Daily Summary

[SSL/TLS] you can change the Viewer Protocol Policy setting for one or more cache behaviors to require HTTPS communication by setting it as either Redirect HTTP to HTTPS or HTTPS Only. In that configuration, CloudFront provides its default SSL/TLS certificate.

There is no default SSL certificate in ELB, unlike what we have in CloudFront

you don't need to add an SSL certificate if you only require HTTPS for communication between the viewers and CloudFront. You should only do this if you require HTTPS between your origin and CloudFront.

you can't use a self-signed certificate in this scenario even though it is stored in a private S3 bucket. You need to use either a certificate from ACM or a third-party certificate.

[CI/CD] CodeBuild compiles your source code, runs unit tests, and produces artifacts that are ready to deploy. CodeBuild eliminates the need to provision, manage, and scale your own build servers. It provides prepackaged build environments

AWS Systems Manager Patch Manager can automate the process of patching managed instances, including both security-related updates and other types of updates.

Patching -> System Manager Patch Manager

CVE -> Amazon Inspector

[Access Private web app for specific employees via public internet] - SSL VPN solution in which the employees can connect first and once they are authenticated, they will be granted access to the online portal. In this way, you can launch the web servers in the private subnet and still access it over the Internet via the VPN.

SignIn via IdP - STS token, AssumeRoleWithWebIdentity -> IAM role to allow access...

Using the user data scripts to retrieve the database password may expose the password to the environment of the operating system of the EC2 instance.

Secrets Manager makes it easier to rotate, manage, and retrieve database credentials, API keys, and other secrets

RDS is not a suitable database for the mobile app because it is not as scalable enough when processing data from various users around the globe,

(SSE-S3) uses strong multi-factor encryption. Amazon S3 encrypts each object with a unique key. As an additional safeguard, it encrypts the key itself with a master key that it rotates regularly. Amazon S3 server-side encryption uses one of the strongest block ciphers available, 256-bit Advanced Encryption Standard (AES-256), to encrypt your data.

the temporary security credentials should be retrieved from the instance metadata and not from the user data.

private VIF on AWS Direct Connect: on-prem -> AWS

EC2 Fleet with ASG : Pull from on-prem

Kinesis Producer Library: Send data into Kinesis Data Stream

Lambda: Process Kinesis data stream

WebSocket API in API Gateway: Invoke the function;

@connections command for the API: send callback messages to connected clients