aws cloudformation "NetworkInterfaces" in Autoscaling launchconfig group - amazon-web-services

Question

In aws cloudformation how to add "NetworkInterfaces" in Autoscaling launchconfig group as I want to configure every instance launched and I need "NetworkInterfaces" to be there same AWS::EC2::Instance?

Answer 1

The solution I'm currently using is to ensure that every Instance is launched with an IAM Instance Profile that allows contains the Policy
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"ec2:CreateTags",
"ec2:DescribeSubnets",
"ec2:AttachNetworkInterface",
"ec2:CreateNetworkInterface",
"ec2:ModifyNetworkInterfaceAttribute"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
My Cloud Formation Template for creating the AutoScalingGroup and LaunchConfiguration receives Parameters for Subnets and Security Groups to attach to each additional ENI.
"SecondaryNICSubnetIds":{
"Type" : "CommaDelimitedList",
"Description" : "Ensure that the spread of Availability Zones for these Subnets matches the SubnetIds used to create Instances, as when creating a Secondary ENI it must exist in the same AZ as the Instance"
},
"SecondaryNICSecurityGroupIds":{
"Type" : "CommaDelimitedList",
"Description" : "Security Groups to associate to the Secondary ENI"
},
Then the LaunchConfiguration contains a UserData property that
ensures awscli is installed
sets the region to use by parse the instance metadata identity document
gets the instance id from the instance metadata
gets the availability zone for the instance from the instance metadata
from the Subnets that have been passed in find the first that matches my instances AZ by using the awscli describe-subnets call
Creates a Network Interface in my chosen Subnet, and add Security Groups to it using the awscli create-network-interface call
Tag my ENI using the awscli create-tags call
Attach ENI to my Instance using the awscli attach-network-interface call
Modify Attachment to Delete the ENI on Instance Termination using the modify-network-interface-attribute call
"UserData": {
"Fn::Base64" : {
"Fn::Join": [ "\n",
[
"#!/bin/bash -xe",
"sudo apt-get install -y awscli",
"export AWS_DEFAULT_REGION=$(curl -sS http://169.254.169.254/latest/dynamic/instance-identity/document | python -c 'import sys, json; print(json.load(sys.stdin)[\"region\"])')",
"INSTANCE_ID=$(curl -sS http://169.254.169.254/latest/meta-data/instance-id)",
"AZ=$(curl -sS http://169.254.169.254/latest/meta-data/placement/availability-zone)",
"echo Availability Zone: ${AZ}",
{"Fn::Sub":[
"SUBNET_ID=$(aws ec2 describe-subnets --subnet-ids ${SubnetNetIds} --filters Name=availabilityZone,Values=${!AZ} --query 'Subnets[0].SubnetId' --output text)",
{"SubnetNetIds": {"Fn::Join": [" ", {"Ref": "SecondaryNICSubnetIds"} ] }}
]},
"echo Subnet Id: ${SUBNET_ID}",
{"Fn::Sub":[
"ENI_ID=$(aws ec2 create-network-interface --subnet ${!SUBNET_ID} --description 'Secondary ENI' --groups ${SecurityGroups} --query 'NetworkInterface.NetworkInterfaceId' --output text)",
{"SecurityGroups": {"Fn::Join": [" ", {"Ref": "SecondaryNICSecurityGroupIds"}]} }
]},
"echo ENI ID: ${ENI_ID}",
"aws ec2 create-tags --resources ${!ENI_ID} --tags Key=Some,Value=Tag",
"ATTACHMENT_ID=$(aws ec2 attach-network-interface --network-interface-id ${ENI_ID} --instance-id ${INSTANCE_ID} --device-index 1 --output text)",
"echo Attachment ID: ${ATTACHMENT_ID}",
"echo Delete On Termination: $(aws ec2 modify-network-interface-attribute --network-interface-id ${ENI_ID} --attachment AttachmentId=${ATTACHMENT_ID},DeleteOnTermination=true --output text)"
]
]
}
}
If you didn't want to pass the Subnets into the Cloud Formation Template you could attempt to look them up by adding tags to --query in the awscli describe-subnets call, if your infrastructure allows you to identify them this way.