Uly.me

cloud engineer

delete

GCP SSL Certificates

by ·

Here’s how to create a regional SSL Certificate.

gcloud compute ssl-certificates create my-ssl-cert \
--description "describe ssl certificate" \
--domains=domain1.com,domain2.com \
--certificate=cert.pem \
--private-key=private.key \
--region=us-central1

List the SSL certificates.

gcloud compute ssl-certificates list --project=project-id

Describe the SSL certificate.

gcloud compute ssl-certificates describe my-ssl-cert \
--region=us-central1 \
--project=project-id

Delete SSL certificate.

gcloud compute ssl-certificates delete my-ssl-cert \
--region=us-central1 \
--project=project-id

AWS Rotate IAM Keys

by ·

Here’s a script that will rotate AWS IAM keys.

#!/bin/bash
# set files
user='johndoe'
newkey='/root/new-access-key.json'
oldkey='/root/old-access-key.json'
credentials='/root/.aws/credentials'
# get old credentials
aws iam list-access-keys --user-name $user > $oldkey
okey=$(jq .AccessKeyMetadata[0].AccessKeyId $oldkey | tr -d \")
# create new key
aws iam create-access-key --user-name $user > $newkey
# get new access keys and new secret
nkey=$(jq .AccessKey.AccessKeyId $newkey | tr -d \")
nsecret=$(jq .AccessKey.SecretAccessKey $newkey | tr -d \")
# backup old credentials
cp /root/.aws/credentials /root/.aws/credentials-backup
# store the new key
echo '[default]' > $credentials
echo 'aws_access_key_id = ' $nkey >> $credentials
echo 'aws_secret_access_key = '$nsecret >> $credentials
sleep 10
# delete old key
aws iam delete-access-key --user-name $user --access-key-id $okey
rm $newkey
rm $oldkey

The script performs the following:

  1. Retrieves the current key
  2. Creates a new key
  3. Backup the current credentials file
  4. Create a new credentials file
  5. Deletes the old key
  6. Deletes the temp files
  7. Done

AWS CLI IAM Keys

by ·

Here’s a few commands to create, delete and disable AWS user keys.

List user keys.

aws iam list-access-keys --user-name john.doe

Create access key. Results are printed on screen in JSON format.

aws iam create-access-key --user-name john.doe

Disable a key. The real key id is obfuscated.

aws iam update-access-key \
--access-key-id ******************** \
--status Inactive \
--user-name john.doe

Delete a key. They real key id is obfuscated.

aws iam delete-access-key \
--access-key-id ******************** \
--user-name john.doe

Set Immutable Attribute

by ·

If you don’t want a file edited or deleted, you can set the immutable attribute to ON. If activated, not even root or the owner of the file can delete it. Users with write access can still read it, but they obviously will not be able to modify it. To unset it, just use the -i option.

# Set immutable attribute
sudo chattr +i text.txt
 
# Unset immutable attribute
sudo chattr -i text.txt

Remove Key from known_hosts

by ·

If you’ve changed keys, you will need to delete a ssh key from /etc/known_hosts file.

You can edit it manually using an editor such as vi or vim.

vim ~/.ssh/known_hosts

Or you can use ssh-keygen command with -R option to delete the hostname or IP address.

ssh-keygen -f "~/.ssh/known_hosts" -R "xxx.xxx.xxx.xxx"

AWS LightSail Delete Snapshots

by ·

Here’s my script to delete AWS LightSail snapshots. It can delete daily or weekly backups and scheduled via crontab. If you want longer or shorter retention, adjust the expired value. It’s in seconds. 604800 is 1 week. 2592000 is 1 month.

#!/bin/bash
 
current=$(date +%s)
 
if [ $# -eq 0 ]; then
  exit 1
fi
 
if [[ $1 = 'daily' ]]; then
  prefix='daily'
  expired=$(($current-604800))
elif [[ $1 = 'weekly' ]]; then
  prefix='weekly'
  expired=$(($current-2592000))
else
  exit 1
fi
 
snaps='/root/snapshots/snapshots.json'
names='/root/snapshots/names.txt'
parse='/root/snapshots/parse.txt'
logfile='/root/snapshots/snapshots.log'
 
/usr/local/bin/aws lightsail get-instance-snapshots > $snaps
cat $snaps | jq -r '.instanceSnapshots[] | .name' > $names
cat $names | grep $prefix > $parse
 
while read -r line; do
 
  snapshot=$(echo $line | cut -d_ -f3)
  snapshotname=$line
 
  if [ `expr $snapshot + 1 2> /dev/null` ] ; then
 
    if [ $snapshot -le $expired ]; then
      echo 'Deleted: '$snapshotname >> $logfile
      /usr/local/bin/aws lightsail delete-instance-snapshot \
      --instance-snapshot-name $snapshotname
    else
      echo 'Nothing: '$snapshotname >> $logfile
    fi
 
  else
    echo $snapshot is not numeric > /dev/null
  fi
 
done < $parse
 
echo 'Current time: '$current >> $logfile
echo 'Expired time: '$expired >> $logfile
echo '-----------------------------------' >> $logfile

Schedule deletes via crontab.

# run daily at 5am
0 5 * * * /bin/bash /root/snapshots/delete-snapshot.sh daily 2>&1
# run weekly every sunday at 6am
0 6 * * 0 /bin/bash /root/snapshots/delete-snapshot.sh weekly 2>&1