01 Create the trust relationship policy for the necessary IAM role. To create the trust relationship policy for the new role, paste the following information into a new policy document named cc-iam-trust-policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
02 Run create-role command (OSX/Linux/UNIX) to create the AWS IAM role using the trust relationship policy defined at the previous step:
aws iam create-role
--role-name cc-web-tier-asg-role
--assume-role-policy-document file://cc-iam-trust-policy.json
03 The command output should return the new IAM role metadata:
{
"Role": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
},
"RoleId": "AAAABBBBCCCCDDDDEEEE",
"CreateDate": "2018-03-15T13:12:22.252Z",
"RoleName": "cc-web-tier-asg-role",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:role/cc-web-tier-asg-role"
}
}
04 To define the IAM role permissions, based on the policy type used by the role, perform one of the following set of commands:
- To attach managed IAM policies:
- Run attach-role-policy command (OSX/Linux/UNIX) to attach the specified IAM managed policy to the newly created role (the command does not produce an output):
aws iam attach-role-policy
--policy-arn arn:aws:iam::aws:policy/AmazonEC2FullAccess
--role-name cc-web-tier-asg-role
- For define and attach inline IAM policies:
- To define the inline policy for the IAM role, paste your own custom policy into a new JSON-based policy document named "cc-iam-custom-policy.json". The following example, provides full access to Amazon EC2 resources:
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "ec2:*",
"Effect": "Allow",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "elasticloadbalancing:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "cloudwatch:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "autoscaling:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "iam:CreateServiceLinkedRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"iam:AWSServiceName": [
"autoscaling.amazonaws.com",
"ec2scheduled.amazonaws.com",
"elasticloadbalancing.amazonaws.com",
"spot.amazonaws.com",
"spotfleet.amazonaws.com"
]
}
}
}
]
}
- Run put-role-policy command (OSX/Linux/UNIX) to attach the inline policy defined at the previous step to the new IAM role (the command does not produce an output):
aws iam put-role-policy
--role-name cc-web-tier-asg-role
--policy-name iam-custom-policy
--policy-document file://cc-iam-custom-policy.json
{
"GroupId": "sg-12345678"
}
05 Create the required IAM instance profile. An instance profile is a container for the IAM role that is attached to the EC2 instance during the launch process. Run create-instance-profile command (OSX/Linux/UNIX) to create the new IAM instance profile:
aws iam create-instance-profile
--region us-east-1
--instance-profile-name cc-asg-instance-profile
06 The command output should return the newly created instance profile metadata:
{
"InstanceProfile": {
"InstanceProfileId": "AAAABBBBCCCCDDDDEEEE",
"Roles": [],
"CreateDate": "2018-03-16T12:35:51.600Z",
"InstanceProfileName": "cc-asg-instance-profile",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:instance-profile/cc-asg-instance-profile"
}
}
07 Run add-role-to-instance-profile command (OSX/Linux/UNIX) to integrate the IAM role created at step no. 2 with the IAM instance profile created at step no. 5 (the command does not return an output):
aws iam add-role-to-instance-profile
--role-name cc-web-tier-asg-role
--instance-profile-name cc-asg-instance-profile
08 Run describe-launch-configurations command (OSX/Linux/UNIX) using the name of the web-tier ASG launch configuration that you want to re-create as identifier (see Audit section part II to identify the right resource), to describe its configuration details, information required later when the new launch configuration will be created:
aws autoscaling describe-launch-configurations
--region us-east-1
--launch-configuration-names cc-web-launch-config
09 The command output should return the requested details:
{
"LaunchConfigurations": [
{
"BlockDeviceMappings": [
{
"DeviceName": "/dev/xvda",
"Ebs": {
"DeleteOnTermination": true,
"VolumeSize": 150,
"VolumeType": "gp2"
}
}
],
...
"KeyName": "cc-ssh-key",
"SecurityGroups": [
"sg-12345678"
],
"LaunchConfigurationName": "cc-web-launch-config",
"KernelId": "",
"RamdiskId": "",
"ImageId": "ami-abcd1234",
"InstanceType": "c3.xlarge"
}
]
}
10 Run create-launch-configuration command (OSX/Linux/UNIX) using the configuration metadata returned at the previous step to create a new launch configuration that will replace the one associated with your web-tier Auto Scaling Group. The following CLI command example creates an ASG launch configuration named "cc-web-tier-launch-config", based on an AWS AMI identified by the ID "ami-abcd1234", with an IAM role/instance profile identified by the name "cc-asg-instance-profile" (the command does not produce an output):
aws autoscaling create-launch-configuration
--region us-east-1
--launch-configuration-name cc-web-tier-launch-config
--image-id ami-abcd1234
--instance-type c3.xlarge
--key-name cc-ssh-key
--security-groups sg-12345678
--iam-instance-profile cc-asg-instance-profile
--block-device-mappings "[{\"DeviceName\": \"/dev/xvda\",\"Ebs\":{\"VolumeSize\":150}}]"
11 Run update-auto-scaling-group command (OSX/Linux/UNIX) to update the configuration for your web-tier Auto Scaling Group, in order to replace the existing launch configuration with the new one created at the previous step (the command does not return an output):
aws autoscaling update-auto-scaling-group
--region us-east-1
--auto-scaling-group-name cc-web-tier-asg
--launch-configuration-name cc-web-tier-launch-config
12 Repeat steps no. 8 – 11 to reconfigure other web-tier ASG launch configurations, created in the selected region, to assign IAM roles to EC2 instances launched within the group.
13 Change the AWS region by updating the --region command parameter value and repeat steps no. 8 – 12 to perform the process for other regions.
Security 