0

I am using the standard "Publish to AWS Elastic Beanstalk ..." feature provided by the AWS Toolkit extension for Visual Studio, however I also need to deploy a credential file to the root of the C: directory for proper access to the S3 API.

If I simply remote into the instance and add the file, then it will only last until Amazon recycles the cloud instance and then spawns a new one to replace it, meaning that the application is broken until I remote into the new instance and make a new file.

It would be nice to have the server automatically run a PowerShell script that handles this and other configuration tasks either when the server instance is created or when it starts up. Is there a way that this can be set up by using the AWS Toolkit? I was able to find documentation that seemed relevant, but I couldn't figure out how to get it to work with the VS extension that I'm using:

http://docs.aws.amazon.com/toolkit-for-visual-studio/latest/user-guide/deployment-beanstalk-custom.html

Or maybe I'm on the wrong path, and I need to make a custom AMI for this?

Improve this question

1 Answer 1

Reset to default
1

For EC2 instances, don't add a credentials file. Instead use an IAM Role.

An IAM role is a policy that defines permissions, just like an IAM user, but for Amazon services such as EC2. You attach the role to the instance.

Amazon tools, SDKs, etc. will autmatically find the credentials from the metadata for the EC2 instance.

The AWS Management Console has a number of predefined policies that you can add to your role. This makes creating a role very easy.

With a role assign to your EC2 instances in Beanstalk, when a new instance is created the credentials from the role will be available. No need to publish a credentials file.

This is also the official recommended method to assign permissions to EC2 instances.

Blog: IAM roles for EC2 instances

User Guide: IAM roles for EC2 instances

Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

Thanks for the help and the links, John. I'll use that strategy. However I also have to give Modify access to the system's IUSR account for a particular subfolder within the web application, so it would still be helpful to run a PowerShell script. Are you aware of any way to do this?
Yes, you can add commands to the "userdata" section for your EC2 instance that run on launch. Here is a link for Windows: docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/…

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.