Questions[boto3](server)

I have a static website consisting of multiple HTML, CSS, and media files uploaded to a private S3 bucket. I would like to access the website using my web browser.

I'm currently using boto3 to generate a presigned URL for a single HTML file. How do I access the entire application without making the bucket public?

s3client = boto3.client('s3')
url = s3client.generate_presigned_url(
    ClientMethod='get_object',
    Params={
        'Bucket': 'my-bucket',
        'Key': 'my-website/index.html',
    }
) # url shows html content but no CSS styling or media files

Trying Create a Launch Configuration item, I get this error:

Launch Config problem: An error occurred (ValidationError) when calling the operation: Invalid IamInstanceProfile:AWS_EC2_INSTANCE_PROFILE_ROLE

executing this type of code w/boto 3:

self.as_client.create_launch_configuration(
                KeyName=f"{self.vpcid}-{self.profile_name}.pem",
                IamInstanceProfile=self.inst_prof_name,
                ImageId=self.ec2_inst.ami,
                InstanceType=self.ec2_inst.type,
                LaunchConfigurationName=self.ec2_inst.lc_name,
                SecurityGroups=[x.id for x in self.sec_groups.values()],
                UserData=userdata,
            )

I created 2 locally managed policies and attached them to a Role and assigned the role to an instance profile. (It seems boto3 does not allow viewing locally managed policies in the Role, only managed AWS ones, except when explicitly trying):

print(iam_client.get_role_policy(RoleName="EC2AppRole",PolicyName="CloudWatchSendPolicy"))
print(iam_client.get_role_policy(RoleName="EC2AppRole",PolicyName="AwsSecretsPolicy"))

Here's the Role w/ policy details:

== Role: EC2AppRole ==

{'RoleName': 'EC2AppRole', 'PolicyName': 'CloudWatchSendPolicy', 'PolicyDocument': {'Version': '2012-10-17', 'Statement': [{'Action': ['autoscaling:Describe*', 'cloudwatch:', 'logs:', 'sns:'], 'Effect': 'Allow', 'Resource': ''}]},

{'RoleName': 'EC2AppRole', 'PolicyName': 'AwsSecretsPolicy', 'PolicyDocument': {'Version': '2012-10-17', 'Statement': {'Effect': 'Allow', 'Action': ['secretsmanager:Describe*', 'secretsmanager:Get*', 'secretsmanager:List*'], 'Resource': '*'}},

The Instance Profiles seems OK:

== Instance Profile == {'Path': '/', 'InstanceProfileName': 'AWS_EC2_INSTANCE_PROFILE_ROLE', 'InstanceProfileId': 'AIPAXQXBO3GJ2LGTKDJ3L', 'Arn': 'arn:aws:iam::516942649747:instance-profile/AWS_EC2_INSTANCE_PROFILE_ROLE', 'CreateDate': datetime.datetime(2020, 12, 24, 5, 30, 4, tzinfo=tzutc()), 'Roles': [{'Path': '/', 'RoleName': 'EC2AppRole', 'RoleId': 'AROAXQXBO3GJ2AUOHJMVV', 'Arn': 'arn:aws:iam::516942649747:role/EC2AppRole', 'CreateDate': datetime.datetime(2020, 12, 24, 5, 30, 4, tzinfo=tzutc()), 'AssumeRolePolicyDocument': {'Version': '2012-10-17', 'Statement': [{'Effect': 'Allow', 'Principal': {'Service': 'ec2.amazonaws.com'}, 'Action': 'sts:AssumeRole'}]}}]}

Sorry I don't know how to properly format this post very well.

Any information I can share to help clarify?

I've tested everything in the create_launch_configuration call to be correct as best I can tell.

I have two variable definition files as follows

vars.yml

aws_common_tags:
    Project: "{{ project_name }}"
    Application: "{{ application_name }}"
        Region: "{{ aws_region }}"
        Ansible: "Yes"

instance.yml

ec2_instance_tags:
    environment_name: dev

Now in task.yml I am trying to create aws ec2 instance with all tags but its not working.

ec2:
    key_name: "{{ keypair_name }}"
    instance_type: "{{ ec2_instance_type }}"
    instance_tags: "{{ aws_common_tags + ec2_instance_tags }}"

We are getting the following error:

"tags": {
        "Ansible": "Yes",
        "Application": "webserver",
        "Project": "document_upload",
        "Region": "us-west-2"
    },

fatal: [localhost]: FAILED! => {
    "msg": "Unexpected templating type error occurred on ({{ aws_common_tags + ec2_instance_tags }}): unsupported operand type(s) for +: 'dict' and 'dict'" }

Thanks

I am trying to set security group ids while creating an EC2 instance. If I have a specific security group Id list, I can do this:

boto3.resource(resource, region_name=self.region)
ec2 = self.resource

instances = ec2.create_instances(
        ImageId=image_id,
        MinCount=minCount,
        MaxCount=maxCount,
        InstanceType=instance_type,
        SubnetId=subnet_id,
        KeyName=key_pair,                
        SecurityGroupIds=security_groups)

If I don't have the security group ids I'd like to use a default security group ids that get associated to launch-wizard-# security group if I don't pass SecurityGroupIds argument in ec2.create_instances. Is there a way to pass something to SecurityGroupIds argument that tells boto3 to use default security group Id? More specifically:

instances = ec2.create_instances(
            ImageId=image_id,
            MinCount=minCount,
            MaxCount=maxCount,
            InstanceType=instance_type,
            SubnetId=subnet_id,
            KeyName=key_pair,                
            SecurityGroupIds= <"What do I pass here so that boto3 takes in defaults?">)

So that I get the same behavior as below (using the previous code snippet):

instances = ec2.create_instances(
                 ImageId=image_id,
                 MinCount=minCount,
                 MaxCount=maxCount,
                 InstanceType=instance_type,
                 SubnetId=subnet_id,
                 KeyName=key_pair)