AWS res high security documentation change
Summary
Updated IAM policies to use AmazonS3ReadOnlyAccess, simplified component parameters, added version pinning guidance for scripts, modified installation steps, updated supported OS, and adjusted image build components.
Security assessment
The IAM policy change replaces a scoped, least-privilege policy (with specific DynamoDB/S3 resource restrictions) with the broader AmazonS3ReadOnlyAccess managed policy, potentially granting excessive S3 read access across all buckets. This reduces adherence to the principle of least privilege. Additionally, the added warning about replacing 'latest' with exact version numbers in script URIs addresses a security best practice to prevent unintended updates. The removal of the 'Setting custom permission boundaries' section eliminates documentation about a key security control.
Diff
diff --git a/res/archive/release-minus-1/ug/res-ready-ami.md b/res/archive/release-minus-1/ug/res-ready-ami.md index 2b6a090f4..e53048f6c 100644 --- a//res/archive/release-minus-1/ug/res-ready-ami.md +++ b//res/archive/release-minus-1/ug/res-ready-ami.md @@ -40,92 +40 @@ To access the RES environment service from EC2 Image Builder, you must create or - * AmazonSSMManagedInstanceCore and EC2InstanceProfileForImageBuilder policies. - - * A custom RES policy with limited DynamoDB and Amazon S3 access to the deployed RES environment. - -(This policy can be either a customer managed or customer inline policy document.) - - - - - 1. Start by creating a new policy that will be attached to your role: **IAM** -> **Policies** -> **Create policy** - - 2. Select **JSON** from the policy editor. - - 3. Copy and paste the policy shown here into the editor, replacing `us-east-1` with your desired AWS Region, `111122223333` with your AWS account ID, and `{RES-EnvironmentName}` with your RES EnvironmentName where applicable. - -**RES policy:** - -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "RESDynamoDBAccess", - "Effect": "Allow", - "Action": "dynamodb:GetItem", - "Resource": "arn:aws:dynamodb:us-east-1:111122223333:table/{RES-EnvironmentName}.cluster-settings", - "Condition": { - "ForAllValues:StringLike": { - "dynamodb:LeadingKeys": [ - "global-settings.gpu_settings.*", - "global-settings.package_config.*", - "cluster-manager.host_modules.*", - "identity-provider.cognito.enable_native_user_login" - ] - } - } - }, - { - "Sid": "RESS3Access", - "Effect": "Allow", - "Action": "s3:GetObject", - "Resource": [ - "arn:aws:s3:::{RES-EnvironmentName}-cluster-us-east-1-111122223333/idea/vdc/res-ready-install-script-packages/*", - "arn:aws:s3:::research-engineering-studio-us-east-1/host_modules/*" - ] - } - ] - } - - - 4. Choose **Next** and provide a name and optional description to complete the policy creation. - - 5. To create the role, start by going to **IAM** -> **Roles** -> **Create role**. - - 6. Under **Trusted Entity Type** , select **"AWS service"**. - - 7. Select **EC2** in the **Service or use case** drop down. - - 8. In the **Use case** section, select **EC2** , then choose **Next**. - - 9. Search for and then select the name of the policy you previously created. - - 10. Choose **Next** and provide a name and optional description to complete the role creation. - - 11. Select your new role and verify that the Trust relationship matches the following: - -**Trusted relationship entity:** - -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": "ec2.amazonaws.com" - }, - "Action": "sts:AssumeRole" - } - ] - } - + * AmazonS3ReadOnlyAccess, AmazonSSMManagedInstanceCore and EC2InstanceProfileForImageBuilder policies. @@ -149,0 +59,2 @@ Follow the directions to [Create a component using the Image Builder console](ht + key : value + @@ -151,0 +63,4 @@ Follow the directions to [Create a component using the Image Builder console](ht +###### Important + +In the definition file, replace `latest` in the download URI (`- source: 's3://research-engineering-studio-us-east-1/releases/`latest`/res-installation-scripts.tar.gz'`) with with the exact version number (for example, `2025.06`) if your RES environment version is not the latest. + @@ -169,4 +84 @@ Linux - - AWSAccountID: - type: string - description: RES Environment AWS Account ID - - RESEnvName: + - GPUFamily: @@ -174,8 +86,2 @@ Linux - description: RES Environment Name - - RESEnvRegion: - type: string - description: RES Environment Region - - RESEnvReleaseVersion: - type: string - description: RES Release Version - + description: GPU family (NONE, NVIDIA, or AMD) + default: NONE @@ -191,2 +97,2 @@ Linux - - 'mkdir -p /root/bootstrap/logs' - - 'mkdir -p /root/bootstrap/latest' + - "mkdir -p /root/bootstrap/logs" + - "mkdir -p /root/bootstrap/latest" @@ -198,3 +104,2 @@ Linux - - source: 's3://{{ RESEnvName }}-cluster-{{ RESEnvRegion }}-{{ AWSAccountID }}/idea/vdc/res-ready-install-script-packages/linux/res_linux_install_{{ RESEnvReleaseVersion }}.tar.gz' - destination: '/root/bootstrap/res_linux_install_{{ RESEnvReleaseVersion }}.tar.gz' - expectedBucketOwner: '{{ AWSAccountID }}' + - source: "s3://research-engineering-studio-us-east-1/releases/latest/res-installation-scripts.tar.gz" + destination: "/root/bootstrap/res-installation-scripts/res-installation-scripts.tar.gz" @@ -207,8 +112,4 @@ Linux - - 'tar -xvf {{ build.DownloadRESLinuxInstallPackage.inputs[0].destination }} -C /root/bootstrap/latest' - - '/bin/bash /root/bootstrap/latest/virtual-desktop-host-linux/install.sh -r {{ RESEnvRegion }} -n {{ RESEnvName }} -g NONE' - - name: FirstReboot - action: Reboot - onFailure: Abort - maxAttempts: 3 - inputs: - delaySeconds: 0 + - "cd /root/bootstrap/res-installation-scripts" + - "tar -xf res-installation-scripts.tar.gz" + - "cd scripts/virtual-desktop-host/linux" + - "/bin/bash install.sh -g {{ GPUFamily }}" @@ -221,3 +122,5 @@ Linux - - '/bin/bash /root/bootstrap/latest/virtual-desktop-host-linux/install_post_reboot.sh' - - name: SecondReboot - action: Reboot + - "cd /root/bootstrap/res-installation-scripts/scripts/virtual-desktop-host/linux" + - 'sed -i ''/^export AWS_DEFAULT_PROFILE="bootstrap_profile"$/d'' install_post_reboot.sh' + - "/bin/bash install_post_reboot.sh -g {{ GPUFamily }}" + - name: PreventAL2023FromUninstallingCronie + action: ExecuteBash @@ -227 +130,2 @@ Linux - delaySeconds: 0 + commands: + - "rm -f /tmp/imagebuilder_service/crontab_installed" @@ -245,13 +148,0 @@ Windows - parameters: - - AWSAccountID: - type: string - description: RES Environment AWS Account ID - - RESEnvName: - type: string - description: RES Environment Name - - RESEnvRegion: - type: string - description: RES Environment Region - - RESEnvReleaseVersion: - type: string - description: RES Release Version @@ -274,3 +165,2 @@ Windows - - source: 's3://{{ RESEnvName }}-cluster-{{ RESEnvRegion }}-{{ AWSAccountID }}/idea/vdc/res-ready-install-script-packages/windows/res_windows_install_{{ RESEnvReleaseVersion }}.tar.gz' - destination: '{{ build.CreateRESBootstrapFolder.inputs[0].path }}\res_windows_install_{{ RESEnvReleaseVersion }}.tar.gz' - expectedBucketOwner: '{{ AWSAccountID }}' + - source: 's3://research-engineering-studio-us-east-1/releases/latest/res-installation-scripts.tar.gz' + destination: '{{ build.CreateRESBootstrapFolder.inputs[0].path }}\res-installation-scripts.tar.gz' @@ -284,9 +174,3 @@ Windows - - 'Tar -xf res_windows_install_{{ RESEnvReleaseVersion }}.tar.gz' - - 'Import-Module .\virtual-desktop-host-windows\Install.ps1' - - 'Install-WindowsEC2Instance' - - name: Reboot - action: Reboot - onFailure: Abort - maxAttempts: 3 - inputs: - delaySeconds: 0 + - 'tar -xf res-installation-scripts.tar.gz' + - 'Import-Module .\scripts\virtual-desktop-host\windows\Install.ps1' + - 'Install-WindowsEC2Instance -PrebakeAMI' @@ -307 +191 @@ RES supports the following image operating systems: - * Ubuntu 22.04.3 (x86) + * Amazon Linux 2023 (x86 and ARM64) @@ -310,0 +195,4 @@ RES supports the following image operating systems: + * Rocky Linux 9 (x86) + + * Ubuntu 22.04.3 (x86)