AWS imagebuilder: Add IMDSv2 recommendation and PowerShell example for infra config
Summary
Adds a note recommending IMDSv2 for EC2 instances launched by Image Builder pipeline builds, adds a PowerShell Update-EC2IBInfrastructureConfiguration example, and updates example ARNs/names.
Security assessment
The added note documents the IMDSv2 hardening best practice (signed token header) to mitigate SSRF-style credential theft via instance metadata, and the PowerShell example shows setting InstanceMetadataOptions_HttpToken to required. This is security guidance, not a fix for a specific disclosed vulnerability.
Evidence
+We recommend that you configure all EC2 instances that Image Builder launches from a pipeline build to use IMDSv2 so that instance metadata retrieval requests require a signed token header.
Diff
diff --git a/imagebuilder/latest/userguide/update-infra-config.md b/imagebuilder/latest/userguide/update-infra-config.md index 1ab6cdf..fc19e5f 100644 --- a//imagebuilder/latest/userguide/update-infra-config.md +++ b//imagebuilder/latest/userguide/update-infra-config.md @@ -9 +9 @@ -This section covers how you can use the Image Builder console or **imagebuilder** commands in the AWS CLI to update an infrastructure configuration resource. To track your resources, you can apply tags as follows. Enter tags as key-value pairs. +This section covers how to update an infrastructure configuration resource. You can use the Image Builder console, **imagebuilder** commands in the AWS CLI, or AWS Tools for PowerShell. To track your resources, you can apply tags as follows. Enter tags as key-value pairs. @@ -17,0 +18,4 @@ This section covers how you can use the Image Builder console or **imagebuilder* +###### Note + +We recommend that you configure all EC2 instances that Image Builder launches from a pipeline build to use IMDSv2 so that instance metadata retrieval requests require a signed token header. + @@ -60 +64 @@ AWS CLI -The following example shows how to update the infrastructure configuration for your image with the Image Builder **[update-infrastructure-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/imagebuilder/update-infrastructure-configuration.html)** command in the AWS CLI. +The following example shows how to update the infrastructure configuration for your image with the Image Builder [update-infrastructure-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/imagebuilder/update-infrastructure-configuration.html) command in the AWS CLI. @@ -64 +68 @@ The following example shows how to update the infrastructure configuration for y -In this example, the settings match the create example, except that `terminateInstanceOnFailure` is set to `true`. After you run the **update-infrastructure-configuration** command, pipelines that use this infrastructure configuration terminate the build and test instances when a build fails. +This example is based on the first example in [Create an infrastructure configuration](./create-infra-config.html). It sets `terminateInstanceOnFailure` to `true`, so pipelines that use this infrastructure configuration terminate the build and test instances when a build fails. @@ -68,4 +71,0 @@ The following example sets common infrastructure fields. To require IMDSv2 token -###### Note - -We recommend that you configure all EC2 instances that Image Builder launches from a pipeline build to use IMDSv2 so that instance metadata retrieval requests require a signed token header. - @@ -75 +75 @@ Use a file editing tool to create a JSON file with keys shown in the following e - "infrastructureConfigurationArn": "arn:aws:imagebuilder:us-west-2:123456789012:infrastructure-configuration/my-example-infrastructure-configuration", + "infrastructureConfigurationArn": "arn:aws:imagebuilder:us-west-2:111122223333:infrastructure-configuration/my-example-infrastructure-configuration", @@ -80 +80 @@ Use a file editing tool to create a JSON file with keys shown in the following e - "instanceProfileName": "myIAMInstanceProfileName", + "instanceProfileName": "my-iam-instance-profile-name", @@ -87 +87 @@ Use a file editing tool to create a JSON file with keys shown in the following e - "s3BucketName": "my-logging-bucket", + "s3BucketName": "amzn-s3-demo-logging-bucket", @@ -92 +92 @@ Use a file editing tool to create a JSON file with keys shown in the following e - "snsTopicArn": "arn:aws:sns:us-west-2:123456789012:MyTopic" + "snsTopicArn": "arn:aws:sns:us-west-2:111122223333:my-topic" @@ -101,0 +102,21 @@ Use a file editing tool to create a JSON file with keys shown in the following e +PowerShell + + +The following example shows how to use the [Update-EC2IBInfrastructureConfiguration](https://docs.aws.amazon.com/powershell/latest/reference/items/Update-EC2IBInfrastructureConfiguration.html) cmdlet to update an infrastructure configuration. This example is based on the first example in [Create an infrastructure configuration](./create-infra-config.html). It sets the `TerminateInstanceOnFailure` parameter to `$true`, so pipelines that use this infrastructure configuration terminate the build and test instances when a build fails. + +The following example sets common infrastructure fields. To require IMDSv2 tokens on the build and test instances, set the `InstanceMetadataOptions_HttpToken` parameter to `required`. + +To update the infrastructure configuration, run the `Update-EC2IBInfrastructureConfiguration` cmdlet: + + + Update-EC2IBInfrastructureConfiguration -InfrastructureConfigurationArn arn:aws:imagebuilder:us-west-2:111122223333:infrastructure-configuration/my-example-infrastructure-configuration ` + -Description "An example that will terminate instances of failed builds" ` + -InstanceType m7i.large, m7i.2xlarge ` + -InstanceProfileName my-iam-instance-profile-name ` + -SecurityGroupId sg-12345678 ` + -SubnetId subnet-12345678 ` + -S3Logs_S3BucketName amzn-s3-demo-logging-bucket ` + -S3Logs_S3KeyPrefix my-path ` + -TerminateInstanceOnFailure $true ` + -SnsTopicArn arn:aws:sns:us-west-2:111122223333:my-topic +