Andreas and Michael Wittig write practical guides on AWS architecture, security, serverless and cost.
Commenters link its AWS how-tos on SSM, Fargate and IAM, though one disputes its claim about SSM security, and the author joins threads.
> For a good wee while now, AWS SSM (or AWS Systems Manager as I see they are calling it nowadays) has arguably been the most secure way to permit controlled and audited access to an EC2 instance.
SSM is definitely not the most secure way[0]. SSM is super complex and super-integrated into the rest of AWS, and also isn't cross-cloud to GCP, Azure, DO, etc, so now everyone needs an account just to log into a Linux server.
Worse, IAM roles are powerful but easy to misconfigure, and that's before getting into how hard they are to apply with any granularity because of the policy length limitations[1], so you're likely giving everyone access to log into every instance without even knowing it.
0. https://cloudonaut.io/aws-ssm-is-a-trojan-horse-fix-it-now/
1. https://aws.amazon.com/premiumsupport/knowledge-center/iam-increase-policy-size/
Howdy, I'm the author :)
I definitely agree, for high traffic applications a compute or memory optimized instance are more optimal choices due to the consistent performance, especially when price isn't as much of a concern.
In situations where cost is more of a concern and the application has "bursty" requirements for performance, I still believe the T2 instance has it's place.
The guys over at Cloudonaut have an excellent article on the importance of T2 burst credits to maintain application performance.
https://cloudonaut.io/burst-credits-of-t2-ec2-instances-need-monitoring/
EDIT: The new T2 Unlimited option mentioned at the above article is also worth considering.
I know this is an old thread now, but I just came back to it and thought to dig in a bit. First thing my Googling hit was this, which provides a good comparison of App Runner and Fargate
https://cloudonaut.io/fargate-vs-apprunner/
That lack of WAF support stood out. So Googling that:
https://github.com/aws/apprunner-roadmap/issues/58
"Hello, we are looking at supporting WAF in App Runner and will have more updates on this thread going forward. "
Oh and by the way it was actually your https://cloudonaut.io/your-single-aws-account-is-a-serious-risk/ post that indirectly inspired this tool, so thanks!
We consolidated users into a bastion account, ran into annoyances with CFN, and have been using iamy ever since for change management across all our accounts (more of a writeup at https://99designs.com.au/tech-blog/blog/2015/10/26/aws-vault/)
Be careful with SSM in general. The documentation suggests adding the AmazonEC2RoleforSSM policy to the role of the EC2 instances you want to access via Session Manager. This role grants read/write to all S3 buckets in your account (amongst other things). See this article for better steps and unavoidable risky things: https://cloudonaut.io/aws-ssm-is-a-trojan-horse-fix-it-now/
There's an SQS/Lamba integration. Push 10k messages in a queue as jobs. The lambdas pull them off and delete them once done.
https://cloudonaut.io/integrate-sqs-and-lambda-serverless-architecture-for-asynchronous-workloads/