Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

initial version of EncryptRootVolume Document #34

Merged
merged 10 commits into from
Apr 9, 2019
+782 −0
Merged

initial version of EncryptRootVolume Document #34

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
c7356af
initial version of EncryptRootVolume Document
Mar 7, 2019
9899500
expanded DescribeInstance step's Output; Changed the way I determine …
Mar 17, 2019
944cb50
asserting that root volume encryption has been completed
Mar 17, 2019
50cc470
Changed sleep to wait. Restoring original EC2 state rather than arbit…
Mar 20, 2019
c62c5c4
Created additional parameter options for snapshot waits; shuffled and…
Mar 21, 2019
4b5a558
changed to more descriptive parameter name; added outputs section to …
Mar 21, 2019
6e321d2
removed max wait for now
Mar 21, 2019
7029545
onFailure changed to 'Continue' in the clean up stages; being more ag…
Mar 26, 2019
50032bf
clean up process adjustment
Apr 5, 2019
0bc9f65
renamed npark-encryptrootvolume.json to aws-encryptrootvolume.json
Apr 9, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
130 changes: 90 additions & 40 deletions Documents/Automation/EncryptRootVolume/Documents/npark-encryptrootvolume.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,22 +3,14 @@
"description": "Encrypt Root Volume Automation Document",
"assumeRole": "{{ AutomationAssumeRole }}",
"parameters": {
"instanceId": {
"InstanceId": {
"description": "(Required) Instance ID of the ec2 instance whose root volume needs to be encrypted",
"type": "String"
},
"region": {
"description": "(Required) Region in which the ec2 instance belong",
"type": "String"
},
"KmsKeyId": {
"description": "(Required) Customer KMS key to use during the encryption",
"type": "String"
},
"devicename": {
"description": "(Optional) Device name of the root volume. Defaults to /dev/sda1",
"type": "String"
},
"AutomationAssumeRole": {
"type": "String",
"description": "(Optional) The ARN of the role that allows Automation to perform the actions on your behalf.",
Expand All @@ -32,48 +24,72 @@
"Service": "ec2",
"Api": "DescribeInstances",
"InstanceIds": [
"{{instanceId}}"
"{{InstanceId}}"
]
},
"outputs": [
{
"Name": "EBSVolumeID",
"Selector": "$.Reservations[0].Instances[0].BlockDeviceMappings[0].Ebs.VolumeId",
"Name": "AvailabilityZone",
"Selector": "$.Reservations[0].Instances[0].Placement.AvailabilityZone",
"Type": "String"
}
],
"name": "extractEBSvolumeID",
"action": "aws:executeAwsApi",
"timeoutSeconds": 30,
"onFailure": "Abort"
},
{
"maxAttempts": 1,
"inputs": {
"Service": "ec2",
"Api": "DescribeInstances",
"InstanceIds": [
"{{instanceId}}"
]
},
"outputs": [
},
{
"Name": "PlacementAvailabilityZone",
"Selector": "$.Reservations[0].Instances[0].Placement.AvailabilityZone",
"Name": "RootDeviceName",
"Selector": "$.Reservations[0].Instances[0].RootDeviceName",
"Type": "String"
}
],
"name": "extractAvailabilityZone",
"name": "describeInstance",
"action": "aws:executeAwsApi",
"timeoutSeconds": 30,
"onFailure": "Abort"
},

{
"name": "describeInstanceRootVolume",
"action": "aws:executeAwsApi",
"onFailure": "Abort",
"timeoutSeconds": 60,
"maxAttempts": 10,
"inputs": {
"Service": "ec2",
"Api": "DescribeVolumes",
"Filters": [
{
"Name": "attachment.instance-id",
"Values": [
"{{ InstanceId }}"
]
},
{
"Name": "attachment.device",
"Values": [
"{{ describeInstance.RootDeviceName }}"
]
}
]
},
"outputs": [
{
"Name": "RootDeviceVolumeId",
"Selector": "$.Volumes[0].Attachments[0].VolumeId",
"Type": "String"
},
{
"Name": "RootDeviceDeleteOnTermination",
"Selector": "$.Volumes[0].Attachments[0].DeleteOnTermination",
"Type": "Boolean"
}
],
"isCritical": true
},

{
"maxAttempts": 3,
"inputs": {
"DocumentName": "AWS-CreateSnapshot",
"RuntimeParameters": {
"VolumeId": "{{extractEBSvolumeID.EBSVolumeID}}"
"VolumeId": "{{describeInstanceRootVolume.RootDeviceVolumeId}}"
}
},
"name": "CreateSnapshot",
Expand Down Expand Up @@ -106,10 +122,10 @@
"Service": "ec2",
"Api": "CopySnapshot",
"SourceSnapshotId": "{{extractSnapshotID.SNAPSHOTID}}",
awsandrewpark marked this conversation as resolved.
Show resolved Hide resolved
"SourceRegion": "{{region}}",
"SourceRegion": "{{global:REGION}}",
"Encrypted": true,
"KmsKeyId": "{{KmsKeyId}}",
"DestinationRegion": "{{region}}"
"DestinationRegion": "{{global:REGION}}"
},
"outputs": [
{
Expand All @@ -135,7 +151,7 @@
"inputs": {
"Service": "ec2",
"Api": "CreateVolume",
"AvailabilityZone": "{{extractAvailabilityZone.PlacementAvailabilityZone}}",
"AvailabilityZone": "{{describeInstance.AvailabilityZone}}",
"Encrypted": true,
"KmsKeyId": "{{KmsKeyId}}",
"SnapshotId": "{{CopySnapshot.EncryptedSnapshotID}}",
Expand All @@ -158,7 +174,7 @@
"inputs": {
"DocumentName": "AWS-StopEC2Instance",
"RuntimeParameters": {
"InstanceId": "{{instanceId}}"
"InstanceId": "{{InstanceId}}"
}
},
"name": "StopInstance",
awsandrewpark marked this conversation as resolved.
Show resolved Hide resolved
awsandrewpark marked this conversation as resolved.
Show resolved Hide resolved
Expand All @@ -171,7 +187,7 @@
"inputs": {
"DocumentName": "AWS-DetachEBSVolume",
"RuntimeParameters": {
"VolumeId": "{{extractEBSvolumeID.EBSVolumeID}}"
"VolumeId": "{{describeInstanceRootVolume.RootDeviceVolumeId}}"
awsandrewpark marked this conversation as resolved.
Show resolved Hide resolved
}
},
"name": "DetachEBSVolume",
Expand All @@ -184,15 +200,49 @@
"inputs": {
"DocumentName": "AWS-AttachEBSVolume",
"RuntimeParameters": {
"Device": "{{devicename}}",
"InstanceId": "{{instanceId}}",
"Device": "{{describeInstance.RootDeviceName}}",
"InstanceId": "{{InstanceId}}",
"VolumeId": "{{CreateVolume.NewRootVolumeID}}"
}
},
"name": "AttachNewEBSVolume",
"action": "aws:executeAutomation",
"timeoutSeconds": 180,
"onFailure": "Abort"
},
{
"name": "ApplyDeleteOnTerminationValue",
"action": "aws:executeAwsApi",
"onFailure": "Abort",
"timeoutSeconds": 60,
"maxAttempts": 10,
"inputs": {
"Service": "ec2",
"Api": "ModifyInstanceAttribute",
"InstanceId": "{{InstanceId}}",
"BlockDeviceMappings": [
{
"DeviceName": "{{describeInstance.RootDeviceName}}",
"Ebs": {
"DeleteOnTermination": "{{describeInstanceRootVolume.RootDeviceDeleteOnTermination}}"
}
}
]
},
"isCritical": true
},
{
"maxAttempts": 1,
"inputs": {
"DocumentName": "AWS-StartEC2Instance",
awsandrewpark marked this conversation as resolved.
Show resolved Hide resolved
"RuntimeParameters": {
"InstanceId": "{{InstanceId}}"
}
},
"name": "StartInstance",
"action": "aws:executeAutomation",
"timeoutSeconds": 300,
"onFailure": "Abort"
}
awsandrewpark marked this conversation as resolved.
Show resolved Hide resolved
]
}
2 changes: 1 addition & 1 deletion Documents/Automation/EncryptRootVolume/Tests/test_document.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,7 @@ def test_update_document(self):
'AutomationAssumeRole': [role_arn]})
self.assertEqual(ssm_doc.automation_execution_status(ssm_client, execution, False), 'Success')

LOGGER.info('Encrypting root volume process has been initiated')
LOGGER.info('Encryption of root volume has been completed')

response=ssm_doc.automation_execution_status(ssm_client, execution)
if response == 'Success':
awsandrewpark marked this conversation as resolved.
Show resolved Hide resolved
Expand Down