Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Event-Based Mirroring: Listen for EC2 Service Events #38

Closed
chelma opened this issue Apr 27, 2023 · 3 comments
Closed

Event-Based Mirroring: Listen for EC2 Service Events #38

chelma opened this issue Apr 27, 2023 · 3 comments
Labels
Capture Resilience Work to make traffic capture more resilient to changes in load, configuration, and sources
Milestone

Comments

@chelma
Copy link
Collaborator

chelma commented Apr 27, 2023

Description

Per design discussion in (#35), we want to begin listening for and responding to AWS Service-emitted EventBridge Events to more swiftly capture new user traffic. This task is to listen for EC2 instances starting up/spinning down and automatically create mirroring configuration for them without having to take manual action or wait for a scheduled scan. It builds on the work accomplished in a preceding task (see #37).

This task will likely entail:

  • Create new Rules to listen for both EC2 and EC2 Autoscaling Instance start/stop events on the AWS Account/Region's default Bus and kick off the appropriate per-ENI create/destroy Lambda to action it.
  • Update the demo traffic source stacks to include an EC2 Autoscaling Group that can be used to test this behavior

Acceptance Criteria

  • Demonstrate that mirroring configuration is correctly created/destroyed when EC2 Instances are added/removed from the User VPC WITHOUT having to wait for a scheduled scan.
@chelma chelma added the Capture Resilience Work to make traffic capture more resilient to changes in load, configuration, and sources label Apr 27, 2023
@chelma chelma added this to the Arkimeet milestone Apr 27, 2023
@chelma
Copy link
Collaborator Author

chelma commented May 3, 2023

It turns out that both ECS-on-EC2 and EC2 will use the same AWS Resources, code, and configuration. Therefore, this is effectively a duplicate of #37, with the exception of adding an dedicated, non-ECS autoscaling group to our demo test stack.

@chelma
Copy link
Collaborator Author

chelma commented May 4, 2023

Mirroring is in place for EC2 instances. Since we can test the behavior using our ECS Cluster's backing ASG, I think I'm going to move the remaining work into a new issue and resolve this one.

@chelma
Copy link
Collaborator Author

chelma commented May 4, 2023

Follow-up created; resolving this task.

#46

@chelma chelma closed this as completed May 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Capture Resilience Work to make traffic capture more resilient to changes in load, configuration, and sources
Projects
None yet
Development

No branches or pull requests

1 participant