How to restrict random (unidentified) requests to a DRF based API hosted on an AWS EC2 instance? - amazon-web-services

I'm running a DRF based API deployed with Docker on an EC2 Instance. After a few days of deploying I started facing an issue where the API stopped responding properly and that's when I noticed unidentified requests to my application, and that too at huge volumes. An example screenshot is attached below:
Although all these requests ultimately return 503 because these pages do not essentially exist, I want to take steps to restrict such requests.
FYR, I have a frontend (React JS Based) app running on AWS Amplify which consumes this API. I was looking for ways to restrict inbound requests to this EC2 to only the Amplify app, but realised that Amplify doesn't offer a Static IP of it's own. Any solution to that would also be appreciated.
UPDATE:
I have also put my domain name in the ALLOWED_HOSTS setting in my DRF, I am still receiving such hits.

Related

Setting up Latency Routing in AWS

I've been digging in the AWS docs for ages and am at my wits end trying to find non AWS official examples.
How do I decide if I should have failover and latency routing or should I have both? I currently have the site on Elastic beanstalk with both a dev and production version, but I get a 500 or 502 errors at least a couple times a month where if you refresh the page, it eventually loads but then the CSS is missing or the page doesn’t load and sometimes the page is just slow to load even with caching. How am I supposed to know if it’s a need for failover or latency routing, or should I have both? The AWS notifications only say “Environment health has transitioned from Degraded to Severe”. How do I log where/which AWS server Route 53 had serve the page?
Are you supposed to have multiple EC2 instances for latency based routing? I’m confused why the docs say to create a latency record for each of my EC2 instances.
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/TutorialTransitionToLBR.html
I currently have Codepipeline connected to my Github, so that changes are automatically deployed to the dev site, and then I manually approve changes to production. If I have multiple EC2 instances, do I need to set up the code pipeline for each EC2 instance such that it’s connected to my Github and then manually approve changes for all instances—ie would I just have multiple copies of the site hosted in diff regions in this situation? How do people manage this? I’m assuming there’s some way to approve production launch for all at once if this is what is done but I don't know what to google

Need Assistance Hosting on AWS

So I’ve just finished working on my first big personal project, bought a domain name, created an AWS account, watched a lot of AWS tutorials, but I still can’t figure out how to host my web app on AWS. The whole AWS thing is a mystery to me. No tutorial online seems to teach exactly what I need.
What I’m trying to do is this:
Host my dynamic web app on a secure https connection.
Host the web app using the personalized domain name I purchased.
Link my git repo to AWS so I can easily commit and push changes when needed.
Please assist me by pointing me to a resource that can help me achieve the above 3 tasks.
For now, the web app is still hosted on Heroku’s free service; feel free to take a look at the application, and provide some feedback if you can.
Link to web app:my web app
You mentioned - The web app is still hosted on Heroku’s free service
So, if you want the same thing in AWS, use Elastic Beanstalk.
First Question: How to host my web app on AWS?
There can be multiple options to host your web app:-
S3 Bucket to host your website. How to Host in S3
Elastic Beanstalk. Link
ECS - using containers
Single EC2 Server to host your website.
EKS - Kubernetes
By the way, there are many couples of things which you need to take care of before starting.
Second Question, Host the web app using the personalized domain name I purchased.
If you have used S3, the hosted URL will be in HTTP and you can create a route entry in your purchased domain settings. If it is AWS, create a new record in Route53.
If you host your website on EC2, you will get Public IP Address. Make a route entry with that Public IP.
If you have used ECS or EKS, you might require to use the Load Balancer and then you will have the Load Balancer DNS. Make a route entry with your Load Balancer DNS. Then again question will arise which kind of Load Balancer you want to use. [Like Application, Classic or Network Load Balancer]
If you use Elastic Beanstalk. It's a managed service, when you host you will directly get an endpoint. Make a route entry with that endpoint.
Third, Link my git repo to AWS so I can easily commit and push changes when needed.
For this, you have to use Code Build and connect Github as a Source while creating Code Build Project. Link
For CI-CD, there are multiple things again.
As Heroku’s is a PaaS, which provides you the platform and but when it comes to AWS, it is an IaaS. So you get the infrastructure and when you get the provisioned infrastructure, there are so many things which you need to take care of like you have to think like an Architect. Prepare the architecture and then proceed. It requires knowledge of other things also networking, security etc.
To answer your question, the best way to host a web app in AWS is Elastic Beanstalk
But what is AWS Elastic Beanstalk and what does it do?
AWS Elastic Beanstalk encompasses processes and operations connected with the deployment of web apps into the cloud environment, as well as their scaling.
Elastic Beanstalk automates the deployment by putting forward the required capacity, balancing the load, autoscaling, and monitoring software efficiency and performance. All that is left for a developer to do is to apply the code. In these conditions, the application owner has overall control over the capacity that AWS provides for the software and can access it at any time.
So this is the best way to deploy the app and let’s follow the steps.
Open the Elastic Beanstalk console and find the management page of your environment.
Select “Upload and Deploy”.
Select “Choose File” and choose the source bundle with the dialog box.
Deploy and select the URL to open the new website.
You can use CodeDeploy to connect your Github and deploy your code
Conclusion
I have taken a simplistic approach and told you exactly what you need to do the required task without going into the hus and fuss of AWS. Saying that there is still a lot that can be done to bring the real value of your application in terms of balancing the load, scaling or improving the performance.

Multiple Restful Api requests issues leads to duplicate records on nginx server

I have been struggling with duplicate rows into my AWS RDS DB. I am running a webserver for restful apis for flutters apps on AWS elastic beanstalk as in the screenshot below you can see after thorough analysis found that the access logs for nginx also recording multiple access from app. These all requests are from same device and from ip (i have removed it for reasons). Such behaviour leads to duplicate of records in our database.
thanks in advance..

Programmatically authenticating and accessing service inside AWS EKS cluster from outside when ALB is used

We build a Kubernetes application that is deployed by our users, our users connect to the deployed API server using a client and then use that client to submit jobs.
This question is about programmatically connecting to an application running inside Kubernetes cluster from outside of the cluster.
We have this working with local Kubernetes deployments and Google Kubernetes Engine (using IAP).
However some of our users on Amazon cloud cannot connect to the application.
I do not have much experience with AWS. I'm used to token-based auth and OAuth-like auth methods where authentication happens outside of a library: the user is redirected to some page where they log into a service and the client library only gets a token without ever seeing the password.
One of our users have implemented an auth solution that takes username and password and then uses Selenium to emulate the login process and get a cookie which is then used for sending requests. https://github.com/kubeflow/pipelines/pull/4182
Here is a quote from the PR.
Currently, kfp client can not be used outside AWS EKS cluster. Application load balancer manages outside traffic and require authentication before traffic coming into mesh. This PR automates ALB authentication and get session cookie to authenticate KFP python client to Kubeflow cluster.
This unblocks user to submit pipeline/run outside kubeflow cluster and user can integrate with their CI/CD solutions much easier.
Cognito or OIDC behind ALB both can leverage this solution.
Is there a better way to authenticate with AWS EKS ALB?
I've searched the AWS documentation for programmatic authentication methods, but did not find what I wanted (the docs mostly focused on server-side auth setup). In my last search I found the following article, but I'm not 100% sure it covers what our AWS users want.

Setting up an Amazon Server with Go Daddy

I am trying to set up an Amazon Server to host a dynamic website I'm currently creating. I have the domain bought on GoDaddy.com, and I believe that what I've done so far has linked the domain to my Amazon account.
I followed this tutorial : http://www.mycowsworld.com/blog/2013/07/29/setting-up-a-godaddy-domain-name-with-amazon-web-services/
In short, this walked me through setting up and Amazon S3 (Simple Storage Service) and Amazon Route 53. I then configured the DNS Servers, and my website now launches properly on the domain.
I'm not sure on the next step from here, but I would like to set up:
-A database server
-Anything else that might be necessary to run a dynamic website.
I am very new to hosting websites, and semi-new to web development in general, so the more in depth the better.
Thanks a lot
You have two options on AWS. Run an EC2 server and setup your application or continue to use the AWS managed services like S3.
Flask apps can be hosted on Elastic Beanstalk and
your database can be hosted on RDS (Relational Database Service). Then the two can be integrated.
Otherwise, spin up your own t2.micro instance in EC2. Log in via ssh and set up the database server and application like you have locally. This server could also host the (currently S3 hosted) static files too.
I have no idea what your requirements are, personally I would start with setting up the EC2 instance and go from there as integrating AWS services is without knowing what you need is probably not the easiest first step.
Heroku might be another option. They host their services on AWS and give you an end to end solution for deploying and running your python code without getting your hands dirty setting up servers.