Add the SSMManagedInstanceCore policy to all EC2 resources#203
Conversation
…tiple CloudFormation templates
Add AvailabilityZone parameter to multiple CloudFormation templates
Add AvailabilityZone parameter to multiple EC2 CloudFormation templates
…ther is installed
…22.0_b1 in docker-compose.yml
…r.sh for improved Docker Swarm initialization
Added kms:Decrypt permission to RGPortalRole
…ll EC2 instance templates
WalkthroughThis update introduces widespread enhancements to AWS infrastructure provisioning scripts and CloudFormation templates. Key changes include enforcing IMDSv2 for EC2 metadata retrieval, adding explicit Availability Zone selection for EC2 resources, tightening IAM permissions, improving S3 bucket security with encryption and logging, updating Docker and MongoDB provisioning to newer and more secure methods, and expanding documentation for AMI creation. Several scripts and templates now support more secure and auditable deployments. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant CloudFormation
participant EC2Instance
participant IMDS
participant SSM
User->>CloudFormation: Deploy stack with AvailabilityZone, IAMRole, UserData
CloudFormation->>EC2Instance: Launch with UserData script and IAMRole
EC2Instance->>IMDS: Request IMDSv2 token (PUT /latest/api/token)
IMDS-->>EC2Instance: Return token
EC2Instance->>IMDS: Request metadata (GET /latest/meta-data/..., with token)
IMDS-->>EC2Instance: Return metadata (region, instance-id, etc.)
EC2Instance->>SSM: Store parameter (e.g., auth token) using fetched metadata
sequenceDiagram
participant User
participant CloudFormation
participant S3Bucket
participant KMS
participant LoggingBucket
User->>CloudFormation: Deploy stack with S3 and logging parameters
CloudFormation->>KMS: Create KMS keys for S3 and logs
CloudFormation->>LoggingBucket: Create S3 bucket for access logs (KMS-encrypted)
CloudFormation->>S3Bucket: Create main S3 bucket (KMS-encrypted, logging enabled, public access blocked)
CloudFormation->>S3Bucket: Attach bucket policy enforcing TLS 1.2+
Poem
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 19
🔭 Outside diff range comments (2)
cft-templates/ec2-jupyterLab.yml (1)
215-220: Duplicate BlockDeviceMappings property will invalidate the stack.
BlockDeviceMappingsis defined twice (lines 206-210 and 216-220). CloudFormation allows only one; the latter will silently overwrite the first, but this is brittle and confusing.Consolidate into a single section that uses
!Ref EBSVolumeSize.- BlockDeviceMappings: - - DeviceName: /dev/xvda - Ebs: - VolumeSize: 32 - Encrypted: false ... - BlockDeviceMappings: + BlockDeviceMappings: - DeviceName: /dev/xvda Ebs: VolumeSize: !Ref EBSVolumeSize Encrypted: truecft-templates/ec2-vscode.yml (1)
202-215: Remove the secondBlockDeviceMappingskey – duplicate YAML keys are invalid
BlockDeviceMappingsis declared twice (L202–206 and L211–215). Most YAML parsers – including CloudFormation’s – treat duplicate keys as an error, so the stack will fail to launch.Pick one mapping block and delete the other, e.g.:
- BlockDeviceMappings: - - DeviceName: /dev/xvda - Ebs: - VolumeSize: 32 - Encrypted: false ... BlockDeviceMappings: - DeviceName: /dev/xvda Ebs: VolumeSize: !Ref EBSVolumeSize Encrypted: true
♻️ Duplicate comments (1)
docker-compose.yml (1)
45-46: Repeat the digest pinning forscheduler-3102Same concern as above: tag-only reference can silently change. Pin to the exact digest.
🧹 Nitpick comments (21)
docker-compose.yml (1)
20-66: Consider adding healthchecks & resource limitsWhile unrelated to the image switch, these services currently have no
healthcheck,deploy.resources.limits, orrestartpolicies. Adding them will improve observability and resiliency, especially now that the images are changing.scripts/connect-db.sh (1)
36-47: Harden the connection logic & align TLS flags withmongoshexpectations
mongoshnow prefers--tls/--tlsCAFileflags; continuing to pass--sslworks but emits deprecation warnings.- The script does not
set -euo pipefail, so silent failures (e.g. a missing CA file) will fall through to themongoblock or exit with an unclear error.- Connection command duplication can be reduced.
+# Fail fast and surface unexpected variables +set -euo pipefail + if command -v mongosh >/dev/null 2>&1; then echo "Using mongosh to connect..." - mongosh --ssl --host "$mydocdburl:27017" --sslCAFile "$RG_HOME/config/rds-combined-ca-bundle.pem" \ - --username "$mydbuser" --password "$mydbuserpwd" + mongosh --tls --host "$mydocdburl:27017" \ + --tlsCAFile "$RG_HOME/config/rds-combined-ca-bundle.pem" \ + --username "$mydbuser" --password "$mydbuserpwd" elif command -v mongo >/dev/null 2>&1; then echo "Using mongo to connect..." mongo --ssl --host "$mydocdburl:27017" --sslCAFile "$RG_HOME/config/rds-combined-ca-bundle.pem" \ --username "$mydbuser" --password "$mydbuserpwd"This keeps the script future-proof and makes failures explicit.
cft-templates/ec2-linux-docker.yml (1)
150-150: Trailing-space removalMinor formatting fix – thanks for the cleanup.
cft-templates/ec2-linux-docker-mysql.yml (1)
189-189: Removed trailing whitespacePurely cosmetic; appreciated.
scripts/swarm_init.sh (1)
4-8: IP-address detection can return the docker bridge or 127.0.0.1
ip route get 1is brittle on hosts with multiple routes (VPNs, docker0, etc.).
Considerhostname -I | awk '{print $1}'as a fallback, or allow the caller to override withSWARM_IP.cft-templates/igv.yml (1)
187-196: Trailing spaces + token error handlingSame whitespace issue flagged by YAMLlint and the potential empty-token problem noted in
vpc-squid.yml. Consider adopting the hardened snippet shown earlier.cft-templates/s3.yml (2)
24-29: Condition syntax is correct, but readability can be improvedMinor: the long-form intrinsics are verbose; consider
!Not [ !Equals [ !Ref AccessLoggingBucketName, "" ] ]for brevity.
58-85: Duplicate TLS policiesStatements
EnforceTLS12andEnforceTLS12OrHigheroverlap.
One denies all insecure transport; the other denies TLS < 1.2. Keeping just the second is sufficient.cft-templates/ec2-EIP.yml (1)
48-50: Strip trailing whitespace to satisfy YAML lint and avoid noisy CI failures.- AvailabilityZone: - Description: Select the availability zone in which to create the instance. If you plan to attach a secondary volume to the instance, create this instance in the same AvailabilityZone as the volume you created. - Type: AWS::EC2::AvailabilityZone::Name + AvailabilityZone: + Description: Select the availability zone in which to create the instance. If you plan to attach a secondary volume to the instance, create this instance in the same AvailabilityZone as the volume you created. + Type: AWS::EC2::AvailabilityZone::Namecft-templates/ec2-jupyterLab.yml (2)
40-43: Fix trailing spaces in new parameter block.Identical to the EIP template, a couple of spaces at EOL will fail YAML lint.
- Type: AWS::EC2::AvailabilityZone::Name + Type: AWS::EC2::AvailabilityZone::Name
286-288: Trailing spaces – same lint failure as above.rg_deploy_bucket.yml (2)
110-129: Minor: two separate TLS-enforcement statements are redundant.
EnforceTLS12(SecureTransport == false) already blocks plain HTTP.
EnforceTLS12OrHigherthen blocks TLS < 1.2. They can be merged, but the duplication is harmless if readability is the goal.
114-124: YAML-lint trailing-space warningsLines 114 and 124 have trailing spaces; clean them to keep pipelines green.
provisioners/provision-mongo.sh (1)
12-12: Consider the implications of removing version pinning.The removal of explicit version pinning (
mongodb-org=4.4.29) means the latest available version will be installed, which could lead to inconsistencies across deployments if the repository is updated.Consider pinning to a specific MongoDB 8.0 version for consistency:
-sudo apt-get install -y mongodb-org +sudo apt-get install -y mongodb-org=8.0.3provisioners/provision-docker.sh (1)
18-18: Consider re-adding the user to thedockergroupYou dropped the previously‐present
usermod -aG docker ubuntuline. Without it the default SSH user will have tosudoevery Docker command, which breaks several downstream scripts that assume password-less access.
If this was intentional for stricter hardening, document the change and audit all scripts that invokedockeras an unprivileged user.rg_AMI-creation.md (1)
1-84: Minor markdown & grammar nitsSeveral headings have trailing punctuation and many lines miss terminal periods or have double spaces. Run
markdownlint+prettierto clean up; content is otherwise clear.cft-templates/Rstudio.yml (1)
130-134: Trailing whitespaceLines 130 and 134 have trailing spaces, causing
yamllinterrors. Strip them to keep the template lint-clean.cft-templates/ec2-vscode.yml (1)
23-27: Strip trailing whitespaceYAML-lint flags L23 & L26. Harmless but easy to clean and keeps VCS churn low.
cft-templates/ec2-dcv.yml (2)
226-236: Echo uses wrong variable & possible empty regionThe IMDS call stores the region in
region, but the echo on L231 references${region}correctly while later the script uses$regionagain – fine.
However, add aset -euo pipefailor explicit check to abort if$TOKENor$regionis empty; otherwise the subsequentaws ssm put-parametermay silently hit the default region.
27-32: Trailing comma in YAML flow-style listThe
AllowedValuesflow list ends witht3.xlarge,(L30-31). Many YAML parsers allow it, but CloudFormation’s can be picky. Safer to drop the comma.cft-templates/ec2-winsecure-desktop.yml (1)
46-47: Trailing comma in flow listThe final comma after
t3.xlargecan trip CloudFormation’s YAML loader. Remove it for safety.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (37)
SRE/Network-CFTS/vpc-squid.yml(1 hunks)cft-templates/Rstudio.yml(6 hunks)cft-templates/ec2-EIP.yml(4 hunks)cft-templates/ec2-dcv.yml(5 hunks)cft-templates/ec2-jupyterLab.yml(5 hunks)cft-templates/ec2-linux-docker-mysql.yml(2 hunks)cft-templates/ec2-linux-docker.yml(2 hunks)cft-templates/ec2-secure-desktop.yml(5 hunks)cft-templates/ec2-ubuntu.yml(2 hunks)cft-templates/ec2-vscode.yml(5 hunks)cft-templates/ec2-winsecure-desktop.yml(5 hunks)cft-templates/igv.yml(2 hunks)cft-templates/s3.yml(2 hunks)docker-compose.yml(4 hunks)dump/standardcatalogitems.json(1 hunks)packer-rg.json(4 hunks)products/Nextflow-Advanced/machine-images/config/infra/files/nextflow/set-token(1 hunks)products/ec2-secure-windows/set_user_token.bat(1 hunks)provisioners/provision-awscli.sh(1 hunks)provisioners/provision-cfn-helper.sh(1 hunks)provisioners/provision-docker.sh(1 hunks)provisioners/provision-mongo.sh(1 hunks)provisioners/provision-rg.sh(1 hunks)rg_AMI-creation.md(1 hunks)rg_deploy_bucket.yml(1 hunks)rg_document_db.yml(2 hunks)rg_main_stack.yml(2 hunks)rg_userpool.yml(1 hunks)scripts/connect-db.sh(1 hunks)scripts/create_rg_admin_user.sh(1 hunks)scripts/fixconfigs.sh(1 hunks)scripts/fixdocdb.sh(1 hunks)scripts/fixmongo.sh(3 hunks)scripts/import_bulk_users.sh(1 hunks)scripts/start_server.sh(3 hunks)scripts/swarm_init.sh(1 hunks)updatescripts.sh(1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
rg_document_db.yml
[error] 81-81: trailing spaces
(trailing-spaces)
[error] 98-98: trailing spaces
(trailing-spaces)
cft-templates/ec2-EIP.yml
[error] 50-50: trailing spaces
(trailing-spaces)
cft-templates/s3.yml
[error] 22-22: trailing spaces
(trailing-spaces)
[error] 24-24: trailing spaces
(trailing-spaces)
[error] 61-61: trailing spaces
(trailing-spaces)
SRE/Network-CFTS/vpc-squid.yml
[error] 318-318: trailing spaces
(trailing-spaces)
[error] 322-322: trailing spaces
(trailing-spaces)
cft-templates/ec2-jupyterLab.yml
[error] 42-42: trailing spaces
(trailing-spaces)
[error] 170-170: trailing spaces
(trailing-spaces)
[error] 174-174: trailing spaces
(trailing-spaces)
rg_main_stack.yml
[error] 138-138: trailing spaces
(trailing-spaces)
[error] 148-148: trailing spaces
(trailing-spaces)
[error] 164-164: trailing spaces
(trailing-spaces)
[error] 169-169: trailing spaces
(trailing-spaces)
[warning] 177-177: wrong indentation: expected 6 but found 8
(indentation)
[error] 180-180: trailing spaces
(trailing-spaces)
cft-templates/ec2-vscode.yml
[error] 23-23: trailing spaces
(trailing-spaces)
[error] 26-26: trailing spaces
(trailing-spaces)
[error] 173-173: trailing spaces
(trailing-spaces)
[error] 177-177: trailing spaces
(trailing-spaces)
cft-templates/ec2-dcv.yml
[error] 52-52: trailing spaces
(trailing-spaces)
[error] 228-228: trailing spaces
(trailing-spaces)
[error] 232-232: trailing spaces
(trailing-spaces)
cft-templates/igv.yml
[error] 189-189: trailing spaces
(trailing-spaces)
[error] 193-193: trailing spaces
(trailing-spaces)
rg_deploy_bucket.yml
[error] 114-114: trailing spaces
(trailing-spaces)
[error] 124-124: trailing spaces
(trailing-spaces)
cft-templates/ec2-secure-desktop.yml
[error] 317-317: trailing spaces
(trailing-spaces)
[error] 321-321: trailing spaces
(trailing-spaces)
[error] 325-325: trailing spaces
(trailing-spaces)
[error] 407-407: trailing spaces
(trailing-spaces)
[error] 501-501: trailing spaces
(trailing-spaces)
cft-templates/Rstudio.yml
[error] 42-42: trailing spaces
(trailing-spaces)
[error] 130-130: trailing spaces
(trailing-spaces)
[error] 134-134: trailing spaces
(trailing-spaces)
cft-templates/ec2-winsecure-desktop.yml
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 190-190: trailing spaces
(trailing-spaces)
[error] 223-223: trailing spaces
(trailing-spaces)
[error] 226-226: trailing spaces
(trailing-spaces)
[error] 254-254: trailing spaces
(trailing-spaces)
[error] 258-258: trailing spaces
(trailing-spaces)
[error] 261-261: trailing spaces
(trailing-spaces)
[error] 279-279: trailing spaces
(trailing-spaces)
[error] 280-280: trailing spaces
(trailing-spaces)
[error] 288-288: trailing spaces
(trailing-spaces)
[error] 354-354: trailing spaces
(trailing-spaces)
🪛 LanguageTool
rg_AMI-creation.md
[grammar] ~1-~1: Use proper spacing conventions.
Context: # Creating the AMI with Pre-Requisites Follow these steps to create an AMI with...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~3-~3: There might be a problem here.
Context: ...ollow these steps to create an AMI with pre-requisites: ## 1. Install Packer - Refer to the [Packe...
(QB_NEW_EN_MERGED_MATCH)
[grammar] ~5-~5: Place a period at the end of declarative sentences.
Context: ...th pre-requisites: ## 1. Install Packer - Refer to the [Packer Installation Guide]...
(QB_NEW_EN_OTHER_ERROR_IDS_000178)
[grammar] ~7-~7: Use proper spacing conventions.
Context: ...torials/packer/get-started-install-cli). - For Amazon Linux 2023 (AWS CloudShell): ...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~8-~8: Use proper spacing conventions.
Context: ... For Amazon Linux 2023 (AWS CloudShell): bash sudo yum install -y yum-utils sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/AmazonLinux/hashicorp.repo sudo yum -y install packer ## 2. Install the Amazon Plugin for Packer ...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~15-~15: Place a period at the end of declarative sentences.
Context: ... 2. Install the Amazon Plugin for Packer 1. Create a Packer Configuration File: ...
(QB_NEW_EN_OTHER_ERROR_IDS_000178)
[grammar] ~17-~17: There might be a mistake here.
Context: ... Create a Packer Configuration File: Create a file named `packer-config.pkr....
(QB_NEW_EN_OTHER)
[grammar] ~18-~18: Use proper spacing conventions.
Context: ...fig.pkr.hcl` with the following content: hcl packer { required_plugins { amazon = { version = ">= 1.3.3" source = "github.com/hashicorp/amazon" } } } 2. Run Packer Initialization: Use the ...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~30-~30: There might be a mistake here.
Context: ... ``` 2. Run Packer Initialization: Use the following command to download a...
(QB_NEW_EN_OTHER)
[grammar] ~31-~31: Use proper spacing conventions.
Context: ... download and install the Amazon plugin: bash packer init packer-config.pkr.hcl ## 3. Export AWS Credentials Set your AWS ...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~36-~36: Use proper spacing conventions.
Context: ...hcl ``` ## 3. Export AWS Credentials Set your AWS credentials and region as e...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~38-~38: Use proper spacing conventions.
Context: ...als and region as environment variables: bash export AWS_ACCESS_KEY_ID="your_Access_Key" export AWS_SECRET_ACCESS_KEY="your_Secret_Key" export AWS_DEFAULT_REGION="Your_Region" ## 4. Clone the Repository Clone the requi...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~45-~45: Use proper spacing conventions.
Context: ..._Region" ``` ## 4. Clone the Repository Clone the required repository to your lo...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~47-~47: Use proper spacing conventions.
Context: ...to your local machine or AWS CloudShell. ## 5. Grant Permissions for Target Account ...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~49-~49: Use proper spacing conventions.
Context: ... 5. Grant Permissions for Target Account - Ensure the target account number is adde...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~51-~51: Use proper spacing conventions.
Context: ...with permissions to access image builds. ## 6. Create an IAM Role for ECR and EC2 Ac...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~53-~53: Use proper spacing conventions.
Context: ...eate an IAM Role for ECR and EC2 Actions 1. Create a Role: - Create a role and ...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~56-~56: Use proper spacing conventions.
Context: ...a policy permitting ECR and EC2 actions. 2. Update the packer-rg.json File: -...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~59-~59: Use proper spacing conventions.
Context: ...he builders section with your role name. ## 7. Build the AMI Run the following comm...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~61-~61: Place a period at the end of declarative sentences.
Context: ...ith your role name. ## 7. Build the AMI Run the following command to build the A...
(QB_NEW_EN_OTHER_ERROR_IDS_000178)
[grammar] ~63-~63: Use proper spacing conventions.
Context: ... the following command to build the AMI: bash packer build -var 'awsRegion=your_region' -var 'vpcId=your_VPCID' -var 'subnetId=your_SubnetID' packer-rg.json ### Runtime Variables: - Pass the following ...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~69-~69: Use proper spacing conventions.
Context: ...Pass the following variables at runtime: - VPCID - SubnetID - AWSRegion ## 8. Retrieve the AMI ID After the build ...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~74-~74: Place a period at the end of declarative sentences.
Context: ...- AWSRegion ## 8. Retrieve the AMI ID After the build completes successfully, ...
(QB_NEW_EN_OTHER_ERROR_IDS_000178)
[grammar] ~76-~76: Use proper spacing conventions.
Context: ...sfully, note the AMI ID from the output. --- ### Notes - Ensure all variables and IAM ro...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~80-~80: Use proper spacing conventions.
Context: ... AMI ID from the output. --- ### Notes - Ensure all variables and IAM roles are c...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~82-~82: Use proper spacing conventions.
Context: ...tly configured before running the build. - For further details, refer to the reposi...
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
[grammar] ~83-~83: Use proper spacing conventions.
Context: ...umentation](https://www.packer.io/docs).
(QB_NEW_EN_OTHER_ERROR_IDS_000007)
🪛 markdownlint-cli2 (0.17.2)
rg_AMI-creation.md
68-68: Trailing punctuation in heading
Punctuation: ':'
(MD026, no-trailing-punctuation)
🔇 Additional comments (38)
cft-templates/ec2-ubuntu.yml (2)
69-70: SSM policy addition looks goodAttaching
AmazonSSMManagedInstanceCoreenables Session Manager without widening the role’s permissions beyond the managed policy.
143-143: Whitespace tidy-up acknowledgedNo functional impact; keeps the template clean.
cft-templates/ec2-linux-docker.yml (1)
67-68: SSM policy correctly attachedMatches the PR objective and is consistent with other templates.
rg_document_db.yml (1)
79-82: Egress “allow all” may violate least-privilege principleSecurity groups default to
0.0.0.0/0egress; explicitly declaring it is fine but still permits any outbound traffic—including from the VPCE SG—which may be broader than necessary. Consider locking down to the specific AWS service CIDRs (DocumentDB endpoints, Secrets Manager, etc.) or to the VPC CIDR to minimise lateral movement.Also, YAML-lint flags trailing spaces on lines 81 & 98—worth trimming to keep CI happy.
Also applies to: 96-98
cft-templates/ec2-linux-docker-mysql.yml (1)
81-82: SSM managed policy addition approvedConsistent with other stacks; no further action required.
cft-templates/igv.yml (1)
107-109: 👍 AddedAmazonSSMManagedInstanceCore– good moveThis managed policy is the recommended way to enable SSM agent features; no issues spotted.
cft-templates/s3.yml (1)
51-56: LoggingConfiguration object formatting is validJust a quick confirmation: the
Fn::Ifreturns an object vsAWS::NoValue; CloudFormation accepts this pattern. 👍dump/standardcatalogitems.json (1)
8-8: Confirm downstream references to the renamed template file.Changing the extension from
s3.yamltos3.ymlis harmless here, but any automation, documentation, or code that still hard-codes the old name will now break.Run a quick grep across the repo and update links / references accordingly.
cft-templates/ec2-EIP.yml (1)
70-72: 👍 Managed policy addition looks correct.Attaching AmazonSSMManagedInstanceCore is the right way to enable Session Manager and aligns with the PR objective.
cft-templates/ec2-jupyterLab.yml (1)
62-64: SSM managed policy addition LGTM.provisioners/provision-rg.sh (1)
15-16: Swarm reset is not idempotent and diverges from PR summary.
docker swarm leave --forcewill exit non-zero when the node is not part of a swarm, potentially breaking re-runs.
Also, the AI summary mentions a switch to an externalswarm_init.sh, but that file is not invoked here—possible drift.Consider:
docker info --format '{{ .Swarm.LocalNodeState }}' | grep -q active && docker swarm leave --force || true docker swarm init --default-addr-pool 172.20.0.0/16to make the step repeat-safe and verify that the intended helper script path is correct.
Likely an incorrect or invalid review comment.
updatescripts.sh (1)
82-85: LGTM! Consistent pattern for script updates.The addition of
swarm_init.shto the update process follows the same pattern as other scripts in the file, maintaining consistency in the update mechanism.scripts/create_rg_admin_user.sh (1)
42-47: Excellent security improvement with IMDSv2 migration.The migration from IMDSv1 to IMDSv2 for metadata service calls enhances security by requiring token authentication. The implementation correctly obtains a session token first, then uses it for the metadata request.
scripts/import_bulk_users.sh (1)
56-57: Security improvement with IMDSv2 migration.The migration to IMDSv2 for metadata service calls enhances security. The implementation correctly uses token authentication and maintains the existing test mode logic.
scripts/fixdocdb.sh (1)
23-25: Security enhancement with IMDSv2 implementation.The migration to IMDSv2 for metadata service calls improves security by requiring token authentication. The implementation correctly retrieves the session token first, then uses it to fetch the local IPv4 address.
scripts/start_server.sh (4)
31-32: Good implementation of IMDSv2 token authentication.The script correctly implements IMDSv2 by fetching a session token and using it for secure metadata retrieval. The token TTL of 21600 seconds (6 hours) is appropriate for the script's execution time.
36-36: Consistent token usage for metadata retrieval.The script properly reuses the token from line 31 for secure metadata access, maintaining consistency with the IMDSv2 implementation.
45-45: Efficient token reuse for instance ID retrieval.Good practice reusing the existing token for subsequent metadata calls instead of creating a new one.
50-50: Good architectural improvement with external swarm initialization.Delegating Docker swarm initialization to a dedicated script
/usr/local/sbin/swarm_init.shimproves maintainability and separation of concerns.scripts/fixmongo.sh (3)
30-32: Correct IMDSv2 token implementation with wget.The script properly implements IMDSv2 by fetching a session token using wget's PUT method and then using it for secure metadata retrieval. The token TTL of 21600 seconds is appropriate.
41-41: Consistent token usage for public hostname retrieval.Good practice reusing the existing token for metadata access to maintain security and efficiency.
106-106: Secure local hostname retrieval for certificate generation.The script correctly uses the token to securely fetch the local hostname for MongoDB certificate generation, maintaining consistency with the IMDSv2 implementation.
scripts/fixconfigs.sh (5)
13-14: Correct IMDSv2 token implementation.The script properly implements IMDSv2 by fetching a session token using wget's PUT method with appropriate TTL header.
16-19: Good addition of debug logging for region retrieval.The debug echo statement helps with troubleshooting and provides visibility into the metadata retrieval process. The token usage is consistent with IMDSv2 security requirements.
20-20: Consistent token usage for role name retrieval.Good practice reusing the existing token for secure metadata access.
22-24: Secure account ID retrieval using token.The script correctly uses the token to access the instance identity document and extract the account ID using jq.
25-27: Proper instance ID retrieval with token authentication.The script maintains consistency by using the token for secure instance ID retrieval.
products/ec2-secure-windows/set_user_token.bat (4)
5-6: Correct IMDSv2 token implementation for Windows.The script properly implements IMDSv2 by fetching a session token using curl with appropriate TTL header. The token is stored correctly for reuse.
7-8: Secure region retrieval using token.The script correctly uses the token for secure metadata access to retrieve the AWS region.
9-10: Proper instance ID retrieval with token authentication.The script maintains consistency by using the token for secure instance ID retrieval.
15-16: Good security improvement with SecureString parameter type.Changing from "String" to "SecureString" type and adding quotes around the parameter name and region arguments improves security and prevents potential issues with special characters.
provisioners/provision-mongo.sh (3)
8-8: Verify Ubuntu noble compatibility.The APT repository configuration now targets Ubuntu "noble" distribution. Ensure that all deployment targets are compatible with Ubuntu 24.04 (noble).
14-19: Comprehensive service management commands are well-structured.The service management commands provide thorough control over the MongoDB service lifecycle, including status checks, enabling on boot, and proper restart procedures.
4-6: Verify legacy mongo shell compatibility with MongoDB 8.0I found multiple provisioning and utility scripts that invoke the legacy
mongoshell (and in one place fall back tomongosh), but MongoDB 8.0 no longer bundles the oldmongoshell by default. Please:
- Ensure your APT install of
mongodb-orgstill includesmongodb-org-shellor explicitly install the legacy shell package, or- Migrate all
mongoinvocations tomongoshand confirm feature parity.Scripts requiring attention:
scripts/connect-db.sh(uses bothmongoshandmongo)scripts/fixmongo.sh(mongo --host …with inline JS)scripts/fixdocdb.sh(mongo --ssl …)scripts/import-seed-db.sh&scripts/remove-org.sh(mongo --eval)Action: test each end-to-end against a fresh MongoDB 8.0 instance to validate CLI flags, JS eval blocks, and any data-model assumptions still hold.
cft-templates/Rstudio.yml (2)
40-43: Parameter lacks a default, breaking existing automation
AvailabilityZoneis now mandatory but no default is provided. Existing pipelines that didn’t supply this parameter will fail. Either supply a sensible default (e.g., first AZ of the region) or make the property conditional.
62-64: 👍 Addition ofAmazonSSMManagedInstanceCoreAttaching the managed policy is the right move to enable Session Manager connectivity without extra IAM plumbing.
rg_main_stack.yml (1)
121-150: Granular IAM split looks goodThe refactor into
InstancePermissions,RoleRelatedPermissions, andPolicyRelatedPermissionstightens scope without breaking existing actions – nice!cft-templates/ec2-winsecure-desktop.yml (1)
255-259: External dependency on pre-existing launch templateThe stack references
LaunchTemplateName: "RG-IMDSv2"but does not create it. Make sure this launch template is created before stack deployment, or reference the one defined inside this template to avoid aValidationError: LaunchTemplateName does not exist.
| cc-3102: | ||
| image: 045938549113.dkr.ecr.us-east-2.amazonaws.com/researchportal:_fd_1.21.2_b2433 | ||
| image: relevancelab/researchportal:_fd_1.22.0_b2690 | ||
| secrets: |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Pin cc-3102 image to digest for deterministic, secure deployments
Relying solely on the tag _fd_1.22.0_b2690 leaves you open to “latest-tag drift” if the publisher mutates or re-tags the image. Pin the image by SHA-256 digest and optionally keep the tag as an inline comment for human readability.
- image: relevancelab/researchportal:_fd_1.22.0_b2690
+# Pin by digest to avoid unexpected upgrades
+ image: relevancelab/researchportal@sha256:<calculated-digest> # _fd_1.22.0_b2690📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| cc-3102: | |
| image: 045938549113.dkr.ecr.us-east-2.amazonaws.com/researchportal:_fd_1.21.2_b2433 | |
| image: relevancelab/researchportal:_fd_1.22.0_b2690 | |
| secrets: | |
| cc-3102: | |
| # Pin by digest to avoid unexpected upgrades | |
| image: relevancelab/researchportal@sha256:<calculated-digest> # _fd_1.22.0_b2690 | |
| secrets: |
🤖 Prompt for AI Agents
In docker-compose.yml around lines 20 to 22, the image for service cc-3102 is
specified using a tag only, which can lead to non-deterministic deployments if
the tag is updated or changed. To fix this, replace the image tag with the full
image digest (SHA-256) to pin the exact image version. Optionally, keep the
original tag as a comment for readability. This ensures deployments use the
exact same image every time.
| image: relevancelab/aws-notificationsink:1.22.0_b1 | ||
| secrets: |
There was a problem hiding this comment.
notificationsink image should also be immutable
The Docker Hub tag 1.22.0_b1 is mutable. Pin by digest to guarantee the runtime artifact.
- image: relevancelab/aws-notificationsink:1.22.0_b1
+ image: relevancelab/aws-notificationsink@sha256:<calculated-digest> # 1.22.0_b1🤖 Prompt for AI Agents
In docker-compose.yml around lines 65 to 66, the notificationsink image tag
`1.22.0_b1` is mutable and should be pinned by digest to ensure immutability.
Replace the image tag with the image digest (sha256) from Docker Hub for that
specific version to guarantee the runtime artifact remains unchanged.
| - logs:CreateLogDelivery | ||
| - logs:CreateLogGroup | ||
| - logs:CreateLogStream | ||
| - logs:DeleteLogGroup | ||
| Resource: arn:aws:logs:*:*:* |
There was a problem hiding this comment.
Missing logs:PutLogEvents will block Lambda logging; logs:DeleteLogGroup is unnecessary
The Lambda service needs logs:PutLogEvents to write log entries—without it, every invocation fails with AccessDeniedException.
Granting logs:DeleteLogGroup is over-permissive; the function never needs to delete its own log group.
- - logs:CreateLogDelivery
- - logs:CreateLogGroup
- - logs:CreateLogStream
- - logs:DeleteLogGroup
+ - logs:CreateLogGroup
+ - logs:CreateLogStream
+ - logs:PutLogEvents
+ # logs:CreateLogDelivery only if you use cross-account log delivery; otherwise omitAlternatively, attach the managed policy AWSLambdaBasicExecutionRole to simplify and future-proof the permissions.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - logs:CreateLogDelivery | |
| - logs:CreateLogGroup | |
| - logs:CreateLogStream | |
| - logs:DeleteLogGroup | |
| Resource: arn:aws:logs:*:*:* | |
| - logs:CreateLogGroup | |
| - logs:CreateLogStream | |
| - logs:PutLogEvents | |
| # logs:CreateLogDelivery only if you use cross-account log delivery; otherwise omit | |
| Resource: arn:aws:logs:*:*:* |
🤖 Prompt for AI Agents
In rg_userpool.yml around lines 351 to 355, the IAM policy is missing the
logs:PutLogEvents permission required for Lambda to write logs, causing
AccessDeniedException on invocation. Add logs:PutLogEvents to the list of
allowed actions and remove logs:DeleteLogGroup as it is unnecessary and
over-permissive. Alternatively, replace the custom permissions with the
AWSLambdaBasicExecutionRole managed policy to simplify and future-proof the
Lambda's logging permissions.
| sudo apt-get update -y | ||
| sudo curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" | ||
| sudo apt install unzip | ||
| sudo unzip awscliv2.zip | ||
|
|
||
| # Install prerequisites | ||
| sudo apt-get install -y jq unzip curl |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Assumes Debian-based AMI – may break on Amazon Linux or RHEL images
apt-get will fail silently on the Amazon Linux 2 and RHEL family AMIs that are used elsewhere in this repo (yum is available there).
Unless the Packer build matrix guarantees Ubuntu/Debian only, guard the installation with a distro check or switch to yum install jq unzip curl when which yum is present.
🤖 Prompt for AI Agents
In provisioners/provision-awscli.sh around lines 4 to 7, the script uses apt-get
which assumes a Debian-based system and will fail on Amazon Linux or RHEL AMIs.
Modify the script to detect the package manager by checking if yum exists; if
yum is present, use yum install for jq, unzip, and curl, otherwise use apt-get.
This conditional logic will ensure compatibility across different Linux
distributions.
| curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" | ||
|
|
||
| # Unzip the AWS CLI installer | ||
| unzip awscliv2.zip | ||
|
|
||
| # Install AWS CLI | ||
| sudo ./aws/install |
There was a problem hiding this comment.
No integrity / signature check on the AWS-CLI installer
Blindly executing the downloaded ZIP is a supply-chain risk. Fetch and verify the published SHA256 (or the GPG signature) before unzipping:
+curl -s "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip.sha256" -o awscliv2.zip.sha256
+sha256sum -c awscliv2.zip.sha256
+if [ $? -ne 0 ]; then
+ echo "Checksum verification failed" >&2
+ exit 1
+fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" | |
| # Unzip the AWS CLI installer | |
| unzip awscliv2.zip | |
| # Install AWS CLI | |
| sudo ./aws/install | |
| curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" | |
| curl -s "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip.sha256" -o awscliv2.zip.sha256 | |
| sha256sum -c awscliv2.zip.sha256 | |
| if [ $? -ne 0 ]; then | |
| echo "Checksum verification failed" >&2 | |
| exit 1 | |
| fi | |
| # Unzip the AWS CLI installer | |
| unzip awscliv2.zip | |
| # Install AWS CLI | |
| sudo ./aws/install |
🤖 Prompt for AI Agents
In provisioners/provision-awscli.sh around lines 10 to 16, the script downloads
and installs the AWS CLI without verifying the integrity of the downloaded ZIP
file. To fix this, fetch the official SHA256 checksum from AWS, compute the
checksum of the downloaded awscliv2.zip, and compare them before unzipping. Only
proceed with unzipping and installing if the checksums match to ensure the
installer has not been tampered with.
| # Get the session token | ||
| TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") | ||
|
|
||
| # Get the region to build the parameter name | ||
| instance_region=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/region) | ||
| echo "Retrieved region ${region} from metadata service" | ||
|
|
||
| # Get the instance id to build the parameter name | ||
| instance_id=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-id) | ||
|
|
There was a problem hiding this comment.
Undefined variable in debug echo
echo "Retrieved region ${region} …" references ${region}, which is unset; the correct variable is instance_region.
-echo "Retrieved region ${region} from metadata service"
+echo "Retrieved region ${instance_region} from metadata service"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # Get the session token | |
| TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") | |
| # Get the region to build the parameter name | |
| instance_region=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/region) | |
| echo "Retrieved region ${region} from metadata service" | |
| # Get the instance id to build the parameter name | |
| instance_id=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-id) | |
| # Get the session token | |
| TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") | |
| # Get the region to build the parameter name | |
| instance_region=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/region) | |
| echo "Retrieved region ${instance_region} from metadata service" | |
| # Get the instance id to build the parameter name | |
| instance_id=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-id) |
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 130-130: trailing spaces
(trailing-spaces)
[error] 134-134: trailing spaces
(trailing-spaces)
🤖 Prompt for AI Agents
In cft-templates/Rstudio.yml around lines 128 to 137, the debug echo references
an undefined variable ${region} instead of the correct variable
${instance_region}. Update the echo statement to use ${instance_region} to
correctly display the retrieved region value.
| # Get the session token | ||
| TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") | ||
|
|
||
| # Get the region to build the parameter name | ||
| instance_region=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/region) | ||
| echo "Retrieved region ${region} from metadata service" | ||
|
|
||
| # Get the instance id to build the parameter name | ||
| instance_id=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-id) | ||
| echo "Retrieved instance_id $instance_id from metadata service" | ||
| aws ssm put-parameter --name "/RL/RG/vs-code/auth-token/$instance_id" --value $access_token --region $instance_region --type SecureString --overwrite |
There was a problem hiding this comment.
Fix variable‐name typo & quote the token before logging
instance_region is set on L175, but the debug echo on L176 references ${region} – this will print an empty string.
While touching this, quote $access_token in the aws ssm put-parameter call to prevent word-splitting and possible shell-injection via the random UUID.
- instance_region=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/region)
- echo "Retrieved region ${region} from metadata service"
+instance_region=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/region)
+echo "Retrieved region ${instance_region} from metadata service"
- aws ssm put-parameter --name "/RL/RG/vs-code/auth-token/$instance_id" --value $access_token --region $instance_region --type SecureString --overwrite
+aws ssm put-parameter --name "/RL/RG/vs-code/auth-token/$instance_id" --value "$access_token" --region "$instance_region" --type SecureString --overwrite 📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # Get the session token | |
| TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") | |
| # Get the region to build the parameter name | |
| instance_region=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/region) | |
| echo "Retrieved region ${region} from metadata service" | |
| # Get the instance id to build the parameter name | |
| instance_id=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-id) | |
| echo "Retrieved instance_id $instance_id from metadata service" | |
| aws ssm put-parameter --name "/RL/RG/vs-code/auth-token/$instance_id" --value $access_token --region $instance_region --type SecureString --overwrite | |
| # Get the session token | |
| TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") | |
| # Get the region to build the parameter name | |
| instance_region=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/region) | |
| echo "Retrieved region ${instance_region} from metadata service" | |
| # Get the instance id to build the parameter name | |
| instance_id=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-id) | |
| echo "Retrieved instance_id $instance_id from metadata service" | |
| aws ssm put-parameter --name "/RL/RG/vs-code/auth-token/$instance_id" --value "$access_token" --region "$instance_region" --type SecureString --overwrite |
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 173-173: trailing spaces
(trailing-spaces)
[error] 177-177: trailing spaces
(trailing-spaces)
[error] 181-181: trailing spaces
(trailing-spaces)
🤖 Prompt for AI Agents
In cft-templates/ec2-vscode.yml around lines 171 to 181, fix the variable name
typo by changing the echo statement to reference ${instance_region} instead of
${region} to correctly display the retrieved region. Also, quote the
$access_token variable in the aws ssm put-parameter command to prevent
word-splitting and potential shell injection vulnerabilities.
| IMDSv2LaunchTemplate: | ||
| Type: AWS::EC2::LaunchTemplate | ||
| Properties: | ||
| LaunchTemplateName: IMDSV2 | ||
| LaunchTemplateData: | ||
| DisableApiTermination: true | ||
| MetadataOptions: | ||
| HttpTokens: required | ||
| HttpPutResponseHopLimit: 2 | ||
| RGEC2Instance: |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
IMDSv2LaunchTemplate declared but never used
The new launch template enforces IMDSv2, but RGEC2Instance (L184 ff.) is still defined the old way and does not reference it.
Either attach the template:
LaunchTemplate:
LaunchTemplateName: !Ref IMDSv2LaunchTemplate
Version: 1or remove the unused resource to avoid dead-code drift.
🏁 Script executed:
#!/bin/bash
# Verify if RGEC2Instance references the new LaunchTemplate
rg -n -A10 "RGEC2Instance:" rg_main_stack.ymlLength of output: 386
Attach or Remove the Unused IMDSv2LaunchTemplate
The IMDSv2LaunchTemplate resource is declared but never referenced by your EC2 instance. You should either attach it to RGEC2Instance or remove it to avoid dead-code drift.
• File: rg_main_stack.yml
• Location: around lines 183–192
Suggested change—add under RGEC2Instance.Properties:
LaunchTemplate:
LaunchTemplateName: !Ref IMDSv2LaunchTemplate
Version: !GetAtt IMDSv2LaunchTemplate.LatestVersionNumberOr, if you don’t intend to use it, delete the IMDSv2LaunchTemplate resource block.
🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 177-177: wrong indentation: expected 6 but found 8
(indentation)
[error] 180-180: trailing spaces
(trailing-spaces)
🤖 Prompt for AI Agents
In rg_main_stack.yml around lines 174 to 183, the IMDSv2LaunchTemplate resource
is defined but not used by the RGEC2Instance. To fix this, either attach the
IMDSv2LaunchTemplate to the RGEC2Instance by adding a LaunchTemplate property
under RGEC2Instance.Properties referencing the IMDSv2LaunchTemplate name and its
latest version, or remove the entire IMDSv2LaunchTemplate resource block if it
is not needed.
| LaunchTemplate: | ||
| LaunchTemplateName: "RG-IMDSv2" | ||
| Version: 1 |
There was a problem hiding this comment.
LaunchTemplate.Version should be quoted
YAML interprets bare 1 as an integer, but CloudFormation expects a string for the Version field. Quote it to avoid “expected String” validation errors.
- Version: 1
+ Version: "1"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| LaunchTemplate: | |
| LaunchTemplateName: "RG-IMDSv2" | |
| Version: 1 | |
| LaunchTemplate: | |
| LaunchTemplateName: "RG-IMDSv2" | |
| Version: "1" |
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 407-407: trailing spaces
(trailing-spaces)
🤖 Prompt for AI Agents
In cft-templates/ec2-secure-desktop.yml around lines 405 to 407, the
LaunchTemplate.Version value is currently an unquoted integer (1), but
CloudFormation requires this to be a string. Fix this by enclosing the Version
value in quotes, changing it from 1 to "1" to ensure proper YAML parsing and
CloudFormation validation.
4 participants
Add the SSMManagedInstanceCore policy to all EC2 resources so that Session Manager connection can be established to debug issues if required.
This change is
Summary by CodeRabbit
New Features
Improvements
Bug Fixes
Chores