CODEWITHSUNDEEP
aws-cloudformationaws-cloudformation-custom-resource
jlo-gmail
jlo-gmail

Reputation: 5048

AWSUtility::CloudFormation::CommandRunner fails with "You do not have permissions to make the TerminateInstances API call"

I am attempting to run a CloudFormation using AWSUtility::CloudFormation::CommandRunner and it fails with

"You do not have permissions to make the TerminateInstances API call"

Is there a work-around? Has anybody had success with this component ?

My CF:

IopsCalculator:
  Type: AWSUtility::CloudFormation::CommandRunner
  Properties:
    Command:
      Fn::Sub: 'expr 100 \* 20 > /command-output.txt'

I found this component at:

and followed the steps listed:

git clone https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-awsutilities-commandrunner.git
cd aws-cloudformation-resource-providers-awsutilities-commandrunner
curl -LO https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-awsutilities-commandrunner/releases/latest/download/awsutility-cloudformation-commandrunner.zip
./scripts/register.sh --set-default

My install results appeared to succeed:

Creating Execution Role...
Waiting for execution role stack to complete...
Waiting for execution role stack to complete...
Creating Execution Role complete.
Creating temporary S3 Bucket 0e5f0a98e79a4f6485ae30924a6b287e...
Creating temporary S3 Bucket 0e5f0a98e79a4f6485ae30924a6b287e complete.
Configuring S3 Bucket Policy for temporary S3 Bucket 0e5f0a98e79a4f6485ae30924a6b287e...
Configuring S3 Bucket Policy for temporary S3 Bucket 0e5f0a98e79a4f6485ae30924a6b287e complete.
Copying Schema Handler Package to temporary S3 Bucket 0e5f0a98e79a4f6485ae30924a6b287e...
Copying Schema Handler Package to temporary S3 Bucket 0e5f0a98e79a4f6485ae30924a6b287e complete.
Registering AWSUtility::CloudFormation::CommandRunner to AWS CloudFormation...
RegistrationToken: 13e7ec35-ea97-42d4-b0e4-b83f3f3d4da2
Waiting for registration to complete...
Waiting for registration to complete...
Waiting for registration to complete...
Waiting for registration to complete...
Waiting for registration to complete...
Registering AWSUtility::CloudFormation::CommandRunner to AWS CloudFormation complete.
Setting current version as default...
Setting current version as default complete. (Current Version is 00000007)
Cleaning up temporary S3 Bucket...
Deleting SchemaHandlerPackage from temporary S3 Bucket 0e5f0a98e79a4f6485ae30924a6b287e...
Deleting SchemaHandlerPackage from temporary S3 Bucket 0e5f0a98e79a4f6485ae30924a6b287e complete.
Cleaning up temporary S3 Bucket complete.

AWSUtility::CloudFormation::CommandRunner is ready to use.

Upvotes: 1

Views: 671

Answers (1)

jlo-gmail
jlo-gmail

Reputation: 5048

The first problem is the code at https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-awsutilities-commandrunner.git does not work... the repository is abandoned.

maslick's repository listed in the accompanying shell does work, if you pull the correct branch (also in this shell script). if you pull the correct branch. You will also need the correct role, also in this post.

Shell script to install commandrunner using cloudshell:

############################################################################
# This script Configures Cloudshell and Builds and Deploys CommandRunner
# This script should work on a Linux Box
# Cloudshell resets when you change Roles
# Cloudshell invokes AWS Client using the current Portal Role.
# You must be in the correct Role before attempting to deploy.
# Use the IAMManagement role depoyed by IAMManagement.yaml
# if you do not specify a Subnet you must have a Default VPC
# The subnet must be in an AZ that can support t3.micro
#############################################################################

#install java
sudo yum install java-1.8.0-openjdk-devel.x86_64 -y
java -version


#Following are the set of commands need to be executed sequentially to install maven.
sudo wget http://repos.fedorapeople.org/repos/dchen/apache-maven/epel-apache-maven.repo -O /etc/yum.repos.d/epel-apache-maven.repo
sudo sed -i s/\$releasever/6/g /etc/yum.repos.d/epel-apache-maven.repo
sudo yum install -y apache-maven
mvn –v


#Install Git
# --> GIT is already present in cloudshell
#sudo yum install git
#git version


# Install Python(LINUX box)
# https://tecadmin.net/install-python-3-8-amazon-linux/#:~:text=Installing%20Python%20on%20Amazon%20Linux%201%20Step%201,Environment%20on%20Ubuntu%2018.04%20%26%2016.04.%20See%20More.
cd /
sudo yum install gcc openssl-devel bzip2-devel libffi-devel  zlib-devel -y
cd /opt
sudo wget https://www.python.org/ftp/python/3.8.12/Python-3.8.12.tgz
sudo tar xzf Python-3.8.12.tgz
cd Python-3.8.12
sudo ./configure --enable-optimizations 
sudo make altinstall
sudo rm -f /opt/Python-3.8.12.tgz
python3.8 --version
python3 --version #(should be 3.8)


# Make Python3.8 default
# https://tech.serhatteker.com/post/2019-12/upgrade-python38-on-ubuntu/
whereis python3.8.12
sudo update-alternatives --install /usr/bin/python3 python3 /usr/local/bin/python3.8 1
sudo update-alternatives --set python3 /usr/local/bin/python3.8
python3 --version #(should be 3.8)


#Install cfn
pip3 install cloudformation-cli cloudformation-cli-java-plugin cloudformation-cli-go-plugin cloudformation-cli-python-plugin cloudformation-cli-typescript-plugin


#Install AWS CLI 2
# --> AWS CLI is already present in cloudshell
#curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
#unzip awscliv2.zip
#sudo yum install awscli -y
#aws --version
# AWAS CLI is already using current role in cloudshell
#aws configure


#get the source
#maslick has the working version.
#the git referred to in AWS docs is unmaintained and does not work.
cd ~
git clone https://github.com/maslick/aws-cloudformation-resource-providers-awsutilities-commandrunner.git
cd ~/aws-cloudformation-resource-providers-awsutilities-commandrunner
git checkout fix-null-sg


#build it
alias python="/usr/bin/Python-3.8.12/python"
clear
cd ~/aws-cloudformation-resource-providers-awsutilities-commandrunner
./scripts/build.sh

The YAML to make an assumable role to run CloudShell under is also included (I pulled it from another project, handy if you have to have and admin install)

AWSTemplateFormatVersion: "2010-09-09"
Metadata:
  Generator: "former2"
Description: "Provides permissions for managing Roles and Policies. Reqired by IAMTouchworks.yaml. Disable these roles by re-deploying and setting allowIAMAssumption=No"

Parameters:
  environment:
    Description: "Environment Name"
    Type: String
    Default: "Sandbox-1"

  environmentShort:
    Description: "Environment Name (Short)"
    Type: String
    Default:  "S1"

  allowIAMAssumption:
    Description: "Allow IAM Assumption Policy"
    Type: String
    Default:  "No"
    AllowedValues: 
      - "No"
      - "YES"
    ConstraintDescription: "Yes or No"


Conditions:
  IAMAssumptionCondition:  !Equals 
    - !Ref allowIAMAssumption
    - "YES"

Resources:

  IAMManagementPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: IAMManagement
      Path: "/"
      PolicyDocument: |
        {
            "Version": "2012-10-17",
            "Statement": [
          {
                "Effect": "Allow",
                "Action": [
                "cloudformation:*",
                "cloudshell:*",
                "s3:*",
                "sns:*",
                "kms:*"
                ],
                "Resource": "*"
            },
          {
                "Effect": "Allow",
                "Action": [
                "ec2:DescribeAccountAttributes",
                    "sts:GetCallerIdentity",
                "access-analyzer:ListPolicyGenerations"
                ],
                "Resource": "*"
            },
          {
                "Effect": "Allow",
                "Action": [
                "iam:List*",
                    "iam:Get*",
                "iam:Update*",
                "iam:Delete*"
                ],
                "Resource": "*"
            },
            {
                "Effect": "Allow",
                "Action": [
                    "iam:AddRoleToInstanceProfile",
                    "iam:CreateInstanceProfile",
                    "iam:DeleteInstanceProfile",
                    "iam:GetInstanceProfile",
                    "iam:RemoveRoleFromInstanceProfile",
                    "iam:DeleteRolePolicy",
                    "iam:ListPolicies",
                    "iam:ListRoles",
                    "iam:ListUserPolicies",
                    "iam:CreateAccessKey",
                    "iam:UpdateAccessKey",
                    "iam:TagUser",
                    "iam:PutUserPolicy",
                    "iam:ListEntitiesForPolicy",
                    "iam:DeleteAccessKey",
                    "iam:ListAccessKeys",
                    "iam:ListAttachedUserPolicies",
                    "iam:ListSigningCertificates",
                    "iam:ListSSHPublicKeys",
                    "iam:ListServiceSpecificCredentials",
                    "iam:DeleteUserPolicy",
                    "iam:GenerateServiceLastAccessedDetails"
                ],
                "Resource": "*"
            },
            {
                "Effect": "Allow",
                "Action": [
                  "iam:AddUserToGroup",
                  "iam:AttachRolePolicy",
                  "iam:AttachUserPolicy",
                  "iam:CreateGroup",
                  "iam:CreateRole",
                  "iam:CreatePolicy",
                  "iam:CreatePolicyVersion",
                  "iam:CreateUser",
                  "iam:DeleteRole",
                  "iam:DeleteRolePolicy",
                  "iam:DetachRolePolicy",
                  "iam:DetachUserPolicy",
                  "iam:DeleteGroup",
                  "iam:DeleteGroupPolicy",
                  "iam:DeleteUser",
                  "iam:GetGroup",
                  "iam:GetRole",
                  "iam:GetRolePolicy",
                  "iam:GetPolicy",
                  "iam:GetUser",
                  "iam:DeletePolicy",
                  "iam:GetPolicyVersion",
                  "iam:ListAttachedRolePolicies",
                  "iam:ListInstanceProfilesForRole",
                  "iam:ListRolePolicies",
                  "iam:ListPolicyVersions",
                  "iam:ListGroups",
                  "iam:ListUsers",
                  "iam:DeletePolicyVersion",
                  "iam:PassRole",
                  "iam:PutRolePolicy",
                  "iam:PutGroupPolicy",
                  "iam:RemoveUserFromGroup",
                  "iam:TagRole"
                ],
                "Resource": "*"
            }]
        }
  
  IAMManagementRole:
    Type: "AWS::IAM::Role"
    Properties:
      Path: "/"
      RoleName: "IAMManagement"
      AssumeRolePolicyDocument:  
        Fn::If: 
          - IAMAssumptionCondition
          - Fn::Sub: |
              {
                "Version": "2012-10-17",
                "Statement": [
                  {
                    "Effect": "Allow",
                    "Principal": {
                      "AWS": ["arn:aws:iam::${AWS::AccountId}:role/CSS-Customer-Admin"]
                  },
                  "Action": "sts:AssumeRole"
                }
                ]
              }
          - Fn::Sub: |
              {
                "Version": "2012-10-17",
                "Statement": [
                  {
                    "Effect": "Deny",
                    "Principal": {
                      "AWS": [
                        "*"
                      ]
                  },
                  "Action": "sts:AssumeRole"
                }
                ]
              }

      MaxSessionDuration: 3600
      ManagedPolicyArns:
        - !Ref IAMManagementPolicy
      Tags:
        - Key: "Environment"
          Value: 
            Ref: environment
        - Key: "Environment-Short"
          Value: 
            Ref: environmentShort
        - Key: "Purpose"
          Value: "Role"
        - Key: "Application"
          Value: "Infrastructure"
        - Key: "Description"
          Value: "Allows IAM Role-Policy Management"

A non-trivial, but simple test CF to verify commandRunner can use the AWS CLI.

#!!! THE RELEASE DOES NOT WORK !!!!
#To actually get this to work, you have to follow these instructions to build the tool yourself.
#https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-awsutilities-commandrunner/issues/24
#https://github.com/maslick/aws-cloudformation-resource-providers-awsutilities-commandrunner/tree/fix-null-sg

#CommandRunner Documentation
#https://aws.amazon.com/premiumsupport/knowledge-center/cloudformation-commandrunner-stack/
#https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-awsutilities-commandrunner#prerequisites


# This script Assumes Default VPC Exists

AWSTemplateFormatVersion: 2010-09-09
Description: AWS CLI version


Resources:
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/command-runner/${AWS::StackName}/"
      RetentionInDays: 14

  Role:
    Type: AWS::IAM::Role
    Properties:
      Description: "Role assumed by Command Runnner"
      MaxSessionDuration: 14400
      Path: "/"
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy
        - arn:aws:iam::aws:policy/AmazonS3FullAccess

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref Role
  CommandRunner:
    Type: AWSUtility::CloudFormation::CommandRunner
    Properties:
      LogGroup: !Ref LogGroup
      Role: !Ref InstanceProfile
      #SubnetId: YOUR_SUBNET_ID
      Command: |
        aws s3 ls | sed -n 1p | cut -d " " -f3 \
          > /command-output.txt

      # aws --version 2>&1 \
      #   | tail -1 \
      #   | head -n 1 \
      #   > /command-output.txt

      # aws s3 ls | sed -n 1p | cut -d " " -f3  > /command-output.txt

Outputs:
  CommandRunnerOutput:
    Description: CommandRunnerOutput
    Value: !GetAtt CommandRunner.Output

Upvotes: 1

Related Questions