Skip to content

Instantly share code, notes, and snippets.

@aurelijusbanelis aurelijusbanelis/README.md Secret
Last active Nov 28, 2019

Embed
What would you like to do?
AWS Automation without root example
Description: |
Example to automate infrastructure changes without Root
Used as a demo during talk "How AWS handles security" at ŠiauliaiPHP v17
Parameters:
# Parameters for deployed version
BuildPath:
Type: String
Description: "Something that differs between deployments"
Resources:
# Place for resources using AppVersion
MyFunction:
Type: AWS::Lambda::Function
Properties:
Code:
ZipFile: |
import json, os
def handler(event, context):
print("Event: %s" % json.dumps(event))
print("BuildPath: %s" % os.getenv('BUILD_PATH'))
Handler: "index.handler"
Role:
"Fn::GetAtt": [MyFunctionRole, Arn]
Runtime: "python3.7"
Environment:
Variables:
BUILD_PATH:
Ref: BuildPath
MyFunctionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
Action:
- sts:AssumeRole
Path: "/"
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
# Deployment configuration
DeployerUser:
Type: AWS::IAM::User
Properties:
Policies:
- PolicyName: AllowToDeployNewVersion
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Action:
- "cloudformation:CreateChangeSet"
Resource:
"Fn::Sub": "arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}/*"
DeployerLogins:
Type: AWS::IAM::AccessKey
Properties:
UserName:
Ref: DeployerUser
Outputs:
AccessKeyId:
Description: "AWS_ACCESS_KEY_ID environment variable"
Value:
Ref: DeployerLogins
SecretAccessKey:
Description: "AWS_SECRET_ACCESS_KEY environment variable"
Value:
"Fn::GetAtt": [DeployerLogins, SecretAccessKey]
#!/bin/bash
export AWS_ACCESS_KEY_ID="AAAAAAAAAAAAAAAAAAAAA" # Change here from output of a stack
export AWS_SECRET_ACCESS_KEY="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" # Change here from output of a stack
export AWS_DEFAULT_REGION="eu-west-1"
aws sts get-caller-identity
DATE=$(date --iso-8601=seconds | tr ':' '-' | tr '+' '--')
aws cloudformation create-change-set \
--stack-name siauliaiphp-automation \
--template-body=file://automation-cf.yaml \
--parameters "ParameterKey=BuildPath,ParameterValue=/custom/$DATE" \
--change-set-name="siauliai-test-$DATE" \
--capabilities CAPABILITY_IAM
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.