AWS res medium security documentation change
Summary
Simplified IAM policy requirements by replacing custom RES policy with AmazonS3ReadOnlyAccess managed policy. Updated component definitions to use centralized installation scripts, added version pinning guidance, modified parameters, and updated supported OS list.
Security assessment
The change adds explicit security guidance to avoid using 'latest' version tags ('Important' note about version pinning), which prevents potential compromise through malicious updates. The removal of AWS_DEFAULT_PROFILE environment variable reduces credential exposure risk. However, the replacement of scoped custom IAM policy with broader AmazonS3ReadOnlyAccess increases potential attack surface.
Diff
diff --git a/res/archive/release-minus-4/ug/res-ready-ami.md b/res/archive/release-minus-4/ug/res-ready-ami.md index 56f20b2cc..777ef3504 100644 --- a//res/archive/release-minus-4/ug/res-ready-ami.md +++ b//res/archive/release-minus-4/ug/res-ready-ami.md @@ -42,92 +42 @@ To access the RES environment service from EC2 Image Builder, you must create or - * AmazonSSMManagedInstanceCore and EC2InstanceProfileForImageBuilder policies. - - * A custom RES policy with limited DynamoDB and Amazon S3 access to the deployed RES environment. - -(This policy can be either a customer managed or customer inline policy document.) - - - - - 1. Start by creating a new policy that will be attached to your role: **IAM** -> **Policies** -> **Create policy** - - 2. Select **JSON** from the policy editor. - - 3. Copy and paste the policy shown here into the editor, replacing `us-east-1` with your desired AWS Region, `111122223333` with your AWS account ID, and `{RES-EnvironmentName}` with your RES EnvironmentName where applicable. - -**RES policy:** - -JSON - - -**** - - - { - "Version":"2012-10-17", - "Statement": [ - { - "Sid": "RESDynamoDBAccess", - "Effect": "Allow", - "Action": "dynamodb:GetItem", - "Resource": "arn:aws:dynamodb:us-east-1:111122223333:table/{RES-EnvironmentName}.cluster-settings", - "Condition": { - "ForAllValues:StringLike": { - "dynamodb:LeadingKeys": [ - "global-settings.gpu_settings.*", - "global-settings.package_config.*", - "cluster-manager.host_modules.*", - "identity-provider.cognito.enable_native_user_login" - ] - } - } - }, - { - "Sid": "RESS3Access", - "Effect": "Allow", - "Action": "s3:GetObject", - "Resource": [ - "arn:aws:s3:::{RES-EnvironmentName}-cluster-us-east-1-111122223333/idea/vdc/res-ready-install-script-packages/*", - "arn:aws:s3:::research-engineering-studio-us-east-1/host_modules/*" - ] - } - ] - } - - - 4. Choose **Next** and provide a name and optional description to complete the policy creation. - - 5. To create the role, start by going to **IAM** -> **Roles** -> **Create role**. - - 6. Under **Trusted Entity Type** , select **"AWS service"**. - - 7. Select **EC2** in the **Service or use case** drop down. - - 8. In the **Use case** section, select **EC2** , then choose **Next**. - - 9. Search for and then select the name of the policy you previously created. - - 10. Choose **Next** and provide a name and optional description to complete the role creation. - - 11. Select your new role and verify that the Trust relationship matches the following: - -**Trusted relationship entity:** - -JSON - - -**** - - - { - "Version":"2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": "ec2.amazonaws.com" - }, - "Action": "sts:AssumeRole" - } - ] - } - + * AmazonS3ReadOnlyAccess, AmazonSSMManagedInstanceCore and EC2InstanceProfileForImageBuilder policies. @@ -151,0 +61,2 @@ Follow the directions to [Create a component using the Image Builder console](ht + key : value + @@ -153,0 +65,4 @@ Follow the directions to [Create a component using the Image Builder console](ht +###### Important + +In the definition file, replace `latest` in the download URI (`- source: 's3://research-engineering-studio-us-east-1/releases/`latest`/res-installation-scripts.tar.gz'`) with with the exact version number (for example, `2025.06`) if your RES environment version is not the latest. + @@ -171,4 +86 @@ Linux - - AWSAccountID: - type: string - description: RES Environment AWS Account ID - - RESEnvName: + - GPUFamily: @@ -176,8 +88,2 @@ Linux - description: RES Environment Name - - RESEnvRegion: - type: string - description: RES Environment Region - - RESEnvReleaseVersion: - type: string - description: RES Release Version - + description: GPU family (NONE, NVIDIA, or AMD) + default: NONE @@ -193,2 +99,2 @@ Linux - - 'mkdir -p /root/bootstrap/logs' - - 'mkdir -p /root/bootstrap/latest' + - "mkdir -p /root/bootstrap/logs" + - "mkdir -p /root/bootstrap/latest" @@ -200,3 +106,2 @@ Linux - - source: 's3://{{ RESEnvName }}-cluster-{{ RESEnvRegion }}-{{ AWSAccountID }}/idea/vdc/res-ready-install-script-packages/linux/res_linux_install_{{ RESEnvReleaseVersion }}.tar.gz' - destination: '/root/bootstrap/res_linux_install_{{ RESEnvReleaseVersion }}.tar.gz' - expectedBucketOwner: '{{ AWSAccountID }}' + - source: "s3://research-engineering-studio-us-east-1/releases/latest/res-installation-scripts.tar.gz" + destination: "/root/bootstrap/res-installation-scripts/res-installation-scripts.tar.gz" @@ -209,8 +114,4 @@ Linux - - 'tar -xvf {{ build.DownloadRESLinuxInstallPackage.inputs[0].destination }} -C /root/bootstrap/latest' - - '/bin/bash /root/bootstrap/latest/virtual-desktop-host-linux/install.sh -r {{ RESEnvRegion }} -n {{ RESEnvName }} -g NONE' - - name: FirstReboot - action: Reboot - onFailure: Abort - maxAttempts: 3 - inputs: - delaySeconds: 0 + - "cd /root/bootstrap/res-installation-scripts" + - "tar -xf res-installation-scripts.tar.gz" + - "cd scripts/virtual-desktop-host/linux" + - "/bin/bash install.sh -g {{ GPUFamily }}" @@ -223,3 +124,5 @@ Linux - - '/bin/bash /root/bootstrap/latest/virtual-desktop-host-linux/install_post_reboot.sh' - - name: SecondReboot - action: Reboot + - "cd /root/bootstrap/res-installation-scripts/scripts/virtual-desktop-host/linux" + - 'sed -i ''/^export AWS_DEFAULT_PROFILE="bootstrap_profile"$/d'' install_post_reboot.sh' + - "/bin/bash install_post_reboot.sh -g {{ GPUFamily }}" + - name: PreventAL2023FromUninstallingCronie + action: ExecuteBash @@ -229 +132,2 @@ Linux - delaySeconds: 0 + commands: + - "rm -f /tmp/imagebuilder_service/crontab_installed" @@ -247,13 +150,0 @@ Windows - parameters: - - AWSAccountID: - type: string - description: RES Environment AWS Account ID - - RESEnvName: - type: string - description: RES Environment Name - - RESEnvRegion: - type: string - description: RES Environment Region - - RESEnvReleaseVersion: - type: string - description: RES Release Version @@ -276,3 +167,2 @@ Windows - - source: 's3://{{ RESEnvName }}-cluster-{{ RESEnvRegion }}-{{ AWSAccountID }}/idea/vdc/res-ready-install-script-packages/windows/res_windows_install_{{ RESEnvReleaseVersion }}.tar.gz' - destination: '{{ build.CreateRESBootstrapFolder.inputs[0].path }}\res_windows_install_{{ RESEnvReleaseVersion }}.tar.gz' - expectedBucketOwner: '{{ AWSAccountID }}' + - source: 's3://research-engineering-studio-us-east-1/releases/latest/res-installation-scripts.tar.gz' + destination: '{{ build.CreateRESBootstrapFolder.inputs[0].path }}\res-installation-scripts.tar.gz' @@ -286,9 +176,3 @@ Windows - - 'Tar -xf res_windows_install_{{ RESEnvReleaseVersion }}.tar.gz' - - 'Import-Module .\virtual-desktop-host-windows\Install.ps1' - - 'Install-WindowsEC2Instance' - - name: Reboot - action: Reboot - onFailure: Abort - maxAttempts: 3 - inputs: - delaySeconds: 0 + - 'tar -xf res-installation-scripts.tar.gz' + - 'Import-Module .\scripts\virtual-desktop-host\windows\Install.ps1' + - 'Install-WindowsEC2Instance -PrebakeAMI' @@ -309 +193 @@ RES supports the following image operating systems: - * Ubuntu 22.04.3 (x86) + * Amazon Linux 2023 (x86 and ARM64) @@ -312,0 +197,4 @@ RES supports the following image operating systems: + * Rocky Linux 9 (x86) + + * Ubuntu 22.04.3 (x86)