|
346 | 346 |
|
347 | 347 | Additionally, setting "populate-all-elbs-in-param-store": true for an account will populates all Accelerator wide ELB information into parameter store within that account. The sample PBMM configuration files set this value on the perimeter account, such that ELB information is available to configure centralized ingress capabilities. |
348 | 348 |
|
| 349 | +??? faq "1.3.3. How do I deploy AWS Elastic Beanstalk instances?" |
| 350 | + |
| 351 | + #### How do I deploy AWS Elastic Beanstalk instances? |
| 352 | + |
| 353 | + If your deployed environment contains an SCP enforcing volume encryption of EC2 instances, your Elastic Beanstalk deployment will fail. |
| 354 | + |
| 355 | + The SCP will contain an entry like this: |
| 356 | + |
| 357 | + ```json |
| 358 | + { |
| 359 | + "Sid": "EBS1", |
| 360 | + "Effect": "Deny", |
| 361 | + "Action": "ec2:RunInstances", |
| 362 | + "Resource": "arn:aws:ec2:*:*:volume/*", |
| 363 | + "Condition": { |
| 364 | + "Bool": { |
| 365 | + "ec2:Encrypted": "false" |
| 366 | + } |
| 367 | + } |
| 368 | + }, |
| 369 | + |
| 370 | + ``` |
| 371 | + A solution is to encrypt the root volume of the AMI that Elastic Beanstalk uses for your selected platform, and perform a custom AMI deployment of your Elastic Beanstalk application. |
| 372 | + |
| 373 | + You can gather the AMI that Elastic Beanstalk uses via CLI with the following command: |
| 374 | + |
| 375 | + ```bash |
| 376 | + aws elasticbeanstalk describe-platform-version --region <YOUR_REGION> --platform-arn <ARN_EB_PLATFORM> |
| 377 | + ``` |
| 378 | + |
| 379 | + Once you have gathered the AMI ID successfully, go to the EC2 console and: |
| 380 | + |
| 381 | + - Click on the ‘AMIs’ option in the left navigation pane |
| 382 | + - Search for your AMI after selecting ‘Public Images’ from the dropdown list. |
| 383 | + - Select the AMI |
| 384 | + - Go to Actions and Copy AMI |
| 385 | + - Click on the checkbox to enable ‘Encryption’ and then select "Copy AMI". |
| 386 | + |
| 387 | + Once the AMI is successfully copied, you can use this AMI to specify a custom AMI in your Elastic Beanstalk environments with root volume encrypted. |
| 388 | + |
| 389 | + |
349 | 390 | ## 1.4. Upgrades |
350 | 391 |
|
351 | 392 | ??? faq "1.4.1. Can I upgrade directly to the latest release, or must I perform upgrades sequentially?" |
|
873 | 914 |
|
874 | 915 |  |
875 | 916 |
|
876 | | -??? faq "1.6.17. How do I deploy AWS Elastic Beanstalk instances?" |
877 | | - |
878 | | - #### How do I deploy AWS Elastic Beanstalk instances? |
879 | | - |
880 | | - If your deployed environment contains an SCP enforcing volume encryption of EC2 instances, your Elastic Beanstalk deployment will fail. |
881 | | - |
882 | | - The SCP will contain an entry like this: |
883 | | - |
884 | | - ```json |
885 | | - { |
886 | | - "Sid": "EBS1", |
887 | | - "Effect": "Deny", |
888 | | - "Action": "ec2:RunInstances", |
889 | | - "Resource": "arn:aws:ec2:*:*:volume/*", |
890 | | - "Condition": { |
891 | | - "Bool": { |
892 | | - "ec2:Encrypted": "false" |
893 | | - } |
894 | | - } |
895 | | - }, |
896 | | - |
897 | | - ``` |
898 | | - A solution is to encrypt the root volume of the AMI that Elastic Beanstalk uses for your selected platform, and perform a custom AMI deployment of your Elastic Beanstalk application. |
899 | | - |
900 | | - You can gather the AMI that Elastic Beanstalk uses via CLI with the following command: |
901 | | - |
902 | | - ```bash |
903 | | - aws elasticbeanstalk describe-platform-version --region <YOUR_REGION> --platform-arn <ARN_EB_PLATFORM> |
904 | | - ``` |
905 | | - |
906 | | - Once you have gathered the AMI ID successfully, go to the EC2 console and: |
907 | | - |
908 | | - - Click on the ‘AMIs’ option in the left navigation pane |
909 | | - - Search for your AMI after selecting ‘Public Images’ from the dropdown list. |
910 | | - - Select the AMI |
911 | | - - Go to Actions and Copy AMI |
912 | | - - Click on the checkbox to enable ‘Encryption’ and then select "Copy AMI". |
913 | | - |
914 | | - Once the AMI is successfully copied, you can use this AMI to specify a custom AMI in your Elastic Beanstalk environments with root volume encrypted. |
915 | | - |
916 | | - |
| 917 | +??? faq "1.6.17. Why are only select interface endpoints provisioned in the sample configuration files?" |
| 918 | + |
| 919 | + #### Why are only select interface endpoints provisioned in the sample configuration files? |
| 920 | + |
| 921 | + For economic reasons, most of the sample configuration files only include the following minimum set of required interface endpoints: |
| 922 | + |
| 923 | + "ec2", "ec2messages", "ssm", "ssmmessages", "secretsmanager", "cloudformation", "kms", "logs", "monitoring" |
| 924 | + |
| 925 | + The full sample configuration file included all interface endpoints that existed in the Canada (Central) region at the time the configuration file was originally developed: |
| 926 | + |
| 927 | + "access-analyzer", "acm-pca", "application-autoscaling", "appmesh-envoy-management", "athena", "autoscaling", "autoscaling-plans", "awsconnector", "cassandra", "clouddirectory", "cloudformation", "cloudtrail", "codebuild", "codecommit", "codepipeline", "config", "datasync", "ebs", "ec2", "ec2messages", "ecr.api", "ecr.dkr", "ecs", "ecs-agent", "ecs-telemetry", "elasticbeanstalk", "elasticbeanstalk-health", "elasticfilesystem", "elasticloadbalancing", "elasticmapreduce", "email-smtp", "events", "execute-api", "git-codecommit", "glue", "kinesis-firehose", "kinesis-streams", "kms", "license-manager", "logs", "macie2", "monitoring", "notebook", "sagemaker.api", "sagemaker.runtime", "secretsmanager", "servicecatalog", "sms", "sns", "sqs", "ssm", "ssmmessages", "states", "storagegateway", "sts", "synthetics", "transfer", "transfer.server", "workspaces" |
| 928 | + |
| 929 | + Since that time these additional endpoints have been launched in the ca-central-1 region and can be optionally added to customer configuration files to make them accessible from private address space: |
| 930 | + |
| 931 | + "airflow.api", "airflow.env", "airflow.ops", "app-integrations", "appstream.api", "appstream.streaming", "auditmanager", "backup", "backup-gateway", "batch", "cloudhsmv2", "codedeploy", "codedeploy-commands-secure", "codestar-connections.api", "comprehend", "comprehendmedical", "databrew", "dms", "elasticache", "emr-containers", "finspace", "finspace-api", "fis", "fsx", "greengrass", "imagebuilder", "inspector2", "iot.data", "iot.fleethub.api", "iotsitewise.api", "iotsitewise.data", "kendra", "lakeformation", "lambda", "memory-db", "mgn", "models-v2-lex", "nimble", "panorama", "profile", "qldb.session", "rds", "rds-data", "redshift", "redshift-data", "rekognition", "runtime-v2-lex", "sagemaker.featurestore-runtime", "securityhub", "servicecatalog-appregistry", "ssm-contacts", "ssm-incidents", "sync-states", "textract", "transcribe", "transcribestreaming", "translate", "xray" |
| 932 | + |
| 933 | + The aws.sagemaker.ca-central-1.studio interface endpoint was also launched, but cannot be auto-deployed by the Accelerator at this time as it does not utilize standardized naming and requires a code update to enable deployment. |
| 934 | + |
| 935 | + Additional endpoints may exist in other AWS regions. Any endpoint can be added to any Accelerator configuration file, as long as it follows the standardized endpoint naming convention (e.g. com.amazonaws.{region}.{service}). |
917 | 936 |
|
918 | 937 | ## 1.7. Network Architecture |
919 | 938 |
|
|
0 commit comments