{"id":2298,"date":"2018-03-29T08:26:37","date_gmt":"2018-03-29T12:26:37","guid":{"rendered":"http:\/\/blog.domb.net\/?p=2298"},"modified":"2018-03-31T17:58:47","modified_gmt":"2018-03-31T21:58:47","slug":"cloudforms-in-aws-part-2","status":"publish","type":"post","link":"https:\/\/blog.domb.net\/?p=2298","title":{"rendered":"CloudForms in AWS part 2"},"content":{"rendered":"

This part of the CloudForms in AWS blog series will walk you through how to make sure that CloudForms reaches its full potential in AWS.<\/p>\n

IMPORTANT<\/strong>: If you want SmartState analysis to work you need to register your AWS account with the cloud access<\/strong> program. Use the link below to enable cloud access:<\/p>\n

https:\/\/engage.redhat.com\/forms\/cloud-access-registration<\/a><\/p>\n

Once you’ve registered and got confirmation you will see the RHEL-Atomic_7.4_HVM_GA-20180104-x86_64-1-Access2-GP2<\/strong> AMI under the “Private images” tab<\/p>\n

\"\"<\/p>\n

Before we configure CloudForms we need go to the AWS console and create the SNS topic<\/strong> for AWSConfig<\/strong> so that CloudForms can subscribe to messages. SNS stands for simple notification service. It enables CloudForms to subscribe to a topic which contains information about configuration change of AWS resources.<\/p>\n

\"\"<\/p>\n

Once created you should see the following:<\/p>\n

\"\"<\/p>\n

Next, create an AWS S3 bucket to store logs of AWS Config and CloudTrail (api logs).<\/p>\n

\"\"<\/p>\n

Enable AWS Config and make sure to choose the created S3 bucket as well as the SNS topic we created above.<\/p>\n

\"\"<\/p>\n

To get events via CloudWatch and CloudTrail we will need to configure a new trail in CloudTrail. In CloudTrail create a new Trail with the following information. As you can see we can also reuse the previously created S3 bucket to store the logs.<\/p>\n

\"\"<\/p>\n

The last step to get events properly delivered through SNS is to create a new CloudWatch event rule.<\/p>\n

\"\"<\/p>\n

If you’ve done everything correctly, CloudForms will automatically create a new SQS queue named manageiq-awsconfig-queue which pulls data from the SNS AWSConfig_topic:<\/p>\n

INFO -- : MIQ(ManageIQ::Providers::Amazon::CloudManager::EventCatcher::Stream#) Amazon SQS Queue manageiq-awsconfig-queue-5f61a1e9-6555-4f06-9c37-f3e6b7539a86 does not exist; creating queue\r\nINFO -- : MIQ(ManageIQ::Providers::Amazon::CloudManager::EventCatcher::Stream#) Subscribing Queue https:\/\/sqs.us-east-1.amazonaws.com\/XXXXXXXXXXX\/manageiq-awsconfig-queue-5f61a1e9-6555-4f06-9c37-f3e6b7539a86 to arn:aws:sns:us-east-1:XXXXXXXXX:AWSConfig_topic\r\nINFO -- : MIQ(ManageIQ::Providers::Amazon::CloudManager::EventCatcher::Stream#) Created Amazon SQS Queue manageiq-awsconfig-queue-5f61a1e9-6555-4f06-9c37-f3e6b7539a86 and subscribed to AWSConfig_topic<\/pre>\n
Also, you test the for incoming events by stopping and starting an instance. This should be caught by the event catcher<\/p>\n
INFO -- : MIQ(ManageIQ::Providers::Amazon::CloudManager::EventCatcher::Stream#) Found SNS Message with message type AWS_API_CALL_StartInstances coming from \r\nINFO -- : MIQ(ManageIQ::Providers::Amazon::CloudManager::EventCatcher::Stream#) Parsed event from SNS Message AWS_API_CALL_StartInstances coming from \r\n<\/pre>\n
Next and this is kind of optional if you assigned CloudForms to an Admin Role. If\u00a0CloudForms is in the power user policy you have to perform this actions as Power User does not have access to IAM! The new smart state analysis in CloudForms is supposed to create the correct roles, policies and instance profiles for you. I prefer to create the policy myself for two main reasons. I prefer to create the policy myself for two main reasons.<\/p>\n
    \n
  1. I know exactly what is happening<\/li>\n
  2. When having CloudForms create the policies you might run into a race condition and CloudForms will complain about “No agent is set up to process requests: Value (smartstate) for parameter iamInstanceProfile.name is invalid. Invalid IAM Instance Profile name”<\/li>\n<\/ol>\n
    Create a trust policy for the role smartstate. Name the file ec2trustpolicy.json<\/span><\/p>\n
    {\r\n\u00a0\"Version\": \"2012-10-17\",\r\n\u00a0\"Statement\": {\r\n\u00a0\u00a0\u00a0\"Effect\": \"Allow\",\r\n\u00a0\u00a0\u00a0\"Principal\": {\"Service\": \"ec2.amazonaws.com\"},\r\n\u00a0\u00a0\u00a0\"Action\": \"sts:AssumeRole\"\r\n\u00a0}\r\n}<\/pre>\n
    Go ahead and create the role smartstate<\/p>\n
    [ec2-user@ip-172-31-14-85 ~]$ aws iam create-role --role-name smartstate --assume-role-policy-document file:\/\/ec2trustpolicy.json<\/pre>\n
    We now create a custom policy which we will assign to the smartstate\u00a0role.<\/p>\n
    [ec2-user@ip-172-31-14-85 ~]$cat ssa_cfme_policy.json\r\n{\r\n\u00a0\u00a0\u00a0\"Version\": \"2012-10-17\",\r\n\u00a0\u00a0\u00a0\"Statement\": [\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"Effect\": \"Allow\",\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"Action\": [\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"ec2:*\",\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"s3:*\",\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"sqs:*\"\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0],\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"Resource\": [\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"*\"\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0]\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}\r\n\u00a0\u00a0\u00a0]\r\n}\r\n<\/pre>\n
    Add the policy to the role smartstate<\/p>\n
    [ec2-user@ip-172-31-14-85 ~]$ aws iam put-role-policy --role-name smartstate --policy-name cfmepermissions --policy-document file:\/\/ssa_cfme_policy.json<\/pre>\n
    The next step is to create the instance profile. This is needed that the smartstate\u00a0instance is allowed to perform actions against s3,sqs\u00a0and ec2<\/p>\n
    [ec2-user@ip-172-31-14-85 ~]$ aws iam create-instance-profile --instance-profile-name smartstate\r\n\r\n[ec2-user@ip-172-31-14-85 ~]$ aws iam add-role-to-instance-profile --instance-profile-name smartstate --role-name smartstate<\/pre>\n
    Finally, you can now login to CloudForms.<\/p>\n
    On the top right corner go and click configure:<\/p>\n
    \"\"<\/p>\n
    Turn on the smartproxy\u00a0under roles. We will need that for the smart state analysis<\/p>\n
    \"\"<\/p>\n
    Next click on the advanced tab on the right. Now, this is SUPER important!<\/strong> The OOTB configuration is not going to work. Search for\u00a0agent_ami_login_user and change the value from ec2-user to cloud-user. It should look like this:<\/p>\n
    \"\"<\/p>\n
    This is the user CloudForms will login with when it will initiate a smartstate analysis.<\/p>\n
    Finally let’s add the aws\u00a0provider. You should be familiar with what access and secret keys you need to add. Important, CloudForms will need at least poweruser\u00a0access.<\/p>\n
    \"\"<\/p>\n
    Next hit validate on save. Don’t bother filling out the “SmartState Docker” tab as it doesn’t do anything if you fill it out at the same time.<\/p>\n
    Once saved go edit the provider again. Now go to the SmartState Docker tab. I am wondering who named these fields and the comment below. Would have been better to\u00a0say “Use registry.access.redhat.com credentials or RHN credentials required to perform ….<\/em>“. What you need is your RHN credentials. These are needed so that you can pull the smartstate\u00a0image from the redhat\u00a0docker registry.<\/p>\n
    \"\"<\/p>\n
    Hit save and your done.<\/p>\n
    You have now configured everything to perform a smartstate\u00a0analysis in AWS.<\/p>\n
    Go to your AWS provider and click on an instance. Under the instance configurations tab click<\/p>\n
    \"\"<\/p>\n
    You can then go to the top right corner and click on Configuration -> tasks. You should see something like this<\/p>\n
    \"\"<\/p>\n
    \"\"<\/p>\n
    When everything is finished you will see<\/p>\n
    \"\"<\/p>\n
    The next post is going to be for the geeks under us. It will explain what is going on under the hood when smart state happens.<\/p>\n
     <\/p>\n
     <\/p>\n
     <\/p>\n
     <\/p>\n","protected":false},"excerpt":{"rendered":"
    This part of the CloudForms in AWS blog series will walk you through how to make sure that CloudForms reaches its full potential in AWS. IMPORTANT: If you want SmartState analysis to work you need to register your AWS account with the cloud access program. Use the link below to enable cloud access: https:\/\/engage.redhat.com\/forms\/cloud-access-registration Once…<\/p>\n","protected":false},"author":2,"featured_media":2048,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"footnotes":""},"categories":[37],"tags":[144,108,29,57,143],"class_list":["post-2298","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloudforms","tag-analysis","tag-aws","tag-cloudforms","tag-introspection","tag-smartstate"],"_links":{"self":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/2298","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2298"}],"version-history":[{"count":18,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/2298\/revisions"}],"predecessor-version":[{"id":2397,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/2298\/revisions\/2397"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/media\/2048"}],"wp:attachment":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2298"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2298"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2298"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}