Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

Assign IAM role to Bamboo instances?

Is it possible for Bamboo to assign an IAM role to instance it start?

We would like our bamboo-agent elastic instance to access a non-public S3 bucket; it is possible to control this using the IP address but it needs to be done again each time an instance is started.

If all instances could start up with a certain IAM role, it would then be easy to give this role access to the bucket.

5 answers

1 accepted

0 votes
Answer accepted

No, not at the moment. This feature should be available with 5.3 .

Is this the case now?

Count my vote here too, this would be insanely handy

It got delayed, but now the feature is implemented and available on the branch scheduled for 5.6.

5.6 is out and we still don't have support for IAM Roles. Any news on that?

Are you sure? Check the image configuration page.

I am facing the same issue when I try to assign an IAM to Bamboo. I don't want to use an IAM with full permission on Bamboo. I want to allow Bamboo to start new instance and terminate only the instance it starts. So I create a IAM role "bamboo" with EC2 permission, the policy is like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:CreateCluster",
                "ecs:DeregisterContainerInstance",
                "ecs:DiscoverPollEndpoint",
                "ecs:Poll",
                "ecs:RegisterContainerInstance",
                "ecs:Submit*"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

Then I create an IAM user with following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ec2:Describe*",
                "iam:Get*",
                "iam:List*",
                "ec2:CreateTags"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::XXXXX:role/bamboo"
        },
        {
            "Sid": "AllowInstanceActions",
            "Effect": "Allow",
            "Action": [
                "ec2:RebootInstances",
                "ec2:StopInstances",
                "ec2:TerminateInstances",
                "ec2:StartInstances"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:InstanceProfile": "arn:aws:iam::XXXXX:instance-profile/bamboo"
                }
            },
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "EC2RunInstances",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:InstanceProfile": "arn:aws:iam::XXXXX:instance-profile/bamboo"
                }
            },
            "Resource": [
                "arn:aws:ec2:*:*:instance/*"
            ]
        },
        {
            "Sid": "RemainingRunInstancePermissions",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:volume/*",
                "arn:aws:ec2:*::image/ami-*",
                "arn:aws:ec2:*:*:subnet/*",
                "arn:aws:ec2:*:*:network-interface/*",
                "arn:aws:ec2:*:*:key-pair/*",
                "arn:aws:ec2:*:*:security-group/*"
            ]
        }
    ]
}

What it does is to allow user to create EC2 instance with the "bamboo" profile and only terminate instance with this profile.

 

This works perfectly fine and I login to AWS console as the user and launch the EC2 instance manually. However, it doesn't work when I set the IAM access in Bamboo and set IAM instance profile with the role.

 

I am not sure what is wrong here. Does anyone have set up Bamboo with restricted IAM permission successfully?

I am experiencing similar issues trying to configure it through the GUI. I've created an IAM role through the AWS Console and am just sticking the generated instance profile name (e.g. "bamboo") into the Image Configuration screen. Any guidance on debugging this issue?

Hi Simon, I have to give up on this. After talking to both Bamboo and AWS supports, it doesn't seem to be an existing solution which can do the job. Bamboo doesn't seem to care about supporting AWS user role properly even though there have been so many requests since 2013. I ended up using a separate AWS account just for Bamboo.

The agent config has an option for "IAM Instance Profile" which seems like it will do the job.

Suggest an answer

Log in or Sign up to answer
TAGS
Community showcase
Published in Bamboo

Bamboo 7.1 is here and is packed with value!

I'm happy to announce that Bamboo 7.1 has been released and it’s overflowing with awesome new features. Top-voted issues First and foremost, a bunch of JAC top voted issues has been delivered - y...

653 views 1 6
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you