AWS elasticbeanstalk documentation change
Summary
Complete restructuring of the Getting Started guide with new step-by-step workflow, added visuals, IAM role creation instructions, and removal of AWS account setup/MFA content
Security assessment
The changes remove previous security guidance about root account MFA and IAM user creation, but add new IAM role configuration details. While IAM roles relate to security permissions, this is standard service configuration rather than addressing a specific vulnerability. No evidence of patching a security issue or disclosing a vulnerability.
Diff
diff --git a/elasticbeanstalk/latest/dg/GettingStarted.md b/elasticbeanstalk/latest/dg/GettingStarted.md index eaa2568ec..f7b449d84 100644 --- a//elasticbeanstalk/latest/dg/GettingStarted.md +++ b//elasticbeanstalk/latest/dg/GettingStarted.md @@ -5 +5 @@ -Setting up: Create an AWS account +What you will buildStep 1 - Create an applicationStep 2 - Deploy your applicationStep 3 - Explore the environmentStep 4 - Update your applicationStep 5 - Scale your applicationClean upNext steps @@ -7 +7 @@ Setting up: Create an AWS account -# Getting started with Elastic Beanstalk +# Learn how to get started with Elastic Beanstalk @@ -9 +9 @@ Setting up: Create an AWS account -To help you understand how AWS Elastic Beanstalk works, this tutorial walks you through creating, exploring, updating, and deleting an Elastic Beanstalk application. It takes less than an hour to complete. +With Elastic Beanstalk you can deploy, monitor, and scale web applications and services. Typically, you will develop your code locally then deploy it to Amazon EC2 server instances. Theses instances, also called _environments_ , run on _platforms_ that can be upgraded through the AWS console or the command line. @@ -11 +11 @@ To help you understand how AWS Elastic Beanstalk works, this tutorial walks you -There is no cost for using Elastic Beanstalk, but the AWS resources that it creates for this tutorial are live (and don't run in a sandbox). You incur the standard usage fees for these resources until you terminate them at the end of this tutorial. The total charges are typically less than a dollar. For information about how to minimize charges, see [AWS free tier](https://aws.amazon.com/free). +To get started, we recommend deploying a pre-built sample application directly from the console. Then, you can learn how to develop locally and deploy from the command line in the [QuickStart: Deploy a PHP application to Elastic Beanstalk](./php-quickstart.html). @@ -13 +13 @@ There is no cost for using Elastic Beanstalk, but the AWS resources that it crea -###### Topics +There is no cost for using Elastic Beanstalk, but standard fees do apply to AWS resources that you create during the course of this tutorial until you delete them at the end. The total charges are typically less than a dollar. For information about how to minimize charges, see [AWS free tier](https://aws.amazon.com/free). @@ -15 +15 @@ There is no cost for using Elastic Beanstalk, but the AWS resources that it crea - * Setting up: Create an AWS account +After completing this tutorial, you will understand the basics of creating, configuring, deploying, updating, and monitoring an Elastic Beanstalk application with environments running on Amazon EC2 instances. @@ -17 +17 @@ There is no cost for using Elastic Beanstalk, but the AWS resources that it crea - * [Create an example application with Elastic Beanstalk](./GettingStarted.CreateApp.html) +Estimated duration: **35-45 minutes** @@ -19 +19 @@ There is no cost for using Elastic Beanstalk, but the AWS resources that it crea - * [Explore your Elastic Beanstalk environment](./GettingStarted.Explore.html) + @@ -21 +21 @@ There is no cost for using Elastic Beanstalk, but the AWS resources that it crea - * [Deploy a new version of your application in Elastic Beanstalk](./GettingStarted.DeployApp.html) +## What you will build @@ -23 +23 @@ There is no cost for using Elastic Beanstalk, but the AWS resources that it crea - * [Configure your Elastic Beanstalk environment](./GettingStarted.EditConfig.html) +Your first Elastic Beanstalk application will consist of a single Amazon EC2 environment running the PHP sample on a PHP managed platform. @@ -25 +25 @@ There is no cost for using Elastic Beanstalk, but the AWS resources that it crea - * [Cleaning up AWS resources in your Elastic Beanstalk environment](./GettingStarted.Cleanup.html) +**Elastic Beanstalk application** @@ -27 +26,0 @@ There is no cost for using Elastic Beanstalk, but the AWS resources that it crea - * [Next steps after getting started with Elastic Beanstalk](./GettingStarted.Next.html) @@ -28,0 +28 @@ There is no cost for using Elastic Beanstalk, but the AWS resources that it crea +An _Elastic Beanstalk application_ is a container for Elastic Beanstalk components, including _environments_ where your application code runs on _platforms_ provided and managed by Elastic Beanstalk, or in custom containers that you provide. @@ -29,0 +30 @@ There is no cost for using Elastic Beanstalk, but the AWS resources that it crea +**Environment** @@ -32 +33 @@ There is no cost for using Elastic Beanstalk, but the AWS resources that it crea -## Setting up: Create an AWS account +An Elastic Beanstalk _environment_ is a collection of AWS resources running together including an Amazon EC2 instance. When you create an environment, Elastic Beanstalk provisions the necessary resources into your AWS account. @@ -34 +35 @@ There is no cost for using Elastic Beanstalk, but the AWS resources that it crea -If you're not already an AWS customer, you need to create an AWS account. Signing up enables you to access Elastic Beanstalk and other AWS services that you need. +**Platform** @@ -36 +36,0 @@ If you're not already an AWS customer, you need to create an AWS account. Signin -### Sign up for an AWS account @@ -38 +38 @@ If you're not already an AWS customer, you need to create an AWS account. Signin -If you do not have an AWS account, complete the following steps to create one. +A _platform_ is a combination of an operating system, programming language runtime, web server, application server, and additional Elastic Beanstalk components. Elastic Beanstalk provides manged platforms, or you can provide your own platform in a container. @@ -40 +40 @@ If you do not have an AWS account, complete the following steps to create one. -###### To sign up for an AWS account +Elastic Beanstalk supports platforms for different programming languages, application servers, and Docker containers. When you create an environment, you must choose the platform. You can upgrade the platform, but you cannot **change** the platform for an environment. @@ -42 +42 @@ If you do not have an AWS account, complete the following steps to create one. - 1. Open [https://portal.aws.amazon.com/billing/signup](https://portal.aws.amazon.com/billing/signup). +###### Switching platforms @@ -44 +44 @@ If you do not have an AWS account, complete the following steps to create one. - 2. Follow the online instructions. +If you need to change programming languages, you must create and switch to a new environment on a different platform. @@ -46 +46 @@ If you do not have an AWS account, complete the following steps to create one. -Part of the sign-up procedure involves receiving a phone call and entering a verification code on the phone keypad. +## Step 1 - Create an application @@ -48 +48 @@ Part of the sign-up procedure involves receiving a phone call and entering a ver -When you sign up for an AWS account, an _AWS account root user_ is created. The root user has access to all AWS services and resources in the account. As a security best practice, assign administrative access to a user, and use only the root user to perform [tasks that require root user access](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#root-user-tasks). +To create your example application, you'll use the **Create application** console wizard. It creates an Elastic Beanstalk application and launches an environment within it. @@ -49,0 +50 @@ When you sign up for an AWS account, an _AWS account root user_ is created. The +Reminder: an _environment_ is a collection of AWS resources required to run your application code. @@ -50,0 +52 @@ When you sign up for an AWS account, an _AWS account root user_ is created. The + @@ -51,0 +54 @@ When you sign up for an AWS account, an _AWS account root user_ is created. The +###### To create an application @@ -53 +56 @@ When you sign up for an AWS account, an _AWS account root user_ is created. The -AWS sends you a confirmation email after the sign-up process is complete. At any time, you can view your current account activity and manage your account by going to [https://aws.amazon.com/](https://aws.amazon.com/) and choosing **My Account**. + 1. Open the [Elastic Beanstalk console](https://console.aws.amazon.com/elasticbeanstalk). @@ -55 +58 @@ AWS sends you a confirmation email after the sign-up process is complete. At any -### Create a user with administrative access + 2. Choose **Create application**. @@ -57 +60 @@ AWS sends you a confirmation email after the sign-up process is complete. At any -After you sign up for an AWS account, secure your AWS account root user, enable AWS IAM Identity Center, and create an administrative user so that you don't use the root user for everyday tasks. + 3. For **Application name** enter `getting-started-app`. @@ -59 +61,0 @@ After you sign up for an AWS account, secure your AWS account root user, enable -###### Secure your AWS account root user @@ -61 +62,0 @@ After you sign up for an AWS account, secure your AWS account root user, enable - 1. Sign in to the [AWS Management Console](https://console.aws.amazon.com/) as the account owner by choosing **Root user** and entering your AWS account email address. On the next page, enter your password. @@ -63 +63,0 @@ After you sign up for an AWS account, secure your AWS account root user, enable -For help signing in by using root user, see [Signing in as the root user](https://docs.aws.amazon.com/signin/latest/userguide/console-sign-in-tutorials.html#introduction-to-root-user-sign-in-tutorial) in the _AWS Sign-In User Guide_. @@ -65 +65 @@ For help signing in by using root user, see [Signing in as the root user](https: - 2. Turn on multi-factor authentication (MFA) for your root user. +The console provides a six step process for creating an application and configuring an environment. For this quick start, you'll only need to focus on the first two steps, then you can skip ahead to review and create your application and environment. @@ -67 +67 @@ For help signing in by using root user, see [Signing in as the root user](https: -For instructions, see [Enable a virtual MFA device for your AWS account root user (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-virt-mfa-for-root.html) in the _IAM User Guide_. +###### To configure an environment @@ -68,0 +69 @@ For instructions, see [Enable a virtual MFA device for your AWS account root use + 1. In **Environment information** , for **Environment name** enter: `gs-app-web-env`. @@ -69,0 +71 @@ For instructions, see [Enable a virtual MFA device for your AWS account root use + 2. For **Platform** , choose the **PHP** platform. @@ -70,0 +73 @@ For instructions, see [Enable a virtual MFA device for your AWS account root use + 3. For **Application code** and **Presets** , accept the defaults (_Sample application_ and _Single instance_), then choose **Next**. @@ -72 +74,0 @@ For instructions, see [Enable a virtual MFA device for your AWS account root use -###### Create a user with administrative access @@ -74 +75,0 @@ For instructions, see [Enable a virtual MFA device for your AWS account root use - 1. Enable IAM Identity Center. @@ -76 +76,0 @@ For instructions, see [Enable a virtual MFA device for your AWS account root use -For instructions, see [Enabling AWS IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/get-set-up-for-idc.html) in the _AWS IAM Identity Center User Guide_. @@ -78 +78 @@ For instructions, see [Enabling AWS IAM Identity Center](https://docs.aws.amazon - 2. In IAM Identity Center, grant administrative access to a user. +###### To configure service access @@ -80 +80 @@ For instructions, see [Enabling AWS IAM Identity Center](https://docs.aws.amazon -For a tutorial about using the IAM Identity Center directory as your identity source, see [ Configure user access with the default IAM Identity Center directory](https://docs.aws.amazon.com/singlesignon/latest/userguide/quick-start-default-idc.html) in the _AWS IAM Identity Center User Guide_. +Next, you need two roles. A _service role_ allows Elastic Beanstalk to monitor your EC2 instances and upgrade you environment’s platform. An _EC2 instance profile_ role permits tasks such as writing logs and interacting with other services. @@ -81,0 +82 @@ For a tutorial about using the IAM Identity Center directory as your identity so +###### To create the Service role @@ -82,0 +84 @@ For a tutorial about using the IAM Identity Center directory as your identity so + 1. For **Service role** , choose **Create role**. @@ -83,0 +86 @@ For a tutorial about using the IAM Identity Center directory as your identity so + 2. For **Trusted entity type** , choose **AWS service**. @@ -85 +88 @@ For a tutorial about using the IAM Identity Center directory as your identity so -###### Sign in as the user with administrative access + 3. For **Use case** , choose **Elastic Beanstalk – Environment**. @@ -87 +90 @@ For a tutorial about using the IAM Identity Center directory as your identity so - * To sign in with your IAM Identity Center user, use the sign-in URL that was sent to your email address when you created the IAM Identity Center user. + 4. Choose **Next**. @@ -89 +92 @@ For a tutorial about using the IAM Identity Center directory as your identity so -For help signing in using an IAM Identity Center user, see [Signing in to the AWS access portal](https://docs.aws.amazon.com/signin/latest/userguide/iam-id-center-sign-in-tutorial.html) in the _AWS Sign-In User Guide_. + 5. Verify that **Permissions policies** include the following, then choose **Next** : @@ -90,0 +94 @@ For help signing in using an IAM Identity Center user, see [Signing in to the AW + * `AWSElasticBeanstalkEnhancedHealth` @@ -91,0 +96 @@ For help signing in using an IAM Identity Center user, see [Signing in to the AW + * `AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy` @@ -92,0 +98 @@ For help signing in using an IAM Identity Center user, see [Signing in to the AW + 6. Choose **Create role**. @@ -94 +100 @@ For help signing in using an IAM Identity Center user, see [Signing in to the AW -###### Assign access to additional users + 7. Return to the **Configure service access** tab, refresh the list, then select the newly created service role. @@ -96 +101,0 @@ For help signing in using an IAM Identity Center user, see [Signing in to the AW - 1. In IAM Identity Center, create a permission set that follows the best practice of applying least-privilege permissions. @@ -98 +102,0 @@ For help signing in using an IAM Identity Center user, see [Signing in to the AW -For instructions, see [ Create a permission set](https://docs.aws.amazon.com/singlesignon/latest/userguide/get-started-create-a-permission-set.html) in the _AWS IAM Identity Center User Guide_. @@ -100 +103,0 @@ For instructions, see [ Create a permission set](https://docs.aws.amazon.com/sin - 2. Assign users to a group, and then assign single sign-on access to the group. @@ -102 +105 @@ For instructions, see [ Create a permission set](https://docs.aws.amazon.com/sin -For instructions, see [ Add groups](https://docs.aws.amazon.com/singlesignon/latest/userguide/addgroups.html) in the _AWS IAM Identity Center User Guide_. +###### To create the EC2 instance profile @@ -103,0 +107 @@ For instructions, see [ Add groups](https://docs.aws.amazon.com/singlesignon/lat + 1. Choose **Create role**. @@ -104,0 +109 @@ For instructions, see [ Add groups](https://docs.aws.amazon.com/singlesignon/lat + 2. For **Trusted entity type** , choose **AWS service**. @@ -105,0 +111,350 @@ For instructions, see [ Add groups](https://docs.aws.amazon.com/singlesignon/lat + 3. For **Use case** , choose**Elastic Beanstalk – Compute**. + + 4. Choose **Next**. + + 5. Verify that **Permissions policies** include the following, then choose **Next** : + + * `AWSElasticBeanstalkWebTier` + + * `AWSElasticBeanstalkWorkerTier` + + * `AWSElasticBeanstalkMulticontainerDocker` + + 6. Choose **Create role**. + + 7. Return to the **Configure service access** tab, refresh the list, then select the newly created EC2 instance profile. + + + + +###### To finish configuring and creating your application + + 1. Skip over **EC2 key pair**. + +We'll show you other ways to connect to your Amazon EC2 instances through the Console. + + 2. Choose **Skip to Review** to move over several optional steps. + +_Optional steps: networking, databases, scaling parameters, advanced configuration for updates, monitoring, and logging._ + + 3. On the **Review** page which shows a summary of your choices, choose **Submit**. + + + + +###### Congratulations! + +You have created an application and configured an environment! Now you need to wait for the resources to deploy. + +## Step 2 - Deploy your application + +When you create an application, Elastic Beanstalk sets up the environments for you. You just need to sit back and wait. + +The initial deploy can take up to five minutes to create the resources. Updates will take less time because only changes will be deployed to your stack. + + + +When you create the example application, Elastic Beanstalk creates the following resources: +