Running PowerShell Script during server startup when using Amazon Toolkit for Visual Studio

Question

I am using the standard "Publish to AWS Elastic Beanstalk ..." feature provided by the AWS Toolkit extension for Visual Studio , however I also need to deploy a credential file to the root of the C: directory for proper access to the S3 API.

If I simply remote into the instance and add the file, then it will only last until Amazon recycles the cloud instance and then spawns a new one to replace it, meaning that the application is broken until I remote into the new instance and make a new file.

It would be nice to have the server automatically run a PowerShell script that handles this and other configuration tasks either when the server instance is created or when it starts up. Is there a way that this can be set up by using the AWS Toolkit? I was able to find documentation that seemed relevant, but I couldn't figure out how to get it to work with the VS extension that I'm using:

http://docs.aws.amazon.com/toolkit-for-visual-studio/latest/user-guide/deployment-beanstalk-custom.html

Or maybe I'm on the wrong path, and I need to make a custom AMI for this?

Answer 1

For EC2 instances, don't add a credentials file. Instead use an IAM Role.

An IAM role is a policy that defines permissions, just like an IAM user, but for Amazon services such as EC2. You attach the role to the instance.

Amazon tools, SDKs, etc. will autmatically find the credentials from the metadata for the EC2 instance.

The AWS Management Console has a number of predefined policies that you can add to your role. This makes creating a role very easy.

With a role assign to your EC2 instances in Beanstalk, when a new instance is created the credentials from the role will be available. No need to publish a credentials file.

This is also the official recommended method to assign permissions to EC2 instances.

Blog: IAM roles for EC2 instances

User Guide: IAM roles for EC2 instances