Using Multiple Accounts with AWS Powershell Tools

At my company we chose to separate our AWS resources into two accounts, one for production data and one for redacted data. This makes sense from a security standpoint, but it also makes it a little trickier for users who want to use a package like the AWS Powershell tools. Constantly copying your secret keys is a big waste of time, and I found it a little confusing how to save different sets of access keys into powershell.

This had been frustrating me for a while, so I finally took an hour to read the documentation and examples more carefully to understand how to setup multiple AWS accounts in the Powershell tools. I found this a little confusing so I figured I would write up an example for others.

Start with grabbing an access key and secret key pair from the Amazon console (mine not shown here for obvious reasons).

Then install the AWS powershell tools and open a powershell window.

Start by saving your credentials using the “-storeas” flag in powershell.

Note if you look in the help doc for this commandlet, adding this flag prevents the commandlet from updating the current credentials in the powershell session

To do that, you have to call the same commandlet and set the “-profilename” flag to the value you just entered in “-storeas”

Then rinse and repeat for other accounts that you want saved. At this point you can flip between accounts much more easily.

Using git bash on windows with AWS CodeCommit

I’ve started using AWS CodeCommit for some projects and so far I’m a fan. It’s a very simple web interface on top of git, so it doesn’t have any code review or issue tracking features, but if what you’re looking for is a private git repository for very cheap, CodeCommit might be right for you.

The only configuration you need for CodeCommit is the name of the repository. Once you’ve created that, AWS will present you with the URL to clone your repo.

They also give you some instructions to tell git that it should use your AWS secret keys as the authentication profile, but I had some trouble getting their instructions to work with git bash.

If you’re a windows user like myself you’re probably used to converting instructions for Linux into the Windows world. In this case it wasn’t too bad. Amazon also provided a blog post that gave some further information.

Instead of using the commands their provided, I found my gitconfig file in C:\Program Files\Git\mingw64\etc (default location) and added the block they described

And that was all it took! From there I could use git normally.

I chose to setup git over HTTP, but I imagine a similar process would work for the actual git protocol.

Chef Cookbooks in CodeBuild

AWS usually releases a large number of new services at re:Invent, and this year was no exception.

The announcement I was most excited about was AWS CodeBuild, which is exactly what it sounds like: a service designed to take servers out of your build process.
One of the problems we looked tackling first is “building” chef recipes. If you’re a chef user, you know that recipes don’t need to be build so much as critiqued using foodcritic and packaged or deployed.
The first step is to put together a buildspec.yml file (apparently AWS has drunk the yml coolaid) that tells CodeBuild how to download and run your build tools. If you’re build can fit into one of the AWS supported docker images it makes this process a little easier because the tools will be built in.
If you need a different tool set it’s a good idea to build your own docker image so that your build environment is consistent, but for getting started quick you can also download and install custom tools in the Install step, as I’ve done in the example below.

https://gist.github.com/LenOtuye/df99701518fbf19dfaa331405d45fb0f.js

This example will run foodcritic, and if it passes zip your recipes and send them to wherever was specified in your code build project.

From there you can point an Opsworks stack at them to have them run on your servers.

I’ve been using CodeBuild for about a week, and the build has been taking about a minute and a half on average on the smallest instance size. That brings my cost per build to about a cent. Obviously this will vary based on what you’re building, but it makes it worth taking a look at.