10 ms·
Ah that's nothing. Simple problem from a high level: static web site on apex domain. What you should be able to do: Click click done. Upload files to S3. Poin
by gw98 4y ago
Ah that's nothing. Simple problem from a high level: static web site on apex domain.
What you should be able to do:
Click click done. Upload files to S3. Point CNAME at AWS.
What you have to do:
Create an S3 bucket and stick the files in it. Create a zone in Route 53 and import your old zone file. Change your nameservers at the registrar. Wait a bit. Go to ACM in the correct region and create a cert. Tell it to add the DNS entries to R53. Wait a bit. Create a CloudFront distribution making sure that you get all the options right which is quite difficult. While that's deploying, copy the IAM policy it generates back to the S3 bucket. Jump back to R53 and add a new A record pointing at the cloudfront distribution alias. Cross fingers and start praying that the whole stack works. If it doesn't spend several hours working out which thing you forgot to click.
What devops culture would have you do:
Play with CloudFormation for 2 days writing oodles of mind numbing YAML and realise that you have to create the ACM cert and CF distribution in a different region to your bucket but that's impossible. Try and work around this with recommended StackSets but realise they are so horrible that they are unusable. Spend an hour googling. Download terraform because everyone is gushing over it. Spend several hours learning the above and writing it in HCL constantly tearing down and creating resources until the whole thing limps along. Eventually realise you need to share this is someone and the thing is stateful so pay Hashicorp for TF Cloud. After the PO is approved with takes 2 weeks, check it in to git, cheer loudly, hand it over to a colleague who has a different version of terraform and then discover about tfenv and terraform upgrades.
I only do this because I'm paid by the hour. I'm not even a cloud or ops guy. I'm an electronics engineer who needs to eat. I eat well due to this mess but I know it's all so so so wrong.
- zoover2020 4y agoAre you aware of the AWS CDK? Doing that in Infra as Code shouldn't take two days IMO.
- gw98 4y agoYes. CDK is just another way of expressing the same things as terraform and cloudfront but using a framework which is opaque. Plus it's slow as fuck, buggy and difficult to debug when it goes wrong. Every attempt keeps trying to solve the same problems with a new abstraction but the problem is the underlying abstraction not the tools.
- cube00 4y agoThis is what worried me when I see the marketing claiming how easy is it run up infra using AWS SAM. It's all great until something goes wrong and you have to peak behind the curtain to the nest of automatically generated Cloudfoundation scripts.
- Hawxy 4y ago> CDK is just another way of expressing the same things as terraform and cloudfront but using a framework which is opaque. It also involves writing many, many less lines of code than Cloudformation/Terraform thanks to the excellent abstractions it bundles in. Your example of writing "2 days' worth of YAML" is less than 120 lines of Typescript in CDK. You could even skip that and just npm install the AWS solutions construct for this scenario if you have literally no idea what you're doing: https://docs.aws.amazon.com/solutions/latest/constructs/aws-cloudfront-s3.html https://docs.aws.amazon.com/solutions/latest/constructs/aws-...
- gw98 4y agoWe don’t know typescript. So we’d have to learn that first.
- indymike 4y agoDo you know JavaScript?
- gw98 4y agoNope! Edit: not strictly true. I know JavaScript quite well but I wish to have nothing whatsoever to do with it and the ecosystem around it due to a number of reasons I would have to write a whole essay on.
- fuckelonmusk 4y ago
- 4y ago
- YPPH 4y ago>Go to ACM in the correct region and create a cert Glad you included the "correct region" qualifier. The number of times I've mistakenly created the certificate in my local region, rather than the one designated for CloudFront...
- gw98 4y agoYep. Really these days I want to solve the problem and go home, not remember where the poo I stepped in last time I had to solve it was.
- kureikain 4y agoto add salt to the wound, there is a certain service you have to use and provision on us-east-1...such as cloudfront...where you already had the same ACM cert in us-east-2.
- quickthrower2 4y agoI prefer log into Hostgator, click cPanel, click File Manager, drag files across. Any day! Ok I missed: point DNS to Hostgator name servers. Click the button to install lets encrypt.
- spaniard89277 4y agoYep, I just opload to my FTP from my file browser (thunar), not even cpanel. I use picocms so can't be easier to manage.
- gw98 4y agoYou know it's bad when cPanel is a less painful solution :)
- viraptor 4y agoAWS is basically a "construct your own custom infrastructure" service and does that well. But if you're not going past a static page, it's not the best service - just go with vercel or netlify or someone similar instead. The policies, cloudformation, r53 config, cloudfront all have their purpose and a lot of flexibility. But don't pay the complexity price if someone else can wrap it for you in a nice saas.
- yakubin 4y ago100% this. A couple times I've considered moving my personal website to AWS, but each time I got lost in the documentation trying to keep all the different moving parts in my head. At the end of the day managing a single VPS running debian+nginx+certbot[1] with a Gandi domain is orders of magnitude simpler. [1]: I'm probably going to move that to FreeBSD/OpenBSD with OpenBSD's relayd+httpd+acme-client at some point, but the general idea stays the same.
- devonkim 4y agoAWS / systems professional here. I’d use something like Netlify for a personal site instead of the complexities and knobs available when using AWS S3 static site options. AWS bare is the equivalent to me of trying to use Linux From Scratch in 2012 for running a bash script in a cronjob when there’s distributions like Ubuntu out there meant to do a lot of the boring and mostly inconsequential stuff for everyone besides the highly regulated. It’s great for educational reasons but learning and productivity are usually diametrically opposed in use cases.
- philliphaydon 4y agoI learned cloudformation in a day. Everyone on HN said use terraforms. Tried to learn terraforms and it made things complicated. Went back to CF.
- laputan_machine 4y agoI'm currently in the middle of converting my team to straight CF instead of CDK/Terraform/Serverless. To me it's needlessly complicated, CF is simple, configurable, importantly it's _declarative_, which is the 'correct' way to approach infra (imho, of course). Deploying it? `aws cloudformation package -> aws cloudformation deploy`. That's it. No need for third party tooling or other madness. I think the lack of understanding the fundamentals leads people to picking up tools that abstract the fundamentals away (but then leads to more complex solutions).
- sgarland 4y agoThe thing is, Terraform is the industry standard, for better or for worse. Much like Helm for Kubernetes (or Kubernetes, for that matter). If you go somewhere else, the expectation is probably that you know how to use those.
- stblack 4y agoI envy you. I am using a simple S3 bucket to serve image files. We’re getting close to busting the free tier web traffic limit. I can’t figure out where, or how, to enter my boss’s credit card so we can start paying for the service. I’m not kidding. I’ve looked everywhere. Several times. I’ve probably spent two hours on this.
- e40 4y agoSounds like you don’t have billing credentials for your iams user.
- vitorfhc 4y agoHey, is the AWS account you are using inside an organization? If it's then all the billing information should go into the management account. Hope this is the issue and I could help you.
- TheLoafOfBread 4y agoExactly this.
- stblack 4y agoHere's how this is playing out. * We need a way to serve image files. * I create an organization account, add an S3 bucket. * We serve images as our application grows. * Fast forward a few months, get an email saying, we're at 85% of free-tier limit. * I invite my boss to the Organization, and make her the financial contact. * Neither I, nor my boss, have been able to figure out where, or how, to enter a credit card number. * We continue to get monthly 85% limit emails. Following the link in the email leads nowhere where we could enter the payment info. * What a completely insane and stupidly opaque UI. Take our money! How? * Will probably move to a service that's better organized. We're just serving image files, a few hundred per day. We have both tried and are unable to figure out how to tie payment info to our AWS organization.
- TheNewsIsHere 4y agoAre you logging in with an Administrator credentialed account _in_ the Organization master account? Did you give your boss a Billing role in IAM, within the Organization master account? If so, search for the “Billing” service and Payment Methods will be on the side. If in doubt, use the root account, but do so only sparingly. You can use it to debug admin and billing permissions.
- lifebeyondfife 4y agoI created a CloudFormation script specifically to do this (including CloudFront for CDN). Yes, there's reasonable complexity, but it's a trade-off of security and configuration. As others noted, the documentation is good, and this took me a weekend to write including learning CloudFormation from scratch. https://github.com/lifebeyondfife/simple-static-website https://github.com/lifebeyondfife/simple-static-website
- fhfuewidxjhe 4y agobest part about debuging you HCL/CL is when you cannot delete some resource and it won't tell you why besides "is in use". I created account after account at first and then had hell deleting them entirely. was still easier than figuring out was using a vpc that had nothing visible attached to it
- deleted 4y ago[deleted]
- hdjjhhvvhga 4y ago> I eat well due to this mess but I know it's all so so so wrong. That's the point - I do this too. I like the fact that AWS jobs pay well. I'm fair and I always point out to my clients that AWS is expensive and it will cost them more in the long run, and the vendor lock-in is considerable - but they don't care as "everybody is doing it." Well, that's fine with me, I also like to eat well.
- TheNewsIsHere 4y agoI recently created a static site at a zone apex without Route53. Everything else just works, well, as you illustrate. > Play with CloudFormation for 2 days writing oodles of mind numbing YAML and realise that you have to create the ACM cert and CF distribution in a different region to your bucket but that's impossible. The discrepancies in cross-region support specifically with ACM drives me nuts. I noped away from Terraform back in 2019. At the time, the state management component was too immature, and it was a little.. lose with credential security. You may like Ansible far more if you’d like something a bit more declarative, readable, and with “batteries included.” I have a close friend who is an EE and he finds tools like Ansible much more intuitive and enjoyable than Terraform and CloudFormation. Every tool has its master.