AWS res documentation change
Summary
Updated RES-ready AMI documentation to simplify IAM permissions (replacing custom policy with AmazonS3ReadOnlyAccess), change installation script source to central S3 bucket, update component parameters, add GPU family support, modify installation steps, update supported OS list, and improve image descriptions.
Security assessment
The changes primarily focus on simplifying the deployment process and updating installation procedures. The IAM policy change from a custom restrictive policy to AmazonS3ReadOnlyAccess actually reduces security granularity but isn't directly addressing a known vulnerability. The removal of environment-specific parameters and centralization of installation scripts is an architectural change. No evidence of addressing a specific security vulnerability, incident, or weakness.
Diff
diff --git a/res/archive/release-minus-3/ug/res-ready-ami.md b/res/archive/release-minus-3/ug/res-ready-ami.md index 042f5044e..bfcb3b625 100644 --- a//res/archive/release-minus-3/ug/res-ready-ami.md +++ b//res/archive/release-minus-3/ug/res-ready-ami.md @@ -40,92 +40 @@ To access the RES environment service from EC2 Image Builder, you must create or - * AmazonSSMManagedInstanceCore and EC2InstanceProfileForImageBuilder policies. - - * A custom RES policy with limited DynamoDB and Amazon S3 access to the deployed RES environment. - -(This policy can be either a customer managed or customer inline policy document.) - - - - - 1. Start by creating a new policy that will be attached to your role: **IAM** -> **Policies** -> **Create policy** - - 2. Select **JSON** from the policy editor. - - 3. Copy and paste the policy shown here into the editor, replacing `us-east-1` with your desired AWS Region, `111122223333` with your AWS account ID, and `{RES-EnvironmentName}` with your RES EnvironmentName where applicable. - -**RES policy:** - -JSON - - -**** - - - { - "Version":"2012-10-17", - "Statement": [ - { - "Sid": "RESDynamoDBAccess", - "Effect": "Allow", - "Action": "dynamodb:GetItem", - "Resource": "arn:aws:dynamodb:us-east-1:111122223333:table/{RES-EnvironmentName}.cluster-settings", - "Condition": { - "ForAllValues:StringLike": { - "dynamodb:LeadingKeys": [ - "global-settings.gpu_settings.*", - "global-settings.package_config.*", - "cluster-manager.host_modules.*", - "identity-provider.cognito.enable_native_user_login" - ] - } - } - }, - { - "Sid": "RESS3Access", - "Effect": "Allow", - "Action": "s3:GetObject", - "Resource": [ - "arn:aws:s3:::{RES-EnvironmentName}-cluster-us-east-1-111122223333/idea/vdc/res-ready-install-script-packages/*", - "arn:aws:s3:::research-engineering-studio-us-east-1/host_modules/*" - ] - } - ] - } - - - 4. Choose **Next** and provide a name and optional description to complete the policy creation. - - 5. To create the role, start by going to **IAM** -> **Roles** -> **Create role**. - - 6. Under **Trusted Entity Type** , select **"AWS service"**. - - 7. Select **EC2** in the **Service or use case** drop down. - - 8. In the **Use case** section, select **EC2** , then choose **Next**. - - 9. Search for and then select the name of the policy you previously created. - - 10. Choose **Next** and provide a name and optional description to complete the role creation. - - 11. Select your new role and verify that the Trust relationship matches the following: - -**Trusted relationship entity:** - -JSON - - -**** - - - { - "Version":"2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": "ec2.amazonaws.com" - }, - "Action": "sts:AssumeRole" - } - ] - } - + * AmazonS3ReadOnlyAccess, AmazonSSMManagedInstanceCore and EC2InstanceProfileForImageBuilder policies. @@ -149,0 +59,2 @@ Follow the directions to [Create a component using the Image Builder console](ht + key : value + @@ -151,0 +63,4 @@ Follow the directions to [Create a component using the Image Builder console](ht +###### Important + +In the definition file, replace `latest` in the download URI (`- source: 's3://research-engineering-studio-us-east-1/releases/`latest`/res-installation-scripts.tar.gz'`) with with the exact version number (for example, `2025.06`) if your RES environment version is not the latest. + @@ -169,4 +84 @@ Linux - - AWSAccountID: - type: string - description: RES Environment AWS Account ID - - RESEnvName: + - GPUFamily: @@ -174,8 +86,2 @@ Linux - description: RES Environment Name - - RESEnvRegion: - type: string - description: RES Environment Region - - RESEnvReleaseVersion: - type: string - description: RES Release Version - + description: GPU family (NONE, NVIDIA, or AMD) + default: NONE @@ -191,2 +97,2 @@ Linux - - 'mkdir -p /root/bootstrap/logs' - - 'mkdir -p /root/bootstrap/latest' + - "mkdir -p /root/bootstrap/logs" + - "mkdir -p /root/bootstrap/latest" @@ -198,3 +104,2 @@ Linux - - source: 's3://{{ RESEnvName }}-cluster-{{ RESEnvRegion }}-{{ AWSAccountID }}/idea/vdc/res-ready-install-script-packages/linux/res_linux_install_{{ RESEnvReleaseVersion }}.tar.gz' - destination: '/root/bootstrap/res_linux_install_{{ RESEnvReleaseVersion }}.tar.gz' - expectedBucketOwner: '{{ AWSAccountID }}' + - source: "s3://research-engineering-studio-us-east-1/releases/latest/res-installation-scripts.tar.gz" + destination: "/root/bootstrap/res-installation-scripts/res-installation-scripts.tar.gz" @@ -207,8 +112,4 @@ Linux - - 'tar -xvf {{ build.DownloadRESLinuxInstallPackage.inputs[0].destination }} -C /root/bootstrap/latest' - - '/bin/bash /root/bootstrap/latest/virtual-desktop-host-linux/install.sh -r {{ RESEnvRegion }} -n {{ RESEnvName }} -g NONE' - - name: FirstReboot - action: Reboot - onFailure: Abort - maxAttempts: 3 - inputs: - delaySeconds: 0 + - "cd /root/bootstrap/res-installation-scripts" + - "tar -xf res-installation-scripts.tar.gz" + - "cd scripts/virtual-desktop-host/linux" + - "/bin/bash install.sh -g {{ GPUFamily }}" @@ -221,3 +122,5 @@ Linux - - '/bin/bash /root/bootstrap/latest/virtual-desktop-host-linux/install_post_reboot.sh' - - name: SecondReboot - action: Reboot + - "cd /root/bootstrap/res-installation-scripts/scripts/virtual-desktop-host/linux" + - 'sed -i ''/^export AWS_DEFAULT_PROFILE="bootstrap_profile"$/d'' install_post_reboot.sh' + - "/bin/bash install_post_reboot.sh -g {{ GPUFamily }}" + - name: PreventAL2023FromUninstallingCronie + action: ExecuteBash @@ -227 +130,2 @@ Linux - delaySeconds: 0 + commands: + - "rm -f /tmp/imagebuilder_service/crontab_installed" @@ -245,13 +148,0 @@ Windows - parameters: - - AWSAccountID: - type: string - description: RES Environment AWS Account ID - - RESEnvName: - type: string - description: RES Environment Name - - RESEnvRegion: - type: string - description: RES Environment Region - - RESEnvReleaseVersion: - type: string - description: RES Release Version @@ -274,3 +165,2 @@ Windows - - source: 's3://{{ RESEnvName }}-cluster-{{ RESEnvRegion }}-{{ AWSAccountID }}/idea/vdc/res-ready-install-script-packages/windows/res_windows_install_{{ RESEnvReleaseVersion }}.tar.gz' - destination: '{{ build.CreateRESBootstrapFolder.inputs[0].path }}\res_windows_install_{{ RESEnvReleaseVersion }}.tar.gz' - expectedBucketOwner: '{{ AWSAccountID }}' + - source: 's3://research-engineering-studio-us-east-1/releases/latest/res-installation-scripts.tar.gz' + destination: '{{ build.CreateRESBootstrapFolder.inputs[0].path }}\res-installation-scripts.tar.gz' @@ -284,9 +174,3 @@ Windows - - 'Tar -xf res_windows_install_{{ RESEnvReleaseVersion }}.tar.gz' - - 'Import-Module .\virtual-desktop-host-windows\Install.ps1' - - 'Install-WindowsEC2Instance' - - name: Reboot - action: Reboot - onFailure: Abort - maxAttempts: 3 - inputs: - delaySeconds: 0 + - 'tar -xf res-installation-scripts.tar.gz' + - 'Import-Module .\scripts\virtual-desktop-host\windows\Install.ps1' + - 'Install-WindowsEC2Instance -PrebakeAMI' @@ -307 +191 @@ RES supports the following image operating systems: - * Ubuntu 22.04.3 (x86) + * Amazon Linux 2023 (x86 and ARM64) @@ -310,0 +195,4 @@ RES supports the following image operating systems: + * Rocky Linux 9 (x86) + + * Ubuntu 22.04.3 (x86)