ACM.104 Preserve a static IP handle when it’s essential delete and recreate an EC2 occasion

This can be a continuation of my sequence on automating cybersecurity metrics.

We bumped into a problem within the final submit and can repair it on this submit. In that submit, we used an AWS managed prefix checklist so as to add guidelines to our safety group as an alternative of including all CIDRs utilized by the S3 service.

Updating safety teams on an EC2 occasion in CloudFormation apparently requires you to delete and recreate an EC2 occasion. I do not know why as a result of you possibly can change the safety teams within the AWS console with an EIP assigned and never have such issues. It appears to be like like AWS may have the ability to repair no matter is inflicting that (#awswishlist).

CloudFormation denied deleting and recreating the AWS EC2 occasion as a consequence of the truth that one other stack trusted an output from our EC2 stack. That different stack was our EIP (Elastic IP Handle) created this submit:

If we delete the EIP, we lose the IP handle that has been assigned to us and we have to create a brand new one. And if we now have to create a brand new IP handle, we now have to return and repair all of our native community guidelines right here that had been configured on this submit:

To ensure we did not lose our EIP however may redeploy our VM, we eliminated the output dependency on our EIP stack. In truth, we needed to change our EIP template code. That is not a superb long-term resolution. We do not need to have to vary code to create, delete, and redeploy assets. There are a number of options to that downside, however the one we’re going to use is an EIP affiliation from CloudFormation:

Leveraging the useful resource of the EIPA affiliation

After we create an EIP affiliation, we move an EIP handle and an occasion ID.

The EIPAssociation CloudFormation documentation says that we now have to move an project ID:

Nicely, the place will we get that from, because the output returned by an EIP is an IP handle? We will work out the best way to get the mapping ID from the code on the backside of the web page.

The pattern code implements an EIP:

It then implements an EIPA affiliation and will get the ID utilizing GetAtt and [EIP].Id. project.

Apparently that is the way you get the ID and we have to add it to our leads to our EIP template:

Since our EIP has no dependencies now, we are able to deploy it in our fundamental deployment script. Keep in mind that we eliminated the occasion ID dependency.

Give it a attempt to now we now have an output with the EIP ID on the CloudFormation stack:

Strive the EIPA affiliation

We will now reference that in our EIPA affiliation template. We will additionally reference the export worth for the EC2 occasion that we need to affiliate the IP handle with.

With the earlier useful resource we are able to delete it and recreate it with out shedding our EIP or fastened IP handle that we’re utilizing in our firewall guidelines.

Rename deployment_eips.sh to deployment_eip_alloc.sh and add the code there to implement an EIP affiliation.

Implement the EIP affiliation and confirm that it really works.

Confirm that we now have the identical IP related together with your EC2 occasion that you just had earlier than. I make. Which means I will not have to vary any community guidelines.

We must always now have the checklist of S3 prefixes within the safety group assigned to our EC2 occasion in that final submit.

That rule permits our EC2 occasion to connect with S3 on port 443. That, in flip, permits us to name yum instructions on AWS, since yum on AWS shops packages in S3. Let’s attempt.

SSH into the Developer EC2 occasion that we created on this sequence. Keep in mind that because the underlying host modified, you will must delete your identified hosts file as I defined in a earlier submit.

Run this command:

sudo yum set up git

Success!

Whereas we’re at it, you must also run the next command to replace any outdated software program on the system:

sudo yum replace

Now that we have put in git on an EC2 occasion, let’s use it. In our subsequent submit, I am going to present you the best way to add community guidelines to permit your EC2 occasion to speak with GitHub to retrieve code.

Observe for updates.

Teri Radichel

In the event you like this story please applaud Y proceed:

Medium: Teri Radichel or E-mail Listing: Teri Radichel
Twitter: @teriradichel or @2ndSightLab
Requests providers by way of LinkedIn: Teri Radichel or IANS Analysis

© second sight lab 2022

All posts on this sequence:

____________________________________________

Writer:

Cybersecurity for executives within the cloud period at Amazon

Do you want cloud safety coaching? 2nd Sight Lab Cloud Safety Coaching

Is your cloud safe? Rent 2nd Sight Lab for a penetration take a look at or safety evaluation.

Do you’ve got a query about cybersecurity or cloud safety? Ask Teri Radichel by scheduling a name with IANS Analysis.

Cybersecurity and Cloud Safety Sources by Teri Radichel: Cybersecurity and cloud safety lessons, articles, white papers, shows, and podcasts