Serverless Framework IAM policy scoping

Through trial and error trying to deploy my lambda function via serverless framework from a github actions runner, I narrowed down the set of IAM permissions needed to successfully deploy. See the end of post for my serverless.yml and IAM policy JSON.

The resource scope is still very open - how would one go about narrowing it? The resource ids generated by `sls deploy` seem randomized but there looks to be a predictable prefix for each that contains some combination of the service, stage, and/or function name. Is it a matter of figuring out the pattern for each resource and then wildcarding it? Is there a simpler solution I'm missing, seems like a lot of work to do for each new function I want to deploy?

​

**serverless.yml:**

service: influx

provider:
name: aws
stage: prod
region: us-east-1
memorySize: 3008 # optional, in MB, default is 1024
timeout: 60
iam:
role: arn:aws:iam::<my account>:role/service-role/influx-manager-role-3mg1fkh4
tracing:
lambda: true
ecr:
images:
latest:
path: ./

functions:
manager:
image:
name: latest

**IAM policy:**

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"cloudformation:SetStackPolicy",
"cloudformation:DescribeStackResources",
"cloudformation:UpdateTerminationProtection",
"cloudformation:DescribeStackResource",
"cloudformation:CreateChangeSet",
"cloudformation:DeleteChangeSet",
"cloudformation:DescribeStacks",
"cloudformation:ExecuteChangeSet",
"cloudformation:ListStackResources",
"cloudformation:DescribeStackEvents",
"cloudformation:CreateStack",
"cloudformation:GetTemplate",
"cloudformation:DeleteStack",
"cloudformation:UpdateStack",
"cloudformation:DescribeChangeSet",
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject",
"lambda:UpdateFunctionCode",
"lambda:ListTags",
"lambda:CreateFunction",
"lambda:DeleteFunction",
"lambda:GetFunction",
"lambda:PublishLayerVersion",
"lambda:DeleteLayerVersion",
"lambda:PublishVersion",
"lambda:TagResource",
"lambda:UntagResource",
"lambda:ListVersionsByFunction"
],
"Resource": [
"arn:aws:cloudformation:*:<my-account>:stack/*/*",
"arn:aws:s3:::*/*",
"arn:aws:lambda:*:<my-account>:layer:*",
"arn:aws:lambda:*:<my-account>:function:*"
]
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": "cloudformation:ValidateTemplate",
"Resource": "*"
},
{
"Sid": "VisualEditor2",
"Effect": "Allow",
"Action": [
"s3:PutEncryptionConfiguration",
"s3:GetEncryptionConfiguration",
"s3:PutBucketAcl",
"s3:PutBucketPolicy",
"s3:CreateBucket",
"s3:ListBucket",
"s3:DeleteBucketPolicy",
"s3:DeleteBucket",
"s3:GetBucketPolicy"
],
"Resource": "arn:aws:s3:::*"
},
{
"Sid": "VisualEditor3",
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:DeleteLogGroup",
"logs:TagResource",
"logs:UntagResource",
"logs:TagLogGroup",

"logs:UntagLogGroup"
],
"Resource": [
"arn:aws:logs:*:<my-account>:log-group:*",
"arn:aws:logs:*:<my-account>:destination:*"
]
},
{
"Sid": "VisualEditor4",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::<my-account>:role/service-role/*"
},
{
"Sid": "VisualEditor5",
"Effect": "Allow",
"Action": [
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage",
"ecr:DescribeImages",
"ecr:DescribeRepositories",
"ecr:ListImages",
"ecr:BatchCheckLayerAvailability",
"ecr:GetRepositoryPolicy",
"ecr:SetRepositoryPolicy"
"ecr:DeleteRepositoryPolicy",
"ecr:CompleteLayerUpload",
"ecr:UploadLayerPart",
"ecr:InitiateLayerUpload",
"ecr:PutImage"
],
"Resource": "arn:aws:ecr:*:<my-account>:repository/*"
},
{
"Sid": "VisualEditor6",
"Effect": "Allow",
"Action": "ecr:GetAuthorizationToken",
"Resource": "*"
}
]
}

https://redd.it/zj5yeu
@r_devops

How to practice DevOps if you don't work as DevOps

I work as a frontend developer and I find it pretty easy to practice it at home after job. However it's hard to do the same with devops. I'm not sure how to develop a skill in let's say K8, Teraform or AWS if you don't already have large infra.

What's your way to practice DevOps?

https://redd.it/zj2bji
@r_devops

cloud-init and nodata source

If I understand cloud-init docs correctly, it is possible to store user-data configuration as part of a VM under /var/lib/cloud/seed/nocloud

tree /var/lib/cloud/seed/nocloud
| user-data
| meta-data

My user-data file looks like this:

#cloud-config
runcmd:
- echo "hello baked in config"

Now my issue is, the runcmd never executes even though cloud-init picks it up correctly,

util.pyDEBUG: Read 408 bytes from /var/lib/cloud/seed/nocloud/user-data

Also, runcmd module is configured properly:

cat /etc/cloud/cloud.cfg
...
cloudconfigmodules:
- runcmd

I also have additional CIDATA volume attached to the VM to provide user-data. But the runcmd in it executes just fine.

Any idea why cloud-init is not running runcmd in /var/lib/seed/nocloud/user-data?

https://redd.it/zjfx8k
@r_devops

I created my first Python program thanks to this sub!

I'm joining a bootcamp in January but decided to dive into learning a language beforehand. (most posts recommended that on here) (also chose python thanks to this sub)

I first used the mimo app to start but then it got confusing since it is mostly theory and no practice.

Finally got a computer and downloaded python.

After hours of youtube and skimming through whatever commands I already knew I was able to code a game to gift to my wife as a part of her Christmas present this year.

Very grateful for this sub and I wish I could attach the python file to this post for you all to see.

It is very elementary but I'm almost to the point of (happy) tears. I didn't know what I wanted to do with my life and deciding to try IT was scary. But after spending the past 4 hours on this project and running the module, seeing it work and feeling the overwhelming accomplishment... I know that I made the right decision.

Can't wait to post my "Got my first job" post and eventually helping others on this journey that you all helped me with.

Happy Holidays devops!

https://redd.it/zj9evh
@r_devops

Here’s a playlist of 7 hours of music with NO VOCALS I use to focus when I’m coding /learning . Post yours as well if you also have one!

Spotify | Apple | Youtube | Amazon

https://redd.it/zjlb8n
@r_devops

What makes a "good" junior engineer? My 2c as a senior.

Something we see a lot in DevOps community forums are posts asking how to get into DevOps. This has been answered endlessly and will continue to be with varying degrees of snark depending on the mood of the people replying. Please, read the friendly manual! Something I personally haven't seen nearly as often, despite it being a much more interesting question, is "How do I succeed as a junior engineer?"

Most people know and would agree that one's skillset can be broadly delineated into soft skills and technical chops. The interview process is (usually poorly) designed to determine whether the applicant satisfies each of those requirements. So, congrats! You've landed your first job offer. What now?

In my opinion, soft skills are much more important to be effective as a junior than technical skills. They're also significantly more nebulous and harder to distill into something that you can just go study. They require huge amounts of practice to refine, and unlike tech, there's no test environment. Every interaction you have with another person is influencing their perception of you.

I was recently enough a junior that a lot of this is still fresh, and I mentor juniors regularly at work, so I figured I'd write this post up and recycle some content from a previous comment of mine that was well received in case this is helpful to anyone just starting out.

Hope some of this might be helpful to someone, and I'd be super keen to hear from other folks in the comments if you disagree or have anything to add.

Cheers!

------

Worry about your mindset first, you'll pick up the tech as you go. Keep in mind, everyone you work with closely will know that you're novice and should set their expectations accordingly. That is a huge blessing as it gives you a ton of room to blatantly not know things. A good junior should be curious, aware of their own limitations, and courageous enough to both try things on your own and ask for help when you need it.

Some of this advice is tailored to my experience with organizations that were not practiced at onboarding and mentoring juniors, but a lot of it is generalizable.

In no particular order:

- Ask questions when you don't understand something.
- Try to get a sense for when your question is specific to you being ignorant or whether it contributes to the discussion. If the former, don't interrupt a meeting to ask it. Ask someone on the side after (or during over chat, if you're comfortable with them).
- https://nohello.net/
- Learn to fish. People will generally resent being repeatedly asked to spoonfeed you information that can be looked up in internal docs or the internet. You wouldn't ask your senior colleague how to create a VM in Azure. You might ask their opinion on when to use a VM vs. a container.
- FIND WHERE THE DOCUMENTATION IS AND READ IT! If it's like most orgs, there will be several places to find docs and none of them will be up to date, but if the systems are still in use there will be good info in there even so.
- If you want serious brownie points, document a bunch of tribal knowledge that's missing from the new hire doc they give you. If there isn't a new hire doc, create one and list stuff you had to do to get onboarded. Permissions in this system or that, setting up MFA, whatever.
- Try to figure things out on your own before asking for help, but don't be stubborn about it. If you've worked a minimum wage job, you'll be shocked by how much you're left alone in a professional setting. Don't misinterpret this as thinking you're expected to work by yourself all the time.
- Talk to your manager or some seniors on your team about a rule of thumb for how long you should spin your wheels trying to figure something out on your own before asking for help. I would and have been annoyed to find out someone spent 4 hours on something and didn't make any progress when I knew the answer already.
- Learn git if you haven't already. Not crazy stuff, but how to create a feature branch and open a PR at

least.
- Try to understand (at a high level) the software development lifecycle at your company within the first few weeks. A good way to approach this is to pick a repository and map out how code goes from a developer's machine to production. Start with just system to system (dev machine -> github -> CI -> CD -> Develop -> UAT -> Staging -> Prod or whatever it is) then recursively dig into the actual processes happening in each system until you operate at the same abstraction layer as your senior colleagues.
- Volunteer for projects, especially things that other people don't want to do. The new pipeline ticket is toil for your senior colleague but represents a learning opportunity for you as well as a chance to deliver business value.
- Pay attention to things that seem silly. A fresh perspective on systems and processes that your predecessors have been working with for years can be invaluable.
- For the love of all that is holy, realize that people are smart and things are often the way they are for reasons that you have no knowledge of. Asking why is great, but reserve judgement on merit until you have a more comprehensive understanding of the thing you might be criticizing.
- Internalize the fact that many of the people you will be working with take a lot of pride in their work. While continuous improvement is an essential part of software development, be careful that you're not calling someone's baby ugly.
- Internalize the fact that as you level up your technical skills, your ability to drive impactful projects and make meaningful achievements is going to be hugely hampered or enabled by your colleague's opinion of you. Software development is a team sport and if you make people feel bad or are difficult to work with then you will be hamstrung in terms of your ability to get other people pulling in the same direction as you.
- Work with your supervisor (even ask senior colleagues for input) on a career development plan. You should orient yourself with the expectations of the next level up and use those to guide your progress.
- Do not abandon tasks unless priorities have shifted and you've been instructed to pivot.
- Project management is almost entirely about setting expectations. Communicate early and often to stakeholders on if something is delayed or if you hit a roadblock!

https://redd.it/zjnk4n
@r_devops

Devops entrepreneurs…..

How do I use my devops knowledge to create my own source of income? Tried freelancing websites, it seems like people are basically paying bare minimum to get massive volumes of work done. Besides 9-5 what’re some ways this skill can be used to generate revenue?

https://redd.it/zjo31k
@r_devops

Programming or Devops?

Hi everyone, I've been studying devops lately thinking about migrating to the area, but I am in great doubt, if I continue studying devops or if I change and go to programming. Nowadays I work as IT support with a focus on azure administration, the salary is not very good, and seeing my friends working with programming and receiving more than twice as much makes me want to migrate to the programming area, but I have more knowledge In Devops due to some courses I took abroad, such as docker, powershell scripting, azure ci/cd, datadog, Linux. I'm not very good at programming, but I can try. Those of you who already work in the area, should I continue studying devops or should I migrate to programming?

https://redd.it/zjuh37
@r_devops

Moving past Jenkins

What would you say is the best alternative to Jenkins? Of course something widely used and not in a beta stage.

I’m learning Jenkins right now and absolutely hate the plug-in based architecture, I was thinking maybe GitLab?

What would you suggest?

https://redd.it/zjvrx2
@r_devops

Director is floating the idea of moving me into Management...

Context:

I've been in the industry for almost two decades now (yes, I'm old LOL) primarily working with Linux based infrastructures. I've spent time as a sys admin, Network Engineer, Infrastructure Architect and now as a Sr. DevOps Engineer. Each transition in my career has been done strategically and with purpose to get to this point, such as my decision to become a Network Engineer for a couple of years where my goal was to gain a much stronger foundation in advanced networking concepts and protocols which I could apply to my journey and as a result, has put me head-and-shoulders over most of my peers.

I've only been with my current employer for about 3 years and in that time have been able to usher in some very impactful change such as self-healing architecture and automation, no-downtime code deployments, and above all else fostering a true DevOps philosophy, all of which contributing to more stability and cost reduction. This has given me a pretty good reputation at my workplace where my name is often part of higher level conversations among directors and some executives.

I'm writing here now, wondering if there's anyone else in here who has made the transition from high-performing individual contributor to manager.

What was that transition like?
What were some of the struggles you had to deal with?
What was it like going from managing machines / code to managing people?
And finally, was it worth it?
Would you do it again if you could?
What would you do differently?

TL:DR

What was your experienced going from a high-performing IC to a Manager?

https://redd.it/zjyojz
@r_devops

When is Ansible needed and why?

I'm having a hard time to understand why would Ansible be needed. I have the following 2 real world scenarios that I have worked on (I excluded details for brevity);

1. Using Azure DevOps as a CICD pipeline to build and push images to an external repository, Terraform A to bootstrap an AWS account, Terraform B to pull images and deploy application infrastructure on ECS.
2. Using JCasC on EKS A to build and push images to an external repository, package helm and deploy infrastructure on EKS B. Terraform A to bootstrap a Transit Gateway account (networking account), Terraform B to bootstrap an application account, Terraform C to deploy the application infrastructure.

Where and when would I need Ansible or any other similar tool to achieve what? Please keep in mind that I'm not specifically talking about the tooling here but generally for CaC. Both of the examples above are reasonably large projects with each having 60+ Terraform modules consisting of 5-8 Microservices and one being multi-region as well (I understand that for some people this isn't large at all but they're large enough for this argument sake)

I am not against introducing new tooling to any process, I am merely trying to understand where I could place a configuration management tool having in mind the 12 factor application methodology.

https://redd.it/zjzkdh
@r_devops

Phantom metrics: why your monitoring dashboard may be lying to you

I keep seeing these blind spots when using metrics, so I decided to put together a simple explainer.
I hope you find it useful.
https://horovits.medium.com/phantom-metrics-why-your-monitoring-dashboard-may-be-lying-to-you-ca477e80589e

https://redd.it/zjzre9
@r_devops

Infrastructure as code

Hi, I hope this is the right place to ask my question.

I try to automate the process of rolling out app VMs on Proxmox. I already use Ansible since quiet some time but recently stumbled upon Packer and Terraform and think they are useful too. However I have trouble to figure out how to best organize the pipeline.

I thought about the following:
- Use Packer to create a Proxmox VM template with the OS installed and some general configuration applied. With general I mean config that will always be the same across all VM instances. (Eg. SSH config hardening)
- Use Terraform to create a VM instance from this template and apply some instance specific configuration. (Eg. Generate SSH host keys)
- Use Ansible to rollout the application.

However I could also leave out the configuration through Packer and Terraform and do it all with Ansible afterwards... having it in three places seems a bit unorganized. But on the other hand why do these tools have the ability to do that.

I am aware that I can call Packer/Terraform from Ansible and vice versa.

I'm just very unsure how to organize that whole thing. And I want to get it (at least close to) right from the beginning.

So... are there any best practices? What could you recommend? Are there other tools that I should know about?

Thanks!

https://redd.it/zk7tgk
@r_devops

Artificial Intelligence Infrastructure-as-Code Generator

ChatGPT is the biggest trend in the tech world now. We developed AIaC to speed up the writing of iac for #devops teams ( terraform, cloudformation, helm, pulumi and more) using OpenAI. AIaC is an opensource and free to use. If you like it, give it a 🌟

https://redd.it/zkbmrb
@r_devops

terraforming existing infra

Hi
I started in a new company with a deployed but undocumented infra
I would like to terraform as much as I can of current infra so I can afront new requirements having a base, but I'm feel it's a big task and probably imposible to do

I'm wrong? There is some kind "of Magic" / procedures/ advises I can follow to have terraformed the infra?

https://redd.it/zkapt1
@r_devops

Expose only part of .env for every service in docker-compose

I was usually just doing env_file: - .env in every service in dc, but now Im little worried, that other some services may be malicious and sneak some sensitive env variables (i.e someone hacks docker hub / github repo and inserts malicious code - so you theoretically can pull malicious code that sends all your env variables).

&#x200B;

So I was wondering what would be the best way to limit the scope of .env file that every service sees? Probably having a dedicated .env for every service is the most straight-forward way, but that will lead to some variables being duplicated in different files (i.e. db password)

https://redd.it/zk7lp5
@r_devops

I am not liking my job

A little background: 31 years old guy here. Did a bachelor in EEE with love in C, MATLAB programming. Wanted to build a career in the embedded system field but ended up joining in a power plant as an electrical maintenance engineer. Worked there for about 4 years then studied Master’s in IT.

Though I loved coding yet web development couldn’t fascinate me at all. I rather wanted to do system level coding with C++, Java or Rust.
But after completing my study, I landed a job as a DevOps engineer in a big software company with a decent salary.

There is not much to do in my position. Everyone knows everything and no one is willing to babysit me to teach me stuff. Nobody touches the pipeline and Kubernetes cluster. Two guys are responsible for AWS deployment and not willing to involve me there. I am only doing monitoring and alerting stuff. Sometimes do some administrative tasks on proxmox. But I like automating tasks with Python script but it’s very rare. At this point I am literally disappointed by DevOps position as it is not matching with what I dreamd of when learning DevOps. When I think about the dark side of my position, I feel like, I should start learning coding Java or Rust then get a job in a related field and quiet this job. Now I need your advice:

i. Should I use my all spare time to learn Rust or Java? If yes then how likely I am able to get a job as a 31 years old guy who started learning code?
ii. Should I stend some of my spare time to learn coding and rest to grow in my current position, so that in case of unsuccessful in coding, I can still continue DevOps?
iii. Should I stick to my current position and grow?

https://redd.it/zkikgj
@r_devops

What's the best and easiest to use GUI-based CI tool? No Jenkins suggestions, please.

I have used Azure Pipelines in my previous job, and I quite liked it. I'm not a fan of the YAML syntax and struggle to follow what is going on in those files, so a GUI friendly system liked Azure Pipelines is awesome. So, I'm looking for something more or less similar. I'm a Linux + opensource guy, that's why even though I like Azure Pipelines, I prefer to avoid Microsoft products. What other tool could meet my requirements?

https://redd.it/zkn8f0
@r_devops