Amazon SES IP addresses

 Sometimes we may need to know SES IP address to mark them as whitelisted.

 

SES will maintain set of ipaddress to send emails. To know what are all those IP address

We need to run the following command in any Linux command prompt

dig TXT amazonses.com +short| grep 'v=spf1'

 

Once we execute will get following output

v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 ip4:69.169.224.0/20 ip4:23.249.208.0/20 ip4:23.251.224.0/19 ip4:76.223.176.0/20 ip4:54.240.64.0/19 ip4:54.240.96.0/19 ip4:52.82.172.0/22 -all

 

These IP ranges are used to send email. This may change, it is better to add SPF record to whitelist otherwise we keep on checking if there is any change, we need to update our IP list

 

Windows we need to use following command

nslookup -type=TXT amazonses.com | find "v=spf1"

Allow access S3 bucket to specific VPC endpoint and Ip address

 

Even though you make it S3 bucket is private, if someone knows the access key,  he can access S3 bucket form anywhere using access key

 

If you want to restrict access to only to corporate network is possible in two ways

 

1.       Allow access to specific VPC end point, So that it will allow to access bucket once you part of specific VPC

2.       Allow access to specific IP Address

 

The above options will give addition level of security.

 

Allowing access to specific VPC end point

 To write S3 policy you use policy editor or Notepad.

Step 1: Change the relevant places in the following XML and copy

{

    "Version": "2012-10-17",

    "Id": "<<policy Name>>",

    "Statement": [

        {

            "Sid": "<<Any id>>",

            "Effect": "Deny",

            "Principal": "*",

            "Action": "s3:*",

            "Resource": [

                "arn:aws:s3:::<<bucket Name>>",

                "arn:aws:s3:::<<bucket Name>>/*"

            ],

            "Condition": {

                "StringNotEquals": {

                    "aws:SourceVpce": "<<VPC ID>>"

                }

            }

        }

    ]

}

 

Step 2: Go to the S3 bucket in which you want to restrict

Step 3: Go to the permission tab

Step 4: Past the copied policy in “Bucket policy” Section and save

 

Allowing access to specific IPS

 

{

    "Version": "2012-10-17",

    "Id": "<<Policy Id>>",

    "Statement": [

        {

            "Sid": "<<Policy ID>>",

            "Effect": "Deny",

            "Principal": "*",

            "Action": "s3:*",

            "Resource": [

                "arn:aws:s3:::<<Bucket Name>>",

                "arn:aws:s3:::<<Bucket Name>>",/*"

            ],

            "Condition": {

                "NotIpAddress": {

                    "aws:SourceIp": [

                       <<multiple Ips with comma separate>>

                    ]

                }

               

            }

        }

    ]

}

 

 

Note: if anything goes wrong you will not have access to bucket, you can remove policy only via root user access. Please careful before you do the change  

The table '/tmp/mysql/#sql_xxxxx' is full in MYSQL

 The table '/tmp/mysql/#sql_xxxxx' is full

 

The above-mentioned error may occur few different scenario.

We faced this issue suddenly when we updated our database from 8.0.21 to 8.0.23, After that when run a large query sometimes we started facing issue this.

 

Following discussion thread helped us to resolve this issue

https://bugs.mysql.com/bug.php?id=99100

 

Look like it is bug,

Based on this discussion in the forum,  we found a solution changing following parameter in MYSQL config helped us.

internal_tmp_mem_storage_engine=Memory;

 

 

 

S3 Bucket SNS Event Configuration: Unable to validate the following destination configurations.

 

Before Amazon S3 publish messages to a destination, you must grant the Amazon S3 principal the necessary permissions to call the relevant API to publish messages to an SNS topic

While creating SNS topics, we should have to provide a publish permission to S3 buckets

Step 1 : Create SNS topic ( Select standard, currently standard is supported by s3 notification)

Step 2: Access policy option select advanced option and update the JSON as like below.

In the JSON Editor change JSON below

{

 "Version": "2012-10-17",

 "Id": "example-ID",

 "Statement": [

  {

   "Sid": "example-statement-ID",

   "Effect": "Allow",

   "Principal": {

    "Service": "s3.amazonaws.com" 

   },

   "Action": [

    "SNS:Publish"

   ],

   "Resource": "SNS-topic-ARN",

   "Condition": {

      "ArnLike": { "aws:SourceArn": "arn:aws:s3:*:*:bucket-name" },

      "StringEquals": { "aws:SourceAccount": "bucket-owner-account-id" }

   }

  }

 ]

}

 

Step3: Create the topic and subscribe the topics.

Step 4: Go the S3 bucket and create event notification.

Step5: Select SNS option, select created SNS topic  and save changes