{"id":11,"date":"2022-03-20T10:37:00","date_gmt":"2022-03-20T15:37:00","guid":{"rendered":"https:\/\/34.82.124.6\/?p=11"},"modified":"2022-04-29T10:41:53","modified_gmt":"2022-04-29T15:41:53","slug":"compare-aws-resource-configurations","status":"publish","type":"post","link":"https:\/\/cloudlearning365.com\/?p=11","title":{"rendered":"Compare AWS resource configurations"},"content":{"rendered":"\n<p>So you have created your resources manually in AWS and it works fine, but when you tried to create the resource using Terraform and it just won\u2019t work?<\/p>\n\n\n\n<p>I\u2019ve ran into this issue when tried to create S3 + Policy + Roles for Palo Alto bootstrap, and here below is how to resolve this, please feel free to comment if you have better methods.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Background:<\/h2>\n\n\n\n<p>I\u2019ve followed&nbsp;<a href=\"https:\/\/docs.paloaltonetworks.com\/vm-series\/9-1\/vm-series-deployment\/bootstrap-the-vm-series-firewall\/bootstrap-the-vm-series-firewall-in-aws.html\">this article<\/a>&nbsp;and created S3 bucket, folder structure, uploaded&nbsp;<strong>bootstrap.xml<\/strong>&nbsp;and&nbsp;<strong>init-cfg.txt<\/strong>&nbsp;under config folder and it works fine. But when I tried to terraform scripts from my buddy and it just doesn\u2019t work. There must be some delta that\u2019s causing the issue.<\/p>\n\n\n\n<p>It\u2019s a very easy problem to tackle in Azure, for most resources, you can choose to export to ARM or BICEP template, which will reveal all configurations.<\/p>\n\n\n\n<p>It isn\u2019t as straight forward in AWS, when I\u2019m looking at AWS CLI, aws s3 command have following subcommands<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ aws s3 ?\n\nusage: aws &#091;options] &lt;command&gt; &lt;subcommand&gt; &#091;&lt;subcommand&gt; ..] &#091;parameters]\nTo see help text, you can run:\n\n  aws help\n  aws &lt;command&gt; help\n  aws &lt;command&gt; &lt;subcommand&gt; help\n\naws: error: argument subcommand: Invalid choice, valid choices are:\n\nls                                       | website\ncp                                       | mv\nrm                                       | sync\nmb                                       | rb\npresign<\/code><\/pre>\n\n\n\n<p>None of them related to describe the current configuration<\/p>\n\n\n\n<p>There is an&nbsp;<a href=\"https:\/\/docs.aws.amazon.com\/cli\/latest\/reference\/s3api\/\">s3api command<\/a>, but it appears that you must query each subcommands, such as following huge list, what if my solution is much more complicated than just S3, then this will snowball much quicker to manage<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>get-bucket-accelerate-configuration\nget-bucket-acl\nget-bucket-analytics-configuration\nget-bucket-cors\nget-bucket-encryption\nget-bucket-intelligent-tiering-configuration\nget-bucket-inventory-configuration\nget-bucket-lifecycle-configuration\nget-bucket-location\nget-bucket-logging\nget-bucket-metrics-configuration\nget-bucket-notification-configuration\nget-bucket-ownership-controls\nget-bucket-policy\nget-bucket-policy-status\nget-bucket-replication\nget-bucket-request-payment\nget-bucket-tagging\nget-bucket-versioning\nget-bucket-website\nget-object\nget-object-acl\nget-object-attributes\nget-object-legal-hold\nget-object-lock-configuration\nget-object-retention\nget-object-tagging\nget-object-torrent\nget-public-access-block<\/code><\/pre>\n\n\n\n<p>Then I\u2019ve come across AWS Config, which should track configuration of each resources<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">AWS Config \u2013 Getting started<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>First goes to the region of the resources you want to track, and search for\u00a0<strong>Config<\/strong><br><\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"173\" src=\"https:\/\/34.82.124.6\/wp-content\/uploads\/2022\/04\/image-8-1536x260-1-1024x173.png\" alt=\"\" class=\"wp-image-12\" srcset=\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/04\/image-8-1536x260-1-1024x173.png 1024w, https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/04\/image-8-1536x260-1-300x51.png 300w, https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/04\/image-8-1536x260-1-768x130.png 768w, https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/04\/image-8-1536x260-1.png 1536w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\"><li>Click on Get started. I have selected Include global resources as there\u2019s a need to track roles and policies and choose to create a new bucket<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/03\/image-9-1024x671.png\" alt=\"\" class=\"wp-image-36\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\"><li>Rules are meant to be auditing purpose to evaluate if your resources is following best practices, which isn\u2019t useful for my situation, so I didn\u2019t select anything<br><\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"261\" src=\"https:\/\/34.82.124.6\/wp-content\/uploads\/2022\/04\/image-10-1024x261.png\" alt=\"\" class=\"wp-image-13\" srcset=\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/04\/image-10-1024x261.png 1024w, https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/04\/image-10-300x77.png 300w, https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/04\/image-10-768x196.png 768w, https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/04\/image-10-1536x392.png 1536w, https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/04\/image-10.png 1630w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\"><li>Finally review and confirm<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"451\" src=\"https:\/\/34.82.124.6\/wp-content\/uploads\/2022\/04\/image-11-1536x676-1-1024x451.png\" alt=\"\" class=\"wp-image-14\" srcset=\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/04\/image-11-1536x676-1-1024x451.png 1024w, https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/04\/image-11-1536x676-1-300x132.png 300w, https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/04\/image-11-1536x676-1-768x338.png 768w, https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/04\/image-11-1536x676-1.png 1536w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">AWS Config \u2013 comparing resources<\/h2>\n\n\n\n<p>Going to AWS Config -&gt; Dashboard, it nicely listed all discovered resources by category. Since we need to compare the S3 configuration, then I\u2019ve clicked on S3 Bucket<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/03\/image-12-1024x791.png\" alt=\"\" class=\"wp-image-42\" \/><\/figure>\n\n\n\n<p>Find the two S3 buckets to compare, notice this is actually under Resources , then filtered by Resource Type = AWS S3 Bucket<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/03\/image-14-1024x420.png\" alt=\"\" class=\"wp-image-45\" \/><\/figure>\n\n\n\n<p>In the middle section, expand View Configuration Item (JSON), then copy to your favorite tool for comparison (VS Code \/ WinMerg)<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/03\/image-16-1024x948.png\" alt=\"\" class=\"wp-image-48\" \/><\/figure>\n\n\n\n<p>Comparison screenshot:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/03\/image-17-1024x662.png\" alt=\"\" class=\"wp-image-49\" \/><\/figure>\n\n\n\n<p>It\u2019s easy to see following section is missing<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\"PublicAccessBlockConfiguration\": {\n      \"blockPublicAcls\": true,\n      \"ignorePublicAcls\": true,\n      \"blockPublicPolicy\": true,\n      \"restrictPublicBuckets\": true\n    },<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Cleanup<\/h2>\n\n\n\n<p>Keep in mind that there is a cost for using AWS Config. If you only need it for comparing resources configuration, after you are done, you should disable it:<\/p>\n\n\n\n<p>Settings -&gt; Note&nbsp;<strong>Recording is on<\/strong>&nbsp;-&gt; Edit<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/03\/image-18-1024x362.png\" alt=\"\" class=\"wp-image-50\" \/><\/figure>\n\n\n\n<p>Uncheck&nbsp;<strong>Enable recording<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/03\/image-19.png\" alt=\"\" class=\"wp-image-51\" \/><\/figure>\n\n\n\n<p>Confirm<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/03\/image-20.png\" alt=\"\" class=\"wp-image-52\" \/><\/figure>\n\n\n\n<p>Now that\u00a0<strong>Recording is off<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"332\" src=\"https:\/\/34.82.124.6\/wp-content\/uploads\/2022\/04\/image-21-1536x498-1-1024x332.png\" alt=\"\" class=\"wp-image-15\" srcset=\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/04\/image-21-1536x498-1-1024x332.png 1024w, https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/04\/image-21-1536x498-1-300x97.png 300w, https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/04\/image-21-1536x498-1-768x249.png 768w, https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/04\/image-21-1536x498-1.png 1536w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>So you have created your resources manually in AWS and it works fine, but when you tried to create the resource using Terraform and it just won\u2019t work? I\u2019ve ran into this issue when tried to create S3 + Policy &hellip; <a href=\"https:\/\/cloudlearning365.com\/?p=11\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[3],"tags":[],"class_list":["post-11","post","type-post","status-publish","format-standard","hentry","category-aws"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/posts\/11","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=11"}],"version-history":[{"count":1,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/posts\/11\/revisions"}],"predecessor-version":[{"id":16,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/posts\/11\/revisions\/16"}],"wp:attachment":[{"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}