Commits on Oct 30, 2020

1. nixos ec2/create-amis.sh: shellcheck: quote region references

   

   grahamc committed Oct 30, 2020
   Copy the full SHA

   c766921 View commit details

   Browse the repository at this point in the history

2. nixos ec2/create-amis.sh: shellcheck: quote state_dir reference

   

   grahamc committed Oct 30, 2020
   Copy the full SHA

   f5994c2 View commit details

   Browse the repository at this point in the history

3. nixos ec2/create-amis.sh: shellcheck: SC2155: Declare and assign sepa… …

   …rately to avoid masking return values.

   

   grahamc committed Oct 30, 2020
   Copy the full SHA

   baf7ed3 View commit details

   Browse the repository at this point in the history

4. nixos ec2/create-amis.sh: shellcheck: read without -r mangles backsla… …

   …shes

   

   grahamc committed Oct 30, 2020
   Copy the full SHA

   a66a22c View commit details

   Browse the repository at this point in the history

5. nixos ec2/create-amis.sh: shellcheck: explicitly make the additions t… …

   …o block_device_mappings single strings

   

   grahamc committed Oct 30, 2020
   Copy the full SHA

   7dac847 View commit details

   Browse the repository at this point in the history

6. nixos ec2/create-amis.sh: shellcheck: $ is not needed in arithmetic

   

   grahamc committed Oct 30, 2020
   Copy the full SHA

   f92a883 View commit details

   Browse the repository at this point in the history

7. create-amis.sh: log the full response if describing the import snapsh… …

   …ot tasks fails

   

   grahamc committed Oct 30, 2020
   Copy the full SHA

   e253de8 View commit details

   Browse the repository at this point in the history

8. create-amis: allow customizing the service role name …

   The complete setup on the AWS end can be configured
   with the following Terraform configuration. It generates
   a ./credentials.sh which I just copy/pasted in to the
   create-amis.sh script near the top. Note: the entire stack
   of users and bucket can be destroyed at the end of the
   import.
   
       variable "region" {
         type = string
       }
       variable "availability_zone" {
         type = string
       }
   
       provider "aws" {
         region = var.region
       }
   
       resource "aws_s3_bucket" "nixos-amis" {
         bucket_prefix = "nixos-amis-"
         lifecycle_rule {
           enabled = true
           abort_incomplete_multipart_upload_days = 1
           expiration {
             days = 7
           }
         }
       }
   
       resource "local_file" "credential-file" {
         file_permission = "0700"
         filename = "${path.module}/credentials.sh"
         sensitive_content = <<SCRIPT
       export service_role_name="${aws_iam_role.vmimport.name}"
       export bucket="${aws_s3_bucket.nixos-amis.bucket}"
       export AWS_ACCESS_KEY_ID="${aws_iam_access_key.uploader.id}"
       export AWS_SECRET_ACCESS_KEY="${aws_iam_access_key.uploader.secret}"
       SCRIPT
       }
   
       # The following resources are for the *uploader*
       resource "aws_iam_user" "uploader" {
         name = "nixos-amis-uploader"
       }
   
       resource "aws_iam_access_key" "uploader" {
         user = aws_iam_user.uploader.name
       }
   
       resource "aws_iam_user_policy" "upload-to-nixos-amis" {
         user = aws_iam_user.uploader.name
   
         policy = data.aws_iam_policy_document.upload-policy-document.json
       }
   
       data "aws_iam_policy_document" "upload-policy-document" {
         statement {
           effect = "Allow"
   
           actions = [
             "s3:ListBucket",
             "s3:GetBucketLocation",
           ]
   
           resources = [
             aws_s3_bucket.nixos-amis.arn
           ]
         }
   
         statement {
           effect = "Allow"
   
           actions = [
             "s3:PutObject",
             "s3:GetObject",
             "s3:DeleteObject",
           ]
   
           resources = [
             "${aws_s3_bucket.nixos-amis.arn}/*"
           ]
         }
   
         statement {
           effect = "Allow"
           actions = [
             "ec2:ImportSnapshot",
             "ec2:DescribeImportSnapshotTasks",
             "ec2:DescribeImportSnapshotTasks",
             "ec2:RegisterImage",
             "ec2:DescribeImages"
           ]
           resources = [
             "*"
           ]
         }
       }
   
       # The following resources are for the *vmimport service user*
       # See: https://docs.aws.amazon.com/vm-import/latest/userguide/vmie_prereqs.html#vmimport-role
       resource "aws_iam_role" "vmimport" {
         assume_role_policy = data.aws_iam_policy_document.vmimport-trust.json
       }
   
       resource "aws_iam_role_policy" "vmimport-access" {
         role = aws_iam_role.vmimport.id
         policy = data.aws_iam_policy_document.vmimport-access.json
       }
   
       data "aws_iam_policy_document" "vmimport-access" {
         statement {
           effect = "Allow"
           actions = [
             "s3:GetBucketLocation",
             "s3:GetObject",
             "s3:ListBucket",
           ]
           resources = [
             aws_s3_bucket.nixos-amis.arn,
             "${aws_s3_bucket.nixos-amis.arn}/*"
           ]
         }
         statement {
           effect = "Allow"
           actions = [
             "ec2:ModifySnapshotAttribute",
             "ec2:CopySnapshot",
             "ec2:RegisterImage",
             "ec2:Describe*"
           ]
           resources = [
             "*"
           ]
         }
       }
   
       data "aws_iam_policy_document" "vmimport-trust" {
         statement {
           effect = "Allow"
           principals {
             type = "Service"
             identifiers = [ "vmie.amazonaws.com" ]
           }
   
           actions = [
             "sts:AssumeRole"
           ]
   
           condition {
             test = "StringEquals"
             variable = "sts:ExternalId"
             values = [ "vmimport" ]
           }
         }
       }

   

   grahamc committed Oct 30, 2020
   Copy the full SHA

   2bf1fc0 View commit details

   Browse the repository at this point in the history

9. create-amis: improve wording around the service name's IAM role …

   Co-authored-by: Cole Helbling <cole.e.helbling@outlook.com>

   

   grahamc and cole-h committed Oct 30, 2020
   Copy the full SHA

   74a577b View commit details

   Browse the repository at this point in the history

10. Merge pull request #102173 from grahamc/create-amis …

    create-amis.sh: fixup shellcheck issues, improve error logging, and add configurable service names

    

    grahamc committed Oct 30, 2020
    Copy the full SHA

    c06b971 View commit details

    Browse the repository at this point in the history