Automatización para la creación de imágenes con Amazon EC2 Image Builder

1.  {
2.  "source": ["aws.ec2"],
3.  "detail-type": ["EC2 AMI State Change"],
4.  "detail": {
5.  "State": ["available"]
6.  }
7.  }

1.  {
2.  "version": "0",
3.  "id": "123f456f-7b89-c012-d3cb-e4567de8901e",
4.  "detail-type": "EC2 AMI State Change",
5.  "source": "aws.ec2",
6.  "account": "123456789012",
7.  "time": "2024-01-09T14:46:28Z",
8.  "region": "us-east-x",
9.  "resources": [
10. "arn:aws:ec2:us-east-x::image/ami-1c2df3456fe78901b"
11. ],
12. "detail": {
13. "RequestId": "1a2c345a-fdd6-78b9-01bf-2eedb345678b",
14. "State": "available",
15. "ImageId": "ami-1c2df3456fe78901b",
16. "ErrorMessage": ""
17. }
18. }

CreateFolderComponent:
    Type: 'AWS::ImageBuilder::Component'
    Properties:
      Name: 'folderssTestingHubCreation'
      Platform: 'Linux'
      Version: '1.0.2'
      Description: 'This component create a folder called TestingHub in the ubuntu user folder and delete the .m2 folder'
      SupportedOsVersions: 
        - 'Ubuntu 20'
      # Require one of 'Data' or 'Uri' for Component template
      Data: |
        name: CreationOfTestingHubFolder
        description: This is to create TestingHub folder on the root path
        schemaVersion: 1.0

        phases:
          - name: build
            steps:

              - name: CreatingFolderLinux
                action: CreateFolder
                inputs:
                  - path: /home/ubuntu/TestingHubDeepak3

              - name: DeletingFolderM2
                action: DeleteFolder
                inputs:
                  - path: /home/ubuntu/.m2
                    force: true

import json
import boto3
import os



#Boto3 Clients
imageBuilder = boto3.client('imagebuilder')
ec2 = boto3.client('ec2')
ssm = boto3.client('ssm')

#environment variables

testRecipeArn= os.environ['testRecipeArn']
infrastructureConfigurationArn= os.environ['infrastructureConfigurationArn'] 
imagepipelineArn = os.environ['imagepipelineArn']
ssmPath = os.environ['ssmPath']
components= os.environ['components']


def lambda_handler(event, context):
    # Image Id delivers by Event Bridge event
    amiId= event['detail']['ImageId']

    # Get the name associated with the Ami ID
    amiInformation= ec2.describe_images(ImageIds=[ amiId, ],)
    amiName= amiInformation['Images'][0]['Name']

      # Compare if the name Ami starts with the specific pattern
    if amiName.startswith('testRecipe') :
        try:
            print('Correct Image')

            #create components array

            componentsRecipe= components.split(',')
            component = [{"componentArn": arn} for arn in componentsRecipe]

            print(component)

            # get Actual version
            version = ssm.get_parameter(Name=ssmPath)['Parameter']['Value']
            values = version.split('.')
            nextVersion = int(values[2]) + 1

            # Convert nextVersion to string before concatenating
            newValueVersion = values[0]+"."+ values[1]+"."+ str(nextVersion)

            print(newValueVersion)

            #update new value version
            ssm.put_parameter(Name=ssmPath, Value=newValueVersion, Type="String", Overwrite=True)


            # Create the new Image Recipe with the new AMI 
            newImageRecipe = imageBuilder.create_image_recipe(
                name='testRecipe',
                description='newversion' + newValueVersion,
                semanticVersion=newValueVersion,
                components=component,
                parentImage=amiId
            )
            # Get the new recipe Arn
            newImageRecipeArn = newImageRecipe['imageRecipeArn']

            # Update the Image Pipeline with the new Image Recipe
            response = imageBuilder.update_image_pipeline(
                imagePipelineArn=imagepipelineArn,
                description='new version for imagepipeline' + newValueVersion,
                imageRecipeArn=newImageRecipeArn,
                infrastructureConfigurationArn=infrastructureConfigurationArn
            )

        except Exception as e:
            print("Error:", e)

# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0
AWSTemplateFormatVersion: 2010-09-09
Transform: 'AWS::Serverless-2016-10-31'


Resources:
  # Create an S3 Bucket for logs.
  # When deleting the stack, make sure to empty the bucket first.
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket.html
  ImageBuilderLogBucket:
    Type: AWS::S3::Bucket
    # If you want to delete the stack, but keep the bucket, set the DelectionPolicy to Retain.
    # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html
    # DeletionPolicy: Retain
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        IgnorePublicAcls: true
        BlockPublicPolicy: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled

  # By default, AWS Services do not have permission to perform actions on your instances. This grants
  # AWS Systems Manager (SSM) and EC2 Image Builder the necessary permissions to build an image.
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html
  # https://docs.aws.amazon.com/imagebuilder/latest/userguide/image-builder-setting-up.html
  InstanceRole:
    Type: AWS::IAM::Role
    Metadata:
      Comment: Role to be used by instance during image build.
    Properties:
      ManagedPolicyArns:
        - Fn::Sub: arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore
        - Fn::Sub: arn:${AWS::Partition}:iam::aws:policy/EC2InstanceProfileForImageBuilder
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - !Sub 'ec2.${AWS::URLSuffix}'
        Version: '2012-10-17'
      Path: /executionServiceEC2Role/

  # Policy to allow the instance to write to the S3 bucket (via instance role / instance profile).
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html
  InstanceRoleLoggingPolicy:
    Type: AWS::IAM::Policy
    Metadata:
      Comment: Allows the instance to save log files to an S3 bucket.
    Properties:
      PolicyName: ImageBuilderLogBucketPolicy
      Roles:
        - Ref: InstanceRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action:
              - s3:PutObject
            Effect: Allow
            Resource:
              - Fn::Sub:
                  - arn:${AWS::Partition}:s3:::${BUCKET}/*
                  - BUCKET:
                      Ref: ImageBuilderLogBucket

  # To pass the InstanceRole to an EC2 instance, we need an InstanceProfile.
  # This profile will be used during the image build process.
  # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html
  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /executionServiceEC2Role/
      Roles:
        - Ref: InstanceRole

  # Specifies the infrastructure within which to build and test your image.
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-imagebuilder-infrastructureconfiguration.html
  Ubuntu2004ImageInfrastructureConfiguration:
    Type: AWS::ImageBuilder::InfrastructureConfiguration
    Properties:
      InstanceTypes:
        - 'm4.large'
        - 'm5.large'
      Name: Ubuntu-2004-with-latest-SSM-Agent-Infrastructure-Configuration
      InstanceProfileName:
        Ref: InstanceProfile
      # Specify an S3 bucket and EC2 Image Builder will save logs to the bucket.
      Logging:
        S3Logs:
          S3BucketName:
            Ref: ImageBuilderLogBucket
          # S3KeyPrefix: 'my-imagebuilder-bucket-prefix'
      # If you would like to keep the instance running after a failed build, set TerminateInstanceOnFailure to false.
      # TerminateInstanceOnFailure: false
      # If you do not have a default VPC or want to use a different VPC, you must specify the subnet ID to use
      # SubnetId: 'subnet-id'

  # The CloudWatch LogGroup for the image build logs is provided to ensure the LogGroup is cleaned up if the stack is deleted.
  Ubuntu2004LogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: /aws/imagebuilder/Ubuntu-2004-with-latest-SSM-Agent
      RetentionInDays: 3

  # Recipe which references the latest (x.x.x) version of the Amazon Linux 2 AMI).
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-imagebuilder-imagerecipe.html
  Ubuntu2004ImageRecipe:
    Type: AWS::ImageBuilder::ImageRecipe
    Properties:
      Name: Ubuntu-2004-with-latest-SSM-Agent
      Version: 1.0.1
      # ${AWS::Partition} returns the partition where you are running the CloudFormation template. For standard AWS regions, the
      # partition is aws. For resources elsewhere, the partition is aws-partitionname. For example, China (Beijing and Ningxia)
      # regions use aws-cn and AWS GovCloud (US) regions are aws-us-gov.
      # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html
      ParentImage:
        Fn::Sub: arn:${AWS::Partition}:imagebuilder:${AWS::Region}:aws:image/ubuntu-server-20-lts-x86/x.x.x
      Components:
        - ComponentArn:
            Fn::Sub: arn:aws:imagebuilder:${AWS::Region}:aws:component/amazon-cloudwatch-agent-linux/x.x.x
        - ComponentArn: 
            Fn::Sub: arn:aws:imagebuilder:${AWS::Region}:aws:component/amazon-corretto-11-apt-generic/x.x.x
        - ComponentArn:
            Fn::Sub: arn:aws:imagebuilder:${AWS::Region}:aws:component/powershell-linux/x.x.x
        - ComponentArn: !Ref CreateFolderComponent
        - ComponentArn: !Ref MavenInstallationComponent

  # Create an SSM Parameter Store entry with our resulting ImageId.
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-parameter.html

  Ubuntu2004WithLatestSSMAgentParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Description: image recipe latest version for image build pipeline 
      Name: /ec2ImageBuilder/imageRecipeVersion
      Type: String
      Value: '0.0.1'

  ImagePipelineBami:
    Type: 'AWS::ImageBuilder::ImagePipeline'
    Properties:
      Name: 'golden-image-for-BAMI'
      Description: 'description'
      ImageRecipeArn: !Ref Ubuntu2004ImageRecipe
      InfrastructureConfigurationArn: !Ref Ubuntu2004ImageInfrastructureConfiguration
      ImageTestsConfiguration:
        ImageTestsEnabled: false
        TimeoutMinutes: 90

  CreateFolderComponent:
    Type: 'AWS::ImageBuilder::Component'
    Properties:
      Name: 'folderssTestingHubCreation'
      Platform: 'Linux'
      Version: '1.0.2'
      Description: 'This component create a folder called TestingHub in the ubuntu user folder and delete the .m2 folder'
      SupportedOsVersions: 
        - 'Ubuntu 20'
      # Require one of 'Data' or 'Uri' for Component template
      Data: |
        name: CreationOfTestingHubFolder
        description: This is to create TestingHub folder on the root path
        schemaVersion: 1.0

        phases:
          - name: build
            steps:

              - name: CreatingFolderLinux
                action: CreateFolder
                inputs:
                  - path: /home/ubuntu/TestingHubDeepak3

              - name: DeletingFolderM2
                action: DeleteFolder
                inputs:
                  - path: /home/ubuntu/.m2
                    force: true

  MavenInstallationComponent:
    Type: 'AWS::ImageBuilder::Component'
    Properties:
      Name: 'MavenComponent'
      Platform: 'Linux'
      Version: '1.0.0'
      Description: 'This component is to install maven'
      SupportedOsVersions: 
        - 'Ubuntu 20'
      # Require one of 'Data' or 'Uri' for Component template
      Data: |
        name: Maven
        description: This is to install Maven
        schemaVersion: 1.0
        phases:
          - name: build
            steps:
              - name: Install_Maven
                action: ExecuteBash
                inputs:
                  commands:
                    - sudo apt update
                    - sudo apt install maven -y

## Lambdas Event Management 

  StartImagePipelineLambda:
    Type: 'AWS::Serverless::Function'
    Properties:
      Handler: startImagePipeline.lambda_handler
      Runtime: python3.8
#      CodeUri: ../functions/startImagePipeline
      InlineCode: |
        import json
        import boto3
        import os



        #Boto3 Clients
        imageBuilder = boto3.client('imagebuilder')
        ec2 = boto3.client('ec2')
        ssm = boto3.client('ssm')

        #environment variables

        testRecipeArn= os.environ['testRecipeArn']
        infrastructureConfigurationArn= os.environ['infrastructureConfigurationArn'] 
        imagepipelineArn = os.environ['imagepipelineArn']
        ssmPath = os.environ['ssmPath']
        components= os.environ['components']


        def lambda_handler(event, context):
            # Image Id delivers by Event Bridge event
            amiId= event['detail']['ImageId']

            # Get the name associated with the Ami ID
            amiInformation= ec2.describe_images(ImageIds=[ amiId, ],)
            amiName= amiInformation['Images'][0]['Name']

              # Compare if the name Ami starts with the specific pattern
            if amiName.startswith('testRecipe') :
                try:
                    print('Correct Image')

                    #create components array

                    componentsRecipe= components.split(',')
                    component = [{"componentArn": arn} for arn in componentsRecipe]

                    # get Actual version
                    version = ssm.get_parameter(Name=ssmPath)['Parameter']['Value']
                    values = version.split('.')
                    nextVersion = int(values[2]) + 1

                    # Convert nextVersion to string before concatenating
                    newValueVersion = values[0]+"."+ values[1]+"."+ str(nextVersion)

                    print(newValueVersion)

                    #update new value version
                    ssm.put_parameter(Name=ssmPath, Value=newValueVersion, Type="String", Overwrite=True)

                    # Delete the last 5 characters
        #            modifyVersionImageRecipe = testRecipeArn[:-5]
        #            actualVersionImageRecipe = modifyVersionImageRecipe + version


                    # Get the last Image Recipe components 
        #            getImageRecipe= imageBuilder.get_image_recipe(imageRecipeArn=actualVersionImageRecipe)
        #            components= getImageRecipe['imageRecipe']['components']

                    # Create the new Image Recipe with the new AMI 
                    newImageRecipe = imageBuilder.create_image_recipe(
                        name='testRecipe',
                        description='newversion' + newValueVersion,
                        semanticVersion=newValueVersion,
                        components=component,
                        parentImage=amiId
                    )
                    # Get the new recipe Arn
                    newImageRecipeArn = newImageRecipe['imageRecipeArn']

                    # Update the Image Pipeline with the new Image Recipe
                    response = imageBuilder.update_image_pipeline(
                        imagePipelineArn=imagepipelineArn,
                        description='new version for imagepipeline' + newValueVersion,
                        imageRecipeArn=newImageRecipeArn,
                        infrastructureConfigurationArn=infrastructureConfigurationArn
                    )

        #        
        #            response = imageBuilder.start_image_pipeline_execution(
        #                imagePipelineArn='arn:aws:imagebuilder:us-east-1:012983038368:image-pipeline/golden-image-for-bami'
        #            )
        #            print("Image pipeline execution started successfully.")
        #            print("Execution ID:", response.get('clientToken'))
                except Exception as e:
                    print("Error:", e)
      Description: Lamdba function to trigger Image Build when a new DAMI is created 
      Environment:
        Variables:
          testRecipeArn: !Ref 'Ubuntu2004ImageRecipe'
          infrastructureConfigurationArn: !Ref 'Ubuntu2004ImageInfrastructureConfiguration'
          imagepipelineArn: !Ref 'ImagePipelineBami'
          ssmPath: !Ref 'Ubuntu2004WithLatestSSMAgentParameter'
          components: 
            Fn::Sub: arn:aws:imagebuilder:${AWS::Region}:aws:component/amazon-cloudwatch-agent-linux/x.x.x,arn:aws:imagebuilder:${AWS::Region}:aws:component/amazon-corretto-11-apt-generic/x.x.x,${CreateFolderComponent.Arn},${MavenInstallationComponent.Arn}


      MemorySize: 128
      Timeout: 300
      Role: !GetAtt 'StartImagePipelineRole.Arn'


  StartImagePipelineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
      Policies:
        - PolicyName: StartImagePipelineLambdaPolicy
          PolicyDocument:
            Statement:
              - Effect: Allow
                Resource: "*"
                Action:
                  - 'ssm:DescribeParameters'
                  - 'ssm:GetParameter'
                  - 'ssm:PutParameter'
                  - 'ssm:GetParameters'
              - Effect: Allow
                Resource: "*"
                Action: 
                  - 'ec2:DescribeImages'
              - Effect: Allow
                Action:
                  - 'imagebuilder:GetWorkflow'
                  - 'imagebuilder:GetComponent'
                  - 'imagebuilder:TagResource'
                  - 'imagebuilder:GetImagePipeline'
                  - 'imagebuilder:GetImageRecipe'
                  - 'imagebuilder:CreateImageRecipe'
                  - 'imagebuilder:GetContainerRecipe'
                  - 'imagebuilder:GetDistributionConfiguration'
                  - 'imagebuilder:GetImage'
                  - 'iam:PassRole'
                  - 'iam:CreateServiceLinkedRole'
                  - 'imagebuilder:GetInfrastructureConfiguration'
                  - 'imagebuilder:UpdateImagePipeline'
                Resource: "*"

  AmiAvailableEventRule:
    Type: AWS::Events::Rule
    Properties:
      Description: "Event rule that captures when a new AMI is available"
      State: "ENABLED"
      EventPattern:
        source:
          - aws.ec2
        detail-type:
          - EC2 AMI State Change
        detail:
          state:
            - available
      Targets:
        - Arn: !GetAtt 'StartImagePipelineLambda.Arn'
          Id: !Ref 'StartImagePipelineLambda'

  SlackNotificationJavaPipelinepEventsRulePermissions:
      Type: AWS::Lambda::Permission
      Properties:
        FunctionName: !Ref 'StartImagePipelineLambda'
        Action: lambda:InvokeFunction
        Principal: events.amazonaws.com
        SourceArn: !GetAtt 'AmiAvailableEventRule.Arn'

######## AWS CHATBOT NOTIFICATIONS RESOURCES #########

  AwsChatbotNotification:
    Type: AWS::Chatbot::SlackChannelConfiguration
    Properties:
      ConfigurationName: codePipelineStartnotificationJavaCode
      IamRoleArn: !GetAtt 'AwsChatBotIamRole.Arn'
      LoggingLevel: 'ERROR'
      SlackChannelId: "xxxxxxxxxxxx" #!Ref SlackChannelId
      SlackWorkspaceId: "xxxxxxxxxx" #!Ref SlackWorkspaceId
      SnsTopicArns: 
        - !Ref 'AwsChatbotSnsTopicLambda'

  AwsChatbotSnsTopicLambda:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: AwsChatbotSnsTopicLambda
      KmsMasterKeyId:
        Ref: SNSKmsAlias

  SNSKmsAlias:
    Type: 'AWS::KMS::Alias'
    Properties:
      AliasName:
        'Fn::Join':
          - '-'
          - - alias/SnsServiceKmsKey
            - 'Fn::Sub': '${AWS::StackName}'
      TargetKeyId:
        Ref: SNSKmsKey

  SNSKmsKey:
    Type: 'AWS::KMS::Key'
    Properties:
      Description: This is used to encrypt-decrypt the SNS.
      EnableKeyRotation: 'true'
      KeyPolicy:
        Statement:
          - Action:
              - 'kms:Create*'
              - 'kms:Describe*'
              - 'kms:Enable*'
              - 'kms:List*'
              - 'kms:Put*'
              - 'kms:Update*'
              - 'kms:Revoke*'
              - 'kms:Disable*'
              - 'kms:Get*'
              - 'kms:Delete*'
              - 'kms:ScheduleKeyDeletion'
              - 'kms:CancelKeyDeletion'
              - 'kms:UntagResource'
              - 'kms:TagResource'
            Effect: Allow
            Principal:
              AWS:
                - 'Fn::Sub': 'arn:aws:iam::${AWS::AccountId}:root'
            Resource: '*'
            Sid: Allow access for Key Administrators
          - Action:
              - 'kms:Encrypt'
              - 'kms:Decrypt'
              - 'kms:ReEncrypt*'
              - 'kms:GenerateDataKey*'
              - 'kms:DescribeKey'
            Effect: Allow
            Principal:
              AWS:
                - 'Fn::Sub': 'arn:aws:iam::${AWS::AccountId}:root'
                - 'Fn::Sub': 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/imagebuilder.amazonaws.com/AWSServiceRoleForImageBuilder'
              Service: cloudwatch.amazonaws.com
            Resource: '*'
            Sid: Allow use of the key
          - Action:
              - 'kms:CreateGrant'
              - 'kms:ListGrants'
              - 'kms:RevokeGrant'
            Condition:
              Bool:
                'kms:GrantIsForAWSResource': true
            Effect: Allow
            Principal:
              AWS:
                - 'Fn::Sub': 'arn:aws:iam::${AWS::AccountId}:root'
            Resource: '*'
            Sid: Allow attachment of persistent resources
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: 
              - 'kms:Decrypt'
              - 'kms:GenerateDataKey*'
            Resource: '*'
          - Action:
              - 'kms:GenerateDataKey*'
              - 'kms:Decrypt'
            Condition:
              StringEquals:
                'kms:ViaService': sns.us-east-1.amazonaws.com
            Effect: Allow
            Principal:
              Service: codestar-notifications.amazonaws.com
            Resource: '*'
            Sid: Allow codepiple to push message to encrypted sns
        Version: '2012-10-17'

  EventTopicPolicy:
    Type: 'AWS::SNS::TopicPolicy'
    Properties:
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: 
                - events.amazonaws.com
                - codestar-notifications.amazonaws.com
            Action: 
              - 'sns:Publish'
            Resource: !Ref AwsChatbotSnsTopicLambda
      Topics:
        - !Ref AwsChatbotSnsTopicLambda

  AwsChatBotIamRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - config.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
      - PolicyName: AwsChatBotIamPolicyName
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Action:
                - s3:PutObject*
              Resource:
                - arn:aws:s3:::bucket-name/*
              Effect: Allow
              Condition:
                StringLike:
                  s3:x-amz-acl: bucket-owner-full-control
            - Action:
                - s3:GetBucketAcl
              Resource:
                - arn:aws:s3:::bucketname
              Effect: Allow
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource:
                - !GetAtt SNSKmsKey.Arn