CODEWITHSUNDEEP
linuxgitamazon-web-servicesamazon-ec2amazon-ami
xShirase
xShirase

Reputation: 12389

Bundle Git SSH keys into a private AMI

I have an EC2 instance which runs an app hosted on a private git repo.

I need to be able to launch many of these from my master server. At the moment, I have 5 fixed "worker" instances which I start/stop from the master with no problem. Each worker starts, pulls the repo, and launches the app on startup. This is obviously not a good solution and I want to make it more flexible (launch as many instances as I want, etc). The configuration and packages are final so I feel good about bundling it all into an AMI.

Is there a way for me to bundle my git keys into the AMI, in order to launch many similar instances and have them all pull and launch my app on startup without heving to connect to each of them and enter the password? Is there a better way? I've read about cloud-init, user-data, puppet and many other things, but I'm quite novice in the matter and couldn't find a proper example using ssh keys.

Upvotes: 1

Views: 422

Answers (1)

helloV
helloV

Reputation: 52375

Instead of bundling the keys into the AMI, I suggest you keep them separate from the AMI because:

  1. If you change your git keys, you don't have to build a new AMI
  2. Unauthorized users who have privileges to launch an instance from your AMI cannot launch your app

I suggest using the user-data feature. You can optionally encrypt your keys and base64encode it if you want to. When you launch your instance manually or using CLI/API, you can pass your keys which can be accessed by the instance once it is launched. There are variety of ways to access the data (python, curl to name a few). I suggest you use AWS metadata server because your instance does not need your AWS credentials to fetch the user-data. Once your instance is launched, have your app make the following call, get the keys and then pull the repo:

curl http://169.254.169.254/latest/user-data

returns your metadata (no credentials needed). You can optionally base64decode and decrypt your keys and use it to pull the repo. If you do not want the extra security, you can bypass encrypt/base64 part.

Upvotes: 2

Related Questions