Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in
Celebration

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root

Avatar

1 badge earned

Collect

Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!

Challenges
Coins

Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.

Recognition
Ribbon

Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!

Leaderboard

Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
4,458,742
Community Members
 
Community Events
176
Community Groups

Assign IAM role to Bamboo instances?

Deleted user Oct 25, 2013

Is it possible for Bamboo to assign an IAM role to instance it start?

We would like our bamboo-agent elastic instance to access a non-public S3 bucket; it is possible to control this using the IP address but it needs to be done again each time an instance is started.

If all instances could start up with a certain IAM role, it would then be easy to give this role access to the bucket.

5 answers

1 accepted

0 votes
Answer accepted

No, not at the moment. This feature should be available with 5.3 .

Is this the case now?

The agent config has an option for "IAM Instance Profile" which seems like it will do the job.

I am facing the same issue when I try to assign an IAM to Bamboo. I don't want to use an IAM with full permission on Bamboo. I want to allow Bamboo to start new instance and terminate only the instance it starts. So I create a IAM role "bamboo" with EC2 permission, the policy is like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:CreateCluster",
                "ecs:DeregisterContainerInstance",
                "ecs:DiscoverPollEndpoint",
                "ecs:Poll",
                "ecs:RegisterContainerInstance",
                "ecs:Submit*"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

Then I create an IAM user with following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ec2:Describe*",
                "iam:Get*",
                "iam:List*",
                "ec2:CreateTags"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::XXXXX:role/bamboo"
        },
        {
            "Sid": "AllowInstanceActions",
            "Effect": "Allow",
            "Action": [
                "ec2:RebootInstances",
                "ec2:StopInstances",
                "ec2:TerminateInstances",
                "ec2:StartInstances"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:InstanceProfile": "arn:aws:iam::XXXXX:instance-profile/bamboo"
                }
            },
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "EC2RunInstances",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:InstanceProfile": "arn:aws:iam::XXXXX:instance-profile/bamboo"
                }
            },
            "Resource": [
                "arn:aws:ec2:*:*:instance/*"
            ]
        },
        {
            "Sid": "RemainingRunInstancePermissions",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:volume/*",
                "arn:aws:ec2:*::image/ami-*",
                "arn:aws:ec2:*:*:subnet/*",
                "arn:aws:ec2:*:*:network-interface/*",
                "arn:aws:ec2:*:*:key-pair/*",
                "arn:aws:ec2:*:*:security-group/*"
            ]
        }
    ]
}

What it does is to allow user to create EC2 instance with the "bamboo" profile and only terminate instance with this profile.

 

This works perfectly fine and I login to AWS console as the user and launch the EC2 instance manually. However, it doesn't work when I set the IAM access in Bamboo and set IAM instance profile with the role.

 

I am not sure what is wrong here. Does anyone have set up Bamboo with restricted IAM permission successfully?

I am experiencing similar issues trying to configure it through the GUI. I've created an IAM role through the AWS Console and am just sticking the generated instance profile name (e.g. "bamboo") into the Image Configuration screen. Any guidance on debugging this issue?

Hi Simon, I have to give up on this. After talking to both Bamboo and AWS supports, it doesn't seem to be an existing solution which can do the job. Bamboo doesn't seem to care about supporting AWS user role properly even though there have been so many requests since 2013. I ended up using a separate AWS account just for Bamboo.

5.6 is out and we still don't have support for IAM Roles. Any news on that?

Are you sure? Check the image configuration page.

Count my vote here too, this would be insanely handy

It got delayed, but now the feature is implemented and available on the branch scheduled for 5.6.

Suggest an answer

Log in or Sign up to answer
TAGS

Atlassian Community Events