renovosolutions / cdk-library-renovo-instance-service Goto Github PK
View Code? Open in Web Editor NEWLicense: Apache License 2.0
License: Apache License 2.0
We only want to accept certain strings for the os.
Is your feature request related to a problem? Please describe.
When launching an instance and bootstrapping to Chef in userdata there is currently no indication that it succeeded. Previously Terraform just always accepted the instance as a success. This would mean manual verification and false positives for successful stack convergence.
Describe the solution you'd like
Use CreationPolicy
and wait for a userdata cfn-signal
to succeed. See here.
Describe alternatives you've considered
None. If we want a userdata tie in this is the way. This was not possible in Terraform (at least when we actively developed Terraform).
Additional context
Knowing for sure we succeeded is key for instance service launches.
Proposed implementation
TBD. This is new territory.
Any currently forseeable downsides to this approach
This solves downsides for other items. If it works this has major upsides.
Is your feature request related to a problem? Please describe.
Currently instance creation is faced with a challenge:
The following criteria is needed to successfully launch an instance that requires any secret from Vault (most things do, even if its just a Sentry DSN).
The problem is that AWS Auth role creation for Vault isn't supported directly in CloudFormation and therefore not in the AWS CDK. Doing so would require significant and complicated custom Cloudformation Registry Resources. This means we somehow need to create a role that knows about a IAM principal that is not created yet.
Describe the solution you'd like
Utilize a mix of well defined IAM policies and the role_tag
feature of AWS Auth to create roles ahead of time that do not need awareness about the exact principal that will use the role and instead get access granted by the role_tag
. This will require working with good IAM policies and Service Control Policy guard rails to avoid any accidental elevation.
Describe alternatives you've considered
Additional context
Proposed implementation
TBD this requires research
Any currently forseeable downsides to this approach
Highly complex and basically requires good AWS Organization work.
Is your feature request related to a problem? Please describe.
Terraform used to support (no longer does) a Chef provider that allowed setting up a Chef role. This allowed us to treat a Chef role as a stack resource and dynamically determine run list items and attributes. This functionality is key for delivering consistent configuration. Especially where instance services may need to be aware of AWS context that could be provided as attributes.
Describe the solution you'd like
TBD but thoughts so far:
Getting context about the stack that would typically be provided by role attributes:
Long term run list management
Describe alternatives you've considered
NA the choices are above
Additional context
Example use case. If a stack creates a resource like an S3 bucket the instance then needs to use for backups it needs to know the bucket name. How does it find out?
Proposed implementation
TBD
Any currently forseeable downsides to this approach
Complex to solve.
Is your feature request related to a problem? Please describe.
We need to securely deliver a Chef validator key to each instance one time only. Once the key is retrieved the validator key needs to not be able to be retrieved again.
Describe the solution you'd like
In Terraform this used a separate role specifically for validator retrieval. Given the instance may also have Vault secrets beyond the validator I think this is the solution we should carry forward.
Describe alternatives you've considered
There isn't a particularly good alternative for delivering a validator. We dont want the validator to be available to the instance beyond its useful window (bootstrapping to Chef). Other implementations like utilizing Systems Manager, placing the key in userdata, placing the key in AWS Secrets Manager, or placing the key in parameter store all have the downside of being available indefinitely.
There is an alternative to this approach entirely. Using AWS SSM and the AWS-ApplyChefRecipes
document. However there isn't a nice way to do this during userdata
phase of instance setup and it adds another challenge of locking down access to SSM run command actions.
Additional context
While this issue is for porting the feature from Terraform to CDK code this replaces the more classic need to bootstrap an instance to Chef after launch and addresses the removal of Chef provisioners from tools like Terraform in later versions.
Proposed implementation
The code from Terraform is below. Here is some key details:
ec2
auth type which is required for the "only once" authenticationdisallow_reauthentication
allows one single token grant per instance IDWe'd likely want to change some of the bindings and see if we can bind to the account id, vpc, subnets, etc without binding to a specific instance ARN.
resource "vault_aws_auth_backend_role" "instance_bootstrap" {
count = var.uses_chef ? 1 : 0
role = "${local.environment}-${var.name}-${data.aws_region.current.name}_bootstrap"
auth_type = "ec2"
bound_account_ids = [data.aws_caller_identity.default.account_id]
bound_vpc_ids = [data.aws_vpc.default.id]
bound_subnet_ids = data.aws_subnet_ids.target.ids
bound_iam_instance_profile_arns = [aws_iam_instance_profile.instance.arn]
token_ttl = 60
token_max_ttl = 60
token_num_uses = 1
token_policies = ["default", "terraform-validator"]
disallow_reauthentication = true
}
Any currently forseeable downsides to this approach
Very complex. But that's security and Vault. So no surprises there.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.