cdk-library-managed-instance-role's Introduction

cdk-library-managed-instance-role

This CDK Construct Library includes a construct (ManagedInstanceRole) which creates an AWS instance profile. By default this instance profile includes the basic policies required for instance management in SSM and the ability to Domain Join the instance.

The purpose of this CDK Construct Library is to ease the creation of instance roles by not needing to code the inclusion of baseline management roles for evey single different role implementation every time. Instance profiles only support a single role so its important the role includes all required access. This construct allows making additions to those baseline policies with ease.

The construct defines an interface (IManagedInstanceRoleProps) to configure the managed policies of the role as well as manage the inclusion of the default roles.

Dev

Pre-reqs:

You will need:

npm installed on your machine
AWS CDK installed on your machine
python installed on your machine
dotnet installed on your machine
a github account

This project is managed with projen. Modify the .projenrc.js file and run npx projen. You can also modify this README file and the src code directory as needed. Github actions take care of publishing utilizing the automatically created workflows from projen.

cdk-library-managed-instance-role's People

Contributors

Watchers

cdk-library-managed-instance-role's Issues

refactor: Work on property descriptions and make sure default is declared in the description

Upgrade targetted cdk version to 1.30.0

Make instance profile creation optional and expose the `iam.Role` directly

Is your feature request related to a problem? Please describe.
When consuming the resulting construct for an ec2.Instance construct you must apply an override to use the role directly. This orphans the default instance profile as well as makes using this construct a bit hacky.

Describe the solution you'd like
There is still a valid case for profile creation, but it should be optionally disabled. In addition the construct should expose the role construct directly so it can be consumed easily for instance creation or otherwise.

Describe alternatives you've considered
None.

Additional context

Proposed implementation
Add properties. Make profile creation optional with a boolean prop.

Any currently forseeable downsides to this approach
No. This is completely compatible with prior usage.

test: Add tests for the enabling/disabling of policies

The following need to be true:

If domain join is enabled both domain join and ssm are enabled regardless of ssm setting
If ssm is enabled then ssm should be enabled, but have no effect on domain join setting
If either is undefined it will default to true and follow the cases above