AWS on Zack's Blog

Cost Optimization with Amazon Q & Cost Explorer MCP Server

Sun, 20 Apr 2025 08:36:56 +0000

Managing cloud costs effectively, especially on AWS, is crucial. Wasted resources can easily inflate bills. This post introduces the AWS Cost Explorer MCP Server, a tool designed to simplify analyzing your AWS spending using the Model Context Protocol (MCP).

GitHub Repository: https://github.com/awslabs/mcp/tree/main/src/cost-explorer-mcp-server

What this AWS Cost Explorer MCP Server Does

This specific MCP Server, provided by AWS Labs, acts as a specialized tool that connects an AI assistant like Amazon Q directly to the detailed AWS cost and usage data. Think of it as giving us AI assistant the specific knowledge and tools needed to understand and analyze our cloud spending.

Destruct AWS account using AWS-Nuke

Tue, 18 Feb 2025 08:16:01 +0000

Here’s a summary of the actions I took to delete an AWS account using an open source tool aws-nuke as it is at the end of free tier I donot need it anymore to aviod cost:

1. Install aws-nuke:

apt install aws-nuke

This command installs aws-nuke, a tool used to delete AWS resources in an account. It requires AWS credentials and the correct configuration file to specify what resources to remove.

AWS Private Link and Cross-account Package deployment

Fri, 15 Nov 2024 04:33:19 +0000

Recently I got a task from the Company’s app team, to install an agent on EC2 instances across several AWS accounts and enable connection via AWS private link to a target AWS account where the management server is hosted. To achieve this task, here I will see how to use AWS Systems Manager for software distribution and installation for multiple AWS accounts and install and configure AWS private link using Terraform.

RedHat Identity Management (IdM) with AD Integration

Sat, 13 Jul 2024 06:17:15 +0000

When a company faces challenge to manage its Linux environments across local and public cloud, RedHat Identity management can be the solution to achieve:

With Local AD and Azure AD (AAD) Integration
With AWS SSO Integration as external identity provider
LDAP, Kerberos and NTP
A web-based management front-end running on Apache

A Typical AD User Authentication Flow End-to-End:

User Creation and Management:

Azure AD / Local AD: Users are created in the Azure Active Directory or local Active Directory.
Synchronization to RedHat IdM: The users are synchronized from AD to RedHat IdM using the two-way trust established between AD and IdM.

Accessing EC2 Instances via SSH:

Serverless with AWS Fargate

Wed, 10 Jul 2024 04:11:38 +0000

‘if people tend to move to serverless, how ‘infrastructure engineer’ will end up’ Why go serverless

Some of the company’s applications recently moved from Rancher to Fargate, which is understandable as the cloud resource and traffic will be very intensive only during a certain period (HSC exam), hence AWS serverless with Fargate can be a better option for such business mode so the rest of the year without the exam we can save costs significantly.

Handling a RDS MySQL cluster CPU 100%

Mon, 17 Jun 2024 04:10:51 +0000

Today I got a performance issue from our analytic team, saying they experienced a Production MySQL cluster running on RDS very slow since yesterday morning.

I started to look into below areas for investigation:

AWS CloudWatch Metrics for RDS

AWS CloudWatch provides a wide range of metrics that can help diagnose resource usage for databases. So I started with:

CloudWatch - Metrics - All metrics - Add query - RDS - Top 10 RDS instances by highest CPU utilization

Automate AMI patching with Lambda and Cloudformation

Thu, 01 Feb 2024 03:14:05 +0000

The application team managing Rancher clusters in AWS EC2 faced a compliance challenge with their Rancher node template golden AMI. To meet security and compliance requirements, they needed to ensure that this AMI is patched regularly with the latest updates. This process had to be automated to guarantee that a newly patched AMI is available every month.

Overview of workflow with Lambda and Cloudformation

I developed this CloudFormation template to set up an automated process for patching Amazon Machine Images (AMIs) on a monthly schedule using AWS services such as Lambda, EventBridge, SNS, and Parameter Store. Here’s a workflow by design:

ZackBlog AWS Serverless webhosting

Sun, 30 Apr 2023 03:02:02 +0000

In this article, I will see how to host “zackweb” as a static web application using the following AWS serverless options:

S3 static webhosting
AWS CDK + CloudFront

Prerequisite

Add one more step in the existing Github Action workflow to copy the static web content to the newly created S3 bucket

# edit github action workflow
aws s3 cp ~/zack-gitops-project/zack_blog/_site/* s3://zackweb-serverless/ --recursive

# validate content in s3 bucket
ubuntu@ip-172-31-26-78:~$ aws s3 ls s3://zackweb-serverless --summarize
 PRE aboutme/
 PRE assets/
 PRE certificate/
 PRE gitrepo/
 PRE jekyll/
 PRE pro/
 PRE skillroadmap/
2023-07-30 14:55:05 4455 404.html
2023-07-30 14:55:05 504 Dockerfile
2023-07-30 14:55:06 80555 feed.xml
2023-07-30 14:55:06 7760 index.html
2023-07-30 14:55:06 0 nginx.conf

Total Objects: 5
 Total Size: 93274

Option 1: S3 static webhosting

Enable Free SSL certificate for blog

Tue, 07 Feb 2023 23:28:37 +0000

An interviewer told me this blog is insecure!!

Generate free SSL certificate from https://zerossl.com/
Validate the Certificate with Private Key via https://www.sslshopper.com/certificate-key-matcher.html
Upload ‘certificate.crt’ and ‘private.key’ to web server /etc/nginx/ssl/
Setting up NGINX HTTPS Server by including the ssl parameter to the listen directive in the server block under ‘http’ in ’nginx.conf’:

http {
 server {
 listen 443 ssl;
 server_name zackdevops.online;

 ssl_certificate /etc/nginx/ssl/certificate.crt;
 ssl_certificate_key /etc/nginx/ssl/private.key;
 }
 ...
}

Fix 2 errors:

2023/02/07 10:29:33 [emerg] 73175#73175: "server" directive is not allowed here in /etc/nginx/nginx.conf:11

2023/02/07 10:30:25 [error] 73207#73207: *1 directory index of "/usr/share/nginx/html/" is forbidden,client: 163.53.144.82, server: zackdevops.online, request: "GET / HTTP/1.1", host: "zackdevops.online"
2023/02/07 10:30:36 [error] 73207#73207: *1 directory index of "/usr/share/nginx/html/" is forbidden, client: 163.53.144.82, server: zackdevops.online, request: "GET / HTTP/1.1", host: "zackdevops.online"

Bingo! https://zackdevops.online connection is secure!