Quick Info
| Plugin Title | Web-Tier Launch Configurations IAM Roles |
| Cloud | AWS |
| Category | AutoScaling |
| Description | Ensures that Web-Tier Auto Scaling launch configuration is configured to use a customer created IAM role. |
| More Info | Web-Tier Auto Scaling launch configuration should have a customer created Web-Tier IAM role to provide necessary credentials to access AWS services. |
| AWS Link | https://docs.aws.amazon.com/autoscaling/ec2/userguide/us-iam-role.html |
| Recommended Action | Update Web-Tier Auto Scaling launch configuration and attach a customer created Web-Tier IAM role |
Detailed Remediation Steps
- Log in to the AWS Management Console.
- Select the “Services” option and search for EC2.
- In the EC2 Management console, scroll down and click on the “Launch Configurations” at the bottom.
- On the “Launch Configuration” page, Select the Launch Configuration which needs to be checked for IAM role.
- On the “Launch configurations” page, scroll down and under the Details check the value of the IAM Instance Profile.If the IAM Instance Profile is blank then the selected Launch Configuration group is not configured to use a customer created IAM role.
- Repeat steps number 2 - 5 to check other groups in the account.
- Navigate to IAM dashboard at https://console.aws.amazon.com/iam/.
- In the “IAM dashboard”, click on the “Roles” option at the left navigation panel.
- Click on the “Create Role” button to create a new IAM role.
- On the “Create role page”, select type of trusted entity as “AWS” and and choose EC2 from Choose the service that will use this role list.Click on the next “Permissions” button.
- On the “Permissions” panel, select the “AmazonEC2FullAccess”, select one or more policies from the list, then click Next: Tags button to continue the setup process.
- On the “Add tags” page, add the tag as per the requirement and click on the “Next: Review” button.
- Enter the “Role Name” and click on the “Create Role” button to complete the process.
- Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.
- In the left navigation panel, choose “Launch Configuration” and select the ASG launch configuration that need to modify.
- On the “Launch Configuration” page, scroll down and click on the “Copy launch configuration” button.
- On the “Create launch configuration” page, scroll down and select the “IAM instance profile” from the dropdown under the Additional configuration.
- Click on the “Create launch configuration” button at the bottom to make the changes.
- Repeat steps number 8 - 18 to update Web-Tier Auto Scaling launch configuration and attach a customer created App-Tier IAM role.