Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to use EC2 to provide an easy-to-use way to bootstrap a hard-to-build web application. Trouble is, there is some sensitive configuration on the filesystem, such as password salts.

I've written a user-data script that replaces these salts with random values on first boot, and I put this in the user-data attribute of the instance from which I built my AMI.

But now it looks to me like user-data scripts are specific to instances, not AMIs - that is, it's only run when specified by the user doing the cloning, not the creator of the AMI (me).

Well... duh, I guess that makes sense given the name "user data".

Is that wrong? Is there any way for me to provide a script that's run automagically on new clones of my AMI?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

If you are building the AMI, then you can put whatever you want on the file system.

For your high level question about running code on startup, you can add the code as a standard system startup script on the AMI file system. The specific way to do this depends on the initialization software used by your particular Linux distro and release.

HOWEVER! Your specific example of overwriting sensitive data on the file system is not something that is safe to do in an AMI. Sensitive, private, or secret information should never be placed in an AMI. In fact, it should never touch the EBS volume used to build a public AMI as there are ways for users to restore the data that has been deleted.

I've written a couple articles about these security risks:

Creating Public AMIs Securely for EC2
http://alestic.com/2011/06/ec2-ami-security

Hidden Dangers in Creating Public EBS Snapshots on EC2
http://alestic.com/2009/09/ec2-public-ebs-danger

share|improve this answer
    
Thanks for the good reading. I guess the question then becomes twofold: 1) how to ensure that my image is clean, which your articles address pretty well; and 2) how to write an init script that only runs once per image, not once per boot. I think I can steal some ideas from the user-data runner for the latter. –  slinkp Sep 8 '11 at 20:11
    
Glad to be of assistance. If you still have questions about how to create startup scripts, post a separate question describing the details of what you want to do and what Linux distro you're using. –  Eric Hammond Sep 12 '11 at 21:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.