to show C: Drive in Amazon Workspaces

If you have been using AWS Workspaces then you might have noticed that the C: Drive cannot be seen when you open Windows File Explorer.

File Explorer not showing C: Drive in an Amazon Workspace

The reason why the C: Drive is hidden in Workspaces is because it is the root volume. Users are discouraged from storing files in the root volume because when you need to Rebuild a workspace any changes that you made in the C: Drive will be wiped out. Only the D: Drive or the User Volume will be restored to what its previous snapshot.

There are some use cases when you need to access the C: Drive. It might also be possible that you just want to have the C: Drive visible.

Follow the steps below to make the C: Drive visible in Windows File Explorer in your Amazon Workspaces.

Steps in showing the C: Drive in Amazon Workspaces

Click on Search icon and type regedit. Then click on regedit.

Require Multi-Factor Authentication (MFA) for IAM User in AWS

As a Security Best Practice we should always require IAM Users to have Multi-Factor Authentication (MFA) enabled when accessing the AWS Console.

The problem is how do we require users to configure MFA?

The IAM policy below can be used to require users to enable their MFA. If they do not have MFA, all their permissions will be denied. This will make access to your AWS Account more secure.

IAM Policy that requires IAM Users to have Multi-Factor Authentication (MFA)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowViewAccountInfo",
            "Effect": "Allow",
            "Action": [
                "iam:ListUsers",
                "iam:ListMFADevices",
                "iam:GetAccountPasswordPolicy",
                "iam:GetAccountSummary"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AllowChangeOwnPasswordsOnFirstLogin",
            "Effect": "Allow",
            "Action": [
                "iam:ChangePassword",
                "iam:GetUser"
            ],
            "Resource": "arn:aws:iam::*:user/${aws:username}"
        },
        {
            "Sid": "AllowChangeOwnPasswordsAfterMFAEnabled",
            "Effect": "Allow",
            "Action": [
                "iam:GetLoginProfile",
                "iam:UpdateLoginProfile"
            ],
            "Resource": "arn:aws:iam::*:user/${aws:username}"
        },
        {
            "Sid": "AllowManageOwnVirtualMFADevice",
            "Effect": "Allow",
            "Action": [
                "iam:CreateVirtualMFADevice",
                "iam:DeleteVirtualMFADevice"
            ],
            "Resource": "arn:aws:iam::*:mfa/${aws:username}"
        },
        {
            "Sid": "AllowManageOwnUserMFA",
            "Effect": "Allow",
            "Action": [
                "iam:DeactivateMFADevice",
                "iam:EnableMFADevice",
                "iam:ListMFADevices",
                "iam:ResyncMFADevice"
            ],
            "Resource": "arn:aws:iam::*:user/${aws:username}"
        },
        {
            "Sid": "DenyAllExceptListedIfNoMFA",
            "Effect": "Deny",
            "NotAction": [
                "iam:ListUsers",
                "iam:ChangePassword",
                "iam:GetUser",
                "iam:CreateVirtualMFADevice",
                "iam:DeleteVirtualMFADevice",
                "iam:DeactivateMFADevice",
                "iam:EnableMFADevice",
                "iam:ListMFADevices",
                "iam:ResyncMFADevice"
            ],
            "Resource": "*",
            "Condition": {
                "BoolIfExists": {
                    "aws:MultiFactorAuthPresent": "false"
                }
            }
        }
    ],
    "Id": "RadishLogic.com MFA Required IAM Policy"
}

The name of my IAM Policy is MFA-Required, you may use whatever name you desire to use.