Pulumi.yaml

name: imds-v2
runtime: yaml
description: Test the ability of pulumi-aws to authenticate on an EC2 instance with IMDSv2 enabled

backend:
  url: file://./pulumi-state

config:
  localProviderBuild:
    type: string

  pulumi:tags:
    value:
      pulumi:template: aws-yaml

variables:
  ec2ami:
    fn::invoke:
      function: aws:ec2:getAmi
      arguments:
        filters:
          - name: name
            values: ["al2023*x86_64*"]
        owners:
          - amazon
        mostRecent: true
      return: id

  instanceType: t2.medium
  policyArn: "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess" # example policy

resources:

  segroup:
    type: aws:ec2:SecurityGroup
    properties:
      ingress:
        - protocol: tcp
          fromPort: 80
          toPort: 80
          cidrBlocks: ["0.0.0.0/0"]
        - protocol: tcp
          fromPort: 22
          toPort: 22
          cidrBlocks: ["0.0.0.0/0"]
      egress:
        - fromPort: 0
          toPort: 0
          protocol: '-1'
          cidrBlocks:
            - 0.0.0.0/0
          ipv6CidrBlocks:
            - ::/0

  priv-key:
    type: tls:PrivateKey
    properties:
      algorithm: RSA
      rsaBits: 2048

  key-pair:
    type: aws:ec2/keyPair:KeyPair
    properties:
      publicKey: ${priv-key.publicKeyOpenssh}

  my-role:
    type: aws:iam/role:Role
    properties:
      assumeRolePolicy: |
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Principal": {"Service": "ec2.amazonaws.com"},
              "Effect": "Allow",
              "Sid": ""
            }
          ]
        }

  my-role-policy-attachment:
    type: aws:iam/rolePolicyAttachment:RolePolicyAttachment
    properties:
      role: ${my-role.name}
      policyArn: ${policyArn}

  upload-bucket:
    type: aws:s3/bucketV2:BucketV2

  upload-provider:
    type: aws:s3:BucketObjectv2
    properties:
      bucket: ${upload-bucket.id}
      key: pulumi-resource-aws
      source:
        fn::fileAsset: ${localProviderBuild}

  my-instance-profile:
    type: aws:iam/instanceProfile:InstanceProfile
    properties:
      role: ${my-role.name}

  inst:
    type: aws:ec2/instance:Instance
    options:
      dependsOn:
        - ${upload-provider}
    properties:
      ami: ${ec2ami}
      instanceType: ${instanceType}
      iamInstanceProfile: ${my-instance-profile.name}
      keyName: ${key-pair.keyName}
      # Enable and enforce IMDSv2
      metadataOptions:
        httpTokens: required
        httpEndpoint: enabled
        httpPutResponseHopLimit: 1
      vpcSecurityGroupIds:
        - ${segroup}
      userData: |
        #!/bin/bash
        # Reconfigure SSHD - workaround for pulumi Command issues
        cat /etc/ssh/ssh_config >/tmp/sshd_config
        echo "AcceptEnv PULUMI_COMMAND_STDOUT" >> /tmp/sshd_config
        echo "AcceptEnv PULUMI_COMMAND_STDERR" >> /tmp/sshd_config
        sudo cp /tmp/sshd_config /etc/ssh/sshd_config || echo "FAILED to set sshd_config"
        rm /tmp/sshd_config
        # copy the file as part of instance startup is much faster than
        # using command:remote
        cd /tmp && aws s3 cp s3://${upload-bucket.id}/pulumi-resource-aws ./

  file-copy:
    type: command:remote:CopyFile
    properties:
      connection:
        host: ${inst.publicIp}
        user: ec2-user # The default user for Amazon Linux AMI
        privateKey: ${priv-key.privateKeyOpenssh}
      localPath: remote-program/Pulumi.yaml
      remotePath: "/tmp/Pulumi.yaml"
    options:
      ignoreChanges:
        - connection

  install-cmd:
    type: command:remote:Command
    properties:
      create: |
        echo "========"
        curl -fsSL https://get.pulumi.com | sh
        export PATH="/home/ec2-user/.pulumi/bin:$PATH"
        echo "========"
        pulumi version
        echo "========"
      connection:
        host: ${inst.publicIp}
        user: ec2-user # The default user for Amazon Linux AMI
        privateKey: ${priv-key.privateKeyOpenssh}
    options:
      ignoreChanges:
        - connection
      dependsOn:
        - ${file-copy}

  init-cmd:
    type: command:remote:Command
    properties:
      create: |
        # Install pulumi and pulumi-resource-aws into PATH
        export PATH="/home/ec2-user/.pulumi/bin:$PATH"
        cp /tmp/pulumi-resource-aws /home/ec2-user/.pulumi/bin/
        chmod a+x /home/ec2-user/.pulumi/bin/pulumi-resource-aws
        echo "pulumi version:"
        pulumi version
        echo "pulumi-resource-aws version:"
        pulumi-resource-aws -version
        mkdir /home/ec2-user/repro
        cp /tmp/Pulumi.yaml /home/ec2-user/repro/Pulumi.yaml
        cd /home/ec2-user/repro
        mkdir ./pulumi-state
        export PULUMI_CONFIG_PASSPHRASE=123456
        pulumi stack init dev
        pulumi stack select dev
        pulumi config
        pulumi preview
      # SSH connection details to the remote machine
      connection:
        host: ${inst.publicIp}
        user: ec2-user # The default user for Amazon Linux AMI
        privateKey: ${priv-key.privateKeyOpenssh}
    options:
      ignoreChanges:
        - connection
      dependsOn:
        - ${install-cmd}

outputs:
  instanceId: ${inst.id}
  publicIp: ${inst.publicIp}
  commandOut: ${init-cmd.stdout}
  bucket: ${upload-bucket.id}