DevOps & Cloud Operations Runbook

aws ecs execute-command \
  --cluster <CLUSTER_NAME> \
  --task <TASK_ID> \
  --container <CONTAINER_NAME> \
  --interactive \
  --command "/bin/bash"

aws ssm start-session \
  --target <INSTANCE_ID> \
  --document-name AWS-StartPortForwardingSessionToRemoteHost \
  --parameters '{"host":["<RDS_ENDPOINT>"],"portNumber":["3306"],"localPortNumber":["3306"]}'

# Put binary certificate secret
aws secretsmanager put-secret-value \
  --secret-id /app/certs/client-p12 \
  --secret-binary fileb://Certificate.p12 \
  --region <REGION>

# Retrieve and decode binary certificate
aws secretsmanager get-secret-value \
  --secret-id /app/certs/client-p12 \
  --query SecretBinary \
  --output text | base64 --decode > client-cert.p12

# Sync across regions with deletion
aws s3 sync s3://<SOURCE_BUCKET> s3://<DEST_BUCKET> \
  --source-region <SRC_REGION> \
  --region <DEST_REGION> \
  --delete

# Generate 7-day presigned download URL
aws s3 presign s3://<BUCKET>/<OBJECT_KEY> --expires-in 604800

SELECT pg_terminate_backend(pid)
FROM pg_stat_activity
WHERE datname = '<DATABASE_NAME>'
  AND state = 'idle'
  AND now() - state_change > interval '10 minutes'
  AND pid <> pg_backend_pid();

psql -h <DB_HOST> -U <DB_USER> -d <DB_NAME> -c "\copy (
  SELECT * FROM public.audit_logs WHERE created_at::date = CURRENT_DATE
) TO '/tmp/audit_export.csv' CSV HEADER"

SELECT TOP 20
  qs.total_worker_time / qs.execution_count AS AvgCPUTime,
  qs.execution_count,
  qs.total_worker_time AS TotalCPUTime,
  SUBSTRING(qt.text, (qs.statement_start_offset/2)+1,
    ((CASE qs.statement_end_offset WHEN -1 THEN DATALENGTH(qt.text) ELSE qs.statement_end_offset END - qs.statement_start_offset)/2)+1) AS QueryText
FROM sys.dm_exec_query_stats qs
CROSS APPLY sys.dm_exec_sql_text(qs.sql_handle) qt
ORDER BY AvgCPUTime DESC;

USE [<DB_NAME>];
GO
ALTER DATABASE [<DB_NAME>] SET RECOVERY SIMPLE;
GO
DBCC SHRINKFILE ('<DB_NAME>_log', 1);
GO
ALTER DATABASE [<DB_NAME>] SET RECOVERY FULL;
GO

# All three outputs must produce the exact same MD5 hash:
openssl req -noout -modulus -in domain.csr | openssl md5
openssl x509 -noout -modulus -in domain.crt | openssl md5
openssl rsa -noout -modulus -in domain.key | openssl md5

openssl x509 -in cert.pem -pubkey -noout \
  | openssl pkey -pubin -outform der \
  | openssl dgst -sha256 -binary \
  | openssl enc -base64

# Disable TLS 1.0 & 1.1; Enable TLS 1.2 & 1.3 (Server 2022+)
@("TLS 1.0", "TLS 1.1") | ForEach-Object {
  $p = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$_\Server"
  New-Item -Path $p -Force | Out-Null
  Set-ItemProperty -Path $p -Name "Enabled" -Value 0 -Type DWord
  Set-ItemProperty -Path $p -Name "DisabledByDefault" -Value 1 -Type DWord
}
@("TLS 1.2", "TLS 1.3") | ForEach-Object {
  $p = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$_\Server"
  New-Item -Path $p -Force | Out-Null
  Set-ItemProperty -Path $p -Name "Enabled" -Value 1 -Type DWord
  Set-ItemProperty -Path $p -Name "DisabledByDefault" -Value 0 -Type DWord
}

add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE' always;
add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, Accept' always;

if ($request_method = 'OPTIONS') {
    return 204;
}

# Automatically upgrades HTTP resource calls to HTTPS behind reverse proxies
add_header 'Content-Security-Policy' 'upgrade-insecure-requests';

curl -s -X POST "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/purge_cache" \
  -H "Authorization: Bearer <CLOUDFLARE_API_TOKEN>" \
  -H "Content-Type: application/json" \
  --data '{"hosts":["subdomain.example.com"]}' | jq

fallocate -l 4G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
free -h

# Add to /etc/ssh/sshd_config (Auto disconnects after 60 mins of inactivity)
ClientAliveInterval 1200
ClientAliveCountMax 3
# sudo systemctl restart sshd

# Creates a 10 GB file instantly for disk throughput tests
dd if=/dev/zero of=/tmp/test_10GB_file bs=1G count=10 status=progress

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ebs-gp3-sc
provisioner: ebs.csi.aws.com
parameters:
  type: gp3
  fsType: ext4
reclaimPolicy: Retain
allowVolumeExpansion: true
volumeBindingMode: WaitForFirstConsumer

AWSTemplateFormatVersion: '2010-09-09'
Description: Cross-Account Admin Access Role
Parameters:
  TrustedAccountID:
    Type: String
    Description: Trusted 12-digit AWS Account ID
Resources:
  CrossAccountAdminRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: CrossAccountOpsRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${TrustedAccountID}:root'
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AdministratorAccess'