nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Assign IAM role to Bamboo instances?

unknown

Is it possible for Bamboo to assign an IAM role to instance it start?

We would like our bamboo-agent elastic instance to access a non-public S3 bucket; it is possible to control this using the IP address but it needs to be done again each time an instance is started.

If all instances could start up with a certain IAM role, it would then be easy to give this role access to the bucket.

Accepted answers

Przemek Bruski

No, not at the moment. This feature should be available with 5.3 .

All comments

Przemek Bruski

No, not at the moment. This feature should be available with 5.3 .

peterkh

Is this the case now?

Oli Wood

Count my vote here too, this would be insanely handy

Przemek Bruski

It got delayed, but now the feature is implemented and available on the branch scheduled for 5.6.

Taylon Silmer

5.6 is out and we still don't have support for IAM Roles. Any news on that?

Przemek Bruski

Are you sure? Check the image configuration page.

Samuel Sun

I am facing the same issue when I try to assign an IAM to Bamboo. I don't want to use an IAM with full permission on Bamboo. I want to allow Bamboo to start new instance and terminate only the instance it starts. So I create a IAM role "bamboo" with EC2 permission, the policy is like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:CreateCluster",
                "ecs:DeregisterContainerInstance",
                "ecs:DiscoverPollEndpoint",
                "ecs:Poll",
                "ecs:RegisterContainerInstance",
                "ecs:Submit*"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

Then I create an IAM user with following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ec2:Describe*",
                "iam:Get*",
                "iam:List*",
                "ec2:CreateTags"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::XXXXX:role/bamboo"
        },
        {
            "Sid": "AllowInstanceActions",
            "Effect": "Allow",
            "Action": [
                "ec2:RebootInstances",
                "ec2:StopInstances",
                "ec2:TerminateInstances",
                "ec2:StartInstances"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:InstanceProfile": "arn:aws:iam::XXXXX:instance-profile/bamboo"
                }
            },
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "EC2RunInstances",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:InstanceProfile": "arn:aws:iam::XXXXX:instance-profile/bamboo"
                }
            },
            "Resource": [
                "arn:aws:ec2:*:*:instance/*"
            ]
        },
        {
            "Sid": "RemainingRunInstancePermissions",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:volume/*",
                "arn:aws:ec2:*::image/ami-*",
                "arn:aws:ec2:*:*:subnet/*",
                "arn:aws:ec2:*:*:network-interface/*",
                "arn:aws:ec2:*:*:key-pair/*",
                "arn:aws:ec2:*:*:security-group/*"
            ]
        }
    ]
}

What it does is to allow user to create EC2 instance with the "bamboo" profile and only terminate instance with this profile.

This works perfectly fine and I login to AWS console as the user and launch the EC2 instance manually. However, it doesn't work when I set the IAM access in Bamboo and set IAM instance profile with the role.

I am not sure what is wrong here. Does anyone have set up Bamboo with restricted IAM permission successfully?

Simon Lam

I am experiencing similar issues trying to configure it through the GUI. I've created an IAM role through the AWS Console and am just sticking the generated instance profile name (e.g. "bamboo") into the Image Configuration screen. Any guidance on debugging this issue?

Samuel Sun

Hi Simon, I have to give up on this. After talking to both Bamboo and AWS supports, it doesn't seem to be an existing solution which can do the job. Bamboo doesn't seem to care about supporting AWS user role properly even though there have been so many requests since 2013. I ended up using a separate AWS account just for Bamboo.

bmantoni

The agent config has an option for "IAM Instance Profile" which seems like it will do the job.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

bamboo

bamboo-administration