atheiman

.cloudformation:
  stage: cloudformation
  variables:
    AWS_DEFAULT_REGION: ''
    CFN_ASSUME_ROLE_ARN: ''
    CFN_TEMPLATE: cloudformation/template.yml
    CFN_STACK_NAME: 'MyStack'
    CFN_DEPLOY_EXTRA_ARGS: ''
  image:
    name: amazon/aws-cli

atheiman

# Prerequisites:
# - ECS Fargate cluster
# - ECS task IAM role: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
#   Be sure to include ECS exec permissions: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html#ecs-exec-required-iam-permissions
# - (optional) ECS task execution IAM role: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_execution_IAM_role.html


aws ecs list-task-definitions

# Register a task definition for alpine image running "sleep 600" so you can exec into the container for 10 min

atheiman

Amazon CloudWatch Agent for Linux

1. Attach needed IAM permissions to the EC2 instance profile IAM role:
   • CloudWatchAgentServerPolicy AWS managed IAM policy
   • Additional permissions likely needed (to download config from SSM parameter and to set CW Logs retention):

     {
       "Effect": "Allow",
       "Action": [
         "ssm:GetParameter"

atheiman

#!/usr/bin/env python3

# Example usage:
#
#     ~ $ export AWS_PROFILE=organization-management-account
#     ~ $ export AGGREGATOR_NAME=my-config-aggregator
#     ~ $ python ~/tmp/config_aggregator_query.py
#     53 resources inspected
#

atheiman

import json
import boto3
import botocore
import os
import datetime
import re
import csv
from functools import lru_cache

sts = boto3.client("sts")

atheiman

# See documented events sent by Config here: https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules_example-events.html
#
# It is much easier to write evaluations for rules using ConfigurationItemChangeNotification and
# OversizedConfigurationItemChangeNotification. These notifications include the resource as recorded
# by Config. The Lambda function can review the resource config json and submit an evaluation for
# the resource.
#
# ScheduledNotification events are not specific to a resource, the event only includes
# the account id and rule name. Lambda functions must list all the resources in the account using
# service apis, call the appropriate apis to evaluate the resources config, and then submit

atheiman

terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

data "aws_partition" "current" {}

atheiman

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

resource "aws_config_organization_custom_policy_rule" "required_tags" {

atheiman

# batch-get-aggregate-resource-config only accepts 100 resource identifiers. If you need to get the configuration
# of more items, use python + boto3: https://gist.github.com/atheiman/9830de25a3fb54a06b86953a2675bbd1

AGGREGATOR_NAME='MyConfigAggregator'
aws configservice batch-get-aggregate-resource-config \
  --configuration-aggregator-name "$AGGREGATOR_NAME" \
  --resource-identifiers "$(
    aws configservice list-aggregate-discovered-resources \
      --configuration-aggregator-name "$AGGREGATOR_NAME" \
      --resource-type 'AWS::EC2::Instance' \

atheiman

EC2 User Data examples

Basic Windows local user with Administrator and RDP access

Add a local rdp user via user data at launch of a Windows EC2 instance. Note that this includes a password passed in thru both the user data and powershell command line and is a bad security practice because they can be viewed later. At a minimum, you should connect to the instance immediately after launch and change the password interactively. Also, delete the userdata from the instance after launch. More secure would be to connect the instance to a domain for authentication or use AWS native tooling to connect to the instance (e.g., AWS Session Manager).

<powershell>
# Be sure to set the username and password on these two lines. Of course this is not a good
# security practice to include a password at command line.