Cost during breaks

  • The running T4G.small setup is estimated around $15/month plus tax, with prices to be verified in the AWS calculator for the viewer's region. 1:22:17 1:22:26
  • Stopping the instance removes the instance runtime cost but leaves EBS storage charges. 1:22:55
  • With 25 GB of gp3 EBS storage, stopping the machine was estimated around $2/month for storage. 1:23:17 1:23:34
  • Taking a snapshot/AMI and terminating the machine can reduce the cost further; a 12 GB snapshot was estimated around $0.60/month at $0.05/GB-month. 1:26:16 1:31:58

AMI and snapshot recovery

  • An AMI is Amazon's machine image metadata, while the associated snapshot is the storage artifact that costs money. 1:25:12 1:25:31
  • Creating an AMI from the instance captures the current disk state and can reboot the instance. 1:24:32 1:24:52
  • The speaker demonstrates deleting the project and damaging the OS, then launching a new instance from the AMI. 1:27:32 1:28:06 1:29:10
  • Restoring from the AMI requires selecting the AMI, choosing the instance type, selecting the key pair, selecting the security group, and updating the local SSH config to the new host name. 1:29:10 1:29:32 1:30:20
  • After restore, the project and dependencies are still present, so yarn start can bring Weer back without reinstalling everything. 1:31:11 1:31:34

Snapshot billing caveat

  • Archived snapshots can reduce storage cost further, but retrieval has a separate per-GB cost. 1:32:19 1:33:43
  • Snapshot size tracks written blocks, not simply current filesystem usage. 1:34:21
  • A disk that is currently using 5 GB can still produce a much larger snapshot if a large file was written and deleted before the snapshot. 1:34:38 1:34:56
  • Heavy disk writes, uploads, or swapping can increase future snapshot size even when the files are later removed. 1:35:41 1:35:56

Secret-management problem

  • High availability eventually requires terminating and respawning a machine without manually SSHing in or recreating .env files. 1:36:39 1:36:55
  • Manual .env creation is a blocker for automated redeployments. 1:37:15 1:37:31
  • AWS Systems Manager Parameter Store is introduced as the secrets vault, with standard parameters described as free in the pricing page at recording time. 1:38:14 1:39:11 1:39:36
  • Standard parameters can store up to 10,000 values, each up to 4 KB. 1:40:28
  • Parameter names are structured by application, stage, and variable name, such as weer/prod/<name>. 1:40:11

IAM role access

  • The AWS CLI can read a parameter from the local machine with ssm get-parameter, but the EC2 machine needs both AWS CLI installed and credentials. 1:41:34 1:42:20 1:43:23
  • IAM roles are introduced as key cards assigned to services, allowing EC2 to access only specific AWS services. 1:44:33 1:44:50
  • The role is created for EC2 and attached to the instance through Modify IAM Role. 1:45:30 1:46:18
  • The speaker warns not to give the public-facing instance admin access, because compromise could let an attacker launch resources, disable alerts, and create very large bills. 1:46:47 1:47:24
  • Public-facing servers are attacked constantly; the speaker shows logs with repeated attempts to read .env, AWS config, and credentials files. 1:47:41 1:48:02 1:48:16
  • The selected permission allows reading parameters by path, enabling get-parameters-by-path for values under the application prefix. 1:49:05 1:50:08
  • IAM policies can be restricted further by resource path, such as permitting only weer/prod parameters. 1:51:30 1:51:49

Weer secrets in Parameter Store

  • The Weer parameters include port, domain, Google client ID, Google client secret, cookie key, Redis URL, database fields, and database password. 1:53:48 1:54:11 1:55:30
  • Sensitive values such as Google client secret, cookie key, and database password are stored as SecureString values encrypted with KMS. 1:54:35 1:54:57 1:55:30
  • Once parameters are created, the local .env file can be removed and Weer can read its production environment from Parameter Store. 1:56:25 1:56:40 1:57:05
  • After deleting and recloning the application, the setup succeeds without manually rebuilding .env because the seed/start scripts read values from Parameter Store. 1:57:28 1:57:57
  • Additional EC2 machines can use the same setup by attaching the same IAM role. 1:58:32
  • Environment variables are inherited by child processes, so untrusted spawned tools should receive a cleared or overwritten environment. 1:58:48 1:59:52