Skip to content

Instantly share code, notes, and snippets.

@espozbob
Last active November 15, 2018 01:10
Show Gist options
  • Save espozbob/9ce163f38aad323c8cab49619ccf01d6 to your computer and use it in GitHub Desktop.
Save espozbob/9ce163f38aad323c8cab49619ccf01d6 to your computer and use it in GitHub Desktop.
Document of AWS Systems Manager that allows Automation to perform the actions for disabling termination protection of the instance
{
"schemaVersion": "0.3",
"assumeRole": "{{ AutomationAssumeRole }}",
"description": "Disable Termination Protection of Instance",
"parameters": {
"InstanceId": {
"type": "String",
"description": "(Required) The ID of the instance."
},
"LambdaAssumeRole": {
"default": "",
"type": "String",
"description": "(Optional) The ARN of the role assumed by lambda"
},
"AutomationAssumeRole": {
"default": "",
"type": "String",
"description": "(Optional) The ARN of the role that allows Automation to perform the actions on your behalf. "
}
},
"mainSteps": [
{
"action": "aws:createStack",
"inputs": {
"StackName": "DisableProtectionInstanceStack{{automation:EXECUTION_ID}}",
"TemplateBody": "AWSTemplateFormatVersion: '2010-09-09'\nConditions:\n LambdaAssumeRoleNotSpecified:\n Fn::Or:\n - Fn::Equals:\n - {Ref: LambdaRoleArn}\n - ''\n - Fn::Equals:\n - {Ref: LambdaRoleArn}\n - undefined\nDescription: Automation Stack for Disable Termination Protection of Instance\nParameters:\n LambdaName: {Description: 'The lambda function name\n\n ', Type: String}\n LambdaRoleArn: {Default: '', Description: 'The ARN of the role that allows Lambda\n created by Automation to perform the action on your behalf\n\n ', Type: String}\nResources:\n LambdaRole:\n Condition: LambdaAssumeRoleNotSpecified\n Properties:\n AssumeRolePolicyDocument:\n Statement:\n - Action: ['sts:AssumeRole']\n Effect: Allow\n Principal:\n Service: [lambda.amazonaws.com]\n Version: '2012-10-17'\n Path: /\n Policies:\n - PolicyDocument:\n Statement:\n Action: ['ec2:ModifyInstanceAttribute']\n Effect: Allow\n Resource: '*'\n Version: '2012-10-17'\n PolicyName: OffProtectInstanceLambdaPolicy\n Type: AWS::IAM::Role\n DisableProtectEC2Lambda:\n Properties:\n Code: {ZipFile: \"import boto3\\n\\n\\ndef handler(event, context):\\n\\tinstance_id\\\n \\ = event[\\\"InstanceId\\\"]\\n\\tec2 = boto3.resource('ec2')\\n\\tinstance = ec2.Instance(instance_id)\\n\\\n \\n\\tinstance.modify_attribute(DisableApiTermination={\\n\\\n \\t\\t'Value': False\\n\\t})\\n\\n\\t# print \\\"\\\n Now disabled\\\"\\n\"}\n FunctionName: {Ref: LambdaName}\n Handler: index.handler\n MemorySize: 128\n Role:\n Fn::If:\n - LambdaAssumeRoleNotSpecified\n - Fn::GetAtt: [LambdaRole, Arn]\n - {Ref: LambdaRoleArn}\n Runtime: python2.7\n Timeout: 60\n Type: AWS::Lambda::Function\n",
"Parameters": [
{
"ParameterValue": "{{LambdaAssumeRole}}",
"ParameterKey": "LambdaRoleArn"
},
{
"ParameterValue": "DisableProtectEC2Lambda-{{automation:EXECUTION_ID}}",
"ParameterKey": "LambdaName"
}
],
"Capabilities": [
"CAPABILITY_IAM"
]
},
"name": "createDocumentStack"
},
{
"action": "aws:invokeLambdaFunction",
"inputs": {
"FunctionName": "DisableProtectEC2Lambda-{{automation:EXECUTION_ID}}",
"Payload": "{\"InstanceId\": \"{{InstanceId}}\"}"
},
"name": "DisableProtectionInstance"
},
{
"action": "aws:deleteStack",
"inputs": {
"StackName": "DisableProtectionInstanceStack{{automation:EXECUTION_ID}}"
},
"name": "deleteCloudFormationTemplate"
}
]
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment