使用云形成在 AWS EC2 实例中创建文件的最佳实践

Question

有很多选择可以做到这一点，我不知道哪个是最好的。我一开始尝试做的事情如下：

ServiceInstance:
Type: "AWS::EC2::Instance"
Properties:
  ImageId: !Ref AmiId, !Ref LatestOnescoutAmi ]
  InstanceType: !Ref InstanceType
  SubnetId: !ImportValue vpc-stack-PublicASubnet
  SecurityGroupIds:
    - !Ref ServiceSecurityGroup
  KeyName: !Ref KeyName
  UserData:
    'Fn::Base64': !Sub |
      #cloud-config
      write_files:
        - path: /etc/sysconfig/cloudformation
          permissions: 0644
          owner: root
          content: |
            STACK_NAME=${AWS::StackName}
            AWS_REGION=${AWS::Region}
        - path: /etc/datadog-agent/conf.d/mysql.d/conf.yaml
          permissions: 0644
          owner: dd-agent
          content: |
            init_config:
            instances:
            - server: some-db-host
              user: some-admin
              pass: some-password
              port: 3306
              tags:
              - dbinstanceidentifier:someide

      runcmd:
        ## enable datadog agent
        - systemctl start datadog-agent
        - systemctl start application.service

但后来我的/etc/datadog-agent/conf.d/mysql.d/conf.yaml 增长了，我有大约 13 个块，将它们硬编码在模板中并不好。最好保持模板通用并将配置文件作为参数传递。 但是，根据这个answer here，不可能将文件或文件内容传递给云形成。

上面的方法是我能想到的其他两个选项中最简单的。

1. 将配置存储在 SSM 中，然后在 ec2 启动时将其取回。

2. 创建一个接受文件路径但比我需要的更复杂的自动缩放和启动组：

   LaunchConfig:
       Type: AWS::AutoScaling::LaunchConfiguration
       Metadata:
         AWS::CloudFormation::Init:
           configSets:
             service_configuration:
             - datadog_setup
           datadog_setup:
             files:
               /etc/datadog-agent/conf.d/mysql.d/conf.yaml:
                 content: "@file://./config/conf-${Env}.yaml"
                 mode: "000644"
                 owner: "root"
                 group: "root"
             commands:
               start_datadog:
                 command: service datadog-agent start
   

知道如何以简单、通用和安全的方式执行此操作吗？ 给出一个例子将不胜感激。 提前致谢。

Answer 1

我如何通过另一种方式做到这一点，我创建了 S3 存储桶，然后为我的 ec2 实例创建了一个角色，该角色可以访问此 s3 存储桶并可以下载文件，然后在我的 runcmd 部分中，我下载了此文件。

  ServiceInstance:
    Type: "AWS::EC2::Instance"
    Properties:
      InstanceType: !Ref InstanceType
      IamInstanceProfile: !Ref InstanceProfile
      UserData:
        'Fn::Base64': !Sub |
          #cloud-config
          write_files:
          - path: /etc/sysconfig/cloudformation
            permissions: 0644
            owner: root
            content: |
              STACK_NAME=${AWS::StackName}
              AWS_REGION=${AWS::Region}
          runcmd:
          - aws s3 cp s3://${ArtifactsBucketName}/dd-get-secrets.py /home/ec2-user/dd-get-secrets.py

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles: [!Ref IAMRole]

  IAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: [ec2.amazonaws.com]
          Action: ['sts:AssumeRole']
      Path: /
      Policies:

      - PolicyName: allow-downloading-dd-templates
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - s3:GetObject
            - s3:ListBucket
            Resource: !Sub "arn:aws:s3:::${ArtifactsBucketName}/*"