initial version of EncryptRootVolume Document

Documents/Automation/EncryptRootVolume/Design/Design.md

@@ -0,0 +1,28 @@
+# Encrypt EBS root volume
+
+## Notes
+
+Encrypts the root volume of an EC2 instance.  This will be a replace operation and not an in-line encryption operation.
+
+## Document Design
+
+Refer to schema.json
+
+Document Steps:
+1. aws:npark-encryptrootvolume - Execute CloudFormation Template to attach the volume.
+   * Parameters:
+       * instanceId: (Required) Instance ID of the ec2 instance whose root volume needs to be encrypted
+       * region: (Required) Region in which the ec2 instance belong
+       * KmsKeyId: (Required) Customer KMS key to use during the encryption
+       * devicename: (Optional) Device name of the root volume.  Defaults to /dev/sda1
+       * AutomationAssumeRole: (Optional) The ARN of the role that allows Automation to perform the actions on your behalf
+
+## Test script
+
+Python script will:
+#  1. Create a test stack with an instance, a volume and a KMS Key (Customer managed)
+#  2. Execute automation document to replace the root volume with the encrypted one (after a copy operation of the root volume snapshot)
+#  3. Ensure the automation has executed successfully
+#  4. Detach the old volume
+#  5. Attach the new (and encrypted) volume
+#  5. Clean up test stack

Documents/Automation/EncryptRootVolume/Design/schema.json

@@ -0,0 +1,28 @@
+{
+  "schemaVersion": "0.3",
+  "description": "Encrypt Root Volume",
+  "assumeRole": "{{ AutomationAssumeRole }}",
+  "parameters": {
+    "instanceId": {
+      "description": "Instance ID of the ec2 instance whose root volume needs to be encrypted",
+      "type": "String"
+    },
+    "region": {
+      "description": "Region in which the ec2 instance belong",
+      "type": "String"
+    },
+    "KmsKeyId": {
+      "description": "Customer KMS key to use during the encryption",
+      "type": "String"
+    },
+    "devicename": {
+      "description": "Device name of the root volume.  Defaults to /dev/sda1",
+      "type": "String"
+    },
+    "AutomationAssumeRole": {
+      "description": "(Optional) The ARN of the role that allows Automation to perform the actions on your behalf",
+      "type": "String"
+    }
+  },
+  "mainSteps": []
+}

Documents/Automation/EncryptRootVolume/Documents/npark-encryptrootvolume.json

@@ -0,0 +1,198 @@
+{
+  "schemaVersion": "0.3",
+  "description": "Encrypt Root Volume Automation Document",
+  "assumeRole": "{{ AutomationAssumeRole }}",
+  "parameters": {
+    "instanceId": {
+      "description": "(Required) Instance ID of the ec2 instance whose root volume needs to be encrypted",
+      "type": "String"
+    },
+    "region": {
+      "description": "(Required) Region in which the ec2 instance belong",
+      "type": "String"
+    },
+    "KmsKeyId": {
+      "description": "(Required) Customer KMS key to use during the encryption",
+      "type": "String"
+    },
+    "devicename": {
+      "description": "(Optional) Device name of the root volume.  Defaults to /dev/sda1",
+      "type": "String"
+    },
+    "AutomationAssumeRole": {
+      "type": "String",
+      "description": "(Optional) The ARN of the role that allows Automation to perform the actions on your behalf.",
+      "default": ""
+    }
+  },
+  "mainSteps": [
+    {
+      "maxAttempts": 1,
+      "inputs": {
+        "Service": "ec2",
+        "Api": "DescribeInstances",
+        "InstanceIds": [
+          "{{instanceId}}"
+        ]
+      },
+      "outputs": [
+        {
+          "Name": "EBSVolumeID",
+          "Selector": "$.Reservations[0].Instances[0].BlockDeviceMappings[0].Ebs.VolumeId",
+          "Type": "String"
+        }
+      ],
+      "name": "extractEBSvolumeID",
+      "action": "aws:executeAwsApi",
+      "timeoutSeconds": 30,
+      "onFailure": "Abort"
+    },
+    {
+      "maxAttempts": 1,
+      "inputs": {
+        "Service": "ec2",
+        "Api": "DescribeInstances",
+        "InstanceIds": [
+          "{{instanceId}}"
+        ]
+      },
+      "outputs": [
+        {
+          "Name": "PlacementAvailabilityZone",
+          "Selector": "$.Reservations[0].Instances[0].Placement.AvailabilityZone",
+          "Type": "String"
+        }
+      ],
+      "name": "extractAvailabilityZone",
+      "action": "aws:executeAwsApi",
+      "timeoutSeconds": 30,
+      "onFailure": "Abort"
+    },
+    {
+      "maxAttempts": 3,
+      "inputs": {
+        "DocumentName": "AWS-CreateSnapshot",
+        "RuntimeParameters": {
+          "VolumeId": "{{extractEBSvolumeID.EBSVolumeID}}"
+        }
+      },
+      "name": "CreateSnapshot",
+      "action": "aws:executeAutomation",
+      "timeoutSeconds": 3600,
+      "onFailure": "Abort"
+    },
+    {
+      "maxAttempts": 1,
+      "inputs": {
+        "Service": "ec2",
+        "Api": "DescribeSnapshots",
+        "SnapshotIds": "{{CreateSnapshot.Output}}"
+      },
+      "outputs": [
+        {
+          "Name": "SNAPSHOTID",
+          "Selector": "$.Snapshots[0].SnapshotId",
+          "Type": "String"
+        }
+      ],
+      "name": "extractSnapshotID",
+      "action": "aws:executeAwsApi",
+      "timeoutSeconds": 30,
+      "onFailure": "Abort"
+    },
+    {
+      "maxAttempts": 1,
+      "inputs": {
+        "Service": "ec2",
+        "Api": "CopySnapshot",
+        "SourceSnapshotId": "{{extractSnapshotID.SNAPSHOTID}}",
+        "SourceRegion": "{{region}}",
+        "Encrypted": true,
+        "KmsKeyId": "{{KmsKeyId}}",
+        "DestinationRegion": "{{region}}"
+      },
+      "outputs": [
+        {
+          "Name": "EncryptedSnapshotID",
+          "Selector": "$.SnapshotId",
+          "Type": "String"
+        }
+      ],
+      "name": "CopySnapshot",
+      "action": "aws:executeAwsApi",
+      "timeoutSeconds": 3600,
+      "onFailure": "Abort"
+    },
+    {
+      "inputs": {
+        "Duration": "PT2M"
+      },
+      "name": "sleep1",
+      "action": "aws:sleep"
+    },
+    {
+      "maxAttempts": 1,
+      "inputs": {
+        "Service": "ec2",
+        "Api": "CreateVolume",
+        "AvailabilityZone": "{{extractAvailabilityZone.PlacementAvailabilityZone}}",
+        "Encrypted": true,
+        "KmsKeyId": "{{KmsKeyId}}",
+        "SnapshotId": "{{CopySnapshot.EncryptedSnapshotID}}",
+        "VolumeType": "gp2"
+      },
+      "outputs": [
+        {
+          "Name": "NewRootVolumeID",
+          "Selector": "$.VolumeId",
+          "Type": "String"
+        }
+      ],
+      "name": "CreateVolume",
+      "action": "aws:executeAwsApi",
+      "timeoutSeconds": 30,
+      "onFailure": "Abort"
+    },
+    {
+      "maxAttempts": 1,
+      "inputs": {
+        "DocumentName": "AWS-StopEC2Instance",
+        "RuntimeParameters": {
+          "InstanceId": "{{instanceId}}"
+        }
+      },
+      "name": "StopInstance",
+      "action": "aws:executeAutomation",
+      "timeoutSeconds": 300,
+      "onFailure": "Abort"
+    },
+    {
+      "maxAttempts": 1,
+      "inputs": {
+        "DocumentName": "AWS-DetachEBSVolume",
+        "RuntimeParameters": {
+          "VolumeId": "{{extractEBSvolumeID.EBSVolumeID}}"
+        }
+      },
+      "name": "DetachEBSVolume",
+      "action": "aws:executeAutomation",
+      "timeoutSeconds": 300,
+      "onFailure": "Abort"
+    },
+    {
+      "maxAttempts": 1,
+      "inputs": {
+        "DocumentName": "AWS-AttachEBSVolume",
+        "RuntimeParameters": {
+          "Device": "{{devicename}}",
+          "InstanceId": "{{instanceId}}",
+          "VolumeId": "{{CreateVolume.NewRootVolumeID}}"
+        }
+      },
+      "name": "AttachNewEBSVolume",
+      "action": "aws:executeAutomation",
+      "timeoutSeconds": 180,
+      "onFailure": "Abort"
+    }
+  ]
+}

Documents/Automation/EncryptRootVolume/Makefile

@@ -0,0 +1,34 @@
+#
+# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy of this
+# software and associated documentation files (the "Software"), to deal in the Software
+# without restriction, including without limitation the rights to use, copy, modify,
+# merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+# permit persons to whom the Software is furnished to do so.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+# INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+# PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+# HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+# SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+#
+TARGET_DIR = "./Output"
+
+documents: targetdir createdocuments
+	@echo "Done making documents"
+
+targetdir:
+	@echo "Making $(TARGET_DIR)"
+	mkdir -p ./Output
+
+createdocuments:
+	python ./Setup/create_document.py > ./Output/npark-EncryptRootVolume.json
+
+test: documents
+	python -m unittest discover Tests
+
+clean:
+	@echo "Removing $(TARGET_DIR)"
+	@rm -rf ./Output