LIGHTNING

ROUND

CLOUD FORUM 2023

Lightning Round Rules

Click to add the title text

Automating DNS Registration for Azure

Cloud Forum 2023

Simon Fairey – Princeton - Lead DevOps Engineer – May 11^th 2023

© 2023 Princeton University OIT

On Premise DNS Processes

Lengthy and complicated ServiceNow form for private DNS

Shorter ServiceNow form for public DNS

Neither appropriate for Azure and IaC

6

© 2023 Princeton University OIT

Azure DNS Process

Functional tags added to specific resource types

Subscription level system topic events sent to ServiceNow webhook

ServiceNow maintains (CRUD) Infoblox records

7

© 2023 Princeton University OIT

https://learn.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover#what-is-a-subdomain-takeover

8

© 2023 Princeton University OIT

Next Steps

Add TXT records for improved security

Support more resources

Add SSL certificate automation and renewal

9

© 2023 Princeton University OIT

SELECT * FROM CLOUD

Using CloudQuery at Northwestern

The 3am Phone Call

12

Image credit: Joe Haupt, flickr.com

What do you have in the cloud?

• How fast can you find your resources across many cloud environments?
• Across multiple cloud service providers?
• While one of those CSPs is experiencing an outage?

​

​

13

CloudQuery

• From the docs: “CloudQuery extracts, transforms, and loads configuration from cloud APIs to variety of supported destinations such as databases, data lakes, or streaming platforms for further analysis.”
• https://www.cloudquery.io/

14

How it works

• Distributed as a Go binary (or you can build)
• “Source” plugins: CSPs & SaaS providers
• Pulls resource, configuration data
• Currently 39 official + 5 partner/community sources
• “Destination” plugins: Data stores
• Currently 19 official destinations
• E.g. Postgresql, object storage, local files

15

CloudQuery @ Northwestern

• Runs nightly via Fargate task run by AWS Step Functions state machine
• ~180 cloud environments queried in ~15 min (US regions only)
• Writes to on premises Postgresql database
• Library of useful SQL queries to find resources

16

Extremely useful!

• Originally just for incident management, now used to quickly find all kinds of resources across accounts, which AWS can’t do natively
• Which accounts have active Savings Plans?
• Who has t3 unlimited instances?
• Which account generated that email cert verification request?

​

17

Thanks!

https://www.cloudquery.io/

​

m-rich@northwestern.edu

18

��Automating EC2 Patching�Cloud Forum 2023

Ezequiel Gioia�Systems Architect�University of Central Florida

CHALLENGE

• Researchers creating EC2 instances that are not being patched
• Instances that are isolated, not connected back to campus
• Lack of visibility of missing critical patches

​

University of Central Florida

Page 21

PROPOSED SOLUTION

• Systems Manager, Patch Manager
• Define patch policies
• Use tags to apply policies
• Control Tower Support
• Security Hub Support

​

University of Central Florida

Page 22

CONSIDERATIONS

• Research workloads can be time-sensitive
• To avoid interrupting critical experiments, you may want to add a manual approval step

University of Central Florida

Page 23

PLAY TIME!

University of Central Florida

Page 24

BRICKS AND SERVICES

• Step Functions as the baseplate
• EventBridge to get the external event that triggers the flow
• Lambda to compose message
• SNS to send the communication out to the user
• Lambda + API Gateway to the the response back
• Systems Manager / Patch Manager to patch the instance

​

Event Bridge

Patch Manager

SNS

Step Functions

Lambda

Lambda

API Gateway

University of Central Florida

Page 25

BASIC APPROVAL WORKFLOW

University of Central Florida

Page 26

CODING THE WORKFLOW

Amazon State Language (ASL)

​

Type of Task Integrations:

• Request Response
• Synchronous (Batch and ECS)
• Wait For Task Token

University of Central Florida

Page 27

ADDING BACKUPS

University of Central Florida

Page 28

NEXT STEPS

• Review API Gateway endpoint security
• Add more notifications
• Instance patched
• Backup failed
• Simplify backup job wait

​

CODE AND FURTHER DETAILS

bit.ly/patch-approval

​

University of Central Florida

Page 29

Approach to Setting up Cloud-App Configs

Yu Li

yul@vt.edu

What?

​

• Database connections
• Cache server connections
• Logging levels
• Alarm settings
• And so on ……

​

How?

AWS AppConfig

• Configure
• Validate
• Deploy
• Monitor

Source Code

• Cover most of AppConfig pros
• More flexible
• More user-friendly
• More secure

​

​

Cloud Insights – Who, How, Why, How Much?

R. Todd Reilly, PhD

May 2023

NIH STRIDES Initiative

Frequently Asked Questions

NIH STRIDES INITIATIVE

Leadership

Who is using STRIDES?

How much [time, effort, $] is NIH saving?

Researchers & Program Officers

How much $ am I spending?

How does my bill break down?

Reporting to Leadership

NIH STRIDES INITIATIVE

The STRIDES App

NIH STRIDES INITIATIVE

Our Vision

NIH STRIDES INITIATIVE

How We Visualize�Participation

NIH STRIDES INITIATIVE

How We Visualize�Account Stewardship

NIH STRIDES INITIATIVE

How We Visualize�Research Topics

NIH STRIDES INITIATIVE

Other Visuals of�Research Topics

NIH STRIDES INITIATIVE

Reporting to Researchers & Program Officers

NIH STRIDES INITIATIVE

Annotated Spending Reports

NIH STRIDES INITIATIVE

STRIDES distributes monthly spending reports to customers.

May

May 1

May billing cycle starts

May 31

May billing cycle ends

June

June 10

May invoices issued

June 30

May spending reports sent

How We Report On Services Consumed

NIH STRIDES INITIATIVE

BAR GRAPH

How much did I spend for different types of cloud services?

LEGEND

What’s included in each category?

How We Report On Multiple Accounts

NIH STRIDES INITIATIVE

SPEND TABLE

How much did I spend in a fiscal year?

CATEGORIZED EXPENSES

How much did each of my accounts spend on each service?

In Conclusion…

NIH STRIDES INITIATIVE

We’ve Learned a Few Things

NIH STRIDES INITIATIVE

• Metadata is critical
• Utilization is complicated
• Impact is difficult to measure…
• But you can plant seeds

And We Have Big Plans

NIH STRIDES INITIATIVE

Metrics

Shift focus from number of accounts to projects supported

Metadata

Gather more effective metadata to better interrogate our data

Service Catalogs

Collaborate on catalogs linking cloud services to research domains

Community

Engage with our community to improve bi-directional sharing

Contact Us

NIH STRIDES Initiative – STRIDES@nih.gov

THANKS!