amazon-web-services - 如何使用 CloudFormation 模板从 S3 获取文件以引导应用程序，而不用角色启动 EC2 实例？

Question

我需要从私有(private)位置的 S3 存储桶下载文件。我已经使用 AWS 控制台创建了一个 IAM 角色 - 因此有一个 IAM 配置文件，我将其分配给启动的实例。我可以通过在 LaunchConfiguration 中提供身份验证对象来从安全位置获取文件。仅当使用 IamInstanceProfile 启动实例时，此方法才有效。

   "LaunchConfiguration":{
        "Type":"AWS::AutoScaling::LaunchConfiguration",
        "Metadata":{
            "Comment":"Configure the Presentation Tier",
             "AWS::CloudFormation::Authentication": {
                "S3Access" : {
                    "type" : "S3",
                    "buckets":["demo-upload"],
                    "roleName": "MYS3ROLE"
                }
            },
            "AWS::CloudFormation::Init":{
                "config":{
                    "packages":{
                        "yum":{
                            "tomcat6": [],
                            "java-1.6.0-openjdk-devel" : [],
                            "tomcat6-webapps" :[],
                            "tomcat6-admin-webapps" :[],
                            "tomcat6-docs-webapp" :[],
                            "curl":[]
                        }
                    },
                    "files":{
                        "/var/lib/tomcat6/webapps/demo.war" : { 
                            "source" : {"Ref":"WarLoc"},
                            "owner" : "tomcat",
                            "group" : "tomcat",
                            "authentication":"S3Access"
                        },
                        "/root/demo.war" : { 
                            "source" : {"Ref":"WarLoc"},
                            "owner" : "root",
                            "group" : "root",
                            "authentication":"S3Access"
                        },
                        "/etc/cfn/cfn-hup.conf" : {
                            "content" : { "Fn::Join" : ["", [
                            "[main]\n",
                            "stack=", { "Ref" : "AWS::StackId" }, "\n",
                            "region=", { "Ref" : "AWS::Region" }, "\n",
                            "interval=1"
                            ]]},
                        "mode"    : "000400",
                        "owner"   : "root",
                        "group"   : "root"
                        },

                      "/etc/cfn/hooks.d/cfn-auto-reloader.conf" : {
                        "content": { "Fn::Join" : ["", [
                          "[cfn-auto-reloader-hook]\n",
                          "triggers=post.update\n",
                          "path=Resources.LaunchConfiguration.Metadata.AWS::CloudFormation::Init\n",
                          "action=/opt/aws/bin/cfn-init -s ", { "Ref" : "AWS::StackId" },
                          "         -r LaunchConfiguration ",
                          "         --region     ", { "Ref" : "AWS::Region" }, "\n",
                          "runas=root\n"
                        ]]}
                      }
                    },
                    "services" : {
                        "sysvinit" : {
                            "tomcat6":{
                                "files":["/var/lib/tomcat6/webapps/demo.war"],
                                "enabled": "true",
                                "ensureRunning":"true"
                            },
                            "cfn-hup":{
                                "files":["/etc/cfn/cfn-hup.conf","/etc/cfn/hooks.d/cfn-auto-reloader.conf"],
                                "enabled":"true",
                                "ensureRunning":"true"
                            }
                        }
                    }
                }
            }
        },
        "Properties":{
            "ImageId"        : { "Fn::FindInMap" : [ "AWSRegionArch2AMI", { "Ref" : "AWS::Region" }, { "Fn::FindInMap" : [ "AWSInstanceType2Arch", { "Ref" : "InstanceType" }, "Arch" ] } ] },
            "SecurityGroups" : [ { "Ref" : "InstanceSecurityGroup" } ],
            "InstanceType"   : { "Ref" : "InstanceType" },
            "InstanceMonitoring": "false",
            "KeyName"        : { "Ref" : "KeyName" },
            "AssociatePublicIpAddress" : "true",
            "IamInstanceProfile":"arn:aws:iam::MY_ACCOUNT_ID:instance-profile/MYS3ROLE",
            "UserData"       : { "Fn::Base64" : { "Fn::Join" : ["", [
              "#!/bin/bash -v\n",
              "yum update -y\n",
              "# Install Presentation Software\n",
              "/opt/aws/bin/cfn-init -s ", { "Ref" : "AWS::StackId" }, " -r LaunchConfiguration ",
              "    --region ", { "Ref" : "AWS::Region" }, "\n",
              "service tomcat6 stop\n",
              "rm -rf /var/lib/tomcat6/webapps/demo\n",
              "sleep 3\n",
              "service tomcat6 start\n",
              "sleep 3\n",
              "service tomcat6 restart\n",
              "/opt/aws/bin/cfn-hup\n",
              "/opt/aws/bin/cfn-signal -e $? -r \"Setup complete\" '", { "Ref" : "WaitHandle" }, "'\n"
              ]]}}
        }
    },

我可以从非公开的 S3 下载文件，而无需使用 IamInstanceProfile 启动计算机吗？ ？

如果我删除 "IamInstanceProfile":"arn:aws:iam::MY_ACCOUNT_ID:instance-profile/s3access", 然后在 /var/log/cfn-init. log 我发现以下几行，我认为这不是因为身份验证失败

ToolError: Failed to retrieve https://s3-us-west-2.amazonaws.com/demo-upload/0.0.1/demo.war: [Errno 404] HTTP Error 404 : <?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
 <title>404 - Not Found</title>
</head>
<body>
   <h1>404 - Not Found</h1>
 </body>
</html>

当我使用 IamProfile 启动实例时，一切运行正常。那么，有没有一种方法可以获取文件 - 无需脚本并在计算机上存储凭据 - 但不使用角色启动实例？

Answer 1

IAM 实例配置文件是将私有(private)文件从 S3 获取到 EC2 的最简洁方法。

其他选项是(除了将 key 保留在代码中 - 这不好!):

• 实例元数据和用户数据 - Amazon Elastic Compute Cloud:http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AESDG-chapter-instancedata.html
• 使用类似 Elastic Beanstalk 的部署服务或OpsWorks 。您可以将任何内容传递给以这种方式启动的 EC2。事实上，这是管理集群的一种简单方法。