4

I'm trying to use EC2 to provide an easy-to-use way to bootstrap a hard-to-build web application. Trouble is, there is some sensitive configuration on the filesystem, such as password salts.

I've written a user-data script that replaces these salts with random values on first boot, and I put this in the user-data attribute of the instance from which I built my AMI.

But now it looks to me like user-data scripts are specific to instances, not AMIs - that is, it's only run when specified by the user doing the cloning, not the creator of the AMI (me).

Well... duh, I guess that makes sense given the name "user data".

Is that wrong? Is there any way for me to provide a script that's run automagically on new clones of my AMI?

Eric Hammond
  • 11,163
  • 1
  • 36
  • 56
slinkp
  • 143
  • 3

1 Answers1

4

If you are building the AMI, then you can put whatever you want on the file system.

For your high level question about running code on startup, you can add the code as a standard system startup script on the AMI file system. The specific way to do this depends on the initialization software used by your particular Linux distro and release.

HOWEVER! Your specific example of overwriting sensitive data on the file system is not something that is safe to do in an AMI. Sensitive, private, or secret information should never be placed in an AMI. In fact, it should never touch the EBS volume used to build a public AMI as there are ways for users to restore the data that has been deleted.

I've written a couple articles about these security risks:

Creating Public AMIs Securely for EC2
http://alestic.com/2011/06/ec2-ami-security

Hidden Dangers in Creating Public EBS Snapshots on EC2
http://alestic.com/2009/09/ec2-public-ebs-danger

Community
  • 1
Eric Hammond
  • 11,163
  • 1
  • 36
  • 56
  • Thanks for the good reading. I guess the question then becomes twofold: 1) how to ensure that my image is clean, which your articles address pretty well; and 2) how to write an init script that only runs once per image, not once per boot. I think I can steal some ideas from the user-data runner for the latter. – slinkp Sep 08 '11 at 20:11
  • Glad to be of assistance. If you still have questions about how to create startup scripts, post a separate question describing the details of what you want to do and what Linux distro you're using. – Eric Hammond Sep 12 '11 at 21:23