如何从另一个实例创建ec2实例？ Boto Awscli

Question

I'm looking to create an AWS system with one master EC2 instance which can create other instances.

For now, I managed to create python files with boto able to create ec2 instances. The script works fine in my computer environment but when I try to deploy it using Amazon BeanStalk with Django (Python 3.4 included) the script doesn't work. I can't configure aws cli (and so Boto) through SSL because the only user I can access is ec2-user and the web server uses another user.

I could simply handwrite my access ID key and password on the python file but that would not be secure. What can I do to solve this problem?

I also discovered AWS cloudformation today, is it a better idea to create new instances with that rather than with the boto function run?

Answer 1

This sounds like an AWS credentials question, not specifically a "create ec2 instances" question. The answer is to assign the appropriate AWS permissions to the EC2 instance via an IAM role. Then your boto/boto3 code and/or the AWS CLI running on that instance will have permissions to make the necessary AWS API calls without having an access key and secret key stored in your code.