How to tag and name the EC2 Instance that was launched by an EC2 Spot Request

amazon ec2amazon-web-services

I have a couple of EC2 Spot Requests that launch EC2 Instances when the price is right. I'd like the resulting instances to get tagged with a Name and Role tag so my configuration management tool knows what type of machine it is.

UPDATE:

I took Hyper Anthony's advice and implemented it — because polling was going to be error-prone and resource-intensive I added a startup script to my AMI which updates the tags when an instance launches, these are the steps I took:

Ensure Boto is installed on whatever AMI you're using

pip install boto

Assign an IAM Role to the EC2 Instance

The instance you're launching must have some way to access information about the spot request. Use an IAM role or alternatively make access keys available to your instance. The policy that I attached to the IAM role that I used is:

{
    "Statement": [
        {
            "Action": [
                "ec2:CreateTags",
                "ec2:DescribeTags",
                "ec2:DescribeInstances"
            ],
            "Effect": "Allow",
            "Resource": [
                "*"
            ],
            "Sid": "Stmt1432737176000"
        }
    ],
    "Version": "2012-10-17"
}

Run a script on startup to update the tags

def get_tags_from_spot_request():

    instance_id = boto.utils.get_instance_identity()['document']['instanceId']
    region = boto.utils.get_instance_identity()['document']['region']
    conn = boto.ec2.connect_to_region(region)
    inst = boto.ec2.instance.Instance(connection=conn)
    inst.id = instance_id
    inst.update()
    spot_id = inst.spot_instance_request_id
    tags = conn.get_all_tags(filters={'resource-type': 'spot-instances-request', 'resource-id': spot_id})
    for tag in tags:
        inst.add_tag(tag.name, tag.value)

Best Answer

Spot instances requests are a type of EC2 resource. The AWS documentation notes that this type of resource can be tagged, but the resulting tags are not carried over to the actual instances:

The tags that you create for your Spot Instance requests only apply to the requests. These tags are not added automatically to the Spot Instance that the Spot service launches to fulfill the request. You must add tags to a Spot Instance yourself when you create the Spot Instance request or after the Spot Instance is launched.

So you'll need to add the tags after the instances have launched. You have some options here:

User Data Script on the created instance: Write a user data script that uses command line tools and the EC2 meta data service to allow the instance to discover its instance Id and create tags for itself. You can use the AWS CLI create-tags to tag any of your EC2 resources. Alternatively, you could bake this into the AMI as a startup script for whatever OS you intend to use. In either situation, the instance will have to have sufficient permissions to create EC2 tags for itself.
External Utility that monitors your spot request: You can use one of the AWS SDKs to monitor your spot request and tag the instances once they have been created. AWS has a tutorial on this very topic under the "How to Tag Your Spot Requests and Instances" header. Without getting too verbose, this simply involves polling Describe Spot Instance Requests until a created Instance Id is available, and then calling Create Tags.

Update

Mike Pope has published a nice article about Granting Permission to Launch EC2 Instances with IAM Roles (PassRole Permission) on the AWS Security Blog, which explains the subject matter from an AWS point of view.

Initial Answer

Skaperen's answer is partially correct (+1), but slightly imprecise/misleading as follows (the explanation seems a bit too complex for a comment, hence this separate answer):

To launch an EC2 instance with an IAM role requires administrative access to the IAM facility.

This is correct as such and points towards the underlying problem, but the required administrative permissions are rather limited, so the following conclusion ...

Because IAM roles grant permissions, there is clearly a security issue to be addressed. You would not want IAM roles being a means to allow permission escalation.

... is a bit misleading, insofar the potential security issue can be properly addressed. The subject matter is addressed in Granting Applications that Run on Amazon EC2 Instances Access to AWS Resources:

You can use IAM roles to manage credentials for applications that run on Amazon EC2 instances. When you use roles, you don't have to distribute AWS credentials to Amazon EC2 instances. Instead, you can create a role with the permissions that applications will need when they run on Amazon EC2 and make calls to other AWS resources. When developers launch an Amazon EC2 instance, they can specify the role you created to associate with the instance. Applications that run on the instance can then use the role credentials to sign requests.

Now, within the use case at hand the mentioned developers [that] launch an Amazon EC2 instance are in fact EC2 instances themselves, which appears to yield the catch 22 security issue Skaperen outlined. That's not really the case though as illustrated by the sample policy in section Permissions Required for Using Roles with Amazon EC2 :

{
   "Version": "2012-10-17",
   "Statement": [{
      "Effect":"Allow",
      "Action":"iam:PassRole",
      "Resource":"*"
    },
    {
      "Effect":"Allow",
      "Action":"iam:ListInstanceProfiles",
      "Resource":"*"
    },
    {
      "Effect":"Allow",
      "Action":"ec2:*",
      "Resource":"*"
    }]
}

So iam:PassRole is in fact the only IAM permission required, and while technically of administrative nature, this isn't that far reaching - of course, the sample policy above would still allow to escalate permissions by means of listing and in turn passing any available role, but this can be prevented by specifying only those roles that are desired/safe to pass for the use case at hand - this is outlined in section Restricting Which Roles Can Be Passed to Amazon EC2 Instances (Using PassRole):

You can use the PassRole permission to prevent users from passing a role to Amazon EC2 that has more permissions than the user has already been granted, and then running applications under the elevated privileges for that role. In the role policy, allow the PassRole action and specify a resource (such as arn:aws:iam::111122223333:role/ec2Roles/*) to indicate that only a specific role or set of roles can be passed to an Amazon EC2 instance.

The respective sample policy illustrates exactly matches the use case at hand, i.e. grants permission to launch an instance with a role by using the Amazon EC2 API:

{
  "Version": "2012-10-17",
  "Statement": [{
      "Effect":"Allow",
      "Action":"ec2:RunInstances",
      "Resource":"*"
    },
    {
      "Effect":"Allow",
      "Action":"iam:PassRole",
      "Resource":"arn:aws:iam::123456789012:role/Get-pics"
    }]
}

Ensure Boto is installed on whatever AMI you're using

Assign an IAM Role to the EC2 Instance

Run a script on startup to update the tags

Best Answer

Related Solutions

How to move a Windows instance to a different EC2 data centre

How to Specify an IAM Role for an Amazon EC2 Instance via AWS CLI

Update

Initial Answer

Related Topic