公式でAWS EC2 Connectという機能が入ったので、そちらを使いましょう。
https://dev.classmethod.jp/cloud/aws/ec2-instance-connect/
−−−−−−−−−−−−
AWSの踏み台ホストのユーザー管理ってどうしていますか？IAMユーザーとホストユーザーで管理が2重になり、大変‥なんとかならないかなぁと思っていたら、IAMユーザーごとにCodeCommit用のSSH公開鍵が登録できるのを見つけたので、今回はこれを使ってホストユーザーを管理をする機構を作ってみました。
やりたいこと
- 自動でIAMに登録されているユーザーと同じユーザーをホストに作成する
- IAMユーザーごとに登録しているCodeCommitのSSH公開鍵を取得し，
~/.ssh/authorized_keysにセットする
主な部品の検証
ホストに登録されているユーザー一覧を取得する
直接ホストに作成されているユーザーの取得方法がわからなかったので、sedを駆使して/home直下に作成されているユーザーディレクトリの一覧を取得するようにしました。
find /home -maxdepth 1 -type d | grep '^/home/' | sed -e 's/^\/home\/\(.\)/\1/'
IAMユーザーの一覧を取得する
aws-cliで，IAMユーザーの名前一覧を取得できました。
aws iam list-users | jq -r '.Users[].UserName'
IAMユーザーのCodeCommit用SSH公開鍵を取得する
ユーザーごとに鍵のID一覧を取得して、IDから鍵の実体が取れました。
key_ids=$(aws iam list-ssh-public-keys --user-name $iam_user | jq -r 'select(.SSHPublicKeys[].Status == "Active") | .SSHPublicKeys[].SSHPublicKeyId')
for key_id in $key_ids; do
aws iam get-ssh-public-key --user-name $iam_user --ssh-public-key-id $key_id --encoding SSH | jq -r '.SSHPublicKey.SSHPublicKeyBody' >> authorized_keys
done
完成版のスクリプト
最終的に以下のようなフローを実行させるようにしました。
- ホストにIAMユーザーと同じ名前でユーザーを作成
- IAMユーザーごとに登録しているCodeCommitのSSH公開鍵を取得し、更新がある場合は
~/.ssh/authorized_keysにセット - IAMユーザーから削除されたユーザーはホストからも削除
- 鍵の更新やIAMから削除があったユーザーが現在SSHで接続している場合は、コネクションを強制切断
#!/bin/bash
PATH=$PATH:/sbin:/bin:/usr/sbin:/usr/bin:/opt/aws/bin
function contains() {
for row in $1; do
if [ "$row" == "$2" ]; then
echo "y"
return 0
fi
done
echo "n"
return 1
}
# current users in host.
host_users=$(find /home -maxdepth 1 -type d | grep '^/home/' | sed -e 's/^\/home\/\(.\)/\1/')
# create iam users
iam_users=$(aws iam list-users | jq -r '.Users[].UserName')
for iam_user in $iam_users; do
user_home="/home/$iam_user"
user_ssh_dir="$user_home/.ssh"
useradd "$iam_user"
# setup ssh directory
mkdir -p "$user_ssh_dir"
chown -R "$iam_user:$iam_user" "$user_home"
chmod -R 500 "$user_home"
# setup ssh key
touch "$user_ssh_dir/authorized_keys"
touch "$user_ssh_dir/new_authorized_keys"
key_ids=$(aws iam list-ssh-public-keys --user-name $iam_user | jq -r 'select(.SSHPublicKeys[].Status == "Active") | .SSHPublicKeys[].SSHPublicKeyId')
for key_id in $key_ids; do
aws iam get-ssh-public-key --user-name $iam_user --ssh-public-key-id $key_id --encoding SSH | jq -r '.SSHPublicKey.SSHPublicKeyBody' >> "$user_ssh_dir/new_authorized_keys"
done
keys_diff=$(diff "$user_ssh_dir/authorized_keys" "$user_ssh_dir/new_authorized_keys")
if [ "$keys_diff" == "" ]; then
rm -f "$user_ssh_dir/new_authorized_keys"
continue
fi
rm -f "$user_ssh_dir/authorized_keys"
mv "$user_ssh_dir/new_authorized_keys" "$user_ssh_dir/authorized_keys"
chown "$iam_user:$iam_user" "$user_ssh_dir/authorized_keys"
chmod 500 "$user_ssh_dir/authorized_keys"
ps aux | grep "sshd: $iam_user@pts/" | grep -v grep | awk '{ print "kill -9", $2 }' | sh
done
# delete iam user deleted by aws from host
for host_user in $host_users; do
# if ec2-user, not action
if [ "$host_user" = "ec2-user" ]; then
continue
fi
if [[ "$(contains "${iam_users[@]}" "$host_user")" == "y" ]]; then
continue
fi
ps aux | grep "sshd: $host_user@pts/" | grep -v grep | awk '{ print "kill -9", $2 }' | sh
userdel -r "$host_user"
rm -rf "/home/$host_user"
echo "delete $host_user from host."
done
あとは、cronでこれを適当な間隔でまわしてあげれば完成です。
お手物の環境に直ぐにデプロイできるようにCloudFromationのテンプレートを作ってみましたので、良ければ使ってください。
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description" : "Bastion Instance",
"Parameters" : {
"KeyName" : {
"Description" : "Name of an existing EC2 KeyPair to enable SSH access to the instances",
"Type" : "AWS::EC2::KeyPair::KeyName",
"ConstraintDescription" : "can contain only alphanumeric characters, spaces, dashes and underscores."
},
"InstanceType" : {
"Description" : "Instance type for node.",
"Type" : "String",
"Default" : "t2.nano",
"AllowedValues" : [ "t2.nano", "t2.micro","t2.small","t2.medium","m3.medium","m3.large","m3.xlarge","m3.2xlarge","c3.large","c3.xlarge","c3.2xlarge","c3.4xlarge","c3.8xlarge" ],
"ConstraintDescription" : "must be a valid T2, M3 or C3 instance type."
},
"Subnets" : {
"Description" : "ID of your existing subnet for launching Bastion",
"Type" : "List<AWS::EC2::Subnet::Id>"
},
"SSHSecurityGroup" : {
"Description" : "SecurityGroup for accessing with SSH",
"Type" : "AWS::EC2::SecurityGroup::Id"
},
"ElasticIpId": {
"Description" : "ID of ElasticIp for launching Bastion",
"Type" : "String",
"AllowedPattern" : "eipalloc-[a-z0-9]{8}",
"ConstraintDescription" : "Input format is eipalloc-xxxxxxxx"
},
"Recurrence" : {
"Type" : "String",
"Description" : "schedule for updating keys. crontab style syntax. ex) 0 0 * * *",
"AllowedPattern" : "(((([*])|(((([0-5])?[0-9])((-(([0-5])?[0-9])))?)))((/(([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?[0-9])))?))(,(((([*])|(((([0-5])?[0-9])((-(([0-5])?[0-9])))?)))((/(([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?[0-9])))?)))* (((([*])|(((((([0-1])?[0-9]))|(([2][0-3])))((-(((([0-1])?[0-9]))|(([2][0-3])))))?)))((/(([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?[0-9])))?))(,(((([*])|(((((([0-1])?[0-9]))|(([2][0-3])))((-(((([0-1])?[0-9]))|(([2][0-3])))))?)))((/(([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?[0-9])))?)))* (((((((([*])|(((((([1-2])?[0-9]))|(([3][0-1]))|(([1-9])))((-(((([1-2])?[0-9]))|(([3][0-1]))|(([1-9])))))?)))((/(([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?[0-9])))?))|(L)|(((((([1-2])?[0-9]))|(([3][0-1]))|(([1-9])))W))))(,(((((([*])|(((((([1-2])?[0-9]))|(([3][0-1]))|(([1-9])))((-(((([1-2])?[0-9]))|(([3][0-1]))|(([1-9])))))?)))((/(([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?[0-9])))?))|(L)|(((((([1-2])?[0-9]))|(([3][0-1]))|(([1-9])))W)))))*)|([?])) (((([*])|((((([1-9]))|(([1][0-2])))((-((([1-9]))|(([1][0-2])))))?))|((((JAN)|(FEB)|(MAR)|(APR)|(MAY)|(JUN)|(JUL)|(AUG)|(SEP)|(OKT)|(NOV)|(DEC))((-((JAN)|(FEB)|(MAR)|(APR)|(MAY)|(JUN)|(JUL)|(AUG)|(SEP)|(OKT)|(NOV)|(DEC))))?)))((/(([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?[0-9])))?))(,(((([*])|((((([1-9]))|(([1][0-2])))((-((([1-9]))|(([1][0-2])))))?))|((((JAN)|(FEB)|(MAR)|(APR)|(MAY)|(JUN)|(JUL)|(AUG)|(SEP)|(OKT)|(NOV)|(DEC))((-((JAN)|(FEB)|(MAR)|(APR)|(MAY)|(JUN)|(JUL)|(AUG)|(SEP)|(OKT)|(NOV)|(DEC))))?)))((/(([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?[0-9])))?)))* (((((((([*])|((([0-6])((-([0-6])))?))|((((SUN)|(MON)|(TUE)|(WED)|(THU)|(FRI)|(SAT))((-((SUN)|(MON)|(TUE)|(WED)|(THU)|(FRI)|(SAT))))?)))((/(([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?[0-9])))?))|((([0-6])L))|(W)|(([#][1-5]))))(,(((((([*])|((([0-6])((-([0-6])))?))|((((SUN)|(MON)|(TUE)|(WED)|(THU)|(FRI)|(SAT))((-((SUN)|(MON)|(TUE)|(WED)|(THU)|(FRI)|(SAT))))?)))((/(([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?[0-9])))?))|((([0-6])L))|(W)|(([#][1-5])))))*)|([?]))((( (((([*])|((([1-2][0-9][0-9][0-9])((-([1-2][0-9][0-9][0-9])))?)))((/(([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?[0-9])))?))(,(((([*])|((([1-2][0-9][0-9][0-9])((-([1-2][0-9][0-9][0-9])))?)))((/(([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?([0-9])?[0-9])))?)))*))?)",
"Default" : "*/10 * * * *"
}
},
"Mappings": {
"AWSBastionAMI" : {
"ap-northeast-1" : { "AMI" : "ami-383c1956" }
}
},
"Resources" : {
"BastionRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [ {
"Effect": "Allow",
"Principal": {
"Service": [ "ec2.amazonaws.com" ]
},
"Action": [ "sts:AssumeRole" ]
} ]
},
"Path": "/",
"Policies": [ {
"PolicyName": "Bastion_Takeover",
"PolicyDocument": {
"Statement": [ {
"Effect": "Allow",
"Action": [
"iam:ListUsers",
"iam:ListSshPublicKeys",
"iam:GetSshPublicKey",
"ec2:AssociateAddress"
],
"Resource": "*"
} ]
}
} ]
}
},
"BastionRoleProfile": {
"Type": "AWS::IAM::InstanceProfile",
"Properties": {
"Path": "/",
"Roles": [ {
"Ref": "BastionRole"
} ]
}
},
"BastionLaunchConfig" : {
"Type" : "AWS::AutoScaling::LaunchConfiguration",
"Metadata" : {
"AWS::CloudFormation::Init" : {
"config" : {
"packages" : {
"yum" : {
"jq" : []
}
},
"files" : {
"/etc/sshkey-update/cron.sh" : {
"content" : { "Fn::Join" : [ "\n", [
"#!/bin/bash",
"PATH=$PATH:/sbin:/bin:/usr/sbin:/usr/bin:/opt/aws/bin",
"function contains() {",
" for row in $1; do",
" if [ \"$row\" == \"$2\" ]; then",
" echo \"y\"",
" return 0",
" fi",
" done",
" echo \"n\"",
" return 1",
"}",
"# current users in host.",
"host_users=$(find /home -maxdepth 1 -type d | grep '^/home/' | sed -e 's/^\\/home\\/\\(.\\)/\\1/')",
"# create iam users",
"iam_users=$(aws iam list-users | jq -r '.Users[].UserName')",
"for iam_user in $iam_users; do",
" user_home=\"/home/$iam_user\"",
" user_ssh_dir=\"$user_home/.ssh\"",
" useradd \"$iam_user\"",
" # setup ssh directory",
" mkdir -p \"$user_ssh_dir\"",
" chown -R \"$iam_user:$iam_user\" \"$user_home\"",
" chmod -R 500 \"$user_home\"",
" # setup ssh key",
" touch \"$user_ssh_dir/authorized_keys\"",
" touch \"$user_ssh_dir/new_authorized_keys\"",
" key_ids=$(aws iam list-ssh-public-keys --user-name $iam_user | jq -r 'select(.SSHPublicKeys[].Status == \"Active\") | .SSHPublicKeys[].SSHPublicKeyId')",
" for key_id in $key_ids; do",
" aws iam get-ssh-public-key --user-name $iam_user --ssh-public-key-id $key_id --encoding SSH | jq -r '.SSHPublicKey.SSHPublicKeyBody' >> \"$user_ssh_dir/new_authorized_keys\"",
" done",
" keys_diff=$(diff \"$user_ssh_dir/authorized_keys\" \"$user_ssh_dir/new_authorized_keys\")",
" if [ \"$keys_diff\" == \"\" ]; then",
" rm -f \"$user_ssh_dir/new_authorized_keys\"",
" continue",
" fi",
" rm -f \"$user_ssh_dir/authorized_keys\"",
" mv \"$user_ssh_dir/new_authorized_keys\" \"$user_ssh_dir/authorized_keys\"",
" chown \"$iam_user:$iam_user\" \"$user_ssh_dir/authorized_keys\"",
" chmod 500 \"$user_ssh_dir/authorized_keys\"",
" ps aux | grep \"sshd: $iam_user@pts/\" | grep -v grep | awk '{ print \"kill -9\", $2 }' | sh",
"done",
"# delete iam user deleted by aws management console from host",
"for host_user in $host_users; do",
" # if ec2-user, not action",
" if [ \"$host_user\" = \"ec2-user\" ]; then",
" continue",
" fi",
" if [[ \"$(contains \"${iam_users[@]}\" \"$host_user\")\" == \"y\" ]]; then",
" continue",
" fi",
" ps aux | grep \"sshd: $host_user@pts/\" | grep -v grep | awk '{ print \"kill -9\", $2 }' | sh",
" userdel -r \"$host_user\"",
" rm -rf \"/home/$host_user\"",
" echo \"delete $host_user from host.\"",
"done"
]]},
"mode" : "0755",
"owner" : "root",
"group" : "root"
}
}
}
}
},
"Properties" : {
"InstanceType" : { "Ref" : "InstanceType" },
"KeyName" : { "Ref" : "KeyName" },
"ImageId" : { "Fn::FindInMap" : [ "AWSBastionAMI", { "Ref" : "AWS::Region" }, "AMI"] },
"IamInstanceProfile" : { "Ref" : "BastionRoleProfile" },
"AssociatePublicIpAddress" : "true",
"SecurityGroups" : [ { "Ref" : "SSHSecurityGroup" } ],
"UserData" : { "Fn::Base64" : { "Fn::Join" : [ "", [
"#!/bin/bash\n",
"yum update -y\n",
"export AWS_DEFAULT_REGION=", { "Ref" : "AWS::Region" }, "\n",
"/opt/aws/bin/cfn-init -s ", { "Ref" : "AWS::StackId" }, " -r BastionLaunchConfig --region ", { "Ref" : "AWS::Region" }, "\n",
"echo \"", { "Ref" : "Recurrence" }, " /bin/bash /etc/sshkey-update/cron.sh\" >> /tmp/$$.tmp\n",
"crontab /tmp/$$.tmp && rm -rf /tmp/$$.tmp\n",
"/bin/bash /etc/sshkey-update/cron.sh\n",
"instanceId=$(curl http://169.254.169.254/latest/meta-data/instance-id)\n",
"aws ec2 associate-address --instance-id $instanceId --allocation-id ", { "Ref" : "ElasticIpId" }, "\n"
]]}
}
}
},
"BastionAutoScalingGroup" : {
"Type" : "AWS::AutoScaling::AutoScalingGroup",
"Properties" : {
"LaunchConfigurationName" : { "Ref" : "BastionLaunchConfig" },
"MaxSize" : "1",
"MinSize" : "1",
"VPCZoneIdentifier" : { "Ref" : "Subnets" },
"Tags" : [
{ "Key" : "Name", "Value" : "bastion", "PropagateAtLaunch" : "true" }
]
}
}
}
}