Skip to content

Conversation

@Yarkrn
Copy link
Collaborator

@Yarkrn Yarkrn commented Sep 17, 2025

Adding cloud formation script for creating EC2 instance using current scripts (powershell/bash)

@Yarkrn Yarkrn requested a review from kcantrel as a code owner September 17, 2025 08:42
@github-actions
Copy link
Contributor

github-actions bot commented Sep 17, 2025

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

@Yarkrn Yarkrn requested a review from kcantrel September 18, 2025 15:40
Copy link
Collaborator

@kcantrel kcantrel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a little cleanup work and it will be prefect!

@benams1 benams1 requested a review from kcantrel November 9, 2025 08:11
Copy link
Collaborator

@kcantrel kcantrel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two items I found:

  1. The username isn't prompted for by the CF template.
  2. The Secret infor is inconsistent between the two scripts.

curl -o /tmp/userdata-script.sh ${LinuxUserDataUrl}
chmod +x /tmp/userdata-script.sh
# Pass parameters to the script
/tmp/userdata-script.sh "${SecretName}" "${AWSRegion}" "${ManagementEndpointIP }" "${VolumeName}" "${VolumeSize}" "${SvmName}"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can't believe I didn't notice this before, but the CloudFormation template doesn't prompt for the username to run under. Please add a prompt for the username.

<powershell>
Invoke-WebRequest -Uri ${WindowsUserDataUrl} -OutFile C:\userdata-script.ps1
(Get-Content 'C:\userdata-script.ps1') | Where-Object { $_ -notmatch '^<powershell>$|^</powershell>$' } | Set-Content 'C:\userdata-script.ps1'
powershell.exe -ExecutionPolicy Bypass -File C:\userdata-script.ps1 -SecretIdParam "${SecretName}" -FSxNAdminIpParam "${ManagementEndpointIP }" -VolumeNameParam "${VolumeName}" -VolumeSizeParam "${VolumeSize}" -DriveLetterParam "${DriveLetter}" -SvmNameParam "${SvmName}"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't pass the AWSRegion parameter. This is the region where the secret is so not necessarily in the same region where the instance is running. Looking at the Windows version of the script it looks like it is expecting the SecretID to be the entire ARN, but the Linux version expects just the name and the region is separate. Personally, I prefer to just prompting for the ARN so you have one less prompt.

Of course it also doesn't pass the username.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants