Assign IAM role to Bamboo instances?

[Deleted user]

Is it possible for Bamboo to assign an IAM role to instance it start?

We would like our bamboo-agent elastic instance to access a non-public S3 bucket; it is possible to control this using the IP address but it needs to be done again each time an instance is started.

If all instances could start up with a certain IAM role, it would then be easy to give this role access to the bucket.

[Przemek Bruski · Accepted solution]

No, not at the moment. This feature should be available with 5.3 .

[peterkh]

Is this the case now?

[bmantoni]

The agent config has an option for "IAM Instance Profile" which seems like it will do the job.

[Samuel Sun]

I am facing the same issue when I try to assign an IAM to Bamboo. I don't want to use an IAM with full permission on Bamboo. I want to allow Bamboo to start new instance and terminate only the instance it starts. So I create a IAM role "bamboo" with EC2 permission, the policy is like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:CreateCluster",
                "ecs:DeregisterContainerInstance",
                "ecs:DiscoverPollEndpoint",
                "ecs:Poll",
                "ecs:RegisterContainerInstance",
                "ecs:Submit*"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

Then I create an IAM user with following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ec2:Describe*",
                "iam:Get*",
                "iam:List*",
                "ec2:CreateTags"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::XXXXX:role/bamboo"
        },
        {
            "Sid": "AllowInstanceActions",
            "Effect": "Allow",
            "Action": [
                "ec2:RebootInstances",
                "ec2:StopInstances",
                "ec2:TerminateInstances",
                "ec2:StartInstances"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:InstanceProfile": "arn:aws:iam::XXXXX:instance-profile/bamboo"
                }
            },
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "EC2RunInstances",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:InstanceProfile": "arn:aws:iam::XXXXX:instance-profile/bamboo"
                }
            },
            "Resource": [
                "arn:aws:ec2:*:*:instance/*"
            ]
        },
        {
            "Sid": "RemainingRunInstancePermissions",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:volume/*",
                "arn:aws:ec2:*::image/ami-*",
                "arn:aws:ec2:*:*:subnet/*",
                "arn:aws:ec2:*:*:network-interface/*",
                "arn:aws:ec2:*:*:key-pair/*",
                "arn:aws:ec2:*:*:security-group/*"
            ]
        }
    ]
}

What it does is to allow user to create EC2 instance with the "bamboo" profile and only terminate instance with this profile.

This works perfectly fine and I login to AWS console as the user and launch the EC2 instance manually. However, it doesn't work when I set the IAM access in Bamboo and set IAM instance profile with the role.

I am not sure what is wrong here. Does anyone have set up Bamboo with restricted IAM permission successfully?

[Simon Lam]

I am experiencing similar issues trying to configure it through the GUI. I've created an IAM role through the AWS Console and am just sticking the generated instance profile name (e.g. "bamboo") into the Image Configuration screen. Any guidance on debugging this issue?

[Samuel Sun]

Hi Simon, I have to give up on this. After talking to both Bamboo and AWS supports, it doesn't seem to be an existing solution which can do the job. Bamboo doesn't seem to care about supporting AWS user role properly even though there have been so many requests since 2013. I ended up using a separate AWS account just for Bamboo.

[Taylon Silmer]

5.6 is out and we still don't have support for IAM Roles. Any news on that?

[Przemek Bruski]

Are you sure? Check the image configuration page.

[Oli Wood]

Count my vote here too, this would be insanely handy

[Przemek Bruski]

It got delayed, but now the feature is implemented and available on the branch scheduled for 5.6.