What is DNS TTL (Time To Live)?

What is time-to-live (TTL)?

Time-to-live (TTL) is a value for the period of time that a packet, or data, should exist on a computer or network before being discarded.

The meaning of TTL, or packet lifetime, depends on the context. For example, TTL is a value in an Internet Protocol (IP) packet that tells a network router when the packet has been in the network too long and should be discarded.

Here's the full video along with a hands-on demo that's based on TTL (time-to-live)👇👇

How Does TTL Work?

TTL's basic function revolves around managing information packets in relation to DNS requests. When one of these packets is created and transmitted through the internet, there is a chance that it will pass, continuously, from router to router forever. To prevent this from happening, each packet has a specific TTL or hop limit. It is also possible to examine the TTL log of a data packet to obtain information on how it has moved through the internet over the course of its travels.

Within each packet, there is a specified place where the TTL value is stored. This is a numerical value, and it indicates how much longer the packet should move around the internet. When a router receives a data packet, it takes away one unit from the TTL count before sending it on to the next destination within the network. This continues to happen until the TTL count within the packet drops all the way down to zero.

What is time-to-live in HTTP?

In Hypertext Transfer Protocol (HTTP), time-to-live describes the number of seconds it takes for cached web content to return before the webserver has to check again to ensure that the content is "fresh."

Settings on the webserver define a default value. Still, cache-control tags, which define the kinds of servers, if any, can cache the data, or expired tags, which represent a date and time when the content is stale, can override it in the HyperText Markup Language page headers.

What Are TTL Values?

When you set TTL values for your website, you choose a value in seconds. For example, a TTL value of 600 is the equivalent of 600 seconds or ten minutes.

The minimum available TTL is usually 30, equivalent to 30 seconds. You could theoretically set a TTL as low as one second. However, most sites use a default TTL of 3600 (one hour). The maximum TTL that you can apply is 86,400 (24 hours).

Technically, you can set any TTL value between the minimum and maximum parameters. Later in this article, we’ll discuss how you can choose the best time to live value for your site.

How Should You Choose a TTL?

Deciding on a suitable TTL for your needs can be challenging. Fortunately, there are some general guidelines that you can follow to see what fits your site best.

We recommend a TTL of 1-24 hours for most sites. Remember that TTL values are measured in seconds, so this is the equivalent of 3,600 to 86,400 seconds.

This TTL value can reduce loading time, which improves the user experience for your visitors and can decrease your bounce rate. The longer the better is a general rule, but remember to schedule any website maintenance accordingly.

How to Setup EC2 Instance

What is Amazon EC2 Instance?

Amazon EC2 provides a wide selection of instance types optimized to fit different use cases. Instance types comprise varying combinations of CPU, memory, storage, and networking capacity and give you the flexibility to choose the appropriate mix of resources for your applications. Each instance type includes one or more instance sizes, allowing you to scale your resources to the requirements of your target workload.

The instance will be charged per hour with different rates based on the type of instance chosen. AWS provides multiple instance types for the respective business needs of the user.
Thus, you can rent an instance based on your own CPU and memory requirements and use it as long as you want. You can terminate the instance when it’s no more used and save on costs. This is the most striking advantage of an on-demand instance- you can drastically save on your CAPEX.

Here is the full dedicated video-based upon "How to Create Amazon EC2 Instance"👇👇

Steps to Create Amazon EC2 Instance

1.    In EC2 go to the Instances

2.    And after that Click on Launch the Instance.

3.    Choose the Machine Image (AMI) you want.

4.    Choose the Instance Type you want.

5.    Configure the Instance Details

6.    Add Storage

7.    Add tags

8.    Configure Security Group

9.    Review and Launch, Here you can see the Detail of your Instance.

10.    If you are done with the Review, Now you can Simply launce the Instance

11.    Then your instance will start the launching

How to create Records in AWS Route53

what is Route53?

Amazon Route 53 is a highly available and scalable Domain Name System (DNS) web service. You can use Route 53 to perform three main functions in any combination: domain registration, DNS routing, and health checking.

Amazon Route 53 pricing and billing

As with other AWS products, there are no contracts or minimum commitments for using Amazon Route 53. You pay only for the hosted zones that you configure and the number of DNS queries that Route 53 answers. For more information, see Amazon Route 53 Pricing  

For information about billing for AWS services, including how to view your bill and manage your account and payments, see the AWS Billing and Cost Management User Guide.

Here is the full video, based on AWS Route53 Domain configuration, Creating the first comment and Query those Records in AWS CloudShell👇👇

To create a record using the Route 53 console

1. Sign in to the AWS Management Console and open the Route 53 console at https://console.aws.amazon.com/route53/
   
   
   

   

   
   
   
   
   
   
2. Search for Route53 service
   
   
   
   
   
   
3. choose Hosted zones.
   
   

   
   
   
   
   
   
   
   
   
   
   
   
   
   
4. If you already have a hosted zone for your domain, skip to the next step. If you don't, select the "create a hosted zone" option and you can create it.
   
   
   
   
   
   
   
   
   
   
   
   
   
   
5. Now If you are done with the Creating hosted zone, On the Hosted zones page, choose the name of the hosted zone that you want to create records in.
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
6. Choose Create Record.
   
   
   
   
   

What is Log4j Vulnerability and how dangerous is it

What is a Software Vulnerability?

A software vulnerability is a defect in software that could allow an attacker to gain control of a system. These defects can be because of the way the software is designed, or because of a flaw in the way that it’s coded.

How Does a Software Vulnerability Work?

An attacker first finds out if a system has a software vulnerability by scanning it.  The scan can tell the attacker what types of software are on the system, are they up to date, and whether any of the software packages are vulnerable.  When the attacker finds that out, he or she will have a better idea of what types of attacks to launch against the system.  A successful attack would result in the attacker being able to run malicious commands on the target system.

What Can an Attacker Do with a Software Vulnerability?

An attacker can exploit a software vulnerability to steal or manipulate sensitive data, join a system to a botnet, install a backdoor, or plant other types of malware.  Also, after penetrating into one network host, the attacker could use that host to break into other hosts on the same network.

Here is a full video which based on Log4J👇👇

What is Log4j?

Modern software can be large, powerful, and complex. Rather than a single author writing all the code themselves as was common decades ago, modern software creation will have large teams, and that software is increasingly made out of ‘building blocks’ pulled together by the team rather than entirely written from scratch.

A team is unlikely to spend weeks writing new code when they can use existing code immediately.

Log4j is one of the many building blocks that are used in the creation of modern software. It is used by many organizations to do a common but vital job. We call this a ‘software library’.

Log4j is used by developers to keep track of what happens in their software applications or online services. It’s basically a huge journal of the activity of a system or application. This activity is called ‘logging’ and it’s used by developers to keep an eye out for problems for users.

What’s the issue?

Last week, a vulnerability was found in Log4j, an open-source logging library commonly used by apps and services across the internet. If left unfixed, attackers can break into systems, steal passwords and logins, extract data, and infect networks with malicious software.
Log4j is used worldwide across software applications and online services, and the vulnerability requires very little expertise to exploit. This makes Log4shell potentially the most severe computer vulnerability in years.

Who is affected by this?

Almost all software will have some form of ability to log (for development, operational and security purposes), and Log4j is a very common component used for this.
For individuals, Log4j is almost certainly part of the devices and services you use online every day. The best thing you can do to protect yourself is make sure your devices and apps are as up to date as possible and continue to update them regularly, particularly over the next few weeks.
For organizations, it may not be immediately clear that your web servers, web applications, network devices and other software and hardware use Log4j. This makes it all the more critical for every organisation to pay attention to our advice, and that of your software vendors, and make necessary mitigations.

What else can we do?

• Check your systems for the use of Log4j
• Check the list of the vulnerable software
• Contact software vendors
• Set Web Application Firewall rules
• Check for scanning activity
• Check for exploitation
• Sign up for the NCSC’s Early Warning

See the vulnerability alert for more technical detail on these steps.

AWS Automation using Terraform

What is Terraform?

HashiCorp Terraform is an open-source infrastructure as code (IaC) software tool that allows DevOps engineers to programmatically provision the physical resources an application requires to run. Infrastructure as code is an IT practice that manages an application's underlying IT infrastructure through programming.

What is AWS Automation?

Automation, a capability of AWS Systems Manager, simplifies common maintenance and deployment tasks of Amazon Elastic Compute Cloud (Amazon EC2) instances and other AWS resources. ... Build automations to configure and manage instances and AWS resources.

Here is a full tutorial video (Concept + Demo) based on "How we can do AWS Automation using Terraform"👇👇

Resource: aws_launch_configuration

Provides a resource to create a new launch configuration, used for autoscaling groups.

Example Usage

data "aws_ami" "ubuntu" {
  most_recent = true

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-trusty-14.04-amd64-server-*"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }

  owners = ["099720109477"] # Canonical
}

resource "aws_launch_configuration" "as_conf" {
  name          = "web_config"
  image_id      = data.aws_ami.ubuntu.id
  instance_type = "t2.micro"
}

Using with AutoScaling Groups

Launch Configurations cannot be updated after creation with the Amazon Web Service API. In order to update a Launch Configuration, Terraform will destroy the existing resource and create a replacement. In order to effectively use a Launch Configuration resource with an AutoScaling Group resource, it's recommended to specify create_before_destroy in a lifecycle block. Either omit the Launch Configuration name attribute, or specify a partial name with name_prefix. Example:

data "aws_ami" "ubuntu" {
  most_recent = true

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-trusty-14.04-amd64-server-*"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }

  owners = ["099720109477"] # Canonical
}

resource "aws_launch_configuration" "as_conf" {
  name_prefix   = "terraform-lc-example-"
  image_id      = data.aws_ami.ubuntu.id
  instance_type = "t2.micro"

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_autoscaling_group" "bar" {
  name                 = "terraform-asg-example"
  launch_configuration = aws_launch_configuration.as_conf.name
  min_size             = 1
  max_size             = 2

  lifecycle {
    create_before_destroy = true
  }
}

With this setup Terraform generates a unique name for your Launch Configuration and can then update the AutoScaling Group without conflict before destroying the previous Launch Configuration.

What is Amazon Aurora and How it's Work?

What is Amazon Aurora?

Amazon Aurora is a MySQL and PostgreSQL-compatible relational database built for the cloud, that combines the performance and availability of traditional enterprise databases with the simplicity and cost-effectiveness of open source databases.

Amazon Aurora is up to five times faster than standard MySQL databases and three times faster than standard PostgreSQL databases. Amazon Aurora is fully managed by Amazon Relational Database Service (RDS), which automates time-consuming administration tasks like hardware provisioning, database setup, patching, and backups.

Amazon Aurora features a distributed, fault-tolerant, self-healing storage system that auto-scales up to 128TB per database instance. It delivers high performance and availability with up to 15 low-latency read replicas, point-in-time recovery, continuous backup to Amazon S3, and replication across three Availability Zones (AZs).

Here is a full tutorial video (Overview + Demo) based on AWS Aurora👇👇

Features of Amazon Aurora

• Scalability
• High throughput
• Instance monitoring and repair
• Encryption
• Easy to use
• Cost-effective
• Migration support
• Fully Managed

Amazon Aurora DB Cluster

Amazon Aurora DB cluster is a virtual database storage volume that spans multiple availability zones. Each Amazon Aurora Database Cluster is made up of two or more DB instances and a cluster volume that primarily manages the data for those DB instances. The following are the two types of DB instances that make up an Amazon Aurora Cluster: 

• Primary DB instance: This type of DB instance supports read and write operations and performs all data modifications to the cluster volume. Each Aurora DB cluster has one primary DB instance. 
• Aurora Replica: Unlike the primary DB instance, Aurora Replica only supports read operations. It is connected to the same storage volume as the primary DB instance. By locating Aurora Replicas in separate availability zones, high availability can be maintained.

Amazon Aurora Pricing

Amazon Aurora is paying as you go. It is comprised of 3 parts:

1. Hosting. You can choose from 3 different types of hosting depending on your needs
2. Storage and Operations. Storage is billed per gigabyte per month, and I/O is billed per million-request
3. Data transferred

RDS Encryption and Security

What is Amazon RDS?

Amazon Relational Database Service (Amazon RDS) makes it easy to set up, operate, and scale a relational database in the cloud. 

It provides cost-efficient and resizable capacity while automating time-consuming administration tasks such as hardware provisioning, database setup, patching and backups. 

It frees you to focus on your applications so you can give them the fast performance, high availability, security, and compatibility they need.

AWS RDS Security

• AWS provides multiple features to provide RDS security
• DB instance can be hosted in a VPC for the greatest possible network access control
• IAM policies can be used to assign permissions that determine who is allowed to manage RDS resources
• Security groups allow controlling what IP addresses or EC2 instances can connect to the databases on a DB instance
• Secure Socket Layer (SSL) connections with DB instances
• RDS encryption to secure RDS instances and snapshots at rest.
• Network encryption and transparent data encryption (TDE) with Oracle DB instances

Here is a full tutorial video based on RDS Encryption and Security👇👇

RDS Authentication and Access Control

• IAM can be used to control which RDS operations each individual user has permission to call

SSL to Encrypt a Connection to a DB Instance

• Encrypt connections using SSL for data in transit between the applications and the DB instance
• Amazon RDS creates an SSL certificate and installs the certificate on the DB instance when RDS provisions the instance.
• SSL certificates are signed by a certificate authority. SSL certificate includes the DB instance endpoint as the Common Name (CN) for the SSL certificate to guard against spoofing attacks
• While SSL offers security benefits, be aware that SSL encryption is a compute-intensive operation and will increase the latency of the database connection.

IAM Database Authentication

• IAM database authentication works with MySQL and PostgreSQL.
• IAM database authentication prevents the need to store static user credentials in the database because authentication is managed externally using IAM.
• IAM database authentication does not require password but needs an authentication token
• An authentication token is a unique string of characters that RDS generates on request.
• Authentication tokens are generated using AWS Signature Version 4.
• Each Authentication token has a lifetime of 15 minutes
• IAM database authentication provides the following benefits:
  • Network traffic to and from the database is encrypted using Secure Sockets Layer (SSL).
  • helps centrally manage access to the database resources, instead of managing access individually on each DB instance.
  • enables using IAM Roles to access the database instead of a password, for greater security.