This GitHub repository contains multiple use cases of working with Terraform to provision Amazon EC2 instances. Specific Git branches separate these use cases. To read more about that, click here.
If you have worked with Amazon EC2 user data, you'd have noticed a shortcoming in the approach -the inability to pass command-line arguments to the user data script at run time.
Let me explain why I believe that to be a problem. User data is a capability associated with an Amazon EC2 instance as part of the provisioning process. Due to its nature, user data is an ideal candidate to carry the load of server provisioning steps like:
- Installing 3rd party software.
- Configuring permissions and access.
- Installing and configuring windows features.
- Installing endpoint agents, etc.
A few of these steps involve sharing secure credentials as part of authentication. Due to its inability to work with command-line arguments, the user data script requires that these credentials be provided inside the script. That means anyone who has access to the user data script in the Amazon EC2 instance also has access to the credentials.
That is not desirable, and there is a way around the problem -AWS System Manager parameter store.
Per AWS-Docs, -Parameter Store (is) a capability of AWS Systems Manager, (that) provides secure, hierarchical storage for configuration data management and secrets management. More information is available at AWS Systems Manager Parameter Store.
In this Github repo and branch I have a working copy of how to manage secure variables using AWS SSM parameter store using Terraform. I also have supporting documentation on my note at: Manage sensitive variables in Amazon EC2 user data with Terraform and PowerShell.
I installed terraform before I worked on this repository. Installation information is available in the install guide.
I used the access_key and the secret_key of an IAM user that had permission to create all the resources managed via this terraform code.
I created a terraform.tfvars file to store them.
I created an Amazon EC2 key pair (format: pem) for Windows Instance by following the guidance at -create ec2-key-pair.
Ensure that the IAM user whose credentials are being used in this configuration has permission to create and manage all the resources that are included in this repository.
Review the code, especially the user_data.tpl, ssm_parameter.tf, iamrole.tf and ec2.tf file to understand all the concepts to (i) store the sensitive credentials in the ssm-parameter store, (ii) associate an IAM role to the Amazon EC2 instance that had permission to read from the parameter store, (iii) pass the parameter store variable name to the Amazon EC2 user data script to decrypt and (iv) add the capability in the user data script to read from the parameter store.
Next, run terraform init
Then run terraform plan
And finally run terraform apply -var SecureVariableOne=ThisIsASecureValue
There are other branches in this repository discussing other use-cases:
This code is released under the Unlincse License. See LICENSE.