generated from ministryofjustice/template-repository
-
Notifications
You must be signed in to change notification settings - Fork 20
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
pav
committed
Nov 27, 2023
1 parent
d947558
commit a855636
Showing
2 changed files
with
221 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
99 changes: 99 additions & 0 deletions
99
terraform/environments/hmpps-domain-services/templates/rds.yaml.tftpl
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,99 @@ | ||
| # This is an EC2Launch V2 type user-data script | ||
| # https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2launch-v2-settings.html#ec2launch-v2-task-configuration | ||
| # See C:\ProgramData\Amazon\EC2Launch\log for logs | ||
| version: 1.0 # version 1.0 is required as this executes AFTER the SSM Agent is running | ||
| tasks: | ||
| - task: executeScript | ||
| inputs: | ||
| - frequency: always | ||
| type: powershell | ||
| runAs: admin | ||
| # debug AmazonSSMAgent service start | ||
| content: |- | ||
| $aws_ssm_status = (Get-Service -Name "AmazonSSMAgent").Status | ||
|
|
||
| $logFilePath = "C:\Temp\ssm_status.txt" | ||
| New-Item -Type File -Force -Path $logFilePath | ||
| Add-Content -Path $logFilePath -Value "SSM Agent status start: $aws_ssm_status" | ||
|
|
||
| if ($aws_ssm_status -eq "Running") { | ||
| Add-Content -Path $logFilePath -Value "SSM Agent is running, no action required. $(Get-Date)" | ||
| } elseif ($aws_ssm_status -eq "Stopped") { | ||
| Add-Content -Path $logFilePath -Value "SSM Agent is not running, starting service. $(Get-Date)" | ||
| Start-Service -Name "AmazonSSMAgent" | ||
| } elseif ($aws_ssm_status -eq "Paused") { | ||
| Add-Content -Path $logFilePath -Value "SSM Agent is paused, resuming service. $(Get-Date)" | ||
| Resume-Service -Name "AmazonSSMAgent" | ||
| } elseif ($aws_ssm_status -eq $null) { | ||
| Add-Content -Path $logFilePath -Value "SSM Agent is not installed... Installing" | ||
| [System.Net.ServicePointManager]::SecurityProtocol = 'TLS12' | ||
| $progressPreference = 'silentlyContinue' | ||
| Invoke-WebRequest https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/windows_amd64/AmazonSSMAgentSetup.exe -OutFile $env:USERPROFILE\Desktop\SSMAgent_latest.exe | ||
|
|
||
| Start-Process -FilePath $env:USERPROFILE\Desktop\SSMAgent_latest.exe -ArgumentList "/S" | ||
|
|
||
| Remove-Item $env:USERPROFILE\Desktop\SSMAgent_latest.exe -Force | ||
|
|
||
| Start-Service -Name "AmazonSSMAgent" | ||
| } else { | ||
| Add-Content -Path $logFilePath -Value "SSM Agent is in an unknown state: $aws_ssm_status $(Get-Date)" | ||
| } | ||
| - frequency: once | ||
| type: powershell | ||
| runAs: admin | ||
| # run SSM test document | ||
| content: |- | ||
| # Install AWS PowerShell module if not already installed | ||
| if (-Not (Get-Module -ListAvailable -Name "AWSPowerShell")) { | ||
| Install-Package -Name "AWSPowerShell" -Force -SkipPublisherCheck | ||
| } | ||
|
|
||
| Function Check-SSMAgent { | ||
| $service = Get-Service -Name "AmazonSSMAgent" | ||
| if ($service.Status -eq "Running") { | ||
| return $true | ||
| } else { | ||
| Start-Service -Name "AmazonSSMAgent" -Force | ||
| } | ||
| } | ||
|
|
||
| Function Execute-SSMCommand { | ||
| $instanceId = Get-EC2InstanceMetadata -Category InstanceId | ||
| $documentName = "csr-server-config" | ||
|
|
||
| $commandId = Send-SSMCommand -InstanceId $instanceId -DocumentName $documentName -Force | ||
| Write-Host "Executed SSM command with Command ID: $($commandId.CommandId)" | ||
| } | ||
|
|
||
| $startTime = Get-Date | ||
|
|
||
| # Main loop to wait for SSM Agent to be running | ||
| do { | ||
| if (Check-SSMAgent) { | ||
| Add-Content -Path "C:\Temp\ssm_status.txt" -Value "SSM Agent is running, executing SSM command. $(Get-Date)" | ||
| Execute-SSMCommand | ||
| break | ||
| } else { | ||
| Add-Content -Path "C:\Temp\ssm_status.txt" -Value "SSM Agent is not running yet. $(Get-Date) Waiting..." | ||
| Start-Sleep -Seconds 10 | ||
| } | ||
| } while ((Get-Date) -lt $startTime.AddMinutes(10)) | ||
| - frequency: once | ||
| type: powershell | ||
| runAs: admin # or localSystem | ||
| # install AD commands | ||
| content: |- | ||
| Install-WindowsFeature -Name RSAT-AD-PowerShell | ||
| - frequency: once | ||
| type: powershell | ||
| runAs: admin | ||
| # Configure RDS | ||
| content: |- | ||
| Set-NetFirewallProfile -Profile Domain, Public, Private -Enabled False | ||
| Disable-NetAdapterBinding -Name 'Ethernet' -ComponentID 'ms_tcpip6' | ||
| Get-WindowsUpdate -Download -Install -AcceptAll | ||
| Import-Module RemoteDesktop | ||
| Enable-PSRemoting -force | ||
| Rename-Computer -NewName $rds_hostname | ||
| Sleep 5 | ||
| Restart-Computer -Force |