All posts by Joel Knight

9 Things to Consider When Estimating Time

Often in my career I have to make an estimate about the so-called “level of effort” (LoE) to do a thing.

  • What’s the LoE for me to do a demo for this customer?
  • What’s the LoE for me to help respond to this RFP?
  • What’s the LoE for me to participate in this conference?

The critical metric by which I usually have to measure the LoE is time. People, equipment, venue, materials, and location are rarely ever a limiting factor. Time is always the limiting factor because no matter the circumstance, you can’t just go and get more of it. The other factors are often elastic and can be obtained.

And oh how I suck at estimating time.

As soon as the question comes up, “What’s the LoE for…”, I immediately start to think, ok, if I am doing the work, I can do this piece and that piece, I can read up on this thing and get it done with slightly more time invested, and then yada, yada, yada… it’s done!

What I don’t account for is the human element. The unexpected. The fact that we’re all different and team members will go about their work in their own way. In other words, the soft, non-technical aspects of doing the thing.

Along these lines, here are 9 things that I would be wise to consider when making time estimates in the future.

Continue reading 9 Things to Consider When Estimating Time

Five Functional Facts About AWS Service Control Policies

Following on the heels of my previous post, Five Functional Facts about AWS Identity and Access Management, I wanted to dive into a separate, yet related way of enforcing access policies in AWS: Service Control Policies (SCPs).

SCPs and IAM policies look very similar–both being JSON documents with the same sort of syntax–and it would be easy to mistake one for the other. However, they are used in different contexts and for different purposes. In this post, I’ll explain the context where SCPs are used and why they are used (and even why you’d use SCPs and IAM policies together).

Read on, dear reader!

Continue reading Five Functional Facts About AWS Service Control Policies

Five Functional Facts about AWS Identity and Access Management

This post is part of an open-ended series I’m writing where I take a specific protocol, app, or whatever-I-feel-like and focus on five functional aspects of that thing in order to expose some of how that thing really works.

The topic in this post is the AWS Identity and Access Management (IAM) service. The IAM service holds a unique position within AWS: it doesn’t get the attention that the machine learning or AI services get, and doesn’t come to mind when buzzwords like “serverless” or “containers” are brought up, yet it’s used by–or should be used by–every single AWS customer (and if you’re not using it, you’re not following best practice, tsk, tsk) so it’s worthwhile to take the time to really get to know this service.

Let’s begin!

Continue reading Five Functional Facts about AWS Identity and Access Management

AWS ABCs – Network Building Blocks

Given that my technical background is largely in the networking space (exhibit A, exhibit B, exhibit C(CIE)), one of the first things I tried to wrap my head around when being introduced to AWS is how networking works in the AWS cloud.

What I attempted to do was build a mental model by relating cloud networking constructs such as Virtual Private Cloud (VPC), subnets, and routing tables to on-prem, physical networking constructs. This worked pretty well but I did get tripped up at times because some of these constructs don’t map exactly one-for-one.

This post will explain the mental model I used while also calling attention to the elements or behaviors that don’t map exactly between on-prem and AWS.

Continue reading AWS ABCs – Network Building Blocks

AWS ABCs – Can I Firewall My Compute Instances?

In a previous post, I reviewed what a public subnet and Internet Gateway (IGW) are and that they allowed outbound and inbound connectivity to instances (ie, virtual machines) running in the AWS cloud.

If you’re the least bit security conscious, your reaction might be, “No way! I can’t have my instances sitting right on the Internet without any protection”.

Fear not, reader. This post will explain the mechanisms that the Amazon Virtual Private Cloud (VPC) affords you to protect your instances.
Continue reading AWS ABCs – Can I Firewall My Compute Instances?

AWS ABCs – EC2 Internet Connectivity

So, you’ve created a compute instance (ie, a virtual machine) on Amazon EC2. Next question: does the instance require access to and/or from the Internet?

Protip: just because you created the instance in the public cloud, i.e. the cloud that you get to over the Internet, it doesn’t mean that your instances all need to sit on the Internet. They can have direct inbound and outbound Internet access, no Internet access, or something in between (which I’ll explain).

The basic building block for networking on AWS is the VPC (Virtual Private Cloud). Within a VPC, you define your IP space, gateways, ACLs, DHCP options, and more. Gateways will be the focus of this article. Continue reading AWS ABCs – EC2 Internet Connectivity

AWS ABCs – Logging Into a New EC2 Instance

Ok, you’ve just launched an Amazon EC2 instance (ie, a virtual machine) and you’re ready to login and get to work. Just once teeeensy problem though… you have no idea how to actually connect to the instance!

This post will walk through how to log into brand new Linux/BSD and Windows instances (the steps are slightly different for different OS families). Continue reading AWS ABCs – Logging Into a New EC2 Instance