Draft proposal; Support autoupdate in AWS Private operators

.github/actions/build_aws_eif/action.yaml

@@ -97,6 +97,7 @@ runs:
         cp ${{ steps.buildFolder.outputs.BUILD_FOLDER }}/identity_scope.txt                                       ${ARTIFACTS_OUTPUT_DIR}/
         cp ${{ steps.buildFolder.outputs.BUILD_FOLDER }}/version_number.txt                                       ${ARTIFACTS_OUTPUT_DIR}/
         cp ./scripts/aws/ec2.py                                                                                   ${ARTIFACTS_OUTPUT_DIR}/
+        cp ./scripts/aws/autoupdate.py                                                                            ${ARTIFACTS_OUTPUT_DIR}/
         cp ./scripts/confidential_compute.py                                                                      ${ARTIFACTS_OUTPUT_DIR}/
         cp ./scripts/aws/requirements.txt                                                                         ${ARTIFACTS_OUTPUT_DIR}/
         cp ./scripts/aws/proxies.host.yaml                                                                        ${ARTIFACTS_OUTPUT_DIR}/
@@ -112,6 +113,7 @@ runs:
         cp ./scripts/aws/logrotate/operator-logrotate.conf                                                        ${ARTIFACTS_OUTPUT_DIR}/
         cp ./scripts/aws/logrotate/logrotate                                                                      ${ARTIFACTS_OUTPUT_DIR}/
         cp ./scripts/aws/logrotate/logrotateDaily                                                                 ${ARTIFACTS_OUTPUT_DIR}/
+        cp ./scripts/aws/logrotate/autoupdate                                                                     ${ARTIFACTS_OUTPUT_DIR}/
         cp -r ./scripts/aws/config-server                                                                         ${ARTIFACTS_OUTPUT_DIR}/
 
         docker cp amazonlinux:/sockd                                    ${ARTIFACTS_OUTPUT_DIR}/

scripts/aws/UID_CloudFormation.template.yml

@@ -14,7 +14,7 @@ Parameters:
       - integ
   ImageId:
     Type: AWS::EC2::Image::Id
-    Default: ami-example1234567890
+    Default: ami-0050e67a1af79f68f
   TrustNetworkCidr:
     Description: The IP address range that can be used to SSH and HTTPS to the EC2 instances
     Type: String
@@ -136,6 +136,9 @@ Resources:
               - 'kms:GenerateDataKey*'
               - 'kms:Describe*'
             Resource: '*'
+      Tags:
+        - Key: Project
+          Value: UID2
   SSMKEYAlias:
     Type: AWS::KMS::Alias
     Properties:
@@ -164,6 +167,9 @@ Resources:
           - Ref: DeployToEnvironment
           - '"'
           - '}'
+      Tags:
+        - Key: Project
+          Value: UID2
   WorkerRole:
     Type: 'AWS::IAM::Role'
     Properties:
@@ -190,8 +196,41 @@ Resources:
               - Effect: Allow
                 Action: 'secretsmanager:GetSecretValue'
                 Resource: !Sub 'arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:uid2-config-stack-${AWS::StackName}*'
+              - Sid: EC2LaunchTemplateWrite
+                Effect: Allow
+                Action:
+                  - 'ec2:CreateLaunchTemplateVersion'
+                Resource:
+                  - !Sub 
+                    - 'arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:launch-template/${LaunchTemplateId}'
+                    - LaunchTemplateId: !Ref LaunchTemplate
+              - Sid: AutoScalingReadPermissions
+                Effect: Allow
+                Action:
+                  - 'autoscaling:DescribeAutoScalingInstances'
+                  - 'autoscaling:DescribeAutoScalingGroups'
+                  - 'autoscaling:DescribeInstanceRefreshes'
+                Resource: '*'
+              - Sid: AutoScalingWritePermissions
+                Effect: Allow
+                Action:
+                  - 'autoscaling:UpdateAutoScalingGroup'
+                  - 'autoscaling:StartInstanceRefresh'
+                Resource: '*'
+                Condition:
+                  StringEquals:
+                    'aws:ResourceTag/Project': 'UID2'
+              - Sid: EC2DescribePermissions
+                Effect: Allow
+                Action:
+                  - 'ec2:DescribeLaunchTemplates'
+                  - 'ec2:DescribeLaunchTemplateVersions'
+                Resource: '*'
       ManagedPolicyArns:
         - 'arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy'
+      Tags:
+        - Key: Project
+          Value: UID2
   WorkerInstanceProfile:
     Type: 'AWS::IAM::InstanceProfile'
     Properties:
@@ -230,9 +269,13 @@ Resources:
           CidrIp: 0.0.0.0/0
           Description: "Allow Outbound DNS"
       VpcId: !Ref VpcId
+      Tags:
+        - Key: Project
+          Value: UID2
   LaunchTemplate:
     Type: AWS::EC2::LaunchTemplate
     Properties:
+      LaunchTemplateName: !Sub 'uid2-launch-template-${AWS::StackName}'
       LaunchTemplateData:
         BlockDeviceMappings:
         - DeviceName: /dev/xvda
@@ -261,6 +304,15 @@ Resources:
           HttpTokens: required # Enforces IMDSv2
           HttpPutResponseHopLimit: 1
           InstanceMetadataTags: enabled
+        TagSpecifications:
+          - ResourceType: instance
+            Tags:
+              - Key: Project
+                Value: UID2
+          - ResourceType: volume
+            Tags:
+              - Key: Project
+                Value: UID2
   AutoScalingGroup:
     Type: AWS::AutoScaling::AutoScalingGroup
     DependsOn:
@@ -283,6 +335,9 @@ Resources:
       - Key: Name
         Value: 'UID2 Instance'
         PropagateAtLaunch: true
+      - Key: Project
+        Value: UID2
+        PropagateAtLaunch: true
     CreationPolicy:
       ResourceSignal:
         Count: 1