Forem: Mim Ahmed

🛡 How to Prevent IAM Password Reuse in AWS

Mim Ahmed — Wed, 23 Jul 2025 02:14:17 +0000

When managing users in AWS, it's crucial to enforce strong security controls — especially around password hygiene. One such control is preventing IAM users from reusing old passwords.

Why Password Reuse Matters
Passwords are still a common attack vector. If users can reuse the same password (or rotate between two), you're exposing your environment to:

Credential stuffing
Password spraying
Social engineering risks

TL;DR: Reused passwords defeat the purpose of rotation policies.

AWS IAM Password Policy Overview
AWS IAM lets you define account-wide password policies for IAM users, including:

Minimum password length
Require symbols/numbers/uppercase/lowercase
Password expiration
Password reuse prevention

We’re focusing on the last one today.

How to Prevent Password Reuse in AWS

✅ Option 1: AWS Console
Go to IAM Console → https://console.aws.amazon.com/iam/

Click Account Settings

Click “Change Password Policy”

Check: ✅ “Prevent password reuse”

Enter a value for “Remember last N passwords” (e.g., 4)
Click Save

That’s it! Users can no longer reuse the last 4 passwords.

Running Docker Containers on a Read‑Only Root File System

Mim Ahmed — Fri, 04 Jul 2025 19:44:09 +0000

In modern DevOps, immutability is a cornerstone of both security and reliability. Docker makes it straightforward to enforce immutability by mounting the container’s root file system as read‑only. This prevents any runtime modification—accidental or malicious—of the files baked into the image.

This lab‐style guide shows you how to:

Build a minimal image.
Launch a container with a read‑only root.
Prove—both manually and programmatically—that it really is read‑only.

Why lock the root file system?

Defense in depth – Attackers (or faulty scripts) can’t tamper with binaries or libraries.
Operational consistency – Every container instance is bit‑for‑bit identical to the image.
Stateless architecture – Ideal for workloads where state lives in external services, volumes, or databases.

Scenario

“As the company’s DevOps engineer, you must deploy containers that cannot be modified in production. Your task: configure a container with a read‑only root and verify that the restriction works.”

Objectives

Build a Docker image for testing.
Run the container with --read-only.
Validate that write attempts fail and confirm the flag via docker inspect.

1. Build a test image
Create a new directory and add the following Dockerfile:

# Use a lightweight, secure base image
FROM alpine:latest

# Create sample data to test read‑only behavior
RUN mkdir /data \
    && echo "This is a read‑only test file." > /data/test.txt

WORKDIR /data
CMD ["sh"]

Build the image:

docker build -t readonly-test .

2. Run the container in read‑only mode

Command: docker run --rm -it --read-only readonly-test

--rm cleans up the container on exit.
-it opens an interactive shell.
--read-only mounts the root file system as read‑only.

You are now inside the container’s shell.

3. Attempt to write
Inside the container, try the following:

# Append to existing file
echo "Trying to write…" >> /data/test.txt

# Create a new file
touch /data/newfile.txt

Expected outcome

sh: can't create /data/test.txt: Read-only file system
touch: /data/newfile.txt: Read-only file system

4. Confirm programmatically
Open another terminal on the host:

# Find the running container
docker ps

# Replace <container_id> with the actual ID or name
docker inspect <container_id> | grep '"ReadonlyRootfs"'

Output:

"ReadonlyRootfs": true,
Docker’s metadata confirms the root file system is indeed read‑only.

Conclusion

By combining a minimal image with the --read-only flag, you have created an immutable runtime environment that:

Blocks unauthorized changes.
Reduces attack surface.
Guarantees that every container matches the original image.

Add this technique to your DevOps toolkit whenever you need strict runtime integrity—whether for compliance, security hardening, or simply peace of mind.

🔐 How to Remove Access Keys from Your AWS Root Account

Mim Ahmed — Thu, 29 May 2025 07:24:04 +0000

🔒 Why You Should Remove AWS Root Access Keys

Using access keys for the AWS root user is a huge security risk. The root account has unrestricted access to your entire AWS environment. If the root keys are compromised, so is your entire AWS account.

✅ AWS recommends never using the root account for everyday tasks. Instead, use IAM roles or users with fine-grained permissions.

🛠 Step-by-Step: Remove AWS Root Access Keys

✅ Prerequisites

You must sign in as the root user (not an IAM user).
You should already have an IAM user or role with admin permissions.
Ensure no services or scripts are actively using the root key.

👣 Step 1: Sign in as Root

Go to https://aws.amazon.com/
Click "Sign In to the Console"
Choose "Root user" and sign in with the root email + password.

- Complete MFA if it's enabled (highly recommended).

If you have keys you can see like this

👣 Step 2: Navigate to Security Credentials

Click your account name at the top right.
Select "Security credentials" from the dropdown.

👣 Step 3: Locate the Access Keys

Scroll to the “Access keys” section.
You will see a list of existing access keys.

- Keys may be in one of these states: Active, Inactive, or Deleted.

Select The Keys or All Keys to Delete

Click on Actions and First Deactivate it (if active).

Now Again Click Delete

👣 Step 4: Delete the Access Key(s)

Click "Delete" next to each active/inactive key.
Confirm the deletion when prompted.

After Successful Delete you can see like this

Now on Dashboard You can see like this

💡 Tip: If unsure whether a key is still in use, deactivate it first and observe if anything breaks. If not, proceed with deletion.

How to Install K3S on AWS EC2 & Deploy Simple JS Game 🚀

Mim Ahmed — Mon, 09 Sep 2024 08:59:28 +0000

In this tutorial you are going to learn How to setup K3S Cluster in EC2 and Join worker nodes and deploy a simple JavaScript Game.

First we need to create EC2 Instances.If you don't know how to create an EC2 Instance you can check this article.

Before You Start

You need

3 EC2 instances (1 master, 2 workers)
Configured with permissions for the necessary ports (e.g. SSH, K3s API, NodePort).
AWS CLI configured for your account.

Hardware Requirements:

Hardware requirements scale based on the size of your deployments. Minimum recommendations are outlined here.

1. Minimum Hardware Requirements for Master Node:

The master node in a Kubernetes cluster manages the control plane, handling tasks like scheduling, maintaining cluster state, and managing the API server. As such, it requires adequate resources to perform these tasks efficiently.

CPU: 2 vCPUs (minimum)
RAM: 2 GB (minimum); 4 GB or more recommended for production environments
Storage: 10 GB (minimum)

2. Minimum Hardware Requirements for Worker Nodes:

Worker nodes in a Kubernetes cluster host the application workloads, running containers that are orchestrated by the master node. The requirements for worker nodes depend on the workloads they will run, but the following are the general minimum recommendations:

CPU: 1 vCPU (minimum); more depending on workload demands
RAM: 1 GB (minimum); 2 GB or more recommended for moderate workloads
Storage: 10 GB (minimum)
Network: High-speed and low-latency network connectivity, especially for communication with the master node and other worker nodes

Example Configuration for AWS EC2:

Master Node: t3.medium (2 vCPUs, 4 GB RAM) for a small cluster

Worker Nodes: t3.small (2 vCPUs, 2 GB RAM) or t3.medium for moderate workloads

We can see we have 3 Instances running

Inbound Rules need to allow for K3s Nodes

Protocol	Port	Source	Destination	Description
TCP	2379-2380	Servers	Servers	Required only for HA with embedded etcd
TCP	6443	Agents	Servers	K3s supervisor and Kubernetes API Server
UDP	8472	All nodes	All nodes	Required only for Flannel VXLAN
TCP	10250	All nodes	All nodes	Kubelet metrics
UDP	51820	All nodes	All nodes	Required only for Flannel Wireguard with IPv4
UDP	51821	All nodes	All nodes	Required only for Flannel Wireguard with IPv6
TCP	5001	All nodes	All nodes	Required only for embedded distributed registry (Spegel)
TCP	6443	All nodes	All nodes	Required only for embedded distributed registry (Spegel)

The K3s server needs port 6443 to be accessible by all nodes.
Typically, all outbound traffic is allowed.

Step 1: Install K3S on Master Node

In this tutorial I am using Ubuntu 22.04. If you are using any old version of Ubuntu you may face some issues with iptables. Check more here:

Now

1.0 SSH your Master node (i am using web console)

Run Following Commands on terminal.

1.1. sudo su (for root privileges)
1.2 apt update

1.3. Now Install k3s on master node.

Command: curl -sfL https://get.k3s.io | sh -

1.4 Check Status

systemctl status k3s

Now Get the node token (needed to join worker nodes):

You need this token to securely join worker nodes to the master node (also known as the control plane).

For Example

Authentication

Secure Communication

Cluster Management

Simplified Node Addition

Command
sudo cat /var/lib/rancher/k3s/server/node-token

Step 2: Prepare Worker Node

Same Above we need to create 2 EC2 instances for worker nodes. For this tutorial we have two t3.medium EC2 machine. Now SSH both worker nodes and perform the below tasks:

Install Docker in the both worker machine.

Join the machine in master node using the token.

2.0 Change the host name to Workwer-1 & Worker-2

2.1 Install Docker

Commands:

sudo su
apt update
apt install docker.io -y

2.2 Check Status
systemctl status docker

Worker-1

Worker-2

Step 3: Join Worker Nodes to the Cluster (Master Node)

First get the token form master node. We already collect the token earlier this tutorial. Now to join the nodes in master nodes run this command from worker nodes.

Command
curl -sfL https://get.k3s.io | K3S_URL=https://<MasterNodePublicIP>:6443 K3S_TOKEN=<NodeToken> sh -

Here change the <MasterNodePublicIP> with your EC2 master node Public IP & <NodeToken> with your token from master node.

Worker-1

Worker-2

Now Check the nodes list from master node

Command: kubectl get nodes

Step 4: Now Deploy a JS Game on k3s:

To run an application on K3s, we need to create Kubernetes deployment and service files.

First Create a Namespace

Kubernetes namespace is like a separate section within a Kubernetes cluster, where you can keep your resources organized and isolated from others. Think of it as different folders on your computer. Each namespace (or folder) can have its own set of applications, settings, and permissions, and they won’t interfere with each other.

Command: kubectl create namespace js-game

Now Create Kubernetes Deployment File:

Command: nano js-game-app.yml

Now Copy Paste the code into js-game-app.yml

in the Image line you can update your dockerhub or any image link.

Applying the Manifest

Save this configuration to a file named js-game-app.yml and apply it using the following command: kubectl apply -f js-game-app.yml -n js-game
`
You will see this if everything is work correctly....

Verify the Deployment

To check if the deployment, service, and ingress are created successfully, you can use the following commands:

kubectl get deployments -n js-game

kubectl get services -n js-game

kubectl get ingress -n js-game

Now check the pods running....

Command: kubectl get pods -n js-game

Now open the browser and visit with your Master Node Public IP

Ref:

Docker Image: internaldev/jsgame:latest
YAML File: https://github.com/mimqupspy/k3s-yaml

Elevate Your Experience: Amazon Q, the Next-Gen AI Assistant by AWS at re:Invent 2023 🚀🔮

Mim Ahmed — Wed, 31 Jan 2024 18:24:54 +0000

Recently AWS re:Invent 2023 Was Happened. There are lots of amazing new lunches. But I think I want to share my experience is Amazon Q.

Image Source: AWS

Amazon Q, a new generative AI-powered assistant intended for work, at AWS re:Invent in one of the biggest announcements to date.

What's the Features

Filtering using metadata – Use document attributes to customize and control the end user chat experience. Currently supported only if you use the Amazon Q API.
Source attribution with citations – Verify responses using Amazon Q source attributions.
Upload files and chat – Let end users upload files directly into chat and use uploaded file data to perform web experience tasks.
Quick prompts – Feature sample prompts to inform end users of the capabilities of their Amazon Q web experience.

Users may converse, find solutions to issues, create content, and obtain insight using Amazon Q. Using basic natural language cues, Amazon Q assists business users in completing tasks.

AWS said Amazon Q was trained on 17 years’ worth of AWS knowledge and can be used to ask questions specific to AWS use. It can suggest the best AWS services for a project.

Areas of expertise

Your business

Amazon Q can be tailored to your business by connecting it to company data, information, and systems, made simple with more than 40 built-in connectors.

AWS

Amazon Q is an expert on patterns in the AWS Well-Architected Framework, best practices, documentation, and solution implementations, making it easier and faster for you to explore new services and capabilities, learn unfamiliar technologies, and architect solutions.

Amazon QuickSight

Amazon QuickSight is a unified business intelligence (BI) service built for the cloud that offers interactive dashboards, paginated reports, and embedded analytics, plus natural language querying capabilities.

Amazon Connect

In Amazon Connect, our contact center service, Amazon Q helps your customer service agents provide better customer service.

AWS Supply Chain

Using Amazon Q in Supply Chain (coming soon), inventory managers, supply and demand planners, and others will be able to ask and get intelligent answers about what is happening in their supply chain.

Know More: https://aws.amazon.com/q/

How Amazon Q works

With Amazon Q, you can build an interactive chat application for your organization’s end users, using a combination of your enterprise data and large language model knowledge, or enterprise data only. The following sections outline how Amazon Q works.

Demo

Step 1: Go to your AWS Console and on the right side click on the Q Icon.

Step 2: Let's Learn S3 First🙂
Q1: Ask Q "How to Turn on S3 Versioning"

Here Q Shows me some suggestion.

Q2: How to reduce my EC2 latency issue?

Here Q guide me how to troubleshoot my latency issue.

Q3: Learning about other AWS products

Amazon Q Pricing

During Writing this blog there are 2 Pricing model please check the official Amazon Q Page for latest price.

Link: https://aws.amazon.com/q/pricing

How to Stop Objects from Being Upload to Amazon S3 Without Encryption using Bucket Policies

Mim Ahmed — Wed, 20 Dec 2023 13:42:31 +0000

To prevent uploads of unencrypted objects to Amazon S3, you can enforce encryption at the bucket level or use bucket policies to require server-side encryption. Amazon S3 provides several options for server-side encryption, including Amazon S3 managed keys (SSE-S3), AWS Key Management Service (AWS KMS) keys (SSE-KMS), and customer-provided keys (SSE-C). Here are steps you can take to enforce encryption.

In this article we are going to learn how to do this using Bucket Policies.

Step 1:

Go to your S3 Console & Choose or create a Bucket

Step 2:

Now to go the permission tab and scroll down and choose

Now Click on Policy generator

Now go back policy page and copy the bucket ARN (We Need This Later)

Step 3: Config Bucket Policy

Now Click add Statement & Click Generate Policy

Now Copy the JSON and past it to bucket policy box

In the Resource Line Just add ' /* ' and click save changes. This Means Every Objects in this Bucket.

Now go back Object Tab and upload some files. The upload will failed unless you choose Encryption Options.

Before

After

Conclusion:

Securing your S3 bucket against unencrypted file uploads is a proactive step towards maintaining the integrity and confidentiality of your data. By following the guidelines outlined in this post, you'll be equipped with the knowledge to establish a robust security framework for your AWS S3 bucket. Stay ahead of potential threats and safeguard your data with these essential practices.

AWS Startup Day 2023 in Dhaka, Bangladesh: A Day of Learning and Innovation

Mim Ahmed — Sat, 07 Oct 2023 16:10:52 +0000

On October 5, 2023, at Daffodil Plaza, 4/2 Sobhanbag, Mirpur Road, Dhanmondi, Dhaka-1207, Bangladesh, a momentous event took place—the first-ever AWS Startup Day. This event brought together cloud enthusiasts, startup founders, and tech aficionados eager to explore the boundless opportunities that AWS (Amazon Web Services) offers.

The day was packed with knowledge-sharing sessions, hands-on AWS DevOps, ML/AI workshops, and deep dives into security practices.

One of the standout features of AWS Startup Day was the comprehensive workshop on AWS DevOps, which provided attendees with practical skills and knowledge to efficiently deploy, manage, and scale applications on the AWS platform. The ML/AI workshop delved into the fascinating world of machine learning and artificial intelligence, showing participants how AWS can be leveraged to build intelligent applications.

In addition to technical sessions, the event also focused on the business side of startups. Entrepreneurs learned how to navigate the intricate path of starting a new venture and scaling it to reach new heights.

The highlight of the day was the announcement of AWS credits awarded to three outstanding startups. These credits, $10,000 AWS Activate Credits for Qualified Startup, will enable these startups to host their solutions on AWS and utilize AWS services to tackle complex problems.

The AWS Startup Day in Dhaka, Bangladesh, marked a pivotal moment in the region's tech landscape. It brought together a community of like-minded individuals passionate about technology, innovation, and entrepreneurship. As the day concluded, attendees left with not only newfound knowledge but also a renewed sense of enthusiasm to harness the power of AWS and embark on their startup journeys.

I am Really enjoy to help the participants in the workshop sessions to archive their goal.

Some Glimpses of the Session.

and Lovely Food

List of Workshops

UI/UX/Story - Designing your Startup with FIGMA
App Build - Build your application utilizing Amplify (Presentation and Hands-on Workshop) Link: https://catalog.workshops.aws/amplify-core/en-US/01-introduction
GenAI - Integrate GenAI into your Startup (Presentation and Hands on Workshop) Link:https://catalog.us-east-1.prod.workshops.aws/workshops/972fd252-36e5-4eed-8608-743e84957f8e/en-US/lab1
Integrate AI/ML into your application (Presentation and Hand on Workshop)
Links:
https://docs.aws.amazon.com/sagemaker/latest/dg/canvas-custom-models.html
https://aws.amazon.com/marketplace/b/57003bb6-9ad2-4c4e-89df-018b56a5af17?category=57003bb6-9ad2-4c4e-89df-018b56a5af17
https://aws.amazon.com/personalize/features/?trk=a4abf964-0e19-44b8-87c3-61cfeb2877ed&sc_channel=ps&ef_id=Cj0KCQjw1OmoBhDXARIsAAAYGSH538XNLBk_pa5VQjPE8SR_M-ffacFHCmlilIqvEj6RrKCRswMnB0QaAsTQEALw_wcB:G:s&s_kwcid=AL!4422!3!652868433298!p!!g!!aws%20personalization!19909695542!150385746209
Scaling your application with DevSecOps (Presentation and Hands on Workshop)
Link: https://samin-bjit.github.io/devsecops-in-aws/

Install Java 11 on Amazon Linux 2

Mim Ahmed — Wed, 11 Jan 2023 09:35:31 +0000

First SSH Your Linux Machine

Run the yum update command. Optionally, you can add the --security flag to apply only security updates

Command: sudo yum update

In order to install java 11:

sudo amazon-linux-extras install java-openjdk11

Type "Y" for install packages

Wait until all packages finished install

Check Java Instillation

Command: java -version

Understanding AWS Market Place?

Mim Ahmed — Sat, 05 Nov 2022 08:47:34 +0000

In General Marketplace is a place or platform where you can find Goods or product for buy. Also in market place where vendors can come together to sell their products or services to a curated customer base.

What is AWS Market Place?

AWS market place is virtual place where different vendors and developer sell their software or services which we can use when we build and architect our applications or solutions on AWS.

There are lots of Categories you found when you land on AWS Market Place Site.

For Example,

As you can see below image you can purchase ready-made WordPress Solutions in AWS Market Place. With that you can easily deploy a WordPress site with zero knowledge of Infrastructure.

You can also find lots of Solutions on there.

Visit and Explore AWS Market Place: https://aws.amazon.com/marketplace

Thanks

Amazon EC2 Master Class

Mim Ahmed — Mon, 01 Aug 2022 06:17:54 +0000

In this series of blog I will discuss every key parts of Amazon EC2 that everybody should know.

What is EC2?

So, When you first start your cloud learning journey on AWS you heard the word EC2. But, What is EC2 and what can we do with EC2?

Ok, I will tell you what is EC2. First of all I believe you already know what is a Server.

But here i recap what a server is:

A server is a piece of hardware or software that offers a
service to a client—also known as another computer program—and
its user. The actual computer that a server program runs on is
usually referred to as a server in a data center.

So, EC2 is a virtual server that runs on a cloud providers (AWS) datacenter. That's it. Super cool! 😎

EC2 = Elastic Computing Cloud.

What is the Use of AWS EC2?

EC2 also allows users to build apps to automate scaling according to changing needs and peak periods, and makes it simple to deploy virtual servers and manage storage, lessening the need to invest in hardware and helping streamline development processes.

Next part we will discuss about the key components of AWS EC2 what makes the EC2 great.

If you need to deploy your app on cloud you can knock me

How to Create a VM on Google Cloud With Web Console

Mim Ahmed — Wed, 15 Jun 2022 04:50:45 +0000

Hello, Everyone in this blog i will show you how you can create a virtual machine in Google Cloud.

Step 1: Go to Google Cloud Console: https://console.cloud.google.com

Step 2: Now Click on the Hamburger Menu and Choose Compute Engine and Click VM Instances.

Step 3: If you have a new account click on Enable API

Wait Few Minutes to Enable The API.

After Successfully Enable The API you will see a notification like this.

Step 4: Now Click on Create Instance

Now Click on Create

Wait Some Time after few moments your VM Will Created.

After Successfully created your VM you will get information like this.

You can now access your VM Via SSH.

Thanks

How to fix Error deleting Snapshots on AWS EC2.

Mim Ahmed — Sat, 25 Dec 2021 15:08:26 +0000

Sometimes you have some EBS volume occurring cost but you don't have any EC2 Instance Running.

You May Have Take Snapshot some EC2 Machine and forget later. Let's find out how to fix this.

First Copy The AMI ID.

Now Go TO AMI

Now Search The AMI By The ID and you will found the AMI Snap

Now Delete This Snap.

Click Delete

Now You Can Go Back EBS Snapshots Again and Delete the Volume.

Thanks

Forem: Mim Ahmed

🛡 How to Prevent IAM Password Reuse in AWS

Running Docker Containers on a Read‑Only Root File System

🔐 How to Remove Access Keys from Your AWS Root Account

🔒 Why You Should Remove AWS Root Access Keys

🛠 Step-by-Step: Remove AWS Root Access Keys

✅ Prerequisites

👣 Step 1: Sign in as Root

- Complete MFA if it's enabled (highly recommended).

👣 Step 2: Navigate to Security Credentials

👣 Step 3: Locate the Access Keys

- Keys may be in one of these states: Active, Inactive, or Deleted.

👣 Step 4: Delete the Access Key(s)

💡 Tip: If unsure whether a key is still in use, deactivate it first and observe if anything breaks. If not, proceed with deletion.

How to Install K3S on AWS EC2 & Deploy Simple JS Game 🚀

Before You Start

You need

Hardware Requirements:

1. Minimum Hardware Requirements for Master Node:

2. Minimum Hardware Requirements for Worker Nodes:

We can see we have 3 Instances running

Inbound Rules need to allow for K3s Nodes

Step 1: Install K3S on Master Node

Now Get the node token (needed to join worker nodes):

Step 2: Prepare Worker Node

Step 3: Join Worker Nodes to the Cluster (Master Node)

Now Check the nodes list from master node

Step 4: Now Deploy a JS Game on k3s:

First Create a Namespace

Now Create Kubernetes Deployment File:

Applying the Manifest

Verify the Deployment

Now check the pods running....

Ref:

Elevate Your Experience: Amazon Q, the Next-Gen AI Assistant by AWS at re:Invent 2023 🚀🔮

Amazon Q, a new generative AI-powered assistant intended for work, at AWS re:Invent in one of the biggest announcements to date.

Areas of expertise

Your business

AWS

Amazon QuickSight

Amazon Connect

AWS Supply Chain

How Amazon Q works

Demo

Amazon Q Pricing

How to Stop Objects from Being Upload to Amazon S3 Without Encryption using Bucket Policies

In this article we are going to learn how to do this using Bucket Policies.

Step 1:

Step 2:

Step 3: Config Bucket Policy

Now Copy the JSON and past it to bucket policy box

Before

After

Conclusion:

AWS Startup Day 2023 in Dhaka, Bangladesh: A Day of Learning and Innovation

List of Workshops

Install Java 11 on Amazon Linux 2

First SSH Your Linux Machine

Run the yum update command. Optionally, you can add the --security flag to apply only security updates

In order to install java 11:

Check Java Instillation

Understanding AWS Market Place?

What is AWS Market Place?

Amazon EC2 Master Class

What is EC2?

What is the Use of AWS EC2?

How to Create a VM on Google Cloud With Web Console

How to fix Error deleting Snapshots on AWS EC2.