amazon-cloudformation - 使用导出的值

Question

我可以使用此 cloudformation 模板导出密钥...

https://github.com/shantanuo/cloudformation/blob/master/restricted.template.txt

但是如何将保存的密钥直接导入另一个模板的“UserData”部分？我试过这个，但不起作用......

aws-ec2-assign-elastic-ip --access-key !Ref {"Fn::ImportValue" : "accessKey" } --secret-key --valid-ips 35.174.198.170

模板的其余部分（没有访问权限和密钥引用）按预期工作。

https://github.com/shantanuo/cloudformation/blob/master/security.template2.txt

标签： amazon-cloudformation

Answer 1

所以，如果这是您执行导出的脚本（对不起，这个是 yaml 中的）

AWSTemplateFormatVersion: '2010-09-09'
Metadata:
  License: Apache-2.0
Description: 'AWS CloudFormation Sample Template'

Parameters:
  NewUsername:
    NoEcho: 'false'
    Type: String
    Description: New account username
    MinLength: '1'
    MaxLength: '41'
    ConstraintDescription: the username must be between 1 and 41 characters
  Password:
    NoEcho: 'true'
    Type: String
    Description: New account password
    MinLength: '1'
    MaxLength: '41'
    ConstraintDescription: the password must be between 1 and 41 characters

Resources:
  CFNUser:
    Type: AWS::IAM::User
    Properties:
      LoginProfile:
        Password: !Ref 'Password'
      UserName : !Ref 'NewUsername'
  CFNAdminGroup:
    Type: AWS::IAM::Group
  Admins:
    Type: AWS::IAM::UserToGroupAddition
    Properties:
      GroupName: !Ref 'CFNAdminGroup'
      Users: [!Ref 'CFNUser']
  CFNAdminPolicies:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: CFNAdmins
      PolicyDocument:
        Statement:
        - Effect: Allow
          Action: '*'
          Resource: '*'
          Condition:
            StringEquals:
              aws:RequestedRegion:
              - ap-south-1
              - us-east-1
      Groups: [!Ref 'CFNAdminGroup']
  CFNKeys:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: !Ref 'CFNUser'

Outputs:
  AccessKey:
    Value: !Ref 'CFNKeys'
    Description: AWSAccessKeyId of new user
    Export:
      Name: 'accessKey'
  SecretKey:
    Value: !GetAtt [CFNKeys, SecretAccessKey]
    Description: AWSSecretAccessKey of new user
    Export:
      Name: 'secretKey'

然后这是一个示例，说明如何在 import cloudformation 脚本中将这些值导入 userdata 中：

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Test instance stack",
  "Parameters": {
    "KeyName": {
      "Description": "The EC2 Key Pair to allow SSH access to the instance",
      "Type": "AWS::EC2::KeyPair::KeyName"
    },
    "BaseImage": {
      "Description": "The AMI to use for machines.",
      "Type": "String"
    },
    "VPCID": {
      "Description": "ID of the VPC",
      "Type": "String"
    },
    "SubnetID": {
      "Description": "ID of the subnet",
      "Type": "String"
    }
  },
  "Resources": {
    "InstanceSecGrp": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "Instance Security Group",
        "SecurityGroupIngress": [{
          "IpProtocol": "-1",
          "CidrIp": "0.0.0.0/0"
        }],
        "SecurityGroupEgress": [{
          "IpProtocol": "-1",
          "CidrIp": "0.0.0.0/0"
        }],
        "VpcId": {
          "Ref": "VPCID"
        }
      }
    },
    "SingleInstance": {
      "Type": "AWS::EC2::Instance",
      "Properties": {
        "KeyName": {
          "Ref": "KeyName"
        },
        "ImageId": {
          "Ref": "BaseImage"
        },
        "InstanceType": "t2.micro",
        "Monitoring": "false",
        "BlockDeviceMappings": [{
          "DeviceName": "/dev/xvda",
          "Ebs": {
            "VolumeSize": "20",
            "VolumeType": "gp2"
          }
        }],
        "NetworkInterfaces": [{
          "GroupSet": [{
            "Ref": "InstanceSecGrp"
          }],
          "AssociatePublicIpAddress": "true",
          "DeviceIndex": "0",
          "DeleteOnTermination": "true",
          "SubnetId": {
            "Ref": "SubnetID"
          }
        }],
        "UserData": {
          "Fn::Base64": {
            "Fn::Join": ["", [
              "#!/bin/bash -xe\n",
              "yum install httpd -y\n",
              "sudo sh -c \"echo ",
              { "Fn::ImportValue" : "secretKey" },
              " >> /home/ec2-user/mysecret.txt\" \n",
              "sudo sh -c \"echo ",
              { "Fn::ImportValue" : "accessKey" },
              " >> /home/ec2-user/myaccesskey.txt\" \n"
            ]]
          }
        }
      }
    }
  }
}

在此示例中，我只是将导入的值回显到文件中。如果您 ssh 到 SingleInstance 并检查日志，/var/lib/cloud/instance/scripts/part-001那么您将看到用户数据脚本在服务器本身上的样子。在我的情况下，该文件的内容是（键的值不是真实的）：

#!/bin/bash -xe
yum install httpd -y
sudo sh -c "echo hAc7/TJA123143235ASFFgKWkKSjIC4 >> /home/ec2-user/mysecret.txt"
sudo sh -c "echo AKIAQ123456789123D >> /home/ec2-user/myaccesskey.txt"

以此为起点，您可以对导入值做任何您需要的事情。

我已经使用上面的确切脚本测试了所有这些，并且一切正常。