Skip to content

Instantly share code, notes, and snippets.

@boostrack

boostrack/IAM_Role.json

Forked from daviddyball/IAM_Role.json
Created February 1, 2021 23:35
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save boostrack/b2c8e0c4290f0b1e3f112d683e1ac8ec to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save boostrack/b2c8e0c4290f0b1e3f112d683e1ac8ec to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @daviddyball daviddyball revised this gist Jan 27, 2015. 1 changed file with 6 additions and 6 deletions.
    12 changes: 6 additions & 6 deletions user-data.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -11,9 +11,9 @@
    #

    # Ensure we have required tools
    /usr/bin/cloud-init-per once apt-get update
    /usr/bin/cloud-init-per once apt-get install python-pip jq -y
    /usr/bin/cloud-init-per once pip install awscli botocore boto
    /usr/bin/cloud-init-per once apt-update apt-get update
    /usr/bin/cloud-init-per once bootstrap-deps1 apt-get install python-pip jq -y
    /usr/bin/cloud-init-per once bootstrap-deps2 pip install awscli botocore boto

    # Gather metadata about instance (e.g. Role + Environment)
    INSTANCE_ID=$(ec2metadata --instance-id)
    @@ -23,6 +23,6 @@ ROLE=$(echo "$TAGS" |grep Role |awk '{print $3}')
    ENVIRONMENT=$(echo "$TAGS" | grep Environment|awk '{print $3}')

    # Pull and run role-specific bootstrap script
    /usr/bin/cloud-init-per always aws s3 cp s3://my-configs/${ENVIRONMENT}/${ROLE}/bootstrap.sh /root/${ENVIRONMENT}_${ROLE}_bootstrap.sh
    /usr/bin/cloud-init-per always chmod +x /root/${ENVIRONMENT}_${ROLE}_bootstrap.sh
    /usr/bin/cloud-init-per once /root/${ENVIRONMENT}_${ROLE}_bootstrap.sh
    /usr/bin/cloud-init-per always bootstrap-pull aws s3 cp s3://my-configs/${ENVIRONMENT}/${ROLE}/bootstrap.sh /root/${ENVIRONMENT}_${ROLE}_bootstrap.sh
    /usr/bin/cloud-init-per always bootstrap-chmod chmod +x /root/${ENVIRONMENT}_${ROLE}_bootstrap.sh
    /usr/bin/cloud-init-per once bootstrap-run /root/${ENVIRONMENT}_${ROLE}_bootstrap.sh
  2. @daviddyball daviddyball created this gist Jan 27, 2015.
    27 changes: 27 additions & 0 deletions IAM_Role.json
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,27 @@
    {
    "Statement": [
    {
    "Sid": "EC2DescribeInstances",
    "Effect": "Allow",
    "Action": [
    "ec2:DescribeInstances",
    "ec2:DescribeTags"
    ],
    "Resource": [
    "*"
    ]
    },
    {
    "Sid": "S3BucketAccess",
    "Effect": "Allow",
    "Action": [
    "s3:Get*",
    "s3:List*"
    ],
    "Resource": [
    "arn:aws:s3:::my-configs",
    "arn:aws:s3:::my-configs/*"
    ]
    }
    ]
    }
    28 changes: 28 additions & 0 deletions user-data.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,28 @@
    #!/bin/bash
    # Name: s3://my-configs/user-data.txt
    # Description: Generic EC2 User-Data File
    # Purpose: Shim script to pull bootstrap script for the server based on the
    # Role + Environment tags stored against the EC2 Instance
    #
    # Tags Used:
    # - Environment = Runtime Environment for this server (live/staging/preview)
    # - Role = The role for this particular server
    # (e.g. webserver, database, imaging)
    #

    # Ensure we have required tools
    /usr/bin/cloud-init-per once apt-get update
    /usr/bin/cloud-init-per once apt-get install python-pip jq -y
    /usr/bin/cloud-init-per once pip install awscli botocore boto

    # Gather metadata about instance (e.g. Role + Environment)
    INSTANCE_ID=$(ec2metadata --instance-id)
    REGION=$(curl -s http://169.254.169.254/latest/dynamic/instance-identity/document|grep region|awk -F\" '{print $4}')
    TAGS=$(aws ec2 describe-instances --instance-id $INSTANCE_ID --region $REGION --output text| grep TAGS)
    ROLE=$(echo "$TAGS" |grep Role |awk '{print $3}')
    ENVIRONMENT=$(echo "$TAGS" | grep Environment|awk '{print $3}')

    # Pull and run role-specific bootstrap script
    /usr/bin/cloud-init-per always aws s3 cp s3://my-configs/${ENVIRONMENT}/${ROLE}/bootstrap.sh /root/${ENVIRONMENT}_${ROLE}_bootstrap.sh
    /usr/bin/cloud-init-per always chmod +x /root/${ENVIRONMENT}_${ROLE}_bootstrap.sh
    /usr/bin/cloud-init-per once /root/${ENVIRONMENT}_${ROLE}_bootstrap.sh