Assign IAM role to Bamboo instances?

Is it possible for Bamboo to assign an IAM role to instance it start?

We would like our bamboo-agent elastic instance to access a non-public S3 bucket; it is possible to control this using the IP address but it needs to be done again each time an instance is started.

If all instances could start up with a certain IAM role, it would then be easy to give this role access to the bucket.

4 answers

1 accepted

Accepted Answer
0 votes

No, not at the moment. This feature should be available with 5.3 .

Is this the case now?

Count my vote here too, this would be insanely handy

It got delayed, but now the feature is implemented and available on the branch scheduled for 5.6.

5.6 is out and we still don't have support for IAM Roles. Any news on that?

Are you sure? Check the image configuration page.

I am facing the same issue when I try to assign an IAM to Bamboo. I don't want to use an IAM with full permission on Bamboo. I want to allow Bamboo to start new instance and terminate only the instance it starts. So I create a IAM role "bamboo" with EC2 permission, the policy is like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:CreateCluster",
                "ecs:DeregisterContainerInstance",
                "ecs:DiscoverPollEndpoint",
                "ecs:Poll",
                "ecs:RegisterContainerInstance",
                "ecs:Submit*"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

Then I create an IAM user with following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ec2:Describe*",
                "iam:Get*",
                "iam:List*",
                "ec2:CreateTags"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::XXXXX:role/bamboo"
        },
        {
            "Sid": "AllowInstanceActions",
            "Effect": "Allow",
            "Action": [
                "ec2:RebootInstances",
                "ec2:StopInstances",
                "ec2:TerminateInstances",
                "ec2:StartInstances"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:InstanceProfile": "arn:aws:iam::XXXXX:instance-profile/bamboo"
                }
            },
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "EC2RunInstances",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:InstanceProfile": "arn:aws:iam::XXXXX:instance-profile/bamboo"
                }
            },
            "Resource": [
                "arn:aws:ec2:*:*:instance/*"
            ]
        },
        {
            "Sid": "RemainingRunInstancePermissions",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:volume/*",
                "arn:aws:ec2:*::image/ami-*",
                "arn:aws:ec2:*:*:subnet/*",
                "arn:aws:ec2:*:*:network-interface/*",
                "arn:aws:ec2:*:*:key-pair/*",
                "arn:aws:ec2:*:*:security-group/*"
            ]
        }
    ]
}

What it does is to allow user to create EC2 instance with the "bamboo" profile and only terminate instance with this profile.

 

This works perfectly fine and I login to AWS console as the user and launch the EC2 instance manually. However, it doesn't work when I set the IAM access in Bamboo and set IAM instance profile with the role.

 

I am not sure what is wrong here. Does anyone have set up Bamboo with restricted IAM permission successfully?

I am experiencing similar issues trying to configure it through the GUI. I've created an IAM role through the AWS Console and am just sticking the generated instance profile name (e.g. "bamboo") into the Image Configuration screen. Any guidance on debugging this issue?

Hi Simon, I have to give up on this. After talking to both Bamboo and AWS supports, it doesn't seem to be an existing solution which can do the job. Bamboo doesn't seem to care about supporting AWS user role properly even though there have been so many requests since 2013. I ended up using a separate AWS account just for Bamboo.

Suggest an answer

Log in or Sign up to answer
Community showcase
Posted Tuesday in Jira

Looking for anyone who made the switch to Data Center

The Jira Marketing team is putting together an ebook on migrating to Data Center. We're looking for pro tips on how you staffed your project team and organized your Proof of Concept. Share yo...

26 views 0 2
Join discussion

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you