Package: puppet-enc-ec2
A Puppet ENC which assigns Nodes based on their AWS EC2 Tags. Additionally, all
EC2 Tags are made available to Puppet as trusted Top Level Variables with theec2_tag_prefix.Problem summaryHistorically, I used theec2tagfactsmodule to classify Puppet Nodes in AWS
EC2. This works great! The Puppet Agents enumerate their own EC2 Tags using the
module and they report the Tags to the Puppet Master as Untrusted Facts. These
Facts can then be used by the Enterprise Node Classifier to assign Classes to
the Node.By example, I created anEnvironmentandRoletag in EC2 that are
reported by the Puppet Agent and used to assign the Node to the matching
Puppet Environment and Role class.There are a few problems with this approach:Every EC2 Instance must be assigned permission to read its own tags, and
consequently, the tags of any other EC2 InstanceA managed agent could spoof the EC2 Tag Facts to retrieve configuration for
and other class or environmentWhen using the Puppet Enterprise console, a Classification Group had to be
created for every Role in every EnvironmentThis solution mitigates these issues as:Only the Puppet Master needs permission to read tagsEC2 tags are provided by the ENC as Top Level Variables - these cannot be
spoofed by an agent and are therefore more secureNo additional configuration is required in the Enterprise ConsoleUsageThis ENC assumes you are using theRoles and Profilesparadigm and intend to
assign a single Role class to each node, with therole::prefix.Each managed EC2 Instance must have the following EC2 Tags assigned:Environment- The Puppet Environment to assign (default:production)Role- the Role class to assign, excluding therole::prefixInstallationInstall the classifier on your Puppet Master with the following:$pipinstallpuppet-enc-ec2# or$curl-o/usr/local/bin/puppet-enc-ec2\https://raw.githubusercontent.com/cavaliercoder/puppet-enc-ec2/master/bin/puppet-enc-ec2$chmod+x/usr/local/bin/puppet-enc-ec2Configure the Puppet Master to use the executable Node Classifier inpuppet.confas follows:[master]node_terminus=execexternal_nodes=/usr/local/bin/puppet-enc-ec2The Puppet Master will also need the following IAM Policy applied so that is can
query the EC2 API for Instance metadata:{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["ec2:DescribeInstances"],"Resource":"*"}]}For for information about installing a custom ENC, see:https://puppet.com/docs/puppet/latest/nodes_external.htmlConfigurationThe script uses the Amazon AWS SDK (boto3) to connect to AWS. The SDK must
be configured with credentials to connect to the AWS APIs. Please see theBoto3
documentationfor instruction.In addition, the desired AWS Region should be configured by modifying the
script, or setting theAWS_DEFAULT_REGIONenvironment variable.Example# test the classifier for an EC2 Instance$puppet-enc-ec2i-deadbeefcafebabe---classes:role::web_server:environment:productionparameters:ec2_tag_name:WebServerec2_tag_description:WebApplicationServerec2_tag_environment:productionec2_tag_role:web_serverec2_tag_aws_cloudformation_logical_id:WebServerec2_tag_aws_cloudformation_stack_id:arn:aws:cloudformation:us-east-1:123456789000:stack/cf-web-server/0f7b6bb0-9d1a-11e7-848e-50fa575f68feec2_tag_aws_cloudformation_stack_name:cf-web-serverec2_tags:Name:WebServerDescription:WebApplicationServerEnvironment:productionRole:web_serveraws:cloudformation:logical-id:WebServeraws:cloudformation:stack-id:arn:aws:cloudformation:us-east-1:123456789000:stack/cf-web-server/0f7b6bb0-9d1a-11e7-848e-50fa575f68feaws:cloudformation:stack-name:cf-web-server