IAM Roles in AWS are quite powerful – especially when users need instances to access service APIs to implement complex deployments. In the past, this could be accomplished by passing access keys and secret keys through the instance user data service, which can be cumbersome and is quite insecure. With IAM roles, instances can be launched with profiles that allow them to leverage various IAM policies provided by the user to control what service APIs instances can access in a secure manner. As part of constant pursuit for AWS compatibility, one of the new features in Eucalyptus 3.4 is the support of IAM roles and instance profiles (and yes, it works with tools like ec2-api-tools, and libraries like boto, which support accessing IAM roles through the instance meta data service).
This blog entry will demonstrate the following:
- Set up an Eucalyptus IAM role
- Create an Eucalyptus instance profile
- Assign an instance profile when launching an instance
- Leverage the IAM role from within the instance to access a service API (for this example, it will be the EC2 service API on Eucalyptus)
Prerequisites
To use IAM roles on Eucalyptus, the following is required:
- A Eucalyptus 3.4 cloud – These packages can be downloaded from the Eucalyptus 3.4 nightly repo. For additional information regarding downloading nightly builds of Eucalyptus, please refer the Eucalyptus Install Guide (note: anywhere there is a “3.3” reference, replace with “3.4”)
- User Credentials – User credentials for an account administrator (admin user), and credentials of a non-admin user of a non-eucalyptus account.
- Apply an IAM policy for the non-admin user to launch instances, and pass roles to instances launched by that user using euare-useruploadpolicy. An example policy is below:
{"Statement": [ "Effect":"Allow", "Action":"iam:PassRole", "Resource":"*" }, { "Effect":"Allow", "Action":"iam:ListInstanceProfiles", "Resource":"*" }, { "Effect":"Allow", "Action":"ec2:*", "Resource":"*" }] } - AWS IAM CLI Tools and Euca2ools 3 – The AWS IAM CLI tools are for creating IAM roles and instance profiles; euca2ools for launching instances. There will be one configuration file for the AWS IAM CLI tools that will contain the credentials of the account admin user (for example, account1-admin.config). Euca2ools will only need the credentials of the non-admin user in the euca2ools.ini file (for example, creating a user section called account1-user01].
Creating a Eucalyptus IAM Role
Just as in AWS IAM, iam-rolecreate can be used with Eucalyptus IAM to create IAM roles. To create a IAM role on Eucalyptus, run the following command:
# iam-rolecreate --aws-credential-file account1-admin.config --url http://10.104.10.6:8773/services/Euare/ -r ACCT1-EC2-ACTIONS -s http://10.104.10.6:8773/services/Eucalyptus # iam-rolelistbypath --aws-credential-file account1-admin.config --url http://10.104.10.6:8773/services/Euare/ arn:aws:iam::735723906303:role/ACCT1-EC2-ACTIONS IsTruncated: false
This will create a IAM role called ACCT1-EC2-ACTIONS. Next, we need to add an IAM policy to the role. As mentioned earlier, the IAM policy will allow the instance to execute an EC2 API call (in this case, ec2-describe-availability-zones). Use iam-roleuploadpolicy to upload the following IAM policy file:
{
"Statement": [
{
"Sid": "Stmt1381454720306",
"Action": [
"ec2:DescribeAvailabilityZones"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
After the IAM policy file has been created (e.g. ec2-describe-az), upload the policy to the role:
# iam-roleuploadpolicy --aws-credential-file account1-admin.config
--url http://10.104.10.6:8773/services/Euare/ -p ec2-describe-az
-f ec2-describe-az -r ACCT1-EC2-ACTIONS
# iam-rolelistpolicies --aws-credential-file account1-admin.config
--url http://10.104.10.6:8773/services/Euare/ -r ACCT1-EC2-ACTIONS -v
ec2-describe-az
{
"Statement": [
{
"Sid": "Stmt1381454720306",
"Action": [
"ec2:DescribeAvailabilityZones"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
IsTruncated: false
As displayed, the IAM role has been created, and an IAM policy has been added to the role successfully. Now its time to deal with instance profiles.
Create an Instance Profile and Add a Role to the Profile
Instance profiles are used to pass the IAM role to the instance. An IAM role can be associated to many instance profiles, but an instance profile can be associated to only one IAM role. To create an instance profile, use iam-instanceprofilecreate. Since the IAM role ACCT1-EC2-ACTIONS was previously created, the role can be added as the instance profile is created:
# iam-instanceprofilecreate --aws-credential-file account1-admin.config --url http://10.104.10.6:8773/services/Euare/ -r ACCT1-EC2-ACTIONS -s instance-ec2-actions # iam-instanceprofilelistbypath --aws-credential-file acct1-user1-aws-iam.config --url http://10.104.10.6:8773/services/Euare/ arn:aws:iam::735723906303:instance-profile/instances-ec2-actions IsTruncated: false
We have successfully created an instance profile and associated an IAM role to it. All that is left to do is test it out.
Testing out the Instance Profile
Before testing out the instance profile, make sure that the euca2ools.ini file has the correct user and region information for the non-admin user of the account (for this example, the user will be user01). For information about obtaining the credentials for the user, please refer to the section “Create Credentials” in the Eucalyptus User Guide.
After setting up the euca2ools.ini file, use euca-run-instance to launch an instance with an instance profile. The image used here is the Ubuntu Raring Cloud Image. The keypair account1-user01 was created using euca-create-keypair. To open up SSH access to the instance, use euca-authorize. Create a cloud-init user data file to enable the multiverse repository.
# cat cloud-init.config #cloud-config apt_sources: - source: deb $MIRROR $RELEASE multiverse apt_update: true apt_upgrade: true disable_root: true # euca-run-instances --key account1-user1 emi-C25538DA --instance-type m1.large --user-data-file cloud-init.config --iam-profile arn:aws:iam::407837561996:instance-profile/instance-ec2-actions --region account1-user01@ RESERVATION r-CED1435E 407837561996 default INSTANCE i-72F244CC emi-C25538DA 0.0.0.0 0.0.0.0 pending account1-user01 0 m1.large 2013-10-10T22:08:00.589Z Exodus eki-C9083808 eri-39BC3B99 monitoring-disabled 0.0.0.0 0.0.0.0 instance-store paravirtualized arn:aws:iam::407837561996:instance-profile/instance-ec2-actions .... # euca-describe-instances --region account1-user01@ RESERVATION r-CED1435E 407837561996 default INSTANCE i-72F244CC emi-C25538DA 10.104.7.22 172.17.190.157 running account1-user01 0 m1.large 2013-10-10T22:08:00.589Z Exodus eki-C9083808 eri-39BC3B99 monitoring-disabled 10.104.7.22 172.17.190.157 instance-store paravirtualized arn:aws:iam::407837561996:instance-profile/instance-ec2-actions TAG instance i-72F244CC euca:node 10.105.10.11
Next, SSH into the instance and confirm the instance profile is accessible by the instance meta-data service.
[root@odc-c-06 ~]# ssh-keygen -R 10.104.7.22
/root/.ssh/known_hosts updated.
Original contents retained as /root/.ssh/known_hosts.old
[root@odc-c-06 ~]# ssh -i euca-admin.priv ubuntu@10.104.7.22
The authenticity of host '10.104.7.22 (10.104.7.22)' can't be established.
RSA key fingerprint is a1:b2:5d:1a:be:e3:cb:0b:58:5f:bd:c1:e2:1f:e3:2d.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.104.7.22' (RSA) to the list of known hosts.
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
Welcome to Ubuntu 13.04 (GNU/Linux 3.8.0-31-generic x86_64)
* Documentation: https://help.ubuntu.com/
.....
Get cloud support with Ubuntu Advantage Cloud Guest:
http://www.ubuntu.com/business/services/cloud
Use Juju to deploy your cloud instances and workloads:
https://juju.ubuntu.com/#cloud-raring
0 packages can be updated.
0 updates are security updates.
ubuntu@ip-172-17-190-157:~$ curl http://169.254.169.254/latest/meta-data/
ami-id
ami-launch-index
ami-manifest-path
block-device-mapping/
hostname
iam/
instance-id
instance-type
kernel-id
local-hostname
local-ipv4
mac
placement/
public-hostname
public-ipv4
public-keys/
ramdisk-id
reservation-id
security-groups
### check for IAM role temporary secuirty credentials ###
ubuntu@ip-172-17-190-157:~$ curl http://169.254.169.254/latest/meta-data/iam/
security-credentials/ACCT1-EC2-ACTIONS
{
"Code": "Success",
"LastUpdated": "2013-10-11T18:07:37Z",
"Type": "AWS-HMAC",
"AccessKeyId": "AKIYW7FDRV8ZG5HIM91D",
"SecretAccessKey": "sgVOgLJoc3wXjI5mu7yrYXI3NHtiq18cJuOT7Mwh",
"Token": "ZXVjYQABQe4E4f2NnIsnvT/5jfpauKh3dClPVwPEoMepqk0lViODSgk4axiQb9rRQyU7Qnhvxb22wO201EoT6Ay/
rg+1i3+2xQLfbkh7kqy4CmqdGM3Q7LNI1dFPSz332E6us5BsSdHpiw3VGLyMLnDAkV8BMi+6lKE5eaJ+hpFI/
KXEVPSNkFMI9R+9bKPIFZvceiBE1w+kAEJC/18uCpZ0kSNy2iFBYcZ+zTwrYTgnsqNYcEIuWzEh4z1WIA==",
"Expiration": "2013-10-11T19:07:37Z"
}
Install the ec2-api-tools from the Ubuntu Raring multiverse repository.
ubuntu@ip-172-17-190-157:~$ sudo apt-get update Get:1 http://security.ubuntu.com raring-security Release.gpg [933 B] Hit http://Exodus.clouds.archive.ubuntu.com raring Release.gpg ...... Ign http://Exodus.clouds.archive.ubuntu.com raring-updates/main Translation-en_US Ign http://Exodus.clouds.archive.ubuntu.com raring-updates/multiverse Translation-en_US Ign http://Exodus.clouds.archive.ubuntu.com raring-updates/universe Translation-en_US Fetched 8,015 kB in 19s (421 kB/s) Reading package lists... Done ubuntu@ip-172-17-190-157:~$ sudo apt-get install ec2-api-tools Reading package lists... Done The following extra packages will be installed: ca-certificates-java default-jre-headless fontconfig-config icedtea-7-jre-jamvm java-common libavahi-client3 libavahi-common-data libavahi-common3 libcups2 libfontconfig1 libjpeg-turbo8 libjpeg8 liblcms2-2 libnspr4 libnss3 libnss3-1d openjdk-7-jre-headless openjdk-7-jre-lib ttf-dejavu-core tzdata-java ...... Adding debian:TDC_Internet_Root_CA.pem Adding debian:SecureTrust_CA.pem done. Setting up openjdk-7-jre-lib (7u25-2.3.10-1ubuntu0.13.04.2) ... Processing triggers for libc-bin ... ldconfig deferred processing now taking place Processing triggers for ca-certificates ... Updating certificates in /etc/ssl/certs... 0 added, 0 removed; done. Running hooks in /etc/ca-certificates/update.d.... done. done.
Finally, run ec2-describe-availability-zones using the –url option to point to the Eucalyptus cloud being used.
ubuntu@ip-172-17-190-157:~$ ec2-describe-availability-zones -U http://10.104.10.6:8773/services/Eucalyptus/ AVAILABILITYZONE Legend 10.104.1.185 arn:euca:eucalyptus:Legend:cluster:IsThisLove/ AVAILABILITYZONE Exodus 10.104.10.22 arn:euca:eucalyptus:Exodus:cluster:NaturalMystic/
Thats it! Notice how there wasn’t a need to pass any access key and secret key. All that information is grabbed from the instance meta-data service.
IAM roles and instance profiles are quite powerful. Great use cases include enabling CloudWatch metrics, and deploying ELBs on Eucalyptus.
I hope this has been helpful. As always, any questions/suggestions/ideas/feedback are greatly appreciated.
Filed under: Infrastructure, Interests, Private Cloud Computing, System Adminstration Tagged: 3.4, aws compatibility, aws iam tools, cloud computing, ec2-api-tools, Euare, euca2ools, euca2ools.ini, IAM, iam roles, instance profiles Image may be NSFW.
Clik here to view.
