Aspose.PDF for AWS

—

Aspose.PDF for AWS offers a modern solution for organizations looking to enhance their document processing capabilities. Whether it’s converting formats, merging files, splitting documents, extracting data, or reordering content, our RESTful API, built on the powerful Aspose.PDF .NET library and optimized Linux packages, provides a streamlined and efficient approach.

Recognizing the need for continuous improvement, many organizations explore ways to optimize their document workflows. Aspose.PDF for AWS enables them to achieve this by eliminating the need to develop custom code for complex tasks. With our API, users benefit from the Aspose.PDF .NET managed library, which addresses common issues associated with unmanaged code, such as stability and performance concerns. Enhanced with linux packages, our solution ensures fast processing speeds and comes with dedicated 24/7 support, giving you peace of mind and the reliability you need for mission-critical applications. The simplicity of saving documents to Amazon S3 further enhances the ease of setup and integration.

Users can quickly begin utilizing the API through the intuitive Swagger UI, facilitating manual document tasks without requiring extensive technical expertise. For developers, integrating the API into existing systems is straightforward with support for popular programming languages like .NET, Java, PHP, and Kotlin.

Organizations looking to optimize their document processing can find real value in the pay-as-you-go model offered by Aspose.PDF for AWS. With no need for a initial payment to get started, you only pay for the resources you actually use to process. This flexibility makes it easier to scale your operations as demand fluctuates, ensuring that you’re not overpaying for unused capacity. By using Aspose.PDF for AWS, your organization can efficiently manage document workflows, adjust quickly to changing needs.

Pricing

Our pricing model offers a competitive and flexible structure based on the number of files processed within the same S3 bucket of the account. The pricing is divided into tiers to accommodate various usage levels:

Tier 1: 0 to 8,000 Files $0.10

Tier 2: Next 80,000 Files $0.02

Tier 3:: Next 160,000 Files $0.01

Tier 4: Next 800,000 Files $0.005

Tier 5: Any additional Files $0.0002

This tiered pricing structure ensures that as your usage scales, the cost per file decreases, providing better value for higher volumes of processed files.

Units Usage Monitoring

On the title page of the running container, you can view the count of processed files for the current hour in property ‘Counter’ and the total number of files processed across all containers for the same S3 bucket in property ‘Total’ and ‘Tier’. This allows for real-time monitoring and better management of your file processing activities.

Getting Started with Aspose.PDF for AWS

To effectively manipulate PDF and other document formats using an API, follow this tutorial on Aspose.PDF for AWS. This guide will take you through setting up your environment, initializing the API, and executing various document manipulations. By the end of this tutorial, you will be proficient in using Aspose.PDF for AWS for all your document handling needs.

Reporting Issues

If you encounter any issues while using our API, report them to ensure they get resolved efficiently. Contact our support team on forum and provide detailed information about the problem, including any error messages received. This will help the support team diagnose and resolve your issue more effectively, ensuring a smoother experience with the API.

• To find is processing failed you need to check ‘statusCode’ field of status JSON. Errored processing has status 500, in progress 204 and success has 200.
• Error message is located in filed ‘status’.
• Details of error is located in filed “errorCallStack”. The details is encoded and Aspose team will use it to help with issue.

Example of processing response you can send with you issue

{
  "statusCode": 500,
  "status": "An error occurred trying to start process 'wkhtmltopdf' with working directory 'c:\\tempOutput\\6c821598-bccf-4ff6-9e06-9841ddf5aec6\\52fd9f2b-7dab-46a0-8a64-049d359210f7'. The system cannot find the file specified.",
  "text": null,
  "locked": false,
  "updated": null,
  "sharedFiles": [],
  "fileProcessingErrorCode": "OK",
  "fileCount": 0,
  "fileName": null,
  "folderName": "7bfd00d8-edab-4bfd-9688-a0cfef43d0e2",
  "resultData": null,
  "appInstanceId": "Aspose.PDF for AWS_a7ec362f-0300-4e0f-9673-e9d687450f1c",
  "errorCallStack": "System.ComponentModel.Win32Exception (2): An error occurred trying to start process..."
}

Steps

The following steps will guide you through the process of using our API:

1. Send a Document or Image: Initiate the process by sending a document or image file via a POST request with the necessary query parameters to set up processing.

2. Check the processing Status: After sending the POST request, check the status of the file conversion process by making a POST request with the folder name received in the upload response.

3. Download the Converted File: Once the file processed, download the converted file using a GET request with the folder name received in the upload response.

Using Swagger UI

Swagger is a powerful tool for interacting with RESTful APIs. It provides a user-friendly interface that allows you to visualize and test the endpoints of your API without writing any additional code. This guide will walk you through the basics of using Swagger UI to understand and interact with a Aspose.PDF for AWS from browser.

Swagger UI is an open-source tool that allows you to interact with API through a web interface. Swagger UI can be accessed in several ways:

Aspose.PDF APIs provide a Swagger UI interface that you can access through a URL.

Accessing Swagger UI Let’s assume you have deployed Aspose.PDF for AWS container running at http://127.0.0.1. The Swagger UI for this API can be accessible at http://127.0.0.1/swagger.

When you open Swagger UI, you will see several sections:

• Header: Contains the API title, description, and version information.
• Servers: Lists the base URLs where the API is available.
• Paths: Shows the available endpoints (also called paths) of the API.
• Schemas: Defines the data models used by the API.

Exploring Endpoints

Each endpoint is represented by a section that shows:

• HTTP Method: The type of request (GET, POST, PUT, DELETE, etc.).
• Endpoint URL: The path of the endpoint.
• Description: A brief explanation of what the endpoint does.
• Parameters: The inputs required for the request (query parameters, path parameters, headers, body, etc.).
• Responses: The possible responses from the API, including status codes and example responses.

Example: Exploring an Endpoint

Let’s explore a POST /pdf/webapi/searchable endpoint:

1. Locate the GET /pdf/webapi/searchable endpoint in the Paths section.
2. Click on the endpoint to expand it.
3. You will see the description, parameters (if any), and responses for this endpoint.

Swagger UI allows you to make requests directly from the interface:

1. Expand the endpoint you want to test.
2. Fill in any required parameters or request body fields.
3. Add files to process with form data
4. Click the “Try it out” button.
5. Click the “Execute” button to send the request.

Viewing Response

After you execute a request, you will see the response from the server, including:

• Status Code: Indicates the result of the request (e.g., 200 for success, 404 for not found).
• Response Body: The data returned by the server in JSON format.
• Headers: Metadata about the response.

Example: Testing a POST /pdf/webapi/searchable Endpoint

1. Locate and expand the POST /pdf/webapi/searchable endpoint.
2. Click the “Try it out” button.
3. Fill in the parameters language ’eng’.
4. Add scanned pdf document to files in request body.
5. Click the “Execute” button.
6. View the response to see if the user was successfully created.

Example: Testing a POST /pdf/webapi/searchable Endpoint

1. Locate and expand the POST /pdf/webapi/searchable endpoint.
2. Click the “Try it out” button.
3. Fill in the parameter language “eng”.
4. Add scanned pdf document to files in request body.
5. Click the “Execute” button.
6. View the response to see if the processing was successfully created.
7. In the response body JSON find “folderName”, for example “8550017d-6bba-428e-b641-25d8aeb16372”

Testing a GET /pdf/webapi/status processing status

1. Locate and expand the GET /pdf/webapi/status/{0} endpoint.
2. Click the “Try it out” button.
3. Fill in the parameter id with folder name “8550017d-6bba-428e-b641-25d8aeb16372”.
4. Click the “Execute” button.
5. View the response to see if the processing was successfully finished “statusCode”: 200.
6. In the response body JSON find “fileName”: “Searchable_test.pdf”

Download a GET /pdf/webapi/download/{0} processed document

1. Locate and expand the GET /pdf/webapi/status endpoint.
2. Click the “Try it out” button.
3. Fill in the parameter id with folder name “8550017d-6bba-428e-b641-25d8aeb16372”.
4. Fill in the parameter file with processed file name “Searchable_test.pdf”
5. Click the “Execute” button.
6. View the response link to download and Click to save the file.

Swagger UI is a valuable tool for anyone working with RESTful APIs. It simplifies the process of exploring, understanding, and testing your API endpoints. By following this guide, you should be able to effectively use Swagger UI to interact with your API and enhance your development workflow.

Conversion PDF to DOCX example

By following these steps, you can successfully send, monitor, and retrieve converted files using the Aspose.PDF AWS

1. Send a Document for Conversion

curl -X POST 'http://localhost/pdf/webapi/convert?inputType=pdf&outputType=docx' -F 'files=@test.pdf'

Response:

{
  "statusCode": 204,
  "status": "Processing",
  "text": null,
  "locked": false,
  "updated": null,
  "sharedFiles": [],
  "files": null,
  "fileProcessingErrorCode": "OK",
  "fileCount": 0,
  "fileName": "processing.pdf",
  "folderName": "7088936f-bcf4-40b9-a06f-d7ca21f3f33e",
  "resultData": null,
  "appInstanceId": "Aspose Pdf Rest.API_05bfc9e8-2486-4a88-9c3d-58999e4f66d8"
}

Response description:

• StatusCode: 204 - The request has been successfully received, and file processing is initiated.
• Status: A string indicating the status of the request. In this case, it is “Processing”.
• Locked: A boolean indicating whether the file is locked or not. In this case, it is false.
• FileProcessingErrorCode: Custom error responses, this time is “OK”, indicating no error.
• FolderName: Unique identifier for the folder where the file is being processed.
• AppInstanceId: A unique identifier for the application instance that processed the file. In this case, it is “Aspose Pdf Rest.API_05bfc9e8-2486-4a88-9c3d-58999e4f66d8”.

2. Check the Status of File Conversion using folder name

curl -X POST 'http://localhost/pdf/webapi/status/7088936f-bcf4-40b9-a06f-d7ca21f3f33e'

Response:

{
  "statusCode": 204,
  "status": "Processing",
  "text": null,
  "locked": false,
  "updated": null,
  "sharedFiles": [],
  "files": null,
  "fileProcessingErrorCode": "OK",
  "fileCount": 0,
  "fileName": "processing.pdf",
  "folderName": "7088936f-bcf4-40b9-a06f-d7ca21f3f33e",
  "resultData": null,
  "appInstanceId": null
}

Response description:

• StatusCode: 200 - The request has been successfully received, and the response contains the requested data.
• Status: A string indicating the status of the request. In this case, it is “Complete”, indicating that the file conversion process has completed successfully.
• SharedFiles: An array of shared files. In this case, it contains a single object with details about the converted file.
• FileProcessingErrorCode: Custom error responses, this time is “OK”, indicating no error.
• FileCount: The number of files being processed. In this case, it is 1.
• FileName: The name of the file being processed. In this case, it is “test.docx”.
• FolderName: A unique identifier for the folder where the file is being processed.

3. Receive error of processing.

curl -X POST 'http://localhost/pdf/webapi/status/7088936f-bcf4-40b9-a06f-d7ca21f3f33e'

Response:

{
  "statusCode": 500,
  "status": "Incorrect file header",
  "text": null,
  "locked": false,
  "updated": null,
  "sharedFiles": [],
  "files": null,
  "fileProcessingErrorCode": "OK",
  "fileCount": 0,
  "fileName": "test.docx",
  "folderName": "4beee097-d297-4e7e-ab08-6ab79ad111d2",
  "resultData": null,
  "appInstanceId": "Aspose Pdf Rest.API_05bfc9e8-2486-4a88-9c3d-58999e4f66d8"
}

Response description:

• StatusCode: The HTTP status code of the response. A status code of 500 indicates that there was an internal server error.
• Status: A string indicating the status of the request. In this case, it is “Incorrect file header”, indicating that there was an error with the file header during the file conversion process.
• FolderName: A unique identifier for the folder where the file is being processed.

4. Download processed file using folder name and file name.

curl -X GET 'http://localhost/pdf/webapi/download/7088936f-bcf4-40b9-a06f-d7ca21f3f33e?file=test.docx' > test.docx

Response description: Provides stream that can be saved to file.

Error Handling

In the event of an error occurring during the processing of files, our system provides detailed error information to help diagnose and resolve issues efficiently.

When an error occurs, the response will include an ErrorCallStack field. This field contains call stack information about the error and should be sent to our support team to assist in troubleshooting the issue.

Example Response with ErrorCallStack:

{
  "StatusCode" : 500,
  "status": "error message",
  "ErrorCallStack": "example error call stack details..."
}

Please include the ErrorCallStack field in your communication with our support team.

To facilitate a quicker resolution, it is also beneficial to provide an example of the file that caused the error. This will help our team understand the context and specifics of the issue.

We do not encrypt customer data during processing. We do not have access to your customer data. Obfuscation of call stack techniques are used to ensure data security of our code. By including both the ErrorCallStack and an example of the file that caused the error, our support team can better assist you in resolving the issue efficiently.

Installation

Deploying Aspose.PDF for AWS Marketplace container product with a RESTful API requires a scalable and reliable setup using ECS of EKS. Amazon Elastic Container Service ECS and Amazon Elastic Kubernetes Service EKS are provided options, each suited for different needs.

When to Use ECS

• Simplicity and Integration: If you want a straightforward deployment with minimal management and deep integration with other AWS services, ECS is the best choice. It handles scaling and operations, letting you focus on your application.

When to Use EKS

• Advanced Configurations: If your application needs complex configurations or you’re already using Kubernetes, EKS provides the flexibility and features you need. It’s ideal for hybrid or multi-cloud environments and leverages the full Kubernetes ecosystem.

Both ECS and EKS offer robust scaling. ECS uses AWS Auto Scaling for effortless scaling. EKS leverages Kubernetes’ built-in scaling features. Since the application processes tasks independently on each node, both services can efficiently handle increased demand.

Choose ECS for simplicity and integration, and EKS for advanced configurations and flexibility. Both ensure your application scales reliably and performs well.

Creating an AWS S3 Bucket

This guide walks you through creating a new Amazon S3 bucket and setting up an IAM user with permissions to access the bucket with Aspose.PDF for AWS to store processed files. These steps ensure secure and controlled access to your S3 resources.

Prerequisites

• An AWS account with sufficient permissions to create S3 buckets and IAM users.
• Access to the AWS Management Console.

Step 1: Create a New S3 Bucket

1. Log in to the AWS Management Console:

   • Navigate to the AWS Management Console.
   • Sign in with your AWS credentials.

2. Go to the S3 Service:

   • In the search bar, type “S3” and select Amazon S3 from the list.

3. Create a New Bucket:

   • Click on the Create bucket button.
   • Enter a unique name for your bucket in the Bucket name field (e.g., my-new-bucket-123).
   • Choose the AWS region where the bucket should be created.

4. Configure Bucket Settings:

   • Object Ownership: Choose whether the bucket will use ACLs (default) or bucket owner enforced settings.
   • Block Public Access Settings: Configure the bucket’s public access settings. It’s recommended to block all public access unless needed.
   • Bucket Versioning: Decide if you want to enable versioning (optional).
   • Tags: Add tags to the bucket if necessary.
   • Default Encryption: You can enable default encryption for all objects stored in the bucket.
   • Advanced Settings: Configure other settings as required (e.g., logging, Object Lock).

5. Create the Bucket:

   • Once all settings are configured, click Create bucket.

In result, a new S3 bucket is created and ready for use.

Step 2: Create an IAM User for S3 Bucket Access

1. Go to the IAM Service:

   • In the AWS Management Console, search for “IAM” and select IAM from the list.

2. Create a New User:

   • Click on Users in the left-hand menu, then click Add users.
   • Enter a username (e.g., aspose-pdf-user).
   • Select the Access key - Programmatic access option to generate an access key for this user.

3. Set Permissions for the User:

   • On the Set permissions page, choose Attach policies directly.
   • Search for and select the AmazonS3FullAccess policy to give the user full access to S3.
   • If you need more granular access, you can create a custom policy instead (see below).

4. Review and Create the User:

   • Review the settings and click Create user.
   • Make sure to download or securely store the user’s access key ID and secret access key, as you will not be able to view the secret key again.

In result, an IAM user with programmatic access to S3 is created.

Step 3: (Optional) Create a Custom IAM Policy for Specific S3 Access

If you need to grant more specific access to the S3 bucket, create a custom IAM policy.

1. Go to the IAM Policies Section:

   • In the IAM console, click on Policies in the left-hand menu, then click Create policy.

2. Write a Custom Policy:

   • In the JSON tab, paste the following JSON code, replacing my-new-bucket-123 with your bucket name:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "s3:ListBucket"
         ],
         "Resource": [
           "arn:aws:s3:::my-new-bucket-123"
         ]
       },
       {
         "Effect": "Allow",
         "Action": [
           "s3:PutObject",
           "s3:GetObject",
           "s3:DeleteObject"
         ],
         "Resource": [
           "arn:aws:s3:::my-new-bucket-123/*"
         ]
       }
     ]
   }

This policy allows the user to list objects in the bucket and perform PutObject, GetObject, and DeleteObject actions on objects within the specified bucket.

Attach the Policy to the User:

After creating the policy, go to the IAM user you created, and attach this custom policy to them.

In result, the IAM user now has specific access to the S3 bucket according to the custom policy.

Step 4: Test the IAM User Access

Use the AWS CLI or SDK:

Test the IAM user’s access to the S3 bucket using the AWS CLI or any AWS SDK by configuring the CLI with the user’s access key and secret key.

Example CLI command to upload a file:

aws s3 cp myfile.txt s3://my-new-bucket-123/myfile.txt

Verify Permissions:

Ensure the IAM user can perform the expected actions (e.g., uploading, listing, or deleting objects) and that permissions are working as intended. In result, the IAM user is verified to have the correct access to the S3 bucket.

Setup Container

Configuration

Our RESTful API is designed to process documents efficiently and securely on the AWS platform. To achieve this, we need to manage sensitive information and optimize performance across various deployment environments.

The task at hand is to ensure that our API is secure, scalable, and robust while simplifying deployment and maintenance processes. This involves configuring environment variables to handle sensitive data, control resource utilization, and enhance overall system stability.

To address these challenges, we have implemented the following environment variables to configure:

1. Storage configuration:

   • AWS_ACCESS_KEY and AWS_SECRET: Stored in environment variables of container definition to grant access to AWS S3 storage for input and output files.
   • AWS_BUCKET and AWS_REGION: AWS S3 storage name and region

2. Performance and Scalability:

   • MAX_BATCH_SIZE and MAX_BATCH_FILES: Set to control the load on the API, preventing resource overload and maintaining consistent performance.

3. Robustness and Reliability:

   • COMPlus_GCHeapHardLimit: Managed to control memory usage, preventing memory leaks and ensuring system stability under varying workloads.
   • OMP_THREAD_LIMIT: Set the maximum number of threads for Tesseract OCR.

4. Security

   • KEY_ENCRYPTION: Enable AWS Key Management Service for AWS S3 environment variables
   • DISABLE_UNMANAGED_PROCESS: Disallow external linux utils execution from the managed Aspose.DF for AWS product.

Environment variables are configured separately for each deployment environment (development, staging, production), streamlining the deployment process and simplifying configuration updates without altering the core application code.

Environment Variables

AWS_ACCESS_KEY

Output storage key.

Required

To store input and output files in an S3 bucket, you need an AWS access key. Ensure that you configure your environment with the correct AWS_ACCESS_KEY. If you work in different environments, you might need to change this value accordingly. By setting the appropriate access key, you will be able to store and retrieve files from your designated S3 bucket, ensuring smooth operation.

AWS_SECRET

Output storage secret.

Required

To store input and output files in an S3 bucket, you need an AWS secret key. Ensure that you configure your environment with the correct AWS_SECRET. If you work in different environments, you might need to change this value accordingly. By setting the appropriate secret key, you will be able to securely store and retrieve files from your designated S3 bucket, ensuring smooth and secure operations.

AWS_REGION_ENDPOINT

Output storage region.

Required

To store input and output files in an S3 bucket, you need to specify the correct AWS region. Ensure that you configure your environment with the appropriate AWS_REGION_ENDPOINT. If you work in different environments, you might need to change this value to switch between different regions. By setting the correct region endpoint, you will ensure that your files are stored and retrieved efficiently from the designated S3 region, optimizing performance and accessibility.

AWS_BUCKET

Output storage backet.

Required

To store input and output files in an S3 bucket, you need to specify the correct AWS_BUCKET. Ensure that you configure your environment with the appropriate bucket name. If you work in different environments, you might need to change this value to switch between different buckets. By setting the correct bucket, you will ensure that your files are stored and retrieved efficiently, enabling smooth operations across various environments.

TEMP_OUTPUT_DIRECTORY

Path temp files during processing.

Default Value: ./tempOutput/

Specify the directory path for temporarily saving output files. All files in this directory will be removed after the results are saved to S3. Customize the TEMP_OUTPUT_DIRECTORY based on your application’s requirements or environment setup. Changing this value might be necessary if you need to store output files in a different location or organize them differently, ensuring efficient file management during processing.

MAX_BATCH_SIZE

Max batch size.

Default Value: 52428800

Specify the maximum total file size for batch processing in bytes. Adjusting the MAX_BATCH_SIZE can optimize batch processing performance and resource utilization. Change this value if you encounter performance issues with large files or need to limit resource usage, ensuring efficient and effective batch processing.

MAX_BATCH_FILES

Max files count in batch for processing.

Default Value: 50

Specify the default number of files in a batch for processing. Adjusting the MAX_BATCH_FILES can optimize processing efficiency and resource usage. Change this value if you encounter performance issues with large batches or need to customize batch processing based on your workload, ensuring smooth and efficient batch processing.

MAX_INFLIGHT

Maximum number of tasks processed in parallel.

Default Value: 10

Define the maximum number of tasks that can be processed simultaneously. If the number of tasks exceeds this value, additional tasks will wait in the queue until resources become available. Adjusting the MAX_INFLIGHT setting helps manage resource utilization and can improve system stability and performance. Increase this value to allow more parallel processing if your system can handle the load, or decrease it if you need to limit concurrent processing to avoid overloading resources.

OMP_THREAD_LIMIT

This option useful for use with searchable pdf endpoint and Tesseract.

Default Value: 1

Set the number of threads for Tesseract to optimize performance. Adjusting the OMP_THREAD_LIMIT can improve processing efficiency based on your system resources and workload. Change this value if you encounter performance issues or need to optimize resource utilization, ensuring better performance and more efficient processing.

COMPlus_GCHeapHardLimit

Is for out of memory error message instead of reboot container in Kubernetes on exit memory limits.

Default Value: 1800000000

Set the GC heap hard limit for the .NET runtime in bytes to manage memory usage effectively. Adjusting the COMPlus_GCHeapHardLimit can help prevent avoid unnecessary container restarts in Kubernetes but large files will throws out-of-memory (OOM) errors. Change this value if you encounter OOM issues or need to fine-tune memory allocation to better suit your application’s needs.

DISABLE_UNMANAGED_PROCESS

This option allows you to disallow external process execution from the managed .NET application.

Default Value: no

You are managing a .NET application that might need to execute external processes, but for security or performance reasons, you want to control or prevent this behavior. To address this, you need to configure the DISABLE_UNMANAGED_PROCESS option to restrict or permit the execution of external processes from the application. If you want to allow the execution of external processes, set the value to “no”, which is the default. By setting the DISABLE_UNMANAGED_PROCESS option to “yes”, you disable formats that nos sported by Aspose.PDF library.

KEY_ENCRYPTION

In case it set to ’true’, then enables KMS encryption for environment variables AWS_ACCESS_KEY, AWS_SECRET, AWS_REGION_ENDPOINT, AWS_BUCKET.

Default Value: false

You are managing implementing KMS store for sensitive environment variables and need to enable it for Aspose.PDF for AWS.

Deploy Container on Amazon ECS

This guide provides step-by-step instructions on how to obtain an AWS Marketplace container and set it up in Amazon ECS with environment variables configured and using a host network on a public subnet.

Prerequisites

• Subscribe to Aspose Pdf for AWS product.
• Select the latest version of the product to obtain link to container in Elastic Container Registry

1. Obtain the AWS Marketplace Container repository url

Login to AWS Marketplace:

• Navigate to the AWS Marketplace.
• Search for Aspose.PDF for AWS container product.
• Click on the container product and subscribe to it.

View Product in Amazon ECR:

Once subscribed, repository url to the container image will be available as instruction on summary page:

aws ecr get-login-password –region | docker login –username AWS –password-stdin <account_id>.dkr.ecr..amazonaws.com docker pull <account_id>.dkr.ecr..amazonaws.com/aspose/aspose_pdf_for_aws:prod-

where ‘<account_id>.dkr.ecr..amazonaws.com/aspose/aspose_pdf_for_aws:prod-’ is a Aspose.PDF for AWS container url.

2. Set Up ECS Cluster

Create an ECS Cluster:

• Go to the Amazon ECS console.
• Choose Clusters from the left-hand navigation pane and click Create Cluster.
• Select EC2 Linux + Networking as the cluster template.

Configure the cluster:

• Choose an instance type (e.g., t3.large, m5.xLarge).
• Select your desired VPC and subnets.

Only for test purpose you can ensure the subnets are public to allow external access. To allow public internet access you need to configure the Security Group. Add inbound rules to the security group associated with the cluster instances:

• Allow HTTP/HTTPS traffic (ports 80/443).
• Ensure the security group allows traffic from your desired IP range (e.g., 0.0.0.0/0 for public access).

3. Create Task Definition

Task definition allows to deploy Aspose.PDF for AWS container for ECS cluster. To define the Task:

• In the ECS console, go to Task Definitions and click Create new Task Definition.
• Choose EC2 as the launch type compatibility.

Configure the task:

• Set a task role if needed for accessing other AWS services.
• Define the task memory and CPU, usually xLarge EC2 instance will handle batch file processing quickly.

Add Container:

• Under Container Definitions, click Add container.
• Set the container name to ‘aspose_pdf’ for example
• Enter repository url from subscribed summary: ‘<account_id>.dkr.ecr..amazonaws.com/aspose/aspose_pdf_for_aws:prod-’
• Set the 80 Port mappings to map container ports to the host.
• Set the Networking mode to host to use the host network.

Configure Environment Variables:

• Scroll down to the Environment section.
• Add the AWS S3 environment variables you need for the container to operate correctly.
  • AWS_ACCESS_KEY - IAM access key allowed to access S3 bucket.
  • AWS_SECRET - IAM access secret
  • AWS_BUCKET - your bucket to store processed files
  • AWS_REGION_ENDPOINT - your preferred region
• Add optional environment variable to limit memory allocation for Restful API to do not reboot container.
  • COMPlus_GCHeapHardLimit - This soft limit allow to stop process to allocate memory bigger then available in cluster setup. Hexadecimal value, the maximum commit size, in bytes, for the GC heap and GC bookkeeping.

Log Configuration:

• Configure logging to Amazon CloudWatch if desired by specifying a log group and stream.

4. Run the Task

Deploy the Task in the ECS Cluster:

• Go to the Clusters section in the ECS console.
• Select your cluster, then choose Tasks and click Run new Task.
• Select the task definition created earlier.
• Choose the host network mode.
• Only for test Ensure to select the appropriate public subnet(s) in the VPC.
• Click Run Task.

Verify the Task:

Once the task is running, you can check the logs and the status of the task from the ECS console. Access the application using the public IP address of the EC2 instances in your cluster.

5. Test the Application

Access the Application:

Once the stack is created, go to the outputs tab to find the link to the public IP. Access the web endpoint of the container solution and start using it. Using this IP address or DNS of the EC2 instance, access your application via the browser or API client. Access OpenAPI UI: To discover the product API with OpenAPI UI, you need to use the /swagger route.

Monitor and Troubleshoot:

Use the ECS console to monitor task performance and troubleshoot any issues using logs and metrics.

6. Configure for production

Configure security groups, IAM roles, and policies to control access to your ECS resources. Ensure that only authorized users and services can interact with the deployed container. Regularly update the container image to ensure security and performance.

Deploy Container on Amazon EKS

This guide outlines the steps to deploy an Aspose.PDF for AWS AWS Marketplace container to Amazon Elastic Kubernetes Service EKS using an EC2 instance from the client machine.

Prerequisites

Select EKS as the delivery method. Retain the default software version setting and continue to launch.

• Subscribe to Aspose Pdf for AWS product.

Once subscribed, repository url to the container image will be available as instruction on summary page:

aws ecr get-login-password –region | docker login –username AWS –password-stdin <account_id>.dkr.ecr..amazonaws.com docker pull <account_id>.dkr.ecr..amazonaws.com/aspose/aspose_pdf_for_aws:prod-

where ‘<account_id>.dkr.ecr..amazonaws.com/aspose/aspose_pdf_for_aws:prod-’ is a Aspose.PDF for AWS container url.

1. Create a new deployment IAM user

• Go to the AWS Management Console and navigate to the IAM service.
• Create a new user with AdministratorAccess policy.
• Download the security credentials (Access Key ID and Secret Access Key) for the IAM user, as you’ll need them in the next step.

2. Configure Linux Client Machine

Install AWS CLI, eksctl, and kubectl:

• Use the following user data script when launching the instance to automatically install the necessary tools:

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
sudo apt-get update
sudo apt-get install unzip
unzip awscliv2.zip
sudo ./aws/install
curl --silent --location "https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp
sudo mv /tmp/eksctl /usr/local/bin
curl -o kubectl https://amazon-eks.s3.us-west-2.amazonaws.com/1.21.2/2021-07-05/bin/linux/amd64/kubectl
chmod +x ./kubectl
sudo mv ./kubectl /usr/local/bin

• Verify the installation of the tools by running the following commands:

aws --version
eksctl version
kubectl version --short --client

• Configure the AWS CLI:

Run aws configure and enter the IAM user credentials you created earlier.

3. Create an EKS Cluster

For test purposes you need to create new EKS cluster or use existing staging environment for test deploy.

Use eksctl to create an EKS cluster, run the following command to create the cluster:

eksctl create cluster --name=mycluster \
                      --region=us-east-1 \
                      --zones=us-east-1a,us-east-1b \
                      --nodegroup-name mynodegroup \
                      --node-type=t3.xlarge \ 
                      --nodes=2 \  
                      --nodes-min=2 \
                      --nodes-max=4 \
                      --managed

• ECS Cluster Name: The name of the ECS cluster where the product will be deployed.
• ECS Cluster Security Group: The security group associated with the ECS cluster.
• Amazon VPC: The Amazon Virtual Private Cloud (VPC) where the product will deploy.
• Subnets: The subnets used by the ECS cluster.

For more information about eksctl, refer to the eksctl documentation.

4. Check Resources Created

The eksctl create cluster command will create the following resources:

• Custom VPC with public and private subnets.
• EC2 instances and an Auto Scaling group.
• CloudFormation stack.
• EKS cluster and node group.

The cluster will have two worker nodes of type t3.xlarge, placed in the public subnet by default.

5. Check Created Kubeconfig

Kubeconfig Setup:

• The eksctl command automatically updates the kubeconfig file on the client machine.
• The kubectl command uses this configuration to interact with the EKS cluster.
• The kubeconfig file is located at $HOME/.kube/config and contains information about clusters, users, namespaces, and authentication mechanisms.

6. Deploy the Application

Create a Kubernetes deployment and service:

Update the deploy.yaml file with the appropriate container image URI from your AWS Marketplace container.

Example deploy.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myaspose
spec:
  replicas: 2
  selector:
    matchLabels:
      app: myaspose
  template:
    metadata:
      labels:
        app: myaspose
    spec:
      containers:
        - name: myaspose
          image: <account_id>.dkr.ecr.<region>.amazonaws.com/aspose/aspose_pdf_for_aws:prod-<sha>
          ports:
            - containerPort: 80
          env:
            - name: AWS_REGION_ENDPOINT
              value: "us-east-1"
            - name: AWS_ACCESS_KEY
              value: "<my key>"
            - name: AWS_SECRET
              value: "<my secret>"
            - name: AWS_BUCKET
              value: "<my bucket>"

Example of service.yaml:

apiVersion: v1
kind: Service
metadata:
  name: myasopseserv
spec:
  selector:
    app: myasposepod
  ports:
    - protocol: TCP
      port: 80
  type: LoadBalancer

To apply the deployment and service, run the following command to create the deployment, replica set, pod, and service:

kubectl apply -f deploy.yaml

7. Verify the Deployment

Use the following commands to check the status of the deployment, replica set, pod, and service:

kubectl get deploy
kubectl get rs
kubectl get pod
kubectl get svc

To access the application, obtain the Load Balancer DNS name from the service output and access it in your browser to view the application.

Once the stack is created, go to the outputs tab to find the link to the public IP. Access the web endpoint of the container solution and start using it.

• Http listening port: To connect to the product API using HTTP, you need to use port 80.
• Https listening port: To connect to the product API using HTTPS, you need to add a certificate.
• Access OpenAPI UI: To discover the product API with OpenAPI UI, you need to use the /swagger route.

8. Delete the EKS Cluster after test

Delete the Kubernetes service:

Before deleting the cluster, manually delete the service or use the following command:

kubectl delete svc myasopseserv

Delete the EKS cluster using eksctl:

Run the following command to delete the cluster and associated resources:

eksctl delete cluster --name mycluster --region us-east-1

You also need to delete instance of Elastic Cloud Balancer.

Adhere to AWS security best practices by regularly updating Aspose.PDF for AWS container images, applying the latest security patches, and using IAM roles and policies to control access to your EKS resources. Encrypt sensitive data at rest and in transit, and regularly review and audit your security configurations to safeguard against potential threats.

Monitoring Health of Instance

Monitoring the health of product ECS or EKS instances is essential for maintaining the reliability and performance of your applications. By leveraging AWS CloudWatch Logs, you can track the status and performance of the service, identify issues, and troubleshoot effectively:

• An AWS account with the necessary permissions.
• An cluster with one or more running Aspose.PDF for AWS services.
• AWS CLI configured with your credentials.
• CloudWatch Logs enabled for the service.

Steps to Monitor Aspose.PDF for AWS on ECS Using Logs:

1. Create CloudWatch Log Group

CloudWatch Logs require a log group to store log streams.

To create a CloudWatch log group for your ECS service logs:

• Open the AWS Management Console and navigate to the CloudWatch section.
• Select “Logs” from the sidebar and click on “Create log group”.
• Name the log group /ecs/aspose_pdf (matching the log configuration in the task definition).

A CloudWatch log group is created to store ECS service logs.

2. Enable CloudWatch Logs for ECS Tasks

• Open the AWS Management Console and navigate to the ECS section.
• Select your task definition and create a new revision.
• In the “Container Definitions” section, add a log configuration.

    "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
            "awslogs-group": "/ecs/aspose_pdf",
            "awslogs-region": "us-east-1",
            "awslogs-stream-prefix": "ecs"
        }
    }

• Save and update your task definition.

Your ECS tasks are configured to send logs to CloudWatch Logs.

3. Update ECS Service to Use the New Task Definition

In case the ECS service needs to use the updated task definition that includes CloudWatch Logs configuration:

• Navigate to the ECS section in the AWS Management Console.
• Select your ECS service and update it to use the latest task definition revision.
• Deploy the updated service.

The ECS service is updated to use the new task definition with CloudWatch Logs enabled.

4. Access and Analyze ECS Service Logs

In case you need to access and analyze the logs to monitor the health of your ECS service. Use CloudWatch Logs to view and analyze ECS service logs:

• Open the AWS Management Console and navigate to the CloudWatch section.
• Select “Logs” from the sidebar and find the log group /ecs/aspose_pdf.
• Click on the log group to view log streams, which represent individual ECS tasks.
• Click on a log stream to view the logs generated by a specific task.

You can access and analyze ECS service logs in CloudWatch Logs.

5. Set Up CloudWatch Alarms for ECS Service Logs

In case you need to be alerted about potential issues with your ECS service. Create CloudWatch Alarms based on log metrics to monitor ECS service health:

• In the CloudWatch section of the AWS Management Console, navigate to “Alarms”.
• Click “Create Alarm” and select “Select metric”.
• Choose “Logs” as the metric source and select the relevant log group /ecs/aspose_pdf.
• Define a metric filter based on log patterns that indicate errors or issues.

    {
      "filterPattern": "ERROR",
      "metricName": "ErrorCount",
      "metricNamespace": "ECS/Logs"
    }

• Set up the alarm with conditions such as threshold and period.
• Configure notification actions, such as sending an email via Amazon SNS.

CloudWatch Alarms are set up to monitor ECS service logs and notify you of potential issues.

6. Automate Log Analysis with CloudWatch Insights

For analyzing large volumes of log data manually can be time-consuming. Use CloudWatch Logs Insights to automate log analysis:

• Open the AWS Management Console and navigate to the CloudWatch section.
• Select “Logs Insights” from the sidebar.
• Choose the log group /ecs/aspose_pdf.
• Use query language to analyze logs.

For example, to find the count of error messages:

    fields @timestamp, @message
    | filter @message like /ERROR/
    | stats count() by bin(1m)

• Run the query to get insights into your ECS service logs.

CloudWatch Logs Insights helps automate log analysis, providing quick insights into ECS service health.

Steps to Monitor Aspose.PDF for AWS on EKS Using Logs:

1. Create CloudWatch Log Group

CloudWatch Logs require a log group to store log streams.

To create a CloudWatch log group for your EKS service logs:

• Open the AWS Management Console and navigate to the CloudWatch section.
• Select “Logs” from the sidebar and click on “Create log group”.
• Name the log group /eks/aspose-pdf-service (matching the log configuration in Fluent Bit).

A CloudWatch log group is created to store EKS service logs.

2. Enable Fluent Bit for EKS Logging

To centralize logs from your EKS cluster, use Fluent Bit as a log router. Fluent Bit can collect logs from Kubernetes pods and send them to CloudWatch Logs.

• Deploy Fluent Bit as a DaemonSet in your EKS cluster. Use the following YAML configuration:

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluent-bit
  namespace: kube-system
spec:
  selector:
    matchLabels:
      k8s-app: fluent-bit-logging
  template:
    metadata:
      labels:
        k8s-app: fluent-bit-logging
    spec:
      containers:
      - name: fluent-bit
        image: amazon/aws-for-fluent-bit:latest
        volumeMounts:
        - name: varlog
          mountPath: /var/log
        - name: varlibdockercontainers
          mountPath: /var/lib/docker/containers
          readOnly: true
      volumes:
      - name: varlog
        hostPath:
          path: /var/log
      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers

Apply the configuration using kubectl:

kubectl apply -f fluent-bit-ds.yaml

Fluent Bit is now deployed and collecting logs from your EKS cluster.

3. Configure Fluent Bit to Send Logs to CloudWatch

To send logs to CloudWatch Logs, configure Fluent Bit with the appropriate output plugin.

Create a ConfigMap for Fluent Bit configuration:

apiVersion: v1
kind: ConfigMap
metadata:
  name: fluent-bit-config
  namespace: kube-system
  labels:
    k8s-app: fluent-bit-logging
data:
  fluent-bit.conf: |
    [SERVICE]
        Flush         1
        Log_Level     info
        Daemon        off
        Parsers_File  parsers.conf

    [INPUT]
        Name              tail
        Tag               kube.*
        Path              /var/log/containers/*.log
        Parser            docker
        DB                /var/log/flb_kube.db
        Mem_Buf_Limit     5MB
        Skip_Long_Lines   On
        Refresh_Interval  10

    [FILTER]
        Name                kubernetes
        Match               kube.*
        Kube_URL            https://kubernetes.default.svc:443
        Kube_CA_File        /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        Kube_Token_File     /var/run/secrets/kubernetes.io/serviceaccount/token
        Kube_Tag_Prefix     kube.var.log.containers.
        Merge_Log           On
        Merge_Log_Key       log_processed
        K8S-Logging.Parser  On
        K8S-Logging.Exclude Off

    [OUTPUT]
        Name                cloudwatch_logs
        Match               *
        region              us-east-`
        log_group_name      /eks/aspose_pdf
        log_stream_prefix   eks-
        auto_create_group   true    

Apply the ConfigMap using kubectl:

kubectl apply -f fluent-bit-config.yaml

Fluent Bit is now configured to send logs to CloudWatch Logs.

4. Access and Analyze EKS Service Logs

To access and analyze the logs to monitor the health of your EKS service, use CloudWatch Logs:

• Open the AWS Management Console and navigate to the CloudWatch section.
• Select “Logs” from the sidebar and find the log group /eks/aspose-pdf-service.
• Click on the log group to view log streams, which represent individual EKS pods.
• Click on a log stream to view the logs generated by a specific pod.

You can access and analyze EKS service logs in CloudWatch Logs.

5. Set Up CloudWatch Alarms for EKS Service Logs

To be alerted about potential issues with your EKS service, create CloudWatch Alarms based on log metrics:

• In the CloudWatch section of the AWS Management Console, navigate to “Alarms”.
• Click “Create Alarm” and select “Select metric”.
• Choose “Logs” as the metric source and select the relevant log group /eks/aspose-pdf-service.
• Define a metric filter based on log patterns that indicate errors or issues.

{
  "filterPattern": "ERROR",
  "metricName": "ErrorCount",
  "metricNamespace": "EKS/Logs"
}

• Set up the alarm with conditions such as threshold and period.
• Configure notification actions, such as sending an email via Amazon SNS.

CloudWatch Alarms are set up to monitor EKS service logs and notify you of potential issues.

6. Automate Log Analysis with CloudWatch Insights

For analyzing large volumes of log data manually can be time-consuming. Use CloudWatch Logs Insights to automate log analysis:

• Open the AWS Management Console and navigate to the CloudWatch section.
• Select “Logs Insights” from the sidebar.
• Choose the log group /eks/aspose_pdf
• Use query language to analyze logs.

For example, to find the count of error messages:

fields @timestamp, @message
| filter @message like /ERROR/
| stats count() by bin(1m)

Run the query to get insights into your EKS service logs.

CloudWatch Logs Insights helps automate log analysis, providing quick insights into EKS service health.

This guide describes for monitoring Aspose.PDF for AWS on Amazon EKS using logs, including steps to enable Fluent Bit, configure log forwarding, create CloudWatch log groups, access and analyze logs, set up alarms, and automate log analysis with CloudWatch Insights.

Monitoring the health of Aspose.PDF for AWS service using logs is crucial for maintaining the reliability and performance of your applications. By enabling CloudWatch Logs, accessing and analyzing log data, setting up alarms, and using CloudWatch Logs Insights, you can effectively monitor and manage your ECS services, ensuring timely identification of issues.

Handling Sensitive Customer Information

Managing sensitive customer information is critical in maintaining data security and compliance. Organizations need to ensure their document processing workflows are secure and protect customer data at every step.

Implement a comprehensive approach to handle sensitive information securely within the Aspose.PDF for AWS RESTful API. This involves configuring ports, setting up HTTPS certificates, managing file inputs and outputs, and ensuring data is protected throughout the processing lifecycle.

To address these requirements, follow these guidelines:

• Port Configuration: Ensure secure port changes to safeguard data transmission.
• HTTPS Certificates: Set up HTTPS certificates for both development and production environments to encrypt data in transit.
• File Handling: Use internal links to directly process files from customer S3 buckets, avoiding direct uploads via form data in the API.
• S3 Folders: Organize input and output data in designated S3 folders, and use temporary working folders that are automatically deleted after processing.
• Temporary Storage: Utilize EFS for temporary file storage to manage files securely during processing.
• Folder Removal: Employ API calls for immediate S3 folder removal after processing and downloading to prevent unauthorized access.
• Security Practices: Harden and secure customer S3 folders to protect data, and leverage AWS Key Management Service (KMS) for rotating secrets and environment variables to maintain secure operations.

By implementing these practices, organizations can effectively secure sensitive customer information throughout the document processing workflow. This approach ensures data integrity, compliance with security standards, and maintains customer trust.

Change Ports on ECS

This guide will help you modify and update ports for Aspose.PDF for AWS container deployed on Amazon ECS using task definitions. Proper port configuration ensures your applications run on the correct ports, maintaining consistency across different environments.

Step 1: Set Port Mappings in the Task Definition

In the ECS task definition, navigate to the “Container Definitions” section where you define your container’s settings. Here, you’ll set the port mappings to ensure the container uses the correct ports.

• Open the ECS Task Definition
• Go to the ECS Console.
• Choose your Task Definition.
• Select the revision to update or create a new revision.
• Edit the Container Definition
• Under “Container Definitions”, select the container you want to configure.
• Scroll to the “Port mappings” section.
• Define the Port Mappings
• Container port: Enter the port on which your application listens inside the container (e.g., 80 or 8080).
• Host port: Enter the port on the host machine that will forward traffic to the container (e.g., 8000).

Example:

"portMappings": [
    {
        "containerPort": 80,
        "hostPort": 8000
    }
]

Container port: The port your application listens to within the container. Host port: The port on the ECS host that routes traffic to the container.

Step 2: Configure Environment Variables

Next, you’ll need to set the necessary environment variables within the ECS task definition to ensure your ASP.NET application uses the correct ports.

• Locate the Environment Variables Section
• Within the same “Container Definitions” section, scroll down to the “Environment variables” section.
• Add the environment variables ASPNETCORE_HTTP_PORTS, ASPNETCORE_HTTPS_PORTS, and ASPNETCORE_URLS to specify the desired ports.

Example:

"environment": [
    {
        "name": "ASPNETCORE_HTTP_PORTS",
        "value": "80"
    },
    {
        "name": "ASPNETCORE_URLS",
        "value": "http://*:80"
    }
]

ASPNETCORE_HTTP_PORTS: Defines the HTTP port inside the container. ASPNETCORE_URLS: Configures the application to listen on the specified ports.

Step 3: Update Ports in the Task Definition

If changing the default port (e.g., from 80 to 8080), ensure you update both the “Port mappings” and the “Environment variables” sections accordingly.

• Change the containerPort and hostPort in the “Port mappings” section to the new port.

Example:

"portMappings": [
    {
        "containerPort": 8080,
        "hostPort": 8000
    }
]

• Modify the ASPNETCORE_HTTP_PORTS and ASPNETCORE_URLS values to reflect the new port.

Example:

"environment": [
    {
        "name": "ASPNETCORE_HTTP_PORTS",
        "value": "8080"
    },
    {
        "name": "ASPNETCORE_URLS",
        "value": "http://*:8080"
    }
]

Configuring ports within your ECS task definition ensures that your Docker ASP.NET applications run on the desired ports. By properly setting the Port mappings and “Environment variables” fields, you can maintain consistency and prevent port conflicts across different environments.

Changing Ports on EKS

This section guides you through modifying the ports used by Aspose.PDF for AWS deployed on Amazon EKS. Proper port configuration ensures the application listens on the correct ports within the Kubernetes cluster.

Step 1: Update Container Port in Deployment YAML

The first step is to update the container port and set the necessary environment variables in your Kubernetes deployment YAML file.

• Locate the Deployment YAML File
• Open your Kubernetes deployment YAML file.
• Modify the Container Port and Set Environment Variables
• Under the spec section, find the containers field. Update the containerPort to the desired port number (e.g., from 80 to 8080).
• Add the environment variables ASPNETCORE_HTTP_PORTS and ASPNETCORE_URLS to ensure the application listens on the correct ports.

Example:

spec:
  containers:
  - name: myaspose
    image: <account_id>.dkr.ecr.<region>.amazonaws.com/aspose/aspose_pdf_for_aws:prod-<sha>
    ports:
    - containerPort: 8080
    env:
    - name: ASPNETCORE_HTTP_PORTS
      value: "8080"
    - name: ASPNETCORE_URLS
      value: "http://*:8080"

containerPort: The port your application listens to inside the container. ASPNETCORE_HTTP_PORTS: Specifies the HTTP port inside the container. ASPNETCORE_URLS: Configures the application to listen on the specified port.

Step 2: Configure Service to Use New Port

Ensure that your Kubernetes service is configured to use the new port.

• Locate the Service YAML File
• Open your Kubernetes service YAML file associated with the deployment. Update the Target Port and Port:
• Under the spec section, update the port and targetPort fields to the new port number. Example:

spec:
  ports:
  - port: 80
    targetPort: 8080

Explanation:

port: The port exposed by the service. targetPort: The port that the service forwards traffic to inside the container.

Step 3: Modify Ingress Rules (If Applicable)

If your application is exposed via an Ingress resource, update the Ingress rules to route traffic to the new port.

• Locate the Ingress YAML File
• Open the Ingress YAML file.
• Update the Service Port
• Under the rules section, find the service and update the servicePort to match the new service port.

Example:

spec:
  rules:
  - host: my-app.com
    http:
      paths:
      - path: /
        backend:
          serviceName: my-app-service
          servicePort: 80

Explanation:

servicePort: The port that the Ingress controller directs traffic to in the service.

By updating the container port, service, and Ingress configuration, and setting the necessary environment variables, you ensure that your Docker ASP.NET application on EKS listens on the correct port, maintaining consistent access across your Kubernetes cluster.

Refer to the official Kubernetes documentation for more detailed guidance on configuring ports and managing Kubernetes resources.

Setting Up HTTPS Certificate

To guide developers through the setup and configuration of HTTPS certificates for ASP.NET containers. This ensures secure communication and prevents potential security threats like person-in-the-middle attacks.

Step 1: Generate HTTPS Development Certificate

Use the following command to generate an HTTPS development certificate and export it to a specified path.

dotnet dev-certs https -ep ${HOME}/.aspnet/https/aspnetapp.pfx -p <CREDENTIAL_PLACEHOLDER>

Explanation:

-ep ${HOME}/.aspnet/https/aspnetapp.pfx: Specifies the export path for the certificate.

-p <CREDENTIAL_PLACEHOLDER>: Placeholder for the password to protect the certificate.

Step 2: Trust the HTTPS Development Certificate

Run the command to trust the generated development certificate on your machine.

dotnet dev-certs https --trust

Explanation:

This command adds the development certificate to the trusted certificate store on your machine.

Step 3: Pull the ASP.NET Sample Docker Image

Pull the ASP.NET sample image from Microsoft’s container registry.

docker pull mcr.microsoft.com/dotnet/samples:aspnetapp

Explanation:

This command fetches the sample ASP.NET application image from the specified registry.

Step 4: Run the Docker Container with HTTPS Configuration

Run the Docker container with the necessary environment variables and volume mappings for HTTPS configuration.

docker run --rm -it -p 8000:80 -p 8001:443 \
-e ASPNETCORE_URLS="https://+;http://+" \
-e ASPNETCORE_HTTPS_PORTS=8001 \
-e ASPNETCORE_Kestrel__Certificates__Default__Password="<CREDENTIAL_PLACEHOLDER>" \
-e ASPNETCORE_Kestrel__Certificates__Default__Path=/https/aspnetapp.pfx \
-v ${HOME}/.aspnet/https:/https/ \
mcr.microsoft.com/dotnet/samples:aspnetapp

Explanation:

–rm: Automatically remove the container when it exits. -it: Interactive terminal mode. -p 8000:80 -p 8001:443: Maps host ports 8000 and 8001 to container ports 80 and 443.

-e ASPNETCORE_URLS=“https://+;http://+”: Configures the application URLs.

-e ASPNETCORE_HTTPS_PORTS=8001: Sets the HTTPS port.

-e ASPNETCORE_Kestrel__Certificates__Default__Password="<CREDENTIAL_PLACEHOLDER>": Provides the certificate password.

-e ASPNETCORE_Kestrel__Certificates__Default__Path=/https/aspnetapp.pfx: Specifies the certificate path inside the container.

-v ${HOME}/.aspnet/https:/https/: Maps the local certificate directory to the container.

Step 5: Update CA Certificates in Docker Container

If you need to update the CA certificates in your Docker container, use the following command:

docker run -v /host/path/to/certs:/container/path/to/certs -d IMAGE_ID "update-ca-certificates"

Explanation:

-v /host/path/to/certs:/container/path/to/certs: Maps the host certificate directory to the container.

-d IMAGE_ID: Runs the container in detached mode with the specified image ID.

“update-ca-certificates”: Command to update the CA certificates in the container.

Additional Resources:

SSL on Amazon Linux 2

Certificate Signing on Amazon EKS

End-to-End TLS Encryption on Amazon EKS

Security Recommendation

Use HTTPS (TLS) to ensure encrypted connections and protect against eavesdropping and network manipulation. Apply the aws:SecureTransport condition in your Amazon S3 bucket policies to enforce HTTPS-only connections. n in your Amazon S3 bucket policies to enforce HTTPS-only connections.

Document with Passwords

You may need to process encrypted documents through our containerized REST API, with support for various operations such as merging, converting, and splitting.

To ensure secure processing, a password is required to unlock encrypted documents before any operation.

Our API supports the documentPassword form parameter across all endpoints, allowing you to specify the necessary password for your documents. In the current version, when submitting multiple documents in a single request, the same password must be used for all. If your documents have different passwords, you can achieve this by running multiple concurrent API calls, each handling one document at a time with its specific password.

This approach provides you with a secure and flexible way to process encrypted documents across all our REST API endpoints, ensuring that your operations run smoothly, whether you’re working with single or multiple documents.

File Uploads via External and Internal Links

When working with various data sources, you often need a flexible approach to file management. Our RESTful API provides robust solutions for uploading files from external web links and internal S3 storage. Internal links are particularly useful for creating workflows, such as sending a file from one processing step (e.g., ‘merge’) to another (e.g., ’lock’), allowing for multiple operations on a document. Additionally, the API supports applying security measures like document locking, ensuring that you can effectively integrate, manage, and secure your files regardless of their source.

Uploading Files via External and Internal Links The API supports uploading files from both external and internal sources. This capability allows you to handle files from diverse origins and manage them seamlessly within your application.

External Links

• Format: The URLs provided should be well-formed and follow the format specified by the inputFormat query parameter.
• Form Data Key: Use unique keys that start with link_ to specify each external link. For example: link_: URL of the external file.

Internal Links

• Format: Internal links should be formatted as {folderName}?file={fileName}.
• Form Data Key: Use unique keys that start with link_ to specify each internal link. For example: link_: URL of the internal S3 object.

Example of Uploading Files

Example of Document Locking from uploaded files, external url and internal link to S3 file.

curl -X POST "https://yourapiendpoint/pdf/webapi/lock?passw=yourpassword" \
-H "Content-Type: multipart/form-data" \
-F "files=@/path/to/document1.pdf" \
-F "files=@/path/to/additional_file.pdf" \
-F "link_1=https://example.com/file1.pdf" \
-F "link_2=feeba224-a78b-436c-bb2a-b515d3ed2369?file=file2.pdf"

Response:

{
  "status": "Processing",
  "folderName": "7088936f-bcf4-40b9-a06f-d7ca21f3f33e"
}

AWS S3 File Storage Structure

Persistent storage

• Input Documents: Input documents are stored in Amazon S3 in a folder named in_<folder_id>, where <folder_id> is the unique identifier for the folder.

  s3://your-bucket-name/in_<folder_id>/

• Output Documents:

Output documents are stored in Amazon S3 in a folder named <folder_id>.

s3://your-bucket-name/<folder_id>/

Temporary storage

The application uses a temporary local directory for intermediate processing:

Temporary Directory configured with TEMP_OUTPUT_DIRECTORY environment variable that have default path to /app/tempOutput/

Files in this directory are removed after processing to ensure efficient resource usage.

Remark: For enhanced security, consider using encrypted file storage EFS for the temporary directory when running containers in ECS or EKS.

Using Encrypted File Storage

To use encrypted file storage for your temporary directory in Amazon ECS or EKS, follow these steps:

Amazon ECS

1. Create an Amazon EFS Elastic File System:

   • Go to the Amazon EFS console.
   • Click on “Create file system.”
   • Follow the steps to create a new file system. Ensure that you enable encryption at rest.

2. Mount the EFS to Your ECS Task:

   • In your ECS task definition, add a volume for the EFS.
   • Specify the file system ID and the directory path you want to use.
   • Update your container definition to mount the volume at the desired path (e.g., /tempOutput/).
   • Update your container environment variable TEMP_OUTPUT_DIRECTORY to be /tempOutput/.

Amazon EKS

1. Create an Amazon EFS (Elastic File System):

   • Go to the Amazon EFS console.
   • Click on “Create file system.”
   • Follow the steps to create a new file system. Ensure that you enable encryption at rest.

2. Install the Amazon EFS CSI Driver:

   • Follow the instructions in the Amazon EFS CSI Driver documentation to install the driver in your EKS cluster.

3. Create a Persistent Volume (PV) and Persistent Volume Claim (PVC):

   • Define a Persistent Volume (PV) that references your EFS.
   • Create a Persistent Volume Claim (PVC) to request storage from the PV.

4. Mount the PVC to Your Pod:

   • In your Kubernetes pod definition, add a volume that references the PVC.
   • Specify the mount path in the container (e.g., /tempOutput/).
   • Update your container environment variable TEMP_OUTPUT_DIRECTORY to be /tempOutput/.

By following these steps, you can ensure that your temporary directory uses encrypted file storage, providing enhanced security for your data.

Immediate Remove of processed files

The remove endpoint in your RESTful API is crucial for ensuring data safety and proper data retention management. This endpoint allows for the immediate removal of processed files from storage, providing several key benefits:

• Data Security: By enabling immediate deletion of files, sensitive information is promptly removed from storage, reducing the risk of unauthorized access or data breaches.
• Compliance: Many regulations and industry standards require the timely deletion of data after processing. This endpoint helps ensure compliance with these legal and regulatory requirements.
• Storage Management: Regular removal of unnecessary files helps in efficient storage management, preventing clutter and optimizing storage resources.
• Performance Optimization: Keeping storage clean by removing outdated files can improve overall system performance, as the system can focus on managing active and relevant data.

cURL Snippet:

curl -X POST "https://yourapiendpoint/remove/{id}" \
-H "Content-Type: application/json" \
-d '{"id": "your-folder-id"}'

Responses: 200: Returns a FileResponse object indicating that all files were successfully removed. 400: Indicates the file does not exist or there was an error processing the request. 500: Indicates a server error.

Other Methods for File Retention in AWS S3

In addition to immediate removal, AWS S3 provides several other methods for managing file retention, ensuring data safety and compliance with retention policies:

S3 Lifecycle Policies:

• Automated Transition and Expiration: Define S3 lifecycle rules to transition objects to different storage classes (e.g., from S3 Standard to S3 Glacier) or to expire objects after a specified period. Cost Management: Helps reduce costs by automatically moving data to more cost-effective storage classes as it ages. Object Lock:

• WORM (Write Once Read Many) Compliance: Enforces a write-once-read-many model, preventing objects from being deleted or overwritten for a specified retention period. Retention Periods and Legal Holds: Use retention periods and legal holds to protect objects from deletion for regulatory compliance and legal requirements. Versioning:

• Object Versioning: Maintain multiple versions of an object, allowing you to recover from unintended user actions or application failures. Data Recovery: Easily restore previous versions of objects to recover from accidental deletions or modifications. Cross-Region Replication:

• Data Redundancy: Automatically replicate objects across different AWS regions to enhance data durability and availability. Disaster Recovery: Ensure data resilience and support disaster recovery strategies by maintaining copies of data in different geographic locations. S3 Intelligent-Tiering:

• Automated Cost Optimization: Automatically moves data between frequent and infrequent access tiers based on changing access patterns, optimizing storage costs. No Retrieval Fees: Provides cost-effective storage management without retrieval fees for infrequently accessed data.

By utilizing these methods alongside the immediate remove feature, you can implement a comprehensive data retention strategy that balances cost, compliance, and performance while ensuring the safety and integrity of your data in AWS S3.

Securing S3 Bucket

This guide provides steps to create and configure IAM policies for securing an S3 bucket such that users can delete files but not edit, and only upload new files without listing objects. Files will be stored in a Guid folder to create unique random paths.

1. IAM Policies

• Policy for Allowing Deletion but Not Editing

This policy allows users to delete objects but not update or edit existing objects, and they cannot list objects in the bucket.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::your-bucket-name/*"
        },
        {
            "Effect": "Deny",
            "Action": [
                "s3:PutObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::your-bucket-name",
                "arn:aws:s3:::your-bucket-name/*"
            ]
        }
    ]
}

• Policy for Allowing Only Uploads of New Files

This policy allows users to upload new files but not delete or overwrite existing ones. Users cannot list objects in the bucket.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::your-bucket-name/*",
            "Condition": {
                "StringNotEqualsIfExists": {
                    "s3:x-amz-copy-source": [
                        "",
                        "arn:aws:s3:::your-bucket-name/*"
                    ]
                }
            }
        },
        {
            "Effect": "Deny",
            "Action": [
                "s3:DeleteObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::your-bucket-name",
                "arn:aws:s3:::your-bucket-name/*"
            ]
        }
    ]
}

2. Attach Policies to IAM Roles or Users

To restrict unwanted behavior for app container IAM, you need to select an IAM user/role that you want to assign the policies to. Attach the above policies to the user/role via the AWS Management Console, CLI, or SDK.

Rotating HTTPS Certificates on ECS

Rotating HTTPS certificates is a crucial security practice to ensure the ongoing protection of the Aspose.PDF for AWS RESTful API. This process involves replacing an existing HTTPS certificate with a new one before the old certificate expires or becomes compromised.

Prerequisites

• Access to the ECS cluster and the ability to update task definitions.
• Administrative access to the server where your API is hosted.
• A new HTTPS certificate issued by a trusted Certificate Authority (CA).

Steps to Rotate HTTPS Certificates

Step 1: Obtain a New HTTPS Certificate

If your existing HTTPS certificate is expiring or compromised, obtain a new certificate from a trusted Certificate Authority (CA).

• Generate a Certificate Signing Request (CSR): Run the CSR generation command on your server.
• Submit the CSR to a CA: Complete the validation process.
• Download the Issued Certificate: Obtain the new certificate along with any necessary intermediate and root certificates provided by the CA.

In result, you have a new HTTPS certificate and any necessary intermediate and root certificates.

Step 2: Backup the Existing Certificate

Before making any changes, it’s essential to backup the existing certificate.

• Locate the Current Certificate File: Identify the .pfx or .pem file on your server.
• Copy to a Secure Location: Create a backup of the current certificate file.

In result, a backup of the existing certificate is safely stored.

Step 3: Update the ECS Task Definition

To replace the certificate in an ECS environment, you must update the task definition.

• Locate Your Current Task Definition
• In the AWS Management Console, navigate to the ECS service.
• Find and select the task definition used by your ASP.NET Core application.
• Modify the Task Definition
• Create a new revision of the task definition.
• Under the volumes section, ensure a volume is defined for the certificate location.
• In the containerDefinitions, update the mountPoints to use the new certificate path.

Example:

{
  "volumes": [
    {
      "name": "certs",
      "host": {
        "sourcePath": "/etc/ssl/certs"
      }
    }
  ],
  "containerDefinitions": [
    {
      "name": "myaspose",
      "image": "<account_id>.dkr.ecr.<region>.amazonaws.com/aspose/aspose_pdf_for_aws:prod-<sha>",
      "mountPoints": [
        {
          "sourceVolume": "certs",
          "containerPath": "/etc/ssl/certs",
          "readOnly": true
        }
      ],
      "environment": [
        {
          "name": "ASPNETCORE_Kestrel__Certificates__Default__Path",
          "value": "/etc/ssl/certs/new-certificate.pfx"
        },
        {
          "name": "ASPNETCORE_Kestrel__Certificates__Default__Password",
          "value": "your-certificate-password"
        }
      ]
    }
  ]
}

The volumes section defines where the certificate is stored on the host. The mountPoints section maps this volume to the container. The environment variables are updated to point to the new certificate file and its password.

In result, the task definition is configured to use the new certificate.

Step 4: Deploy the Updated Task Definition

Once the task definition is updated, you need to deploy it.

• Update the ECS Service
• Navigate to your ECS service.
• Update the service to use the new task definition revision.
• This will trigger a rolling update, where new tasks are started with the new certificate, and old tasks are drained and stopped.

In result, the new certificate is deployed, and the application begins using it.

Step 5: Verify the New Certificate

Ensuring the new certificate is correctly installed and functional is crucial.

• Access the Application: Open a browser and navigate to your API’s URL.
• Check the Certificate: Click the padlock icon in the browser’s address bar to view the certificate details.
• Verify: Ensure the new certificate is displayed and the connection is secure.

In result, the new HTTPS certificate is correctly installed and operational.

Step 6: Monitor Certificate Validity

Monitoring the certificate’s validity and documenting the process is important for future reference.

• Set Up Monitoring: Use tools like AWS Certificate Manager or other monitoring solutions to alert you before the new certificate expires.
• Document the Process: Record the steps taken during the certificate rotation for future use.

In result, continuous monitoring is in place, and the rotation process is documented.

Integrating AWS Key Management Service on ECS

Amazon Web Services (AWS) Key Management Service (KMS) provides a secure and resilient service for creating and managing cryptographic keys. Integrating KMS with Docker environment variables in Amazon Elastic Container Service (ECS) ensures sensitive data, such as API keys and database credentials, are securely encrypted.

Prerequisites

• An AWS account with the necessary permissions.
• An ECS cluster and a running ECS service.
• AWS CLI configured with your credentials.
• Docker installed on your local machine.
• A KMS key created in AWS.

Steps to Integrate AWS KMS with Docker Environment Variables for ECS

1. Create a KMS Key

In case you need a KMS key to encrypt and decrypt sensitive data, create a new KMS key in AWS:

• Open the AWS Management Console.
• Navigate to the KMS section.
• Click on “Create key” and follow the prompts to configure your key.
• Note the Key ID or ARN of the newly created key.

In result, a new KMS key is created and ready for use.

2. Encrypt Environment Variables Using KMS

The sensitive data needs to be encrypted using the KMS key. To encrypt the environment variables using AWS KMS:

• Use the AWS CLI to encrypt your environment variables. Replace and with your KMS key ID and the data you want to encrypt.

aws kms encrypt --key-id <your-kms-key-id> --plaintext <your-secret-data> --query CiphertextBlob --output text

• The command outputs a base64-encoded ciphertext. Note this value.

In result, your environment variables are securely encrypted.

3. Store Encrypted Variables in AWS Secrets Manager (Optional)

In case, you want to securely store and manage encrypted variables, store the encrypted variables in AWS Secrets Manager:

• Open the AWS Management Console and navigate to Secrets Manager.
• Click on “Store a new secret”.
• Choose “Other type of secret” and input your encrypted data.
• Follow the prompts to create the secret, and note the Secret ARN.

In result, encrypted environment variables are stored securely in Secrets Manager.

4. Configure IAM Roles and Policies

The ECS tasks need permissions to use KMS for decryption, to attach the necessary IAM roles and policies:

• Navigate to the IAM section in the AWS Management Console.
• Create a new IAM policy with permissions to decrypt using the KMS key.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "<your-kms-key-arn>"
    }
  ]
}

• Attach this policy to the ECS task execution role.

In result, the ECS task has the necessary permissions to decrypt environment variables.

5. Update ECS Task Definition

You need to pass the encrypted environment variables to your ECS tasks. To update the ECS task definition to include the encrypted environment variables:

• Navigate to the ECS section in the AWS Management Console.
• Select your task definition and create a new revision.
• Under the “Container Definitions” section, add environment variables using the encrypted values.
• If using Secrets Manager, reference the secrets.

{
  "name": "MY_SECRET",
  "valueFrom": "arn:aws:secretsmanager:region:account-id:secret:your-secret-name"
}

In result, the task definition includes encrypted environment variables.

6. Update the ECS Service

The ECS service needs to use the updated task definition, to update the ECS service to use the new task definition revision:

• Navigate to the ECS section in the AWS Management Console.
• Select your ECS service and update it to use the latest task definition revision.
• Deploy the updated service.

In result, the ECS service uses the updated task definition with encrypted environment variables.

7. Decrypt Environment Variables in Aspose.PDF tor AWS

You can configure the decryption of environment variables encrypted with AWS Key Management Service (KMS). To enable or disable the decryption of KMS environment variables, use the KEY_ENCRYPTION environment variable:

• KEY_ENCRYPTION = 'true': When set to 'true', the API will attempt to decrypt the environment variables using AWS KMS before use.
• KEY_ENCRYPTION = 'false': When set to 'no', the API will use the environment variables as-is without attempting decryption.

Integrating AWS KMS with Docker environment variables in Amazon ECS enhances the security of sensitive data in your applications. By following these steps, you ensure that sensitive environment variables are encrypted, securely stored, and decrypted only when needed by your application, thereby reducing the risk of exposure.

Rotating HTTPS Certificates on EKS

Rotating HTTPS certificates is a crucial security practice to ensure the ongoing protection of the Aspose.PDF for AWS RESTful API. This process involves replacing an existing HTTPS certificate with a new one before the old certificate expires or becomes compromised.

Prerequisites

• Access to your Kubernetes cluster on EKS.
• Administrative access to the server where your API is hosted.
• A new HTTPS certificate issued by a trusted Certificate Authority (CA).
• Familiarity with Kubernetes deployment YAML files and configuration.

Steps to Rotate HTTPS Certificates

Step 1: Obtain a New HTTPS Certificate

If your existing HTTPS certificate is expiring or compromised, obtain a new certificate from a trusted Certificate Authority (CA).

• Generate a Certificate Signing Request (CSR): Run the CSR generation command on your server.
• Submit the CSR to a CA: Complete the validation process.
• Download the Issued Certificate: Obtain the new certificate along with any necessary intermediate and root certificates provided by the CA.

In result, you have a new HTTPS certificate and any necessary intermediate and root certificates.

Step 2: Backup the Existing Certificate

Before making any changes, it’s essential to backup the existing certificate.

• Locate the Current Certificate File: Identify the .pfx or .pem file on your server.
• Copy to a Secure Location: Create a backup of the current certificate file.

In result, a backup of the existing certificate is safely stored.

Step 3: Update the Kubernetes Secrets

In an EKS environment, certificates are often managed through Kubernetes secrets. You’ll need to update these secrets with the new certificate.

• Create a New Secret for the Certificate
• Use kubectl to create a new secret that includes the new certificate and private key.

Example:

kubectl create secret tls my-api-tls --cert=/path/to/new-certificate.crt --key=/path/to/private.key

This command creates a new TLS secret named my-api-tls using the new certificate and private key files.

In result, the new certificate is stored as a Kubernetes secret.

Step 4: Update the Deployment to Use the New Secret

Update your Kubernetes deployment to reference the new certificate secret.

• Locate the Deployment YAML File
• Open your Kubernetes deployment YAML file for the ASP.NET Core application.
• Modify the Deployment
• In the spec section under containers, add a volumeMounts section to mount the secret containing the certificate.
• Add a corresponding volumes section to define the secret.

Example:

spec:
  containers:
  - name: myaspose
    image: <account_id>.dkr.ecr.<region>.amazonaws.com/aspose/aspose_pdf_for_aws:prod-<sha>
    volumeMounts:
    - name: tls-secret
      mountPath: /etc/ssl/certs
    env:
    - name: ASPNETCORE_Kestrel__Certificates__Default__Path
      value: "/etc/ssl/certs/tls.crt"
    - name: ASPNETCORE_Kestrel__Certificates__Default__Password
      value: "your-certificate-password"
  volumes:
  - name: tls-secret
    secret:
      secretName: my-api-tls

The volumeMounts section specifies where to mount the secret in the container. The volumes section defines the secret to be mounted. The environment variables ASPNETCORE_Kestrel__Certificates__Default__Path and ASPNETCORE_Kestrel__Certificates__Default__Password point to the new certificate and its password.

In result, the deployment is configured to use the new certificate stored in the Kubernetes secret.

Step 5: Deploy the Updated Configuration

Once the deployment YAML is updated, apply the changes to your EKS cluster.

• Apply the Deployment
• Use kubectl to apply the updated deployment.

kubectl apply -f my-deployment.yaml

This command updates the running pods to use the new certificate.

In result, the updated deployment is applied, and the application begins using the new certificate.

Step 6: Verify the New Certificate

Ensuring the new certificate is correctly installed and functional is crucial.

• Access the Application: Open a browser and navigate to your API’s URL.
• Check the Certificate: Click the padlock icon in the browser’s address bar to view the certificate details.
• Verify: Ensure the new certificate is displayed and the connection is secure.

In result, the new HTTPS certificate is correctly installed and operational.

Step 7: Monitor Certificate Validity

Monitoring the certificate’s validity and documenting the process is important for future reference.

• Set Up Monitoring: Use tools like AWS Certificate Manager or other monitoring solutions to alert you before the new certificate expires.
• Document the Process: Record the steps taken during the certificate rotation for future use.

In result, continuous monitoring is in place, and the rotation process is documented.

Integrating AWS Key Management Service on EKS

Amazon Web Services (AWS) Key Management Service (KMS) provides a secure and resilient service for creating and managing cryptographic keys. Integrating KMS with Docker environment variables in Amazon Elastic Kubernetes Service (EKS) ensures sensitive data, such as API keys and database credentials, are securely encrypted.

Prerequisites

• An AWS account with the necessary permissions.
• An EKS cluster and kubectl configured to interact with it.
• AWS CLI configured with your credentials.
• Docker installed on your local machine.
• A KMS key created in AWS.

Steps to Integrate AWS KMS with Docker Environment Variables for EKS

1. Create a KMS Key

In case you need to protect AWS_ACCESS_KEY, AWS_SECRET, AWS_REGION_ENDPOINT, AWS_BUCKET, you need a KMS keys to encrypt and decrypt sensitive data.

To create a new KMS key in AWS.

• Open the AWS Management Console.
• Navigate to the KMS section.
• Click on “Create key” and follow the prompts to configure your key.
• Note the Key ID or ARN of the newly created key.

In result, a new KMS key is created and ready for use.

2. Encrypt Environment Variables Using KMS

To protect this sensitive data, it needs to be encrypted using the KMS key.

To encrypt the environment variables, use the AWS CLI to encrypt your environment variables. Replace and with your KMS key ID and the data you want to encrypt.

aws kms encrypt --key-id <your-kms-key-id> --plaintext <your-secret-data> --query CiphertextBlob --output text

• The command outputs a base64-encoded ciphertext. Note this value.

In result, your environment variables are securely encrypted.

3. Store Encrypted Variables in AWS Secrets Manager (Optional)

In case you want to securely store and manage encrypted variables, store the encrypted variables in AWS Secrets Manager:

• Open the AWS Management Console and navigate to Secrets Manager.
• Click on “Store a new secret”.
• Choose “Other type of secret” and input your encrypted data.
• Follow the prompts to create the secret, and note the Secret ARN.

In result, encrypted environment variables are stored securely in Secrets Manager.

4. Configure IAM Roles and Policies

For improve EKS pods to use KMS secrets, need permissions to use KMS for decryption. To attach the necessary IAM roles and policies:

• Navigate to the IAM section in the AWS Management Console.
• Create a new IAM policy with permissions to decrypt using the KMS key.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "<your-kms-key-arn>"
    }
  ]
}

Attach this policy to the IAM role associated with your EKS nodes or configure IAM roles for service accounts (IRSA) for specific pods. If using IRSA, create a Kubernetes service account and annotate it with the IAM role ARN.

In result, the EKS pods have the necessary permissions to decrypt environment variables.

5. Update Kubernetes Secrets

To pass the encrypted environment variables to your EKS pods, create or update Kubernetes secrets with the encrypted environment variables:

• Create a Kubernetes secret with the encrypted environment variables.

apiVersion: v1
kind: Secret
metadata:
  name: secret
data:
  MY_SECRET: <base64-encoded-ciphertext>

• Apply the secret to your cluster.

kubectl apply -f secret.yaml

In result, the Kubernetes secret containing encrypted environment variables is created.

6. Update Kubernetes Deployment

To enhance EKS deployment with Kubernetes secret, update the Kubernetes deployment to include the secret as environment variables:

• Edit your Kubernetes deployment to reference the secret.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: aspose_pdf
  template:
    metadata:
      labels:
        app: aspose_pdf
    spec:
      serviceAccountName: my-service-account # If using IRSA
      containers:
      - name: aspose_pdf
        image: <account_id>.dkr.ecr.<region>.amazonaws.com/aspose/aspose_pdf_for_aws:prod-<sha> 
        env:
        - name: AWS_ACCESS_KEY
          valueFrom:
            secretKeyRef:
              name: my-secret
              key: MY_SECRET

• Apply the deployment to your cluster.

kubectl apply -f deployment.yaml

In result the Kubernetes deployment uses the secret as environment variables.

7. Decrypt Environment Variables in Aspose.PDF for AWS container

You can configure the decryption of environment variables encrypted with AWS Key Management Service (KMS). To enable or disable the decryption of KMS environment variables, use the KEY_ENCRYPTION environment variable:

• KEY_ENCRYPTION = 'true': When set to 'true', the API will attempt to decrypt the environment variables using AWS KMS before use.
• KEY_ENCRYPTION = 'false': When set to 'no', the API will use the environment variables as-is without attempting decryption.

Integrating AWS KMS with Docker environment variables in Amazon EKS enhances the security of sensitive data in your applications. By following these steps, you ensure that sensitive environment variables are encrypted, securely stored, and decrypted only when needed by your application, thereby reducing the risk of exposure.

Client SDKs

We provide client SDKs for different programming languages to make it easier for you to integrate our API into your applications. These SDKs are designed to simplify the process of making requests to our API and handling responses. They abstract away many of the complexities of HTTP and JSON, allowing you to focus on your application’s logic.

.NET 6.0

For .NET developers, we provide a client SDK that abstracts the complexities of HTTP and JSON, allowing you to focus on your application’s logic.

Java 11

For Java developers, we offer a client SDK designed to simplify API integration.

PHP 5.5

For PHP developers, our client SDK makes interacting with our API straightforward.

Kotlin 1.4.0

For Kotlin developers, we provide a client SDK that eases the API integration process.

Release Notes

Aspose.PDF for AWS offers Aspose.PDF library manipulation capabilities, enabling users to seamlessly manage and process PDF and other document formats within the AWS environment. The latest release introduces essential features designed to optimize document handling and streamline operations from Aspose PDF Web team.

Support

For any questions, or suggestions, please visit our Forum or contact our Sales Team.

This release of Aspose.PDF for AWS is designed to enhance your document processing capabilities within the AWS environment, providing a robust and scalable solution for managing PDF documents.

Version: 1 Release Date: 1 Jul 2024

Features

1. Restful API consists of 29 document manipulation endopints: conversion, merger, convert-webpage, resize, redaction, table-extraction, rotate, crop, splitter, search, metadata, compress, word-counter, parser, page-numbering, remove-pages,hash-generator, unlock, annotation, watermark, signature, lock, comparison, searchable, organize, esign, repair, remove-watermark, change-fonts

2. Direct Document Upload:

   • Users can directly upload documents with form data, via internal links and web URLs, simplifying the process of adding documents to your workflow.

3. Amazon S3 Storage Integration:

   • S3 for document storage allows for secure and scalable storage of documents processed by Aspose.PDF for AWS container, making it easy to manage and retrieve files from S3 bucket.

4. In-Memory Task and Status Queue:

   • A new in-memory local task and status queue system has been implemented. This allows for efficient management of processing documents and their statuses in real-time, improving the responsiveness and reliability of the application.

5. Client SDK Support:

   • Aspose.PDF for AWS now provides client SDKs for multiple programming languages, including .NET, Java, PHP, and Kotlin. This multi-language support ensures that developers can easily integrate the API into their existing applications, regardless of the development environment.

6. Immediate Removal of Processed Files:

   • To enhance security and optimize storage, processed files can be immediately removed after successful operations. This ensures that no residual data remains on the storage, reducing the risk of unauthorized access.

Aspose.PDF for AWS Features

PHP Client .NET Client Java Client Kotlin Client

Add Page Numbers to Document.

• Adds page numbers to your documents based on specified alignment, starting number, and format. The service ensures that page numbers are accurately applied, improving the readability and professionalism of your documents. It supports various formats, including DOC, PPTX, TIFF, DOCX, and PDF, to cater to your specific requirements.

Supported formats:

curl -X POST 'http://localhost:5252/pdf/webapi/addnumber?vAlignment=value&hAlignment=value&startingNumber=value&sNumber=value&fNumber=value&margin=value&fontSize=value&format=value' -F 'files=@file.pdf'

$apiInstance = new Swagger\Client\Api\ApiApi(
// If you want use custom http client, pass your client which implements GuzzleHttp\\ClientInterface.
// This is optional, GuzzleHttp\\Client will be used as default.
new GuzzleHttp\Client()
);
$files = array(“files_example”); // string[] |
$document_password = “document_password_example”; // string |
$v_alignment = new \Swagger\Client\Model\PageNumberVerticalAlign(); // \Swagger\Client\Model\PageNumberVerticalAlign | The vertical alignment of the page numbers.
$h_alignment = new \Swagger\Client\Model\PageNumberHorizontalAlign(); // \Swagger\Client\Model\PageNumberHorizontalAlign | The horizontal alignment of the page numbers.
$starting_number = 56; // int | The starting number for the page numbers.
$s_number = 56; // int | The number of the first page to start numbering from.
$f_number = 56; // int | The number of the last page to end numbering at.
$margin = 56; // int | The margin around the page numbers.
$font_size = 56; // int | The font size of the page numbers.
$format = “format_example”; // string | The format of the page numbers.

try {
$result = $apiInstance->pdfWebapiAddnumberPost($files, $document_password, $v_alignment, $h_alignment, $starting_number, $s_number, $f_number, $margin, $font_size, $format);
print_r($result);
} catch (Exception $e) {
echo ‘Exception when calling ApiApi->pdfWebapiAddnumberPost: ‘, $e->getMessage(), PHP_EOL;
}
?>

using System;
using System.Diagnostics;
using IO.Swagger.Api;
using IO.Swagger.Client;
using IO.Swagger.Model;
namespace Example
{
public class PdfWebapiAddnumberPostExample
{
public void main()
{
        var apiInstance = new ApiApi();
        var files = new List<FileParameter>(); // List<FileParameter> |  (optional) 
        var documentPassword = documentPassword\_example;  // string |  (optional) 
        var vAlignment = PageNumberVerticalAlign.B; // PageNumberVerticalAlign | The vertical alignment of the page numbers. (optional) 
        var hAlignment = PageNumberHorizontalAlign.C; // PageNumberHorizontalAlign | The horizontal alignment of the page numbers. (optional) 
        var startingNumber = 56;  // int? | The starting number for the page numbers. (optional) 
        var sNumber = 56;  // int? | The number of the first page to start numbering from. (optional) 
        var fNumber = 56;  // int? | The number of the last page to end numbering at. (optional) 
        var margin = 56;  // int? | The margin around the page numbers. (optional) 
        var fontSize = 56;  // int? | The font size of the page numbers. (optional) 
        var format = format\_example;  // string | The format of the page numbers. (optional) 

        try
        {
            // Add Page Numbers to Document.
            FileResponse result = apiInstance.PdfWebapiAddnumberPost(files, documentPassword, vAlignment, hAlignment, startingNumber, sNumber, fNumber, margin, fontSize, format);
            Debug.WriteLine(result);
        }
        catch (Exception e)
        {
            Debug.Print("Exception when calling ApiApi.PdfWebapiAddnumberPost: " + e.Message );
        }
    }
}

}

// Import classes:
//import io.swagger.client.ApiException;
//import io.swagger.client.api.ApiApi;
ApiApi apiInstance = new ApiApi();
List files = Arrays.asList(new File("/path/to/file")); // List |
String documentPassword = “documentPassword_example”; // String |
PageNumberVerticalAlign vAlignment = PageNumberVerticalAlign.B; // PageNumberVerticalAlign | The vertical alignment of the page numbers.
PageNumberHorizontalAlign hAlignment = PageNumberHorizontalAlign.C; // PageNumberHorizontalAlign | The horizontal alignment of the page numbers.
Integer startingNumber = 56; // Integer | The starting number for the page numbers.
Integer sNumber = 56; // Integer | The number of the first page to start numbering from.
Integer fNumber = 56; // Integer | The number of the last page to end numbering at.
Integer margin = 56; // Integer | The margin around the page numbers.
Integer fontSize = 56; // Integer | The font size of the page numbers.
String format = “format_example”; // String | The format of the page numbers.
try {
FileResponse result = apiInstance.pdfWebapiAddnumberPost(files, documentPassword, vAlignment, hAlignment, startingNumber, sNumber, fNumber, margin, fontSize, format);
System.out.println(result);
} catch (ApiException e) {
System.err.println(“Exception when calling ApiApi#pdfWebapiAddnumberPost”);
e.printStackTrace();
}

// Import classes:
//import io.swagger.client.infrastructure.\*
//import io.swagger.client.models.\*;
val apiInstance = ApiApi()
val files : kotlin.Array<kotlin.Array<kotlin.Byte» =  // kotlin.Array<kotlin.Array<kotlin.Byte» |
val documentPassword : kotlin.String = documentPassword_example // kotlin.String |
val vAlignment : PageNumberVerticalAlign =  // PageNumberVerticalAlign | The vertical alignment of the page numbers.
val hAlignment : PageNumberHorizontalAlign =  // PageNumberHorizontalAlign | The horizontal alignment of the page numbers.
val startingNumber : kotlin.Int = 56 // kotlin.Int | The starting number for the page numbers.
val sNumber : kotlin.Int = 56 // kotlin.Int | The number of the first page to start numbering from.
val fNumber : kotlin.Int = 56 // kotlin.Int | The number of the last page to end numbering at.
val margin : kotlin.Int = 56 // kotlin.Int | The margin around the page numbers.
val fontSize : kotlin.Int = 56 // kotlin.Int | The font size of the page numbers.
val format : kotlin.String = format_example // kotlin.String | The format of the page numbers.
try {
val result : FileResponse = apiInstance.pdfWebapiAddnumberPost(files, documentPassword, vAlignment, hAlignment, startingNumber, sNumber, fNumber, margin, fontSize, format)
println(result)
} catch (e: ClientException) {
println(“4xx response calling ApiApi#pdfWebapiAddnumberPost”)
e.printStackTrace()
} catch (e: ServerException) {
println(“5xx response calling ApiApi#pdfWebapiAddnumberPost”)
e.printStackTrace()
}

Change Fonts in Provided Files.

• Updates the fonts in your documents according to specified replacements. Provide the font replacement details as a JSON string and upload your files using multipart/form-data.The service processes these requests asynchronously using Kafka, ensuring efficient handling of your files.

curl -X POST 'http://localhost:5252/pdf/webapi/change-fonts' -F 'files=@file.pdf'

$apiInstance = new Swagger\Client\Api\ApiApi(
// If you want use custom http client, pass your client which implements GuzzleHttp\\ClientInterface.
// This is optional, GuzzleHttp\\Client will be used as default.
new GuzzleHttp\Client()
);
$font_replacements_json = “font_replacements_json_example”; // string |
$files = array(“files_example”); // string[] |
$document_password = “document_password_example”; // string |

try {
$result = $apiInstance->pdfWebapiChangeFontsPost($font_replacements_json, $files, $document_password);
print_r($result);
} catch (Exception $e) {
echo ‘Exception when calling ApiApi->pdfWebapiChangeFontsPost: ‘, $e->getMessage(), PHP_EOL;
}
?>

using System;
using System.Diagnostics;
using IO.Swagger.Api;
using IO.Swagger.Client;
using IO.Swagger.Model;
namespace Example
{
public class PdfWebapiChangeFontsPostExample
{
public void main()
{
        var apiInstance = new ApiApi();
        var fontReplacementsJson = fontReplacementsJson\_example;  // string |  (optional) 
        var files = new List<FileParameter>(); // List<FileParameter> |  (optional) 
        var documentPassword = documentPassword\_example;  // string |  (optional) 

        try
        {
            // Change Fonts in Provided Files.
            FileResponse result = apiInstance.PdfWebapiChangeFontsPost(fontReplacementsJson, files, documentPassword);
            Debug.WriteLine(result);
        }
        catch (Exception e)
        {
            Debug.Print("Exception when calling ApiApi.PdfWebapiChangeFontsPost: " + e.Message );
        }
    }
}

}

// Import classes:
//import io.swagger.client.ApiException;
//import io.swagger.client.api.ApiApi;
ApiApi apiInstance = new ApiApi();
String fontReplacementsJson = “fontReplacementsJson_example”; // String |
List files = Arrays.asList(new File("/path/to/file")); // List |
String documentPassword = “documentPassword_example”; // String |
try {
FileResponse result = apiInstance.pdfWebapiChangeFontsPost(fontReplacementsJson, files, documentPassword);
System.out.println(result);
} catch (ApiException e) {
System.err.println(“Exception when calling ApiApi#pdfWebapiChangeFontsPost”);
e.printStackTrace();
}

// Import classes:
//import io.swagger.client.infrastructure.\*
//import io.swagger.client.models.\*;
val apiInstance = ApiApi()
val fontReplacementsJson : kotlin.String = fontReplacementsJson_example // kotlin.String |
val files : kotlin.Array<kotlin.Array<kotlin.Byte» =  // kotlin.Array<kotlin.Array<kotlin.Byte» |
val documentPassword : kotlin.String = documentPassword_example // kotlin.String |
try {
val result : FileResponse = apiInstance.pdfWebapiChangeFontsPost(fontReplacementsJson, files, documentPassword)
println(result)
} catch (e: ClientException) {
println(“4xx response calling ApiApi#pdfWebapiChangeFontsPost”)
e.printStackTrace()
} catch (e: ServerException) {
println(“5xx response calling ApiApi#pdfWebapiChangeFontsPost”)
e.printStackTrace()
}

Compare documents text.

• Compares the text of the provided documents and highlights the differences. Upload the files you want to compare, and the service will analyze them to detect any changes in the text. The result is a new document that clearly marks all text variations, making it easy to review and understand the modifications between the original and updated versions.

Supported formats:

curl -X POST 'http://localhost:5252/pdf/webapi/comparison' -F 'files=@file.pdf'

$apiInstance = new Swagger\Client\Api\ApiApi(
// If you want use custom http client, pass your client which implements GuzzleHttp\\ClientInterface.
// This is optional, GuzzleHttp\\Client will be used as default.
new GuzzleHttp\Client()
);
$files = array(“files_example”); // string[] |
$document_password = “document_password_example”; // string |

try {
$result = $apiInstance->pdfWebapiComparisonPost($files, $document_password);
print_r($result);
} catch (Exception $e) {
echo ‘Exception when calling ApiApi->pdfWebapiComparisonPost: ‘, $e->getMessage(), PHP_EOL;
}
?>

using System;
using System.Diagnostics;
using IO.Swagger.Api;
using IO.Swagger.Client;
using IO.Swagger.Model;
namespace Example
{
public class PdfWebapiComparisonPostExample
{
public void main()
{
        var apiInstance = new ApiApi();
        var files = new List<FileParameter>(); // List<FileParameter> |  (optional) 
        var documentPassword = documentPassword\_example;  // string |  (optional) 

        try
        {
            // Compare documents text.
            FileResponse result = apiInstance.PdfWebapiComparisonPost(files, documentPassword);
            Debug.WriteLine(result);
        }
        catch (Exception e)
        {
            Debug.Print("Exception when calling ApiApi.PdfWebapiComparisonPost: " + e.Message );
        }
    }
}

}

// Import classes:
//import io.swagger.client.ApiException;
//import io.swagger.client.api.ApiApi;
ApiApi apiInstance = new ApiApi();
List files = Arrays.asList(new File("/path/to/file")); // List |
String documentPassword = “documentPassword_example”; // String |
try {
FileResponse result = apiInstance.pdfWebapiComparisonPost(files, documentPassword);
System.out.println(result);
} catch (ApiException e) {
System.err.println(“Exception when calling ApiApi#pdfWebapiComparisonPost”);
e.printStackTrace();
}

// Import classes:
//import io.swagger.client.infrastructure.\*
//import io.swagger.client.models.\*;
val apiInstance = ApiApi()
val files : kotlin.Array<kotlin.Array<kotlin.Byte» =  // kotlin.Array<kotlin.Array<kotlin.Byte» |
val documentPassword : kotlin.String = documentPassword_example // kotlin.String |
try {
val result : FileResponse = apiInstance.pdfWebapiComparisonPost(files, documentPassword)
println(result)
} catch (e: ClientException) {
println(“4xx response calling ApiApi#pdfWebapiComparisonPost”)
e.printStackTrace()
} catch (e: ServerException) {
println(“5xx response calling ApiApi#pdfWebapiComparisonPost”)
e.printStackTrace()
}

Compress Document.

• Compresses the provided documents to reduce their file size based on the specified compression level. Upload the documents and choose the desired compression level. The service will reduce the file sizes while maintaining quality, resulting in compressed files that are easier to handle and share, saving storage space and reducing upload and download times.

Supported formats:

curl -X POST 'http://localhost:5252/pdf/webapi/compress?compressType=value' -F 'files=@file.pdf'

$apiInstance = new Swagger\Client\Api\ApiApi(
// If you want use custom http client, pass your client which implements GuzzleHttp\\ClientInterface.
// This is optional, GuzzleHttp\\Client will be used as default.
new GuzzleHttp\Client()
);
$files = array(“files_example”); // string[] |
$document_password = “document_password_example”; // string |
$compress_type = new \Swagger\Client\Model\CompressType(); // \Swagger\Client\Model\CompressType | The level of compression to use.

try {
$result = $apiInstance->pdfWebapiCompressPost($files, $document_password, $compress_type);
print_r($result);
} catch (Exception $e) {
echo ‘Exception when calling ApiApi->pdfWebapiCompressPost: ‘, $e->getMessage(), PHP_EOL;
}
?>

using System;
using System.Diagnostics;
using IO.Swagger.Api;
using IO.Swagger.Client;
using IO.Swagger.Model;
namespace Example
{
public class PdfWebapiCompressPostExample
{
public void main()
{
        var apiInstance = new ApiApi();
        var files = new List<FileParameter>(); // List<FileParameter> |  (optional) 
        var compressType = CompressType.Low; // CompressType | The level of compression to use. (optional) 
        var documentPassword = documentPassword\_example;  // string |  (optional) 
        
        try
        {
            // Compress Document.
            FileResponse result = apiInstance.PdfWebapiCompressPost(files, documentPassword, compressType);
            Debug.WriteLine(result);
        }
        catch (Exception e)
        {
            Debug.Print("Exception when calling ApiApi.PdfWebapiCompressPost: " + e.Message );
        }
    }
}

}

// Import classes:
//import io.swagger.client.ApiException;
//import io.swagger.client.api.ApiApi;
ApiApi apiInstance = new ApiApi();
List files = Arrays.asList(new File("/path/to/file")); // List |
CompressType compressType = CompressType.HIGH; // CompressType | The level of compression to use.
String documentPassword = “documentPassword_example”; // String |
try {
FileResponse result = apiInstance.pdfWebapiCompressPost(files, documentPassword, compressType);
System.out.println(result);
} catch (ApiException e) {
System.err.println(“Exception when calling ApiApi#pdfWebapiCompressPost”);
e.printStackTrace();
}

// Import classes:
//import io.swagger.client.infrastructure.\*
//import io.swagger.client.models.\*;
val apiInstance = ApiApi()
val files : kotlin.Array<kotlin.Array<kotlin.Byte» =  // kotlin.Array<kotlin.Array<kotlin.Byte» |
val documentPassword : kotlin.String = documentPassword_example // kotlin.String |
val compressType : CompressType =  // CompressType | The level of compression to use.
try {
val result : FileResponse = apiInstance.pdfWebapiCompressPost(files, documentPassword, compressType)
println(result)
} catch (e: ClientException) {
println(“4xx response calling ApiApi#pdfWebapiCompressPost”)
e.printStackTrace()
} catch (e: ServerException) {
println(“5xx response calling ApiApi#pdfWebapiCompressPost”)
e.printStackTrace()
}

Convert Document to Another Format.

• Converts documents from one format to another seamlessly. Upload the files you need to convert and specify the target format. The service will handle the conversion process efficiently, ensuring that the resulting document is ready for use in the desired format and compatible with various applications and systems.

Supported formats: