How to enforce a security baseline for an AWS WAF ACL across your organization using AWS Firewall Manager

Post Syndicated from Omner Barajas original https://aws.amazon.com/blogs/security/how-to-enforce-a-security-baseline-for-an-aws-waf-acl-across-your-organization-using-aws-firewall-manager/

Most organizations prioritize protecting their web applications that are exposed to the internet. Using the AWS WAF service, you can create rules to control bot traffic, help prevent account takeover fraud, and block common threat patterns such as SQL injection or cross-site scripting (XSS). Further, for those customers managing multi-account environments, it is possible to enforce security baselines for AWS WAF access control lists (ACLs) across the whole organization by using AWS Firewall Manager.

In a previous AWS Security Blog post, there is a good explanation about how to create Firewall Manager policies to deploy AWS WAF ACLs across multiple accounts. In addition, this AWS Architecture Blog post goes deeper, describing operating models for web applications security governance in Amazon Web Services (AWS). This post will show, in a central or hybrid operating model, how to create a policy to enforce a security baseline in your AWS WAF ACLs while still allowing application administrators or developers to apply specific ACL rules for their particular use case.

Centrally manage firewall policies

It’s a common scenario that a security team in an organization wants to implement a security baseline, consisting of a set of rules, across multiple applications that are distributed in multiple accounts. Those rules are not always applicable for all workloads because different applications might have different needs for protection or exposure to the public. Furthermore, sometimes local teams responsible for managing applications have permissions to create their own rules and decide not to follow policies mandated by the organization.

AWS Firewall Manager solves this problem by allowing you to centrally configure and manage firewall policies, deploy preconfigured AWS WAF rules across your organization, and automatically enforce them in existing and newly created resources.

The following architecture diagram describes how you can design a Firewall Manager policy from a central security account, establishing a security baseline that will be enforced within other member accounts in your organization. To do so, you create a managed AWS WAF ACL with the first and last group rules not editable, but allowing a custom rule group to be modified by administrators of member accounts.

Figure 1: AWS Firewall Manager enforcing security baseline for AWS WAF

Figure 1: AWS Firewall Manager enforcing security baseline for AWS WAF

Firewall Manager delegated administrators

At the time of writing this post, Firewall Manager supports up to 10 administrators who can manage firewall resources in your organization by applying scope conditions. For example, you can define an administrator for specific accounts or even a complete organization unit (OU), AWS Region, or policy type. Using this feature, you can enforce the principle of least privilege access, in addition to assigning administrators to enforce security baselines for your AWS ACL rules across your organization in a more granular way. This delegation needs to be completed from the AWS Organizations management account, as shown in Figure 2.

Figure 2: AWS Firewall Manager administrator account delegation

Figure 2: AWS Firewall Manager administrator account delegation

Firewall Manager policies

A Firewall Manager policy contains the rule groups that will be applied to your protected resources. The service creates a web ACL in each account where the policy is enforced. Account administrators can add rules or rule groups to the resulting web ACL in addition to the rules groups defined by the Firewall Manager policy.

Rules groups

AWS WAF ACLs that are managed by Firewall Manager policies contain three sets of rules that provide a higher level of prioritization in the ACL. AWS WAF evaluates rule groups in the following order:

  1. Rule groups that are defined in the Firewall Manager policy with the highest priority
  2. Rules that are defined by the account administrator in the web ACL after the first rule group
  3. Rule groups that are defined in Firewall Manager to be evaluated at the end

Within each rule set, AWS WAF evaluates rules according to their priority settings, evaluating the rules from the lowest number up until either finds a match that terminates the evaluation or exhausts all of the rules.

Security baseline policy

Figure 3 shows an example of a Firewall Manager policy that will serve as the security web ACL baseline across your organization. This policy should be created in a delegated administrator acco­­unt and enforced across all or specific accounts in your organization where the administrator has permissions. Refer to the service documentation for additional guidance on setting up this type of policy.

Figure 3: AWS Firewall Manager policy rules acting as the security baseline

Figure 3: AWS Firewall Manager policy rules acting as the security baseline

First rule group

The first rule group in the policy will contain the following:

  • Organization-level blocked list – Known bad IP addresses by organization.
  • AWS IP reputation list – Recommended AWS managed rules for IP addresses with a bad reputation.
  • AWS Anonymous IP list – Recommended AWS managed rules for anonymous IP addresses.
  • Organization-level rate limit – A high-level rate limit defined by the organization.

Last rule group

The last rule group in the policy will contain the following:

  • Organization-level allowed list – Even if these are well-known IP addresses, they still need to be evaluated against the set of rules enforced by the organization and specific rules per application. If a “good” IP address is supplanted, it might hide the real source identity, bypassing AWS WAF rules.
  • AWS bot control – Recommended if you want to enforce bot control across your organization or a set of accounts managed by an administrator.

This configuration will allow individual account administrators to define and include their own rules to protect applications based on specific use cases and the expected number of requests.

When designing your own security baselines, take into consideration that some managed rules, such as bot control, might have additional cost, and enforcing them across your organization would increase the overall cost of the service.

Policy scope

The policy scope for your security baseline defines where the policy applies. It can apply to all accounts and resources in your organization or just a subset of accounts and resources. Based on the settings selected, Firewall Manager will apply policy for accounts in scope by using the following options:

  1. All accounts in your organization
  2. Only a specific list of accounts and organization units
  3. All accounts and OUs except a specific list of those to exclude

On the other hand, when selecting the scope for resources, you can use the following options:

  1. All resources
  2. Resources that have all of the specified tags
  3. All resources except those that have all the specified tags

For delegated administrators, scope definition will apply only for accounts, Regions, or OUs defined during the delegation process. Figure 4 shows an example of the scope definition for a policy.

Figure 4: Firewall Manager scope definition

Figure 4: Firewall Manager scope definition

Use case–specific rule groups

Figure 5 is an example of a specific use case, where AWS WAF administrators in a member account within the Firewall Manager policy scope want to protect their web application by using the following rules.

Figure 5: Web ACL managed by Firewall Manager containing rules in a member account

Figure 5: Web ACL managed by Firewall Manager containing rules in a member account

Middle rule group

The middle rule group is configured in each account within the ACL deployed by Firewall Manager. The examples from Figure 5 are rules oriented to apply protection that is specific for the application where the ACL is assigned:

  • App-level blocked list – Known IP addresses blocked by the administrator.
  • App-level rate limit – The rate limit supported by the application.
  • Core rule set – The recommended rule set, focused on OWASP Top Ten vulnerabilities.
  • Technology-specific protection – An example for PHP applications.
  • App-level allowed list – Well-known IP addresses that still need to be evaluated against some rules but bypass others, such as fraud prevention.
  • Account takeover prevention – This managed rule needs specific configuration per application to work as expected. However, it is recommended that you use it after the bot control managed rule to optimize cost. Take that into consideration when building your own security baseline.

This rule group will be second priority between the first and the last rule groups coming from the Firewall Manager policy. This configuration provides account administrators the ability to design their set of rules to cover the specific use case for their application and also the possibility to override rules evaluated in a lower priority (last rule group). For example, having a higher rate limit in the app-level rule than the org-level rule would have no impact on the traffic being filtered, since the org-level rule in the first group of the policy will have priority. However, having more granular bot control rules at the app-level will supersede the org-level rules contained in the last group of the policy. Take that logic into consideration when you decide which rules need to be in the first and last groups of your Firewall Manager policies.

Recommended approach for testing

Before you deploy your web ACL implementation for production, test and tune it in a staging or testing environment until you are comfortable with the potential impact on your traffic. Then, test and tune the rules in count mode with your production traffic before enabling them.

  1. Prepare the environment for testing:
    1. Enable logging and web request sampling for your ACL.
    2. Set the protection to count mode.
    3. Associate the ACL with a resource.
  2. Monitor and tune in the test environment:
    1. Monitor traffic and rules matching by using logs, metrics, the dashboard, or sampled requests.
    2. Configure mitigation rules such as false positive, matching, scope-down, and label match.
  3. Enable protection in production:
    1. Remove any additional rules that are no longer needed.
    2. Enable rules in production accounts.
    3. Closely monitor your application behavior to be sure requests are being handled as expected.

Cleanup

To avoid unexpected charges in your accounts, delete any unnecessary policies and resources. You can do that from the console by following these steps.

  1. On the Firewall Manager policies page, choose the radio button next to the policy name, and then choose Delete.
  2. In the Delete confirmation box, select Delete all policy resources, and then choose Delete again.

AWS WAF removes the policy and any associated resources, like web ACLs, that it created in your account. The changes might take a few minutes to propagate to all accounts.

Conclusion

By using Firewall Manager, you can take advantage of native cloud features to enforce security baseline configurations for your AWS WAF rules in a multi-account environment across your organization. It is possible to centrally design policies with broad rule groups to protect workloads from a high-level perspective while allowing application administrators to design custom rules to protect, for instance, web applications from specific use cases such as OWASP Top Ten or technology-related vulnerabilities.

The examples provided in this post can be further customized and adapted to align with your organization’s needs. Design policies to comply with security requirements and specific use cases to protect your workloads.

If you want to learn more, visit the Automations for AWS Firewall Manager webpage, which provides a solution with preset rules to create a quick security baseline to protect against distributed denial of service (DDoS).

 
If you have feedback about this post, submit comments in the Comments section below. If you have questions about this post, contact AWS Support.

Want more AWS Security news? Follow us on X.

Omner Barajas

Omner Barajas

Omner is a senior security specialist solutions architect based in Mexico, supporting customers in LATAM. He usually collaborates with account teams to help clients accelerate cloud adoption and improve security posture for their workloads, resolving complex technical challenges related to cybersecurity and compliance with international standards and regulations.

Security updates for Thursday

Post Syndicated from jake original https://lwn.net/Articles/973071/

Security updates have been issued by AlmaLinux (ansible-core, avahi, bind, buildah, containernetworking-plugins, edk2, fence-agents, file, freeglut, freerdp, frr, git-lfs, gnutls, golang, grafana, grafana-pcp, gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, harfbuzz, httpd, ipa, libjpeg-turbo, libnbd, LibRaw, libreswan, libsndfile, libssh, libtiff, libvirt, libX11, libXpm, mingw components, mingw-glib2, mingw-pixman, mod_http2, mod_jk and mod_proxy_cluster, motif, mutt, openssl and openssl-fips-provider, osbuild-composer, pam, pcp, perl, pmix, podman, python-jinja2, python-jwcrypto, python3.11, python3.11-cryptography, python3.11-urllib3, qemu-kvm, qt5-qtbase, runc, skopeo, sssd, systemd, tcpdump, tigervnc, toolbox, webkit2gtk3, xorg-x11-server, xorg-x11-server-Xwayland, and zziplib), CentOS (firefox, grub2, kernel, squid, thunderbird, tigervnc, and xorg-x11-server), Debian (chromium, glib2.0, python-idna, webkit2gtk, and wordpress), Fedora (freerdp, freerdp2, and pypy), Mageia (chromium-browser-stable, exfatprogs, freeglut, libtiff, libvirt, libxml2, openpmix, php-tcpdf, ruby, tpm2-tools, tpm2-tss, traceroute, and zziplib), Oracle (bind, buildah, git-lfs, gnutls, golang, grafana, grafana-pcp, libreswan, libvirt, libxml2, mod_http2, podman, python-jwcrypto, skopeo, sssd, and tigervnc), Red Hat (nodejs:18, nodejs:20, and squid:4), and SUSE (avahi, ghostscript, go1.21, go1.22, python-pymongo, python-Werkzeug, and sssd).

Layered Defense to Stop Attacks Before they Begin

Post Syndicated from Dina Durutlic original https://blog.rapid7.com/2024/05/09/layered-defense-to-stop-attacks-before-they-begin/

Layered Defense to Stop Attacks Before they Begin

Ransomware has evolved from opportunistic attacks to highly orchestrated campaigns driven by cyber criminals who are seeking high financial gains.

Ransomware-as-a-Service has increased due to its lowered barrier to entry, allowing even those with limited technical expertise to launch devastating attacks with relative ease. Big game hunting has made a comeback, targeting high-value organizations – such as large enterprises – to maximize ransom payouts. The introduction of triple extortion represents a chilling escalation in tactics and demands. Attackers will encrypt files and demand payment for their decryption not just once, twice, but sometimes three times. Malicious actors execute additional attacks to coerce victims into giving more money or forcing them to comply with the attacker.

Security teams understandably have a lot that keeps them up at night, but that’s where a trusted partner can help! We’re excited to announce the expansion of our leading managed detection and response (MDR) service, Managed Threat Complete, to include Ransomware Prevention.

Rapid7’s Ransomware Prevention provides a robust, patented preemptive solution to stop attacks before they begin. Coupled with the expertise of the Rapid7 MDR team, this additional layer of protection now extends comprehensive coverage end to end.

Don’t Give Malware a Chance with Ransomware Prevention

Ransomware Prevention provides security teams a robust solution leveraging Minerva technology to stop attacks before they begin. This patented technology is an additional layer of protection on the endpoint designed to disrupt malicious actors and prevent ransomware attacks. It provides customers with dedicated ransomware prevention engines that reinforce at each stage of an attack to strengthen defenses and minimize exposure.

Layered Defense to Stop Attacks Before they Begin

Full Coverage from a Single, Trusted Partner

Leveraging this new functionality, we take a more proactive approach to security operations. By unifying relevant exposure management, external threat intelligence, and now prevention capabilities, we are able to get ahead of risk and eliminate breaches earlier.

With Rapid7, customers can feel confident they are covered before, during, and after an attack. Our team of industry experts not only provides transparent service, but they also drastically reduce the risk of ransomware actors succeeding by mitigating attacks in early stages prior to ransomware deployment.

Our Incident Response team spends far fewer hours per incident than the industry average due to:

  • Continuous monitoring through MDR
  • Rapid remote containment of minor incidents
  • Early detection of events
  • Remediation support through the SOC and Customer Advisors

Differentiating on the Endpoint

Rapid7 is continuously working with our customers with the goal of providing differentiated endpoint solutions and capabilities. You can learn more about how Rapid7 protects endpoints here.

По буквите: Ю Хуа, Карабашлиев, Попов

Post Syndicated from Зорница Христова original https://www.toest.bg/po-bukvite-yu-hua-karabashliev-popov/

„Китай в 10 думи“ от Ю Хуа

По буквите: Ю Хуа, Карабашлиев, Попов

превод от китайски Стефан Русинов, Пловдив: изд. „Жанет 45“, 2024

Възможно ли е да разкажем история, в която не сме морално безукорни?
Например история, в която – макар и деца – харесваме един масов убиец, потънали сме изцяло в култа към личността му?

Можем ли да разкажем как сме бързали към мястото на екзекуцията на някой невинен, за да изпреварим тълпата? Да опишем краткия път от набеждаването до смъртта, до опозоряването, да опишем как това е сполетяло бащата на наш съученик и за малко е отминало собствения ни баща (с цената на публична семейна самокритика), да опишем всичко това „пред чужденците“ – и да не се самопоставим в ролята на жертва?

Китайският писател Ю Хуа го прави. Поставил си задачата да опише

Китай „в десет думи“ – народ, лидер, четене, писане, Лу Сюн, неравенство, революция, низовци, менте, баламосване –

той замества дефиницията на всяка от тях със серия от истории.

В „Народ“ описва как като малък е направил „откритието“, че „председателят Мао е народът и народът е председателят Мао“ – и полусмешните перипетии как страдал, че първо не му давали да го повтаря, а после не му признавали авторството. До истинското усещане за „народ“ по време на студентските вълнения на „Тиананмън“ – и липсващата днешна памет за тях.

В „Лидер“ се разказва как Мао участвал в ритуално преплуване на река – и как неговото „помахване по хавлия“ се запечатало в съзнанието на хората, за разлика от всички днешни „лидерства“ в света на технологиите, перилните препарати и какво ли не още. Погледнато отстрани, изглежда абсурдистко; напушва те смях при представата за тавана на стаята, облепен с вестници, от които ежедневно те гледат огромни портрети на вожда. Звучи абсурдистко, докато не си спомниш за Георги Димитров и образа му в „Работническо дело“ или пък за „димитровската“ организация „Септемврийче“. 

По буквите: Ю Хуа, Карабашлиев, Попов

А Ю Хуа продължава да разказва. Разказва например за липсата на книги по време на Културната революция – как всичко освен Мао и любимия му писател било обявено за реакционно и как по случайност попаднал на неизмеримо богатство – книга на същия този Лу Сюн, но с бележки под линия, които разкривали необичаен, различен свят (докато се смея, се сещам как разни книги се появиха препечатани „под индиго“ в първите години на перестройката). А източник на любовни истории се оказват саморъчно направените плакати, с които бдителни граждани разобличават разни прелюбодейци. Анекдотично? Може би, но не и непредставимо, ако сте виждали глад за клюки в малка общност.

А историите продължават – и никоя от тях не е непредставима, не само по хоризонталните линии на общата комунистическа история. Защото Ю Хуа прави още по-смела връзка: той демонстрира, че срез, прекъсване, край и тотално ново начало няма не само в географията, а и в историята. Тоест той отказва да представи Културната революция като явление от екзотичната страна на миналото, като нещо несводимо с днешен Китай и неговото икономическо чудо. Напротив, той казва, че едното и другото имат обща същина – и само различни проявления. Че това е същата енергия, която се е разляла по други канали. Доста смелост и писателска проницателност се искат, за да пишеш така.

„Рана“ от Захари Карабашлиев

София: изд. „Сиела“, 2023

Романът „Рана“ има за цел да възстанови изтритата история на Добруджа, по-точно неудобната история на боевете за Добруджа по време на Първата световна война. Веднага казвам, че тази тема е персонално важна за мен; още повече че протагонистът на книгата е бежанец от Одринска Тракия, също като моя прадядо.

За историята на Добруджа в училище не сме учили нищо – от това се подразбираше, че и нищо не се е случило, което моят детски ум си обясняваше с липсата на планини, в които да се крият шумкари. Разбира се, голямото изключение е Йовков, който има изключително подробни описания, включително на социалната тъкан на собствения ми град; но военните разкази, които се учеха („Последна радост“), не внасяха особени нюанси в познанията ни по политическа история. Врагът беше… зададеният по условие в цялата историческа парадигма, тоест турците.

Война, в която враг са румънци и руснаци, а съюзници са германци и турци, не се учеше. Отгласи от ожесточеността на тази война видях едва по-късно, когато от любопитство изчитах в интернет историята на селата, през които бях минавала безброй пъти, и внезапно се оказваше, че населението на „скучния“ Стожер е било избито почти до крак. Разбира се, устно разказани спомени се срещаха обилно, но по-късни, от обмена на населението след освобождението на Южна Добруджа. Причината цялата тази история да бъде изличена е проста – комунистическа България, както и комунистическа Румъния са сателити на СССР, така че не може да се разкаже сюжет, в който те да са врагове.

Целта на „Рана“ на Захари Карабашлиев е да запълни липсата на този разказ. Тоест да използва жанра на историческата фикция, за да излекува колективната амнезия и да даде на националното въображение запомнящ се сюжет, с който боевете за Добруджа да станат част от българската представа за миналото. Това е извънредно амбициозна задача, бих казала – архетипната задача в българската литература от Вазов насам.

По буквите: Ю Хуа, Карабашлиев, Попов

Нейният успешен изход обаче е свързан с няколко фактора. Първо, доколко плътен, богат, убедителен е литературният материал. А тази плътност като че ли не търпи прекалена идеализация, нито прекалена пасторалност в одринските села, нито пък накъдреност на градския образ на софийското студентство. Не знам и доколко моделът „детето пита – възрастният се замисля“ е достатъчен за въвеждане на толкова страници „родови контекст“ за героя.

Другото, което бих пожелала, е по-убедителен противник. Периодично книгата „обръща“ гледната точка, за да ни разкаже как вижда нещата един румънски офицер – само дето неговата морална оценка практически не се различава от българската. В неговите очи българите са успели, защото са се били на своя земя за своя земя. Тоест ние си представяме враг, който си представя (и приема) нашата гледна точка. Това може и да е възможно, но не води до реално многогласие на романа.

Това, разбира се, ни най-малко не означава, че не стискам палци на книгата

Изличаването на историческата памет е тема, която е твърде болезнена – особено на фона на международните политически събития, които връщат в обращение изрази като „съда на историята“.

Изтриването на страници от тази история значи, че този съд също е подкупен, податлив на натиск – тогава какво? Лечението от колективна посттравматична амнезия не е лесна работа: ако историята е твърде сложна, няма да има масов ефект; ако е твърде проста, няма да е вярна.

„Лични спомени от живота и дейността на Яни Д. Рододарович от Лозенград“ от Иван Н. Попов

София, 1928 г.

Третата книга, за която искам да разкажа, не отговаря на правилото да е публикувана през последната година. Отклонението е, меко казано, безсрамно: „Лични спомени от живота и дейността на Яни Д. Рододарович от Лозенград“ е излязла през 1928 г., тоест преди 96 години. Автор е някой си Иван Н. Попов, а неговата идея е приблизително същата – да спаси една част от българската колективна история от забрава.

По буквите: Ю Хуа, Карабашлиев, Попов

Иван Н. Попов има предимството да скицира от натура; и понеже няма никаква литературна претенция – да не додава много литературни модели, а да описва онова, което самия него го е впечатлило.

И каква смешна и пъстра картина на Одринска Тракия се е получила!

В нея виждаме самия Рододарович, пътуващ книжар, който покрай другото разпространява и патриотична литература; виждаме огромния калъф на неговото оръжие, носено, за да всява респект по пътищата, но виждаме и как при вадене то се разпада на части, защото всъщност е само практически неупотребим реквизит; чуваме къде се използва български, къде гръцки и къде турски и между кои точно езици е напрежението; виждаме войната между българските и гръцките кокони и кой при кого би отишъл на кафе; виждаме как горят резбованите врати на харема, хвърлени на огъня от разквартируваните в конака руски части.

Виждаме, през сълзи и смях, историята на местния поп, който първо участвал в таен революционен комитет, после задигнал парите, после се помохамеданчил и оженил за богата ханъма, после задигнал и нейните пари и избягал в Цариград; пък накрая, след пристигането на българските войски по време на Балканската война, решил да си изпроси пенсия като революционер, препатил повече от всички останали – нали по стечение на обстоятелствата се наложило да бъде обрязан… Неподправеното богатство на лозенградската история, предадено от Иван Н. Попов, съдържа очарованието на устния разказ и онази смесица от смях и трагизъм, от високо и ниско, която прозира и в най-добрите страници от нашата революционно-историческа класика. А явно и в самата тъкан на историята.

„Лични спомени от живота и дейността на Яни Д. Рододарович от Лозенград“ може да се намери в „Книжен пазар“ и в Националната библиотека.

 Активните дарители на „Тоест“ получават постоянна отстъпка в размер на 20% от коричната цена на всички заглавия от каталозите на „Жанет 45“ и няколко други български издателства в рамките на партньорската програма Читателски клуб „Тоест“. За повече информация прочетете на toest.bg/club.

В емблематичната си колонка, започната още през 2008 г. във в-к „Култура“, Марин Бодаков ни представяше нови литературни заглавия и питаше с какво точно тези книги ни променят. Вярваме, че е важно тази рубрика да продължи. От човек до човек, с нова книга в ръка.

До Болоня и назад – с „радост, тъга и надежда“

Post Syndicated from original https://www.toest.bg/do-bolonya-i-nazad/

Разговор със Свобода Цекова и Антон Стайков

До Болоня и назад – с „радост, тъга и надежда“

Антон Стайков и Свобода Цекова работят в сферата на визуалните изследвания и дизайна. Те са автори и куратори на няколко отличени книги и изложби, между които „Българският буквар. 200 години в първи клас“ (2015) и „Отвъд картините. За изкуството и живота на Борис и Славка Деневи“ (2021). Автори са и на концепцията и дизайна на българския павилион и изложбата на илюстраторите на 61-вия Международен панаир на детската книга в Болоня. Това е и поводът да разговаряме с тях.

Каква беше книжната селекция тази година и на какъв принцип се основаваше изборът на автори?

Антон Стайков: Книжната селекция направиха Вал Стоева, Зорница Христова и Кристина Тужарова. Тя включва заглавия от последните десет години, селекция с нови книги, както и такива, влезли през годините в селекцията на Тhe White Ravens.

За съжаление, не се размина и без лек скандал – от Асоциация „Българска книга“ (АБК) възразиха официално именно срещу кураторския принцип при подбора. Макар и да сте подизпълнители и да нямате пряка връзка с конфликта, все пак може би имате поглед – как и дали се разреши в крайна сметка той?

Антон Стайков: Не можем да говорим за динамиките в АБК, защото просто нямаме вътрешен поглед. Бяхме поканени от организаторите – Асоциация „Книжовност и култура“, за да направим нещо съвсем конкретно, а именно да бъдем куратори на изложбата на илюстраторите и да създадем концепцията и дизайна на щанда. От самото начало в този проект селекцията е заложена като принцип на работа и като такъв той е финансиран от Национален фонд „Култура“, Министерството на културата и Столичната програма „Култура“. Това важи както за изложбата, така и за книжната селекция. Сигурно тук е добре да кажем, че всеки, приел ролята да бъде куратор, особено когато става дума за промяна на инертна практика, е поел риска да бъде атакуван.

Свобода Цекова: Когато се случи нещо толкова хубаво, е много жалко да започнем с негативен знак. Отзивите говорят, че щандът на България тази година беше успех, и то голям. Въпреки обстоятелствата той произведе планирания резултат – българските детски книги и илюстраторите им бяха забелязани, беше привлечена многобройна публика, добавеното съдържание в сайта на проекта BooksForKids.bg удължи този ефект и осигури възможности за устойчивост. Освен това беше разбита порочната традиция българските участия да имат вид на търговски сергии с някоя друга картинка, понякога с трикольор и шевица, понякога без. Щандове, които не вършат добра работа нито за имиджа на страната ни, нито за осъществяването на успешни контакти и договори.

Още с откриването започнаха положителните реакции както от страна на организаторите в Болоня, така и от представители на национални щандове, на големи и малки издателства, на художници и литературни агенти. А когато на втория ден качихме кратко видео с щанда във Facebook, се получи вълна от възторжени отзиви и в България. Между тях със сигурност е имало и негативни, но доминиращите бяха ентусиазирани.

Но е истина също така, че този „лек скандал“ отваря други важни теми и те са по-големи от участието на България в книжните панаири по света и конкретно в Болоня. Теми като тези за идентичността, експертността, дългосрочните културни политики на страната ни. И не на последно място – темата за вкуса…

Разкажете ни малко повече за концепцията на щанда.

Свобода Цекова: Съобразно ограниченията на бюджета измислихме максимално икономична, сдържана, но ефикасна формула за представяне на продуктите и за функционална комуникация с издателите и гостите на панаира. Всички елементи бяха изработени в България и пренесени в Болоня. За монтажа на място бяхме целият малък, но мотивиран екип. Разполагахме с 64 кв.м и с наличната модулна система на панаира. Взехме решение да работим с черна основа, така че книгите и илюстрациите да бъдат акцент. Разделихме пространството на щанда в три основни зони, като ги планирахме така, че да си взаимодействат. Вляво – книжната селекция с масите за срещи, вдясно – изложбата, отново с място за сядане и разглеждане на 25-те книги, от които бяха фрагментите в изложбата. Между тези две зони стоеше модул с българските книги, влезли през годините в престижната книжна селекция The White Ravens, класически български издания, повечето от 70-те.

В средата на павилиона, до info point, където бяха и каталозите, направихме голямоформатна композиция с мечето на Кирил Златков от „Когато искам да мълча“ – една, според нас, от най-хубавите илюстровани книги през последните години, и лястовичето от „Майчина сълза“ на Любен Зидаров, белязала няколко поколения български деца. Тези многократно увеличени, изрязани картонени фрагменти, алюзия за поп-ъп книжка или детски хартиен театър, бяха сърцето на щанда. Към тях добавихме цветни „пръчици“ – абстрактен образ за книги. В работата с текста комбинирахме блоков и серифен шрифт (от fontfabric, които станаха партньори на проекта).

До Болоня и назад – с „радост, тъга и надежда“
До Болоня и назад – с „радост, тъга и надежда“
До Болоня и назад – с „радост, тъга и надежда“
До Болоня и назад – с „радост, тъга и надежда“

© Свобода Цекова

Антон Стайков: Локацията на българския павилион беше в дъното на една от основните панаирни зали, но с добра видимост и подстъп откъм пиацата за събития и входа в съседство с големите павилиони на Китай и Гърция. За да уловим потока от посетители, направихме върху двете странични стени композиции от същите елементи, като към тях добавихме още две илюстрации – на Мила Янева-Табакова и Люба Халева.

В селекцията присъстваха детски книги от последните десет години. Това достатъчно дълъг период ли е за значителна трансформация в естетиката на детската книга? Какво според Вас най-вече се е променило в поднасянето на текстовете и илюстрациите, които оформят едно издание за деца?

Антон Стайков: Десет години не е дълъг период. Като световна тенденция може би промяната е в по-свободното отношение към образността. Съчетаването на всевъзможни техники, по-разнообразното композиране на илюстрациите и текста в книжното тяло. Правят се повече експериментални издания, лимитирани книги със специални хартии и печат. Като че ли и тематичният спектър е по-богат и нюансиран.

Свобода Цекова: Наблюдава се и един доста интересен феномен – илюстрацията все повече заприличва на съвременна живопис, а съвременната живопис – на илюстрация. Може би е така, защото това размиване на жанровете се случва във всички сфери на изкуството. Иначе, когато говорим за илюстровани книги (picture books) и тихи книги (silent books), все по-често художниците са и автори на книгите. И у нас също има такива примери, но не са много.

След Болоня изложбата „Радост, тъга и надежда. 25 български илюстратори на детски книги“ ще пътува и в няколко града у нас. Има ли общ почерк между подбраните имена, или напротив – те са изключително самобитни и търсени като такива?

Антон Стайков: От самото начало и в каталога, и в изложбата поясняваме, че това не е класация от типа „най-доброто от…“. Искахме селекцията да е разнообразна и нещата да стоят добре в твърде близкото си съседство на панаирния щанд. Представяме и по-малко известни имена наред с утвърдени и награждавани илюстратори. Авторите са от различни поколения, някои са учили в България по времето на социализма, други – след, трети – в специализирани академии по света.

Изложбата е изградена от увеличени фрагменти от илюстрации. Тези своеобразни аватари са композирани така, че да образуват смислови и визуални връзки помежду си. Те са един вид портали към добавеното съдържание. Под всяка илюстрация е името на художника и QR код, който отвежда към неговия индивидуален профил в сайта на проекта BooksForKids.bg с галерия, кураторски текст, техническа информация за изданието, биография и контакти на илюстратора, както и каталог за изтегляне. Има и уводно табло, което дава контекст и насочва посетителите към отделните акценти. Цялото съдържание на изложбата, каталога и сайта беше преведено на английски от Трейси Спийд. Когато имаш ограничение в броя на авторите, финалният избор не е лесен.

До Болоня и назад – с „радост, тъга и надежда“
До Болоня и назад – с „радост, тъга и надежда“
До Болоня и назад – с „радост, тъга и надежда“

А можем ли да говорим за господстващ художествен стил в детската илюстрация днес – у нас и изобщо? И съществуват ли национални специфики?

Антон Стайков: Не мисля. Поне аз не бих могъл да откроя такъв. Има завръщане към естетиката от 60-те – 70-те, има завръщане към аналоговото. Някои декоративни стилове – аз ги наричам хипстърски – могат да бъдат видени масово. Обяснението ми е, че до голяма степен този занаят се е глобализирал, мрежи като Pinterest и професионалния Behance дават достъп на всеки илюстратор до всичко, което се прави днес.

Илюстраторите вече работят за издателства по цял свят. Винаги е имало цайтгайст. Но все пак, когато гледаш мексикански, бразилски или други латиноамерикански издателства, не може да не забележиш по-интензивните гами, силните контрасти, характерната за тях експресия. Такива специфики като че ли могат да се видят сред по-големи езикови територии или държави.

В случая говорим по-скоро за глобални и локални тенденции, нали така? Но какво представлява кичът в контекста на детската книга: локален феномен ли е, допустим ли е, търсен ли е дори от част от публиката, съзнателен избор на издателите ли е понякога и какво му противостои?

Антон Стайков: Това е сериозен проблем в детското книгоиздаване у нас. Има много издания, които са направени по схема и са маскирани като „харесвани от децата“. Крещящата шарена книга с глупави герои и истории не просто подценява детето, ами може и да му навреди. Първите срещи с книгите имат много други важни роли, освен да забавляват.

Криворазбраното „национално“ често присъства в такива книги, него също спокойно можем да наречем кич. Но в ситуацията на свободния пазар не може да забраним на когото и да било да издава книги само заради това, че те не ни харесват. Решението на проблема, още веднъж, е в доброто образование и в качествената оперативна критика, каквато без целенасочена държавна подкрепа няма как да просъществува.

Свобода Цекова: Ролята и отговорността на възрастните е на първо място – не е маловажно каква книга ще купиш на детето си, как ще му я представиш чрез авторитета си на родител, близък, учител. Когато критериите в едно общество са ниски, в комбинация с бедността, се отваря ниша за некачествени продукти. Някои издатели се възползват от ситуацията, други изобщо не осъзнават, че се намират в зоната на кича.

А ако говорим за послания, променила ли се е като цяло етиката на съвременните детски истории – доколко днес поуката и ясните морални координати са неизменна част от тях, така както в класическите приказки?

Свобода Цекова: Според мен сме свидетели на крайности. Има издания, които са с обидно прост релеф – като че ли децата са таргетирани единствено в ролята на обекти, подлежащи на „правилно“ възпитание. Точно на панаира в Болоня един колега издател от Канада се оплака, че политическата коректност там до такава степен е настъпила детското книгоиздаване, че вече е невъзможно да се пишат и рисуват хубави книги. Но пък точно в Болоня се вижда, че все още има много специални, многопластови детски издания – мога да дам пример с книгите на италианските издателства Topipittori и Orecchio Acerbo.

Като споменахте италианските издателства – има ли още нещо от панаирната програма, за което бихте искали да ни разкажете?

Антон Стайков: Този панаир е гигантско място за срещи и работа. И тъй като е много ясно профилиран и с дълга традиция, функционира перфектно. Достъпът до събитията е с билети и пропуски, но е ограничен за деца до 18 години, за да може да се осигури по-спокойна работна атмосфера. Всъщност цялата програма e изключително плътна. Срещи с известни автори и илюстратори, издатели, детски психолози, литературни агенти, представители на други панаири, обучения за издателски практики, преводачески ателиета. Събитията от програмата на държавата гост тази година – Словения – бяха едно изключително представяне. Много силни книги имаше на щандовете на Тайван, Китай, Мексико, Аржентина, Бразилия… И зашеметяващите малки италиански издателства, и какво ли още не…

До Болоня и назад – с „радост, тъга и надежда“
До Болоня и назад – с „радост, тъга и надежда“

Номинациите за Bologna Ragazzi Awards (BRAW) © Свобода Цекова

Свобода Цекова: Както всяка година, в сравнително малкото по площ пространство, където традиционно е „висящата градина“ от номинирани и наградени книги с Bologna Ragazzi Awards (BRAW), се концентрират цялата красота и смисъл на илюстрованата детска книга.

A new generative engine and three voices are now generally available on Amazon Polly

Post Syndicated from Channy Yun original https://aws.amazon.com/blogs/aws/a-new-generative-engine-and-three-voices-are-now-generally-available-on-amazon-polly/

Today, we are announcing the general availability of the generative engine of Amazon Polly with three voices: Ruth and Matthew in American English and Amy in British English. The new generative engine was trained with publicly available and proprietary data, a variety of voices, languages, and styles. It performs with the highest precision to render context-dependent prosody, pausing, spelling, dialectal properties, foreign word pronunciation, and more.

Amazon Polly is a machine learning (ML) service that converts text to lifelike speech, called text-to-speech (TTS) technology. Now, Amazon Polly includes high-quality, natural-sounding human-like voices in dozens of languages, so you can select the ideal voice and distribute your speech-enabled applications in many locales or countries.

With Amazon Polly, you can select various voice options, including neural, long-form, and generative voices, which deliver ground-breaking improvements in speech quality and produce human-like, highly expressive, and emotionally adept voices. You can store speech output in standard formats like MP3 or OGG, adjust the speech rate, pitch, or volume with Speech Synthesis Markup Language (SSML) tags, and quickly deliver lifelike voices and conversational user experiences with consistently fast response times.

What’s the new generative engine?
Amazon Polly now supports four voice engines: standard, neural, long-form, and generative voices.

Standard TTS voices, introduced in 2016 use traditional concatenative synthesis. This method strings together the phonemes of recorded speech, producing very natural-sounding synthesized speech. However, the inevitable variations in speech and the techniques used to segment the waveforms limit the quality of speech.

Neural TTS (NTTS) voices, introduced in 2019, use a sequence-to-sequence neural network that converts a sequence of phonemes into spectrograms, and a neural vocoder that converts the spectrograms into a continuous audio signal. The NTTS produces even higher quality human-like voices than its standard voices.

Long-form voices, introduced in 2023, are developed with cutting-edge deep learning TTS technology and designed to captivate listeners’ attention for longer content, such as news articles, training materials, or marketing videos.

In February 2024, Amazon scientists introduced a new research TTS model called Big Adaptive Streamable TTS with Emergent abilities (BASE). With this technology, Polly Generative engine is able to create human-like synthetically generated voices. You can use these voices as a knowledgeable customer assistant, a virtual trainer, or an experienced marketer.

Here are the new generative voices:

Name Locale Gender Language Sample prompt NTTS voices
 Generative voices
Ruth en_US Female English (US) Selma was lying on the ground halfway down the steps. 'Selma! Selma!' we shouted in panic.
Matthew en_US Male English (US) The guards were standing outside with some of our neighbours, listening to a transistor radio. 'Any good news?' I asked. 'No, we're listening to the names of people who were killed yesterday,' Bruno replied.
Amy en_GB Female English (British) What are you looking at?' he said as he stood over me. They got off the bus and started searching the baggage compartment. The tension on the bus was like a dark, menacing cloud that hovered above us.

You can choose from these voice options to suit your application and use case. To learn more about the generative engine, visit Generative voices in the AWS documentation.

Get started with using generative voices
You can access the new voices using the AWS Management Console, AWS Command Line Interface (AWS CLI), or the AWS SDKs.

To get started, go to the Amazon Polly console in the US (N. Virginia) Region and choose Text-to-Speech menu in the left pane. If you select the voice of Ruth or Matthew in the language of English, US or Amy in English, UK, you can choose Generative engine. Input your text and listen to or download the generated voice output.

Using the CLI, you can list the voices that use the new generative engine:

$ aws polly describe-voices --output json --region us-east-1 \
| jq -r '.Voices[] | select(.SupportedEngines | index("generative")) | .Name'

Matthew
Amy
Ruth

Now, run the synthesize-speech CLI command to synthesize sample text to an audio file (hello.mp3) with the parameters of generative engine and a supported voice ID.

$ aws polly synthesize-speech --output-format mp3 --region us-east-1 \
  --text "Hello. This is my first generative voices!" \
  --voice-id Matthew --engine generative hello.mp3

To learn more code examples using AWS SDKs, visit Code and Application Examples in the AWS documentation. You can use Java and Python code examples, application examples such as web applications using Java or Python, or iOS and Android applications.

Now available
The new generative voices of Amazon Polly are now available today in the US East (N. Virginia) Region. You only pay for what you use based on the number of characters of text that you convert to speech. To learn more, visit our Amazon Polly Pricing page.

Give new generative voices a try in the Amazon Polly console today and send feedback to AWS re:Post for Amazon Polly or through your usual AWS Support contacts.

— Channy

Creating an organizational multi-Region failover strategy

Post Syndicated from Michael Haken original https://aws.amazon.com/blogs/architecture/creating-an-organizational-multi-region-failover-strategy/

AWS Regions provide fault isolation boundaries that prevent correlated failure and contain the impact from AWS service impairments to a single Region when they occur. You can use these fault boundaries to build multi-Region applications that consist of independent, fault-isolated replicas in each Region that limit shared fate scenarios. This allows you to build multi-Region applications and leverage a spectrum of approaches from backup and restore to pilot light to active/active to implement your multi-Region architecture. However, applications typically don’t operate in isolation; consider both the components you will use and their dependencies as part of your failover strategy. Generally, multiple applications make up what we refer to as a user story, a specific capability offered to an end user, like “posting a picture and caption on a social media app” or “checking out on an e-commerce site”. Because of this, you should develop an organizational multi-Region failover strategy that provides the necessary coordination and consistency to make your approach successful.

Overview

There are four high-level strategies that organizations can pick from to guide a multi-Region approach:

  • Component-level failover
  • Individual application failover
  • Dependency graph failover
  • Entire application portfolio failover

These strategies move from the most granular to the coarsest approach. Each strategy has tradeoffs and addresses different challenges, including flexibility of failover decision making, testability of the failover combinations, presence of modal behavior, and organizational investment in planning and implementation. By the end of this post, you will be able to identify the pros and cons of each strategy so you can make intentional choices about which you select for your multi-Region failover solution.

Component-level failover

Applications are made up of multiple components, including their infrastructure, code and config, data stores, and dependencies. The component-level failover strategy helps you recover from individual component impairments. This means that when a single component is impaired, the application will fail over to a component hosted in a different Region. Consider the application in Figure 1. When the Amazon Simple Storage Service (Amazon S3) resources used by the application experience elevated error rates or higher latency, the application fails over to use data from an S3 bucket in its secondary Region.

When the application experiences an impairment using S3 resources in the primary Region, it fails over to use an S3 bucket in the secondary Region.

Figure 1. When the application experiences an impairment using S3 resources in the primary Region, it fails over to use an S3 bucket in the secondary Region.

This strategy gives the most autonomy and flexibility to individual applications, but has four main tradeoffs:

  • It adds latency by using resources in a second Region because they are physically further away. This gives the application multiple modes of behavior, lower latency when all components are in one Region, and higher latency when the components are split between Regions. Modal behavior can produce unexpected and undesirable results.
  • It introduces the possibility for inconsistent data if asynchronous replication is used in the data store.
  • It typically requires a runtime update of the application’s configuration to switch a component to a different Region, which can be unreliable during a failure scenario.
  • There are 2N-1 possible configurations (where N is the number of components in the application) of the application, which can make every possible combination in an application difficult to test.

Individual application failover

The next strategy allows individual applications to make an autonomous decision to fail over all of its components together, shown in Figure 2. This removes the latency tradeoff from the previous strategy by keeping all of the application components in the same Region. It also significantly reduces the complexity by only having two possible configurations per application. Additionally, applications can be failed over to another Region without updating their configuration by using approaches like Amazon Route 53 DNS failover, removing the unreliability of runtime configuration updates.

Application 3 experiences an impairment and fails over to the secondary Region.

Figure 2. Application 3 experiences an impairment and fails over to the secondary Region

However, allowing individual applications to make their own failover decision can introduce the same modal behavior we saw with component-level failover, just in a different dimension. In the worst case, 50% of the applications in a user story could fail over while 50% don’t, meaning every application interaction could be a cross-Region request, shown in Figure 3.

The worst-case scenario of allowing applications to make failover decisions independently.

Figure 3. The worst-case scenario of allowing applications to make failover decisions independently

Additionally, while this approach removes the complexity of the component failover approach, it still exhibits a level of similar complexity, albeit smaller, by having 2N-1 combinations of application locations across Regions, also making this approach difficult to test and coordinate.

Dependency graph failover

To solve the complexity of the previous strategy, you might decide to coordinate failover of all applications that support a user story as a single unit. We call this a dependency graph and it ensures that all applications that interact with each other will always be in the same Region, as shown in Figure 4.

A dependency graph of applications that all support user story "A".

Figure 4. A dependency graph of applications that all support user story “A”

While this solves the previous latency, modal behavior, and complexity tradeoffs, it comes with its own challenges. In a portfolio with multiple user stories and applications, this graph can be very large and discovering each dependency, especially infrequently used ones, can be difficult. In fact, seemingly unrelated dependency graphs can be connected by a single vertex that is shared between them, as shown in Figure 5.

Two unrelated user stories share a dependency on Application 4, requiring both dependency graphs to failover if either experience an impairment.

Figure 5. Two unrelated user stories share a dependency on Application 4, requiring both dependency graphs to failover if either experience an impairment

For example, if every user story you provide depends on a single authentication and authorization system, when one graph of applications needs to failover, then so does the entire authorization system. In turn, every other user story that depends on that authorization system needs to fail over as well. To mitigate this, you might implement independent replicas of these types of applications in each Region, if possible, to remove edges from the dependency graph.

Entire portfolio failover

The final strategy is failing over an entire application portfolio, whether or not applications are impacted or have any interaction with those that are, as shown in Figure 6. This strategy helps remove the operational burden of creating and maintaining dependency graphs for every user story your business supports.

Every user story fails over together regardless of observed impact from a failure.

Figure 6. Every user story fails over together regardless of observed impact from a failure

The major tradeoff is the organizational investment to create multi-Region capabilities for every application – you might not have made that broad investment in the other strategies. You can make this strategy slightly more granular by implementing it for specific application tiers, for example, failing over all tier-1 applications together, as long as you know there aren’t dependencies across applications of different criticality.

You can also combine this approach with the second strategy. Let individual applications make failover decisions until you see broad enough impact, or impact from the modal behavior, that you decide to make all applications failover to your secondary Region to mitigate the effects.

Conclusion

This blog post has looked at four different high-level approaches for creating an organizational multi-Region failover strategy.

Each strategy optimizes for different outcomes. Component-level failover gives you the highest degree of flexibility without organizational capabilities or coordination, but introduces the most complexity and bimodal behavior. Individual application failover optimizes for less complexity in failover combinations than component-level while still maintaining decentralized flexibility in failover decision making. Dependency graph failover optimizes for only needing to failover the minimum set of applications to support a capability, which removes the presence of modal behavior while requiring more organizational investment to do so. Finally, portfolio failover optimizes for not needing to maintain dependency graphs, but requires significant additional investment to build a multi-Region capability for every application.

Creating the strategy can be an iterative journey. You might start with allowing individual applications to make failover decisions while you build toward a future state of managing failover of independent dependency graphs. For more information on creating multi-Region architectures, see AWS Multi-Region Fundamentals and Disaster Recovery of Workloads on AWS.

Accelerate your Software Development Lifecycle with Amazon Q

Post Syndicated from Chetan Makvana original https://aws.amazon.com/blogs/devops/accelerate-your-software-development-lifecycle-with-amazon-q/

Software development teams are constantly looking for ways to accelerate their software development lifecycle (SDLC) to release quality software faster. Amazon Q, a generative AI–powered assistant, can help software development teams work more efficiently throughout the SDLC—from research to maintenance.

Software development teams spend significant time on undifferentiated tasks while analyzing requirements, building, testing, and operating applications. Trained on 17 years’ worth of AWS expertise, Amazon Q can transform how you build, deploy, and operate applications and workloads on AWS. By automating mundane tasks, Amazon Q enables development teams to spend more innovating and building. Amazon Q can speed up on-boarding, reduce context switching, and accelerate development of applications on AWS.

This blog post explores how Amazon Q can accelerate development tasks across the SDLC using an example To-Do API project. Throughout this blog, we will navigate through the various phases of the SDLC while implementing To-Do API by leveraging Amazon Q Business and Amazon Q Developer. We will walk through common use cases for Amazon Q Business in the planning and research phases, and Amazon Q Developer in the research, design, development, testing, and maintenance phases.

Planning

As a product owner, you spend significant time on requirements analysis and user story development. You research internal documents like functional specifications and business requirements to understand the desired functionalities and objectives. Manually sifting through documentation is time consuming. You can leverage Amazon Q Business to quickly extract relevant information from your internal documents or wikis, such as Confluence. Amazon Q Business quickly connects to your business data, information, and systems so that you can have tailored conversations, solve problems, generate content, and take actions relevant to your business. Amazon Q Business offers over 40 built-in connectors to popular enterprise applications and document repositories, including Amazon Simple Storage Service (Amazon S3), Confluence, Salesforce and more, enabling you to create a generative AI solution with minimal configuration. Amazon Q Business also provides plugins to interact with third-party applications. These plugins support read and write actions that can help boost end user productivity.

So, instead of digging through the internal documentations, you can simply ask Amazon Q Business about requirements using natural language and it will provide immediate and relevant information to the users, and helps streamline tasks and accelerate problem solving.

For our To-Do API example, let’s consider the business requirements are documented in Confluence, and Jira is utilized for issue management. You can configure Amazon Q Business with Confluence and Jira through the Confluence connector and Jira plugin, respectively. To understand requirements, you may ask Amazon Q Business for an overview of the use case, business drivers, non-functional requirements, and other related questions. Amazon Q Business then pulls the relevant details from the Confluence documents and presents them to you in a clear and concise manner. This allows you to save time gathering requirements and focus more on developing user stories.

Ask Amazon Q Business to understand requirements from the requirement document available on Confluence

Once you have a good understanding of the requirements, you can ask Amazon Q Business to write a user story and even create a Jira issue for you. For the To-Do API use case, Amazon Q Business generates the user stories tailored to the requirements and creates the corresponding Jira ticket ready for your team, saving you time and ensuring efficiency in the project workflow.

Ask Amazon Q Business to create issue in Jira

Research and Design

Let’s consider a scenario where the above mentioned user story is assigned to you and you have to implement it based on the technology stacks described in the confluence page.

First, you ask Amazon Q Business to gain insights into the technology stacks aligning with the organization’s development guidelines. Amazon Q Business promptly provides you with details sourced from the internal development guidelines document hosted on Confluence along with references and citations.

Ask Amazon Q Business to gain insight in technology stack detail from Confluence.

As a developer, you can use Amazon Q Developer in your integrated development environment (IDE) to get software development assistance, including code explanation, code generation, and code improvements such as debugging and optimization. Amazon Q Developer can help by analyzing the requirements, assessing different approaches, and creating an implementation plan and sample code. It can investigate options, weigh tradeoffs, recommend best practices, and even brainstorm with you to optimize the design.

Let’s see how Amazon Q Developer can help analyze the user story, design, and brainstorm with you arrive at an implementation plan.

Ask Amazon Q Developer to design To-Do API.

Let us further refine the design with adding non-functional requirements such as security and performance.

Ask Amazon Q Developer to design with non-functional requirements.

Develop and Test

Amazon Q Developer can generate code snippets that meet your specified business and technical needs. You can review the auto-generated code, manually copy, and paste it into your editor, or use the Insert at cursor option to directly incorporate it into your source code. This allows you to rapidly prototype and iterate on new capabilities for your application. Amazon Q Developer uses the context of your conversation to inform future responses for the duration of your conversation. This makes it easy to help you focus on building applications because you don’t have to leave your IDE to get answers and context-specific coding guidance.

Amazon Q Developer is particularly useful for answering questions related to the following areas:

  • Building on AWS, including AWS service selection, limits, and best practices.
  • General software development concepts, including programming language syntax and application development.
  • Writing code, including explaining code, debugging code, and writing unit tests.
  • Upgrading and modernizing existing application code using Amazon Q Developer Agent for Code Transformation.

Expanding on the same user story design generated by Amazon Q Developer, you can ask Amazon Q Developer to implement the API and refine based on additional requirements and parameters. Let’s collaborate with Amazon Q Developer, to expand our design to implementation. You can leverage Amazon Q Developer’s expertise to ideate, evaluate options, and arrive at an optimal solution. Amazon Q Developer can have an intelligent discussion to brainstorm creative new test cases based on the requirements. It can then help construct an implementation plan, suggesting ways to efficiently add robust, comprehensive tests that cover edge cases.

Let’s ask Amazon Q Developer to generate code based on the design.

Ask Amazon Q Developer to generate code

Now, let’s ask Amazon Q Developer to implement the AWS Lambda function.

Ask Amazon Q Developer to generate AWS Lambda function.

Amazon Q Developer can provide code examples and snippets that show how to implement the design. You can review the code, get Amazon Q Developer’s feedback, and seamlessly integrate it into the project. Collaborating with Amazon Q Developer allows you to amplify your productivity by leveraging its knowledge to quickly iterate and enrich our application capabilities.

Amazon Q Developer can also review the code and find opportunities for improvements, optimization based on performance and other parameters. Let us ask Amazon Q Developer to find any opportunities for improvements on the code for our To-do API.

Ask Amazon Q Developer for code improvements

Debugging and Troubleshooting

Amazon Q Developer can assist you with troubleshooting and debugging your code. For unfamiliar error codes or exception types, you can ask Amazon Q Developer to research their meaning and common resolutions. Amazon Q Developer can also help by analyzing your applications’ debug logs, highlighting any anomalies, errors, or warnings that could indicate potential issues.

Amazon Q Developer can troubleshoot network connectivity issues caused by misconfiguration, providing concise problem analysis and resolution suggestions. Amazon Q Developer can also research AWS best practices to identify areas not aligned with recommendations. For code issues, it can answer questions and debug problems within supported IDEs. Leveraging its knowledge of AWS services and their interactions, Amazon Q Developer can provide service-specific guidance. In the AWS Management Console, Amazon Q Developer can troubleshoot errors you receive while working with AWS services such as insufficient permissions, incorrect configuration, and exceeding service limits.

Let’s test our To-Do API by hitting the Amazon API Gateway endpoint using cURL.

Test To-Do API in IDE.

The API Gateway endpoint invokes the Lambda function to insert records in the Amazon DynamoDB table. Since it throws Internal Server Error, let’s go to the Lambda console to troubleshoot this further and test the function directly by creating a test event for the POST method. You can troubleshoot different console errors with Amazon Q Developer, directly in the AWS Management Console. For the above error, Amazon Q analyzes the issue and helps find the resolution. Amazon Q explains how to fix this error directly on the console by adding an environment variable for DynamoDB table name.

Ask Amazon Q to troubleshoot issue in the AWS Management Console.

Now, let’s ask Amazon Q Developer in IDE to generate code to fix this error. Amazon Q Developer then generates a code snippet to set the desired environment variable in the AWS Cloud Development Kit (AWS CDK) code for Lambda function.

Ask Amazon Q Developer to generate CDK.

Conclusion

In this post, you learned how to leverage Amazon Q Business and Amazon Q Developer to streamline SDLC and accelerate time-to-market. With its deep understanding of code and AWS resources, Amazon Q Developer enables development teams to work efficiently throughout the research, design, development, testing, and review phases. By automating mundane tasks, offering expert guidance, generating code snippets, optimizing implementations, and troubleshooting issues, Amazon Q Developer allows developers to redirect their focus towards higher-value activities that drive innovation. Moreover, through Amazon Q Business, teams can leverage the power of generative AI to expedite the requirements planning and research phases.

Chetan Makvana

Chetan Makvana is a Senior Solutions Architect with Amazon Web Services. He works with AWS partners and customers to provide them with architectural guidance for building scalable architecture and implementing strategies to drive adoption of AWS services. He is a technology enthusiast and a builder with a core area of interest on generative AI, serverless, and DevOps. Outside of work, he enjoys watching shows, traveling, and music.

Suruchi Saxena

Suruchi Saxena is a Cloud/DevOps Engineer working at Amazon Web Services. She has a background in Generative AI and DevOps, leveraging years of IT experience to drive transformational changes for AWS customers. She specializes in architecting and managing cloud-based solutions, automation, code delivery and analysis, infrastructure as code, and continuous integration/delivery. In her free time, she enjoys traveling and reading.

Venugopalan Vasudevan

Venugopalan Vasudevan is a Senior Specialist Solutions Architect at Amazon Web Services (AWS), where he specializes in AWS Generative AI services. His expertise lies in helping customers leverage cutting-edge services like Amazon Q, and Amazon Bedrock to streamline development processes, accelerate innovation, and drive digital transformation. Venugopalan is dedicated to facilitating the Next Generation Developer experience, enabling developers to work more efficiently and creatively through the integration of Generative AI into their workflows.

[$] Securing Git repositories with gittuf

Post Syndicated from jzb original https://lwn.net/Articles/972467/

The so-called software supply chain starts with source code. But most security measures and tooling
don’t kick in until source is turned into an artifact—a source
tarball, binary build, container image, or other method of delivering a
release to users. The gittuf project
is an attempt to provide a security layer for Git that can handle key management,
enforce security policies for repositories, and guard against attacks
at the version-control layer. At Open Source Summit North America (OSSNA), Aditya Sirish A
Yelgundhalli and Billy Lynch presented
an introduction to gittuf with an overview of its goals and
status.

Fedora Asahi Remix 40 is now available

Post Syndicated from jzb original https://lwn.net/Articles/972874/

Fedora Magazine reports
that the Fedora Asahi
Remix for Apple Arm hardware, based on Fedora
40, is now available:

Fedora Asahi Remix offers KDE Plasma 6 as our flagship desktop
experience. It also features a custom Calamares-based initial setup
wizard. A GNOME variant is also available, featuring GNOME 46, with
both desktop variants matching what Fedora Linux offers. Fedora Asahi
Remix also provides a Fedora Server variant for server workloads and
other types of headless deployments. Finally, we offer a Minimal image
for users that wish to build their own experience from the ground up.

See the installation
guide to get started with the Asahi Remix.

Security updates for Wednesday

Post Syndicated from jzb original https://lwn.net/Articles/972861/

Security updates have been issued by Debian (glib2.0 and php7.3), Gentoo (Commons-BeanUtils, Epiphany, glibc, MariaDB, Node.js, NVIDIA Drivers, qtsvg, rsync, U-Boot tools, and ytnef), Oracle (kernel), Red Hat (git-lfs and kernel), SUSE (flatpak, less, python311, rpm, and sssd), and Ubuntu (libde265, libvirt, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp,
linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4,
linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi,
linux-raspi-5.4, linux-xilinx-zynqmp, linux, linux-azure, linux-azure-5.15, linux-azure-fde,
linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop,
linux-gkeop-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency,
linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-oem-6.5, and nghttp2).

Rapid7 Signs 100% Talent Compact with Boston Women’s Workforce Council

Post Syndicated from Rapid7 original https://blog.rapid7.com/2024/05/08/rapid7-signs-100-talent-compact-with-boston-womens-workforce-council/

The effort aims to help close gender and racial pay gaps

Rapid7 Signs 100% Talent Compact with Boston Women’s Workforce Council

Rapid7 is proud to announce their signing of the 100% Talent Compact through the Boston Women’s Workforce Council (BWWC). The Talent Compact is a collective effort among the Boston Mayor and local employers to close the gender and racial wage gaps in Greater Boston. Compact Signers are actively committed to examining their salary data, contributing that data anonymously to the BWWC’s biennial wage-gap measurement, and participating in quarterly briefing sessions.

As an organization, the BWWC works alongside the City of Boston’s Mayor as well as local employers. Their programs and initiatives reflect their core beliefs surrounding the positive impact women have on businesses and communities, the importance of addressing gender and racial pay inequities, and the systemic impact gender and racial pay disparities can have in Greater Boston.

As stated by Christina Luconi, Chief People Officer, “At Rapid7, we are committed to fostering an environment where all of our people are doing impactful work in a way that is meaningful to them. Ensuring that we have equitable salary practices is just one way we can ensure everyone has the opportunity to thrive in their career.”

In the United States, women earn 84 cents for every dollar earned by a man. In Boston, data collected by participants of the Talent Compact shows consistency with this number, with a wage gap of $0.21 for women and a gap of $0.27 for employees of color.

According to Lauren Noonan, Engagement Manager with the BWWC, “These numbers are disappointing to see, but measuring this data and understanding the work that needs to be done is the first critical step to creating necessary change. The companies that have signed on to our Talent Compact are committed to taking active roles in identifying gaps within their own organizations and actively participating in the panel discussions, sharing ideas, and putting corrective plans into action to address them.”

When it comes to diversity, equity and inclusion (DEI), Rapid7 has consistently demonstrated a commitment to focus efforts on driving impact; whether it’s through similar strategic partnerships with organizations like Hack.Diversity, Cyversity, and the University of South Florida or developing in-house resources and programs. Addressing systemic hurdles and supporting historically marginalized communities have become an integral part of our business strategy.

In addition to having programs and partnerships in place, Rapid7’s Director of Diversity, Equity and Inclusion, Sophia Dozier stresses how transparency is critical for creating impact and success. “Transparency is a key pillar in fostering spaces that are not only diverse and inclusive, but truly equitable. Levers of transparency should be embedded into every DEI strategy, as it helps ensure that decisions continue to reflect commitments made in support of building and maintaining impactful, high-performing, multi-dimensional teams and organizations.”

At Rapid7, we believe we are truly #NeverDone in our efforts to build an inclusive and equitable workplace where our employees can develop the career experience of a lifetime. This partnership furthers our commitment to continuously examining and enhancing our practices and programs so that all people can thrive, while being part of a greater discussion that impacts our industry and local community.

Case Study: Zabbix at the European Space Agency

Post Syndicated from Arturs Lontons original https://blog.zabbix.com/case-study-zabbix-at-the-european-space-agency/28024/

The European Space Agency (ESA) is a 22-member intergovernmental body devoted to space exploration. Headquartered in Paris and with a global staff of around 2,200, the ESA was founded in 1975. Its annual budget was €7.08 billion in 2023.

The challenge

The Columbus laboratory is the European module of the International Space Station and the cornerstone of Europe’s participation. Positioned on the starboard side of the Station’s leading edge, it is designed to provide an environment for pursuing research and development in a wide variety of fields. Its characteristics include:

  • Payload complement flexibility, provided by a modular design and serviced by a regular logistics, maintenance, and upgrade capability
  • A permanent crew presence for servicing payload support systems and interacting with payloads
  • A continuously available ground infrastructure for monitoring and controlling onboard activities

Columbus provides internal payload accommodation for multidisciplinary research into material science, fluid physics, and life sciences, while the External Payload Facility (EPF) hosts space science and Earth observation payloads.

Academics on Earth perform their tests on Columbus remotely – programming them and getting the results. The infrastructure required for these tests and the payloads that get sent back and forth require a flexible and dependable monitoring solution, and that’s where Zabbix enters the picture.

The solution

Zabbix proxy was deployed in the Columbus module alongside other software required for research, operations, and connectivity. The Zabbix server and frontend are deployed in the ground data center, and this is what the proxy communicates with.

In addition to proxies, we have a Zabbix sender and Agent 2 that are used on this infrastructure, which is made of VMS and containers running different kinds of services. Data is collected in a very ordinary fashion – Zabbix Agent 2 performs native checks because there is still server hardware running with operating systems and OS level resources that need to be monitored by the Agent.

We mix these native checks with user parameters which execute custom checks based on scripts or commands for commercial off-the-shelf components. The agent is extended depending on the requirements of the components. It then collects those metrics and sends them to the proxy. Scripting is used for custom components, and because Zabbix is language agnostic, any type of programming or scripting language works. It gets wrapped together with Zabbix sender, which then sends data to the proxy, which then sends data to the server.

Because there are so many custom services and metrics that need to be monitored (the number of high priority files in the transfer queue for a particular payload, for example) and because metrics, services, and payloads can change over time, the ESA needed to automate a way of automatically discovering these, displaying them, and collecting data for them. We used low-level discovery together with some scripting to discover and automatically start monitoring new payloads.

The results

Thanks to Zabbix’s visualization capabilities, the ESA’s team has found it easy to observe their dashboards and react to alerts in real time.

The ESA has also found Zabbix proxy to be an ideal solution for their needs, because if a link between the ground data center and the Columbus module goes down, the proxy keeps collecting local metrics, stores them in its own database, and then sends them back to the ground once the connection is restored. No such situation has arisen yet, but Zabbix has performed flawlessly in all test scenarios.

Monitoring is a never-ending process and there’s always room for improvement, but it’s reasonable to expect that the ESA will continue working on Zabbix and finding new metrics and new ways of improving monitoring.

In conclusion

Part of the beauty of Zabbix has always been its adaptability – it can be as simple or as complex as any user needs it to be. The simplicity of the Zabbix setup in this scenario (as opposed to a more modular setup with 4 or 5 pieces of software) is what makes it ideal for deployment by the ESA on the International Space Station.

To learn more about what we do for customers across multiple industries, visit our website or request a demo.

The post Case Study: Zabbix at the European Space Agency appeared first on Zabbix Blog.

The collective thoughts of the interwebz