{"id":2657,"date":"2024-02-26T21:09:53","date_gmt":"2024-02-26T21:09:53","guid":{"rendered":"https:\/\/www.maghilda.com\/staging\/9669\/?p=2657"},"modified":"2024-02-26T21:23:25","modified_gmt":"2024-02-26T21:23:25","slug":"howto-use-cloudformation-to-tag-new-ec2-instances-with-lambda-function-eventbridge-vpc-and-cloudtrail","status":"publish","type":"post","link":"https:\/\/www.maghilda.com\/staging\/9669\/howto-use-cloudformation-to-tag-new-ec2-instances-with-lambda-function-eventbridge-vpc-and-cloudtrail\/","title":{"rendered":"HOWTO: Use CloudFormation to tag new EC2 instances with Lambda function, EventBridge, VPC and CloudTrail"},"content":{"rendered":"\n

In this tutorial, we will automate the tagging of new EC2 instances using CloudFormation templates. In the previous<\/a> tutorial, we learnt how to tag AWS EC2 instances when they are created. We created an event rule in EventBridge to trigger a Lambda function to tag new EC2 instances with the name of the user that created it. That tutorial had step by step instructions on how to accomplish this via the AWS management console. This tutorial covers all the steps using CloudFormation templates for easy build and tear down and re-use in the future.<\/p>\n\n\n\n

Steps<\/h3>\n\n\n\n
    \n
  1. Create a python file with the Lambda function to tag EC2 instances when they are created<\/li>\n\n\n\n
  2. Upload the file to a S3 bucket<\/li>\n\n\n\n
  3. Create the VPC stack<\/li>\n\n\n\n
  4. Create the CloudTrail stack<\/li>\n\n\n\n
  5. Create the Lambda deployment and EventBridge rules stack<\/li>\n\n\n\n
  6. Create EC2 stack<\/li>\n\n\n\n
  7. Validate the tags on the EC2 instances <\/li>\n\n\n\n
  8. Clean up resources. Delete all the stacks above<\/li>\n<\/ol>\n\n\n\n

    Step 1: Create a python file with the Lambda function to tag EC2 instances when they are created<\/h3>\n\n\n\n
    import json\nimport boto3\n\nprint('loading tagEC2 lambda function')\n \nec2 = boto3.client('ec2')\n \ndef lambda_handler(event, context):\n    #print(event)\n    \n    #user name; please note that this may differ based on the structure of your IAM user\n    userName = event['detail']['userIdentity']['sessionContext']['sessionIssuer']['userName']\n    \n    #instance id\n    instanceId = event['detail']['responseElements']['instancesSet']['items'][0]['instanceId']\n    \n    try:\n        ec2.create_tags(\n            Resources=[\n                instanceId,\n            ],\n            Tags=[\n                {\n                    'Key': 'CreatedBy',\n                    'Value': userName\n                },\n            ]\n        )\n        print(\"completed executing tagEC2 lambda function\")\n    except Exception as e:\n        print(e)\n        raise e\n    \n    return<\/code><\/pre>\n\n\n\n
    Step 2: Upload the file to a S3 bucket<\/h3>\n\n\n\n
    To upload the newly created Lambda function to the S3 bucket, first convert it to a zip file as follows:<\/p>\n\n\n\n
    zip maghilda_tagResourceCreation.zip maghilda_tagResourceCreation.py<\/code><\/pre>\n\n\n\n
    Step 3: Create the VPC stack<\/h3>\n\n\n\n
    AWSTemplateFormatVersion: 2010-09-09\nDescription: Set up VPC template for test environment with one public subnet in one availabily zone. \n\nParameters:\n  EnvironmentName:\n    Description: An environment name that is prefixed to resource names\n    Type: String\n    Default: test\n\n  VpcCIDR:\n    Description: Please enter the IP range (CIDR notation) for this VPC\n    Type: String\n    Default: 10.0.0.0\/16\n\n  PublicSubnetCIDR:\n    Description: Please enter the IP range (CIDR notation) for the public subnet in the one Availability Zone\n    Type: String\n    Default: 10.0.10.0\/24\n\nResources:\n  VPC:\n    Type: AWS::EC2::VPC\n    Properties:\n      CidrBlock: !Ref VpcCIDR\n      EnableDnsSupport: true\n      EnableDnsHostnames: true\n      Tags:\n        - Key: Name\n          Value: !Ref EnvironmentName\n\n  InternetGateway:\n    Type: AWS::EC2::InternetGateway\n    Properties:\n      Tags:\n        - Key: Name\n          Value: !Ref EnvironmentName\n\n  InternetGatewayAttachment:\n    Type: AWS::EC2::VPCGatewayAttachment\n    Properties:\n      InternetGatewayId: !Ref InternetGateway\n      VpcId: !Ref VPC\n\n  PublicSubnet:\n    Type: AWS::EC2::Subnet\n    Properties:\n      VpcId: !Ref VPC\n      AvailabilityZone: !Select [ 0, !GetAZs '' ]\n      CidrBlock: !Ref PublicSubnetCIDR\n      MapPublicIpOnLaunch: true\n      Tags:\n        - Key: Name\n          Value: !Sub ${EnvironmentName} Public Subnet (AZ)\n\n  PublicRouteTable:\n    Type: AWS::EC2::RouteTable\n    Properties:\n      VpcId: !Ref VPC\n      Tags:\n        - Key: Name\n          Value: !Sub ${EnvironmentName} Public Routes\n\n  DefaultPublicRoute:\n    Type: AWS::EC2::Route\n    DependsOn: InternetGatewayAttachment\n    Properties:\n      RouteTableId: !Ref PublicRouteTable\n      DestinationCidrBlock: 0.0.0.0\/0\n      GatewayId: !Ref InternetGateway\n\n  PublicSubnetRouteTableAssociation:\n    Type: AWS::EC2::SubnetRouteTableAssociation\n    Properties:\n      RouteTableId: !Ref PublicRouteTable\n      SubnetId: !Ref PublicSubnet\n\n  NoIngressSecurityGroup:\n    Type: AWS::EC2::SecurityGroup\n    Properties:\n      GroupName: \"no-ingress-sg\"\n      GroupDescription: \"Security group with no ingress rule\"\n      VpcId: !Ref VPC\n\nOutputs:\n  VPC:\n    Description: A reference to the created VPC\n    Value: !Ref VPC\n\n  PublicSubnet:\n    Description: A reference to the public subnet in the Availability Zone\n    Value: !Ref PublicSubnet\n\n  NoIngressSecurityGroup:\n    Description: Security group with no ingress rule\n    Value: !Ref NoIngressSecurityGroup<\/code><\/pre>\n\n\n\n
    Deploy the stack via the AWS CLI<\/p>\n\n\n\n
    aws cloudformation create-stack --stack-name testvpc --template-body file:\/\/vpc-template.yml<\/code><\/pre>\n\n\n\n
    Step 4: Create the CloudTrail stack<\/h3>\n\n\n\n
    EventBridge requires CloudTrail Trail to exist as it uses the CloudTrail API. To set up CloudTrail trail with S3, please review my post here<\/a>.<\/p>\n\n\n\n
    Step 5: Create the Lambda deployment and EventBridge rules stack<\/h3>\n\n\n\n
    AWSTemplateFormatVersion: 2010-09-09\nDescription: Set up EventBridge Trigger and Lambda function to tag EC2 resources \n    \nResources:\n  # BEGIN MANAGED POLICY \n  ManagedPolicy:\n    Type: AWS::IAM::ManagedPolicy\n    Properties:\n      PolicyDocument: \n        Version: '2012-10-17'\n        Statement:\n          - Sid: CloudWatchLogs #similar to AWSLambdaBasicExecutionRole\n            Effect: Allow\n            Action:\n              - logs:PutLogEvents\n              - logs:CreateLogGroup\n              - logs:CreateLogStream\n            Resource: \"arn:aws:logs:*:*:*\"\n          - Sid: CreateTags\n            Effect: Allow\n            Action: ec2:CreateTags\n            Resource: \"*\" \n\n  # BEGIN LAMBDA IAM RESOURCES\n  EventBridgeLambdaRole:\n    Type: 'AWS::IAM::Role'\n    Properties:\n      AssumeRolePolicyDocument:\n        Version: '2012-10-17'\n        Statement:\n          - Effect: Allow\n            Principal:\n              Service:\n                - lambda.amazonaws.com\n            Action:\n              - 'sts:AssumeRole'\n      ManagedPolicyArns:\n          - !Ref ManagedPolicy\n  \n  # Deploy Lambda function\n  myLambdaFunction:\n    Type: AWS::Lambda::Function\n    Properties:\n      Runtime: python3.11\n      FunctionName: maghilda_tagResourceCreation\n      Role: !GetAtt EventBridgeLambdaRole.Arn\n      Handler: maghilda_tagResourceCreation.lambda_handler #filename.handler\n      Code:\n        S3Bucket: m-lambdafunctions  #s3 bucket name\n        S3Key: maghilda_tagResourceCreation.zip   #file uploaded to the s3 bucket\n      Description: tagEC2 lambda function\n      TracingConfig:\n        Mode: Active\n\n  #Provide Lambda permissions to execute Events\n  LambdaPerms:\n      Type: AWS::Lambda::Permission\n      Properties:\n        Action: 'lambda:InvokeFunction'\n        FunctionName: !Ref myLambdaFunction\n        Principal: events.amazonaws.com \n        SourceAccount: !Ref AWS::AccountId  \n        SourceArn: !GetAtt EventBridgeTrigger.Arn\n\n  #Set up EventBridge Rule\n  EventBridgeTrigger:\n      Type: AWS::Events::Rule\n      Properties:\n        Description: 'EventTrigger on EC2'\n        State: 'ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS'\n        EventPattern: \n          source:\n            - 'aws.ec2'\n          detail-type:\n            - 'AWS API Call via CloudTrail'\n          detail: #the service generating the event determines the content of this field.\n            eventSource: \n              - 'ec2.amazonaws.com'\n            eventName: \n              - 'RunInstances'\n        Targets:\n          - Arn: !GetAtt myLambdaFunction.Arn\n            Id: 'LambdaFunction'\n\nOutputs :\n  LambdaFunctionName:\n    Value: !Ref myLambdaFunction\n\n  LambdaRoleArn:\n    Value: !GetAtt EventBridgeLambdaRole.Arn\n\n  EventRuleArn:\n    Value: !GetAtt EventBridgeTrigger.Arn<\/code><\/pre>\n\n\n\n
    Deploy the stack via the AWS CLI<\/p>\n\n\n\n
    aws cloudformation create-stack --stack-name testlambda  --capabilities CAPABILITY_NAMED_IAM --template-body file:\/\/TagEC2Lambda-template.yml<\/code><\/pre>\n\n\n\n
    Step 6: Create EC2 stack<\/h3>\n\n\n\n
    AWSTemplateFormatVersion: 2010-09-09\nDescription: Create EC2 instance. The security group allows only SSH traffic \n\nParameters:\n  InstanceType:\n    Description: Instance Type to use\n    Type: String\n    Default: t2.micro\n  AMI:\n    Description: AMI to use; Amazon Linux 2023 AMI\n    Type: String\n    Default: 'ami-0e731c8a588258d0d'\n  Key:\n    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance\n    Type: AWS::EC2::KeyPair::KeyName\n    Default: 'app-key-pair' #change to use your key-pair name\n  SSHLocation:\n    Description: The IP address range that can be used to SSH to the EC2 instances\n    Type: String\n    Default: 18.206.107.24\/29 #using EC2 Instance Connect IP address range to connect to an instance\n  VPC:\n    Description: The ID of the VPC for the security group\n    Type: String\n    Default: 'vpc-0ac7ad98b5f0b664b' \n  SubnetID:\n    Description: The ID of the subnet to launch the instance into.\n    Type: String\n    Default: 'subnet-0f7be13cfe8e7f030' \n\n\nResources:\n  MyEC2Instance: \n    Type: AWS::EC2::Instance\n    Properties: \n      ImageId: !Ref AMI\n      KeyName: !Ref Key\n      InstanceType: !Ref InstanceType\n      NetworkInterfaces: \n        - AssociatePublicIpAddress: \"true\"\n          DeviceIndex: \"0\"\n          GroupSet: [!Ref SSHSecurityGroup]\n          SubnetId: !Ref SubnetID\n\n  SSHSecurityGroup:\n    Type: AWS::EC2::SecurityGroup\n    Properties:\n      GroupName: \"ssh-ingress-sg\"\n      GroupDescription: \"Enable SSH access via port 22\"\n      SecurityGroupIngress:\n        - IpProtocol: tcp\n          FromPort: 22\n          ToPort: 22\n          CidrIp: !Ref SSHLocation   \n      VpcId: !Ref VPC\n\nOutputs:\n  InstanceID:\n    Description: InstanceId of the newly created EC2 instance\n    Value: !Ref MyEC2Instance\n  AZ:\n    Description: Availability Zone of the newly created EC2 instance\n    Value: !GetAtt [MyEC2Instance, AvailabilityZone]\n  PublicDNS:\n    Description: Public DNSName of the newly created EC2 instance\n    Value: !GetAtt [MyEC2Instance, PublicDnsName]\n  PublicIP:\n    Description: Public IP address of the newly created EC2 instance\n    Value: !GetAtt [MyEC2Instance, PublicIp]\n  SSHSecurityGroup:\n    Description: Security group with SSH access only\n    Value: !Ref SSHSecurityGroup<\/code><\/pre>\n\n\n\n
    Deploy the stack via the AWS CLI<\/p>\n\n\n\n
    aws cloudformation create-stack --stack-name testEC2 --template-body file:\/\/EC2-template.yml<\/code><\/pre>\n\n\n\n
    You should have the four CloudFormation Stacks on CloudFormation as follows:<\/p>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    Step 7: Validate the tags on the EC2 instances <\/h3>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    Step 8: Clean up resources. Delete all the stacks above<\/h3>\n\n\n\n
    Delete Lambda function deployment and EventBridge Rules<\/h4>\n\n\n\n
    aws cloudformation delete-stack --stack-name testlambda<\/code><\/pre>\n\n\n\n
    Delete the EC2 instances <\/h4>\n\n\n\n
    aws cloudformation delete-stack --stack-name testEC2<\/code><\/pre>\n\n\n\n
    Delete the VPC and associated subnet and security groups<\/h4>\n\n\n\n
    aws cloudformation delete-stack --stack-name testvpc<\/code><\/pre>\n\n\n\n
    Delete the CloudTrail trail<\/h4>\n\n\n\n
    aws cloudformation delete-stack --stack-name testcreatetrail<\/code><\/pre>\n\n\n\n
    This is the end of the tutorial. Hope it was helpful to you.<\/p>\n\n\n\n
    References<\/h3>\n\n\n\n