Uly.me

cloud engineer

Cloud

AWS List of Auto Scaling Groups

Here’s a script to list Auto Scaling Groups from multiple AWS accounts. Accounts are in your AWS profiles.

#!/bin/bash
file='results-aws-asg.txt'
> $file
declare -a account=("default" "account-1" "account-2" "account-3" "account-4" "account-5")
declare -a region=("us-east-1" "us-east-2" "us-west-1" "us-west-2")
for i in "${account[@]}"
do
    echo '----------------------' >> $file
    echo 'Account: '$i >> $file
    for j in "${region[@]}"
    do
        echo 'Region: '$j >> $file
        aws autoscaling describe-auto-scaling-groups \
        --query "AutoScalingGroups[].[AutoScalingGroupName,LaunchConfigurationName]" \
        --profile $i \
        --region $j \
        --output text >> $file
    done
done

AWS Create Volume From Snapshot with Tags

Here’s another script that creates a volume from a snapshot, but also add the tags.

#!/bin/bash
read -p "server     : " server
read -p "volumeId   : " volume
read -p "snapshotId : " snapshot
read -p "region     : " region
read -p "zone       : " zone
read -p "profile    : " profile
# get tags
tags1=$(aws ec2 describe-volumes --volume-ids $volume --query 'Volumes[].Tags[]' --region $region --profile $profile)
# remove quotes
tags2=$(echo "$tags1" | tr -d '"')
# remove spaces
tags3=$(echo $tags2 | sed 's/ //g')
# replace : with =
tags4=$(echo $tags3 | sed 's/:/=/g')
# if empty value replace with quotes
tags5=$(echo $tags4 | sed 's/Value=}/Value=""}/g')
# create volume
aws ec2 create-volume \
--availability-zone $zone \
--encrypted \
--iops 3000 \
--volume-type gp3 \
--snapshot-id $snapshot \
--tag-specifications 'ResourceType=volume,Tags='$tags5'' \
--region $region \
--profile $profile

AWS Create Volume From Snapshot

Here’s a bash script that creates a volume from a snapshot in AWS.

#!/bin/bash
read -p "snapshotId : " snapshot
read -p "server     : " server
read -p "tag1       : " tag1
read -p "tag2       : " tag2
read -p "region     : " region
read -p "zone       : " zone
read -p "profile    : " profile
aws ec2 create-volume \
--availability-zone $zone \
--encrypted \
--iops 3000 \
--volume-type gp3 \
--snapshot-id $snapshot \
--tag-specifications "ResourceType=volume,Tags=[{Key=Name,Value="$server"},{Key=tag1,Value="$tag1"},{Key=tag2,Value="$tag2"}]" \
--region $region \
--profile $profile

AWS List Account Aliases

Here’s how to list account aliases. I have four profiles in my credentials. I’m looping through all four and printing the aliases.

#!/bin/bash
file='results-aws-account-aliases.txt'
> $file
declare -a account=("default" "one" "two" "three")
for i in "${account[@]}"
do
    echo '----------------------' >> $file
    echo 'Account: '$i >> $file
    aws iam list-account-aliases \
    --profile $i 
done

GCP List of BMS Servers

Here’s how to list Bare Metal Servers in Google Cloud Platform via gcloud.

gcloud bms instances list --region REGION --project PROJECT

Result

NAME            ID                 PROJECT         REGION       MACHINE_TYPE           CLIENT_IPS    PRIVATE_IPS                    STATE
server-001      at-xxxxxxx-svr001  project-01      us-central1  o2-ultramem-896-metal  10.0.0.1      192.168.253.1,192.168.252.1    RUNNING
server-002      at-xxxxxxx-svr002  project-02      us-central1  o2-ultramem-896-metal  10.0.0.2      192.168.253.2,192.168.252.2    RUNNING

Obviously you can see the same from GCP’s Console.

CloudWatch Notifications

How to give someone access to enable/disable CloudWatch notifications.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "cloudwatch:DescribeAlarms",
                "cloudwatch:EnableAlarmActions",
                "cloudwatch:DisableAlarmActions"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}

GCP Role Policy Binding

How to display the policy binding.

gcloud compute instances get-iam-policy SERVER --project=PROJECT_ID --zone=ZONE

Result

# There is no binding policy
etag: ACAB
 
# There is a binding policy
bindings:
- members:
  - serviceAccount:SERVICEACCOUNT
  role: organizations/xxxxxxxxxxxx/roles/ROLE
etag: xxxxxxxxxxx=
version: 1

Add a role binding policy

gcloud compute instances add-iam-policy-binding SERVER \
--project=PROJECT_ID \
--zone=ZONE \
--member=serviceAccount:SERVICEACCOUNT \
--role="organizations/xxxxxxxxxxxx/roles/ROLE"

Remove a role binding policy

gcloud compute instances remove-iam-policy-binding SERVER \
--project=PROJECT_ID \
--zone=ZONE \
--member=serviceAccount:SERVICEACCOUNT \
--role="organizations/xxxxxxxxxxxx/roles/ROLE"