This message was deleted.

sparse-intern-71089

02/15/2021, 8:09 PM

This message was deleted.

little-cartoon-10569

02/15/2021, 8:10 PM

AmiFromInstance or ImageBuilder.

little-cartoon-10569

02/15/2021, 8:10 PM

Currently I'm using SSM to configure instances on startup, but that's not scalable, takes too long to start up 10 identical images.

brave-planet-10645

02/15/2021, 10:04 PM

The "official" way with AWS is to use their imagebuilder service. We've talked internally about using the EC2 provisioner alongside automation API (as you should stop the instance before you use AmiFromInstance and you can't do that from Pulumi - you'd have to use the SDK to stop it)

little-cartoon-10569

02/15/2021, 10:07 PM

Image builder will stop the instance for you...

little-cartoon-10569

02/15/2021, 10:08 PM

But I don't really want to mess with jinja or whatever that double-curly json-like data config is in image builder, if I can do it better in TypeScript...

brave-planet-10645

02/15/2021, 10:14 PM

https://www.github.com/pulumi/examples/tree/master/aws-ts-ec2-provisioners for provisioners example

little-cartoon-10569

02/15/2021, 10:28 PM

Hmm... that's a step in the right direction. It has a few advantages over SSM: 1. Don't need to have the SSM agent running. 2. Don't need to open port 443 to the SSM service (which is addressable only by FQDN and not IP address, so can't easily punch a hole in my SGs for it). 3. Don't need to wait for the agent to pick up the job to configure the instance. 4. When Pulumi is finished, then the instance is already configured. 5. The scripts are in a well-known location on the target machine, so can be manually run later if need be. 6. No more wrestling with PowerShell-text-in-TypeScript-files double-escaping woes.

little-cartoon-10569

02/15/2021, 10:28 PM

But it's fully manual, which means 1. No "free" logging, error reporting or retrying. 2. No UI over progress or results.

little-cartoon-10569

02/15/2021, 10:29 PM

Also, I'd have to figure out how to join my domain, since I'm currently using a provided SSM function for that..

little-cartoon-10569

02/15/2021, 10:37 PM

That provisioners example would allow you to stop the instance @brave-planet-10645. Just put a call in a RemoteExec script to

aws ec2 stop-instance

. Thought I suppose then you'd have issues with AWS creds ending up baked into your AMIs... might need a few layers of vaults and env vars to work around that...

brave-planet-10645

02/16/2021, 9:26 AM

Yeah windows EC2 are harder because you usually have to join the domain and then restart the instance. At one place I worked we didn't bother to join the windows instances to the domain as there wasn't any need for it. Worth thinking if you absolutely need them joined. If it's purely for credentials then set a strong admin password.

2 Views

Open in Slack

Previous Next

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.