CODEWITHSUNDEEP
amazon-web-servicesamazon-ec2
stressedmana
stressedmana

Reputation: 1

AWS EC2 Image Builder issue with authorized_keys

I'm trying to create a custom image of RedHat 8 using the EC2 Image Builder. In one of the recipes added to the pipeline, I've created the ansible user and used S3 to download the authorized_keys and the custom sudoers.d file. The issue I'm facing is that the sudoers file called "ansible" gets copied just fine, the authorized_keys doesn't. CloudWatch says that the recipe get executed without errors, the files are downloaded but when I create an EC2 with this AMI, the authorized_keys file is not in the path.

What's happening?

This is the recipe I'm using:

name: USER-Ansible
description: Creazione e configurazione dell'utente ansible
schemaVersion: 1.0
phases:
  - name: build
    steps:
      - name: UserCreate
        action: ExecuteBash
        inputs:
          commands:
            - groupadd -g 2004 ux
            - useradd -u 4134 -g ux -c "AWX Ansible" -m -d /home/ansible ansible
            - mkdir /home/ansible/.ssh
      - name: FilesDownload
        action: S3Download
        inputs:
          - source: s3://[REDACTED]/authorized_keys
            destination: /home/ansible/.ssh/authorized_keys
            expectedBucketOwner: [REDACTED]
            overwrite: false
          - source: s3://[REDACTED]/ansible
            destination: /etc/sudoers.d/ansible
            expectedBucketOwner: [REDACTED]
            overwrite: false
      - name: FilesConfiguration
        action: ExecuteBash
        inputs:
          commands:
            - chown ansible:ux /home/ansible/.ssh/authorized_keys; chmod 600 /home/ansible/.ssh/authorized_keys
            - chown ansible:ux /home/ansible/.ssh; chmod 700 /home/ansible/.ssh
            - chown root:root /etc/sudoers.d/ansible; chmod 440 /etc/sudoers.d/ansible

Thanks in advance!

Upvotes: 0

Views: 639

Answers (1)

tvb
tvb

Reputation: 830

AWS EC2 Image Builder cleans up afterwards

https://docs.aws.amazon.com/imagebuilder/latest/userguide/security-best-practices.html#post-build-cleanup

# Clean up for ssh files
SSH_FILES=(
    "/etc/ssh/ssh_host_rsa_key"
    "/etc/ssh/ssh_host_rsa_key.pub"
    "/etc/ssh/ssh_host_ecdsa_key"
    "/etc/ssh/ssh_host_ecdsa_key.pub"
    "/etc/ssh/ssh_host_ed25519_key"
    "/etc/ssh/ssh_host_ed25519_key.pub"
    "/root/.ssh/authorized_keys"
)
if [[ -f {{workingDirectory}}/skip_cleanup_ssh_files ]]; then
    echo "Skipping cleanup of ssh files"
else
    echo "Cleaning up ssh files"
    cleanup "${SSH_FILES[@]}"
    USERS=$(ls /home/)
    for user in $USERS; do
        echo Deleting /home/"$user"/.ssh/authorized_keys;
        sudo find /home/"$user"/.ssh/authorized_keys -type f -exec shred -zuf {} \;
    done
    for user in $USERS; do
        if [[ -f /home/"$user"/.ssh/authorized_keys ]]; then
            echo Failed to delete /home/"$user"/.ssh/authorized_keys;
            exit 1
        fi;
    done;
fi;

You can skip individual sections of the clean up script.

https://docs.aws.amazon.com/imagebuilder/latest/userguide/security-best-practices.html#override-linux-cleanup-script

Upvotes: 1

Related Questions