AWSSupport-StartEC2RescueWorkflow

Description

The AWSSupport-StartEC2RescueWorkflow runbook runs the provided base64 encoded script (Bash or Powershell) on a helper instance created to rescue your instance. The root volume of your instance is attached and mounted to the helper instance, also known as the EC2Rescue instance. If your instance is Windows, provide a Powershell script. Otherwise, use Bash. The runbook sets some environment variables which you can use in your script. The environment variables contain information about the input you provided, as well as information about the offline root volume. The offline volume is already mounted and ready to use. For example, you can save a Desired State Configuration file to an offline Windows root volume, or chroot to an offline Linux root volume and perform an offline remediation.

Run this Automation (console)

Additional Information

To base64 encode a script, you can use either Powershell or Bash. Powershell:

[System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes([System.IO.File]::ReadAllText('PATH_TO_FILE')))

Bash:

base64 PATH_TO_FILE

Here is a list of environment variables you can use in your offline scripts, depending on the target OS

Windows:

Linux:

Document type

Automation

Owner

Amazon

Platforms

Linux, macOS, Windows

Parameters

Required IAM permissions

The AutomationAssumeRole parameter requires the following actions to use the runbook successfully.

It is recommended the user who runs the automation have the AmazonSSMAutomationRole IAM managed policy attached. In addition to that policy, the user must have:

{
                "Version": "2012-10-17",
                "Statement": [
                   {
                      "Action": [
                         "lambda:InvokeFunction",
                         "lambda:DeleteFunction",
                         "lambda:GetFunction"
                      ],
                      "Resource": "arn:aws:lambda:*:An-AWS-Account-ID:function:AWSSupport-EC2Rescue-*",
                      "Effect": "Allow"
                   },
                   {
                      "Action": [
                         "s3:GetObject",
                         "s3:GetObjectVersion"
                      ],
                      "Resource": [
                         "arn:aws:s3:::awssupport-ssm.*/*.template",
                         "arn:aws:s3:::awssupport-ssm.*/*.zip"
                      ],
                      "Effect": "Allow"
                   },
                   {
                      "Action": [
                         "iam:CreateRole",
                         "iam:CreateInstanceProfile",
                         "iam:GetRole",
                         "iam:GetInstanceProfile",
                         "iam:PutRolePolicy",
                         "iam:DetachRolePolicy",
                         "iam:AttachRolePolicy",
                         "iam:PassRole",
                         "iam:AddRoleToInstanceProfile",
                         "iam:RemoveRoleFromInstanceProfile",
                         "iam:DeleteRole",
                         "iam:DeleteRolePolicy",
                         "iam:DeleteInstanceProfile"
                      ],
                      "Resource": [
                         "arn:aws:iam::An-AWS-Account-ID:role/AWSSupport-EC2Rescue-*",
                         "arn:aws:iam::An-AWS-Account-ID:instance-profile/AWSSupport-EC2Rescue-*"
                      ],
                      "Effect": "Allow"
                   },
                   {
                      "Action": [
                         "lambda:CreateFunction",
                         "ec2:CreateVpc",
                         "ec2:ModifyVpcAttribute",
                         "ec2:DeleteVpc",
                         "ec2:CreateInternetGateway",
                         "ec2:AttachInternetGateway",
                         "ec2:DetachInternetGateway",
                         "ec2:DeleteInternetGateway",
                         "ec2:CreateSubnet",
                         "ec2:DeleteSubnet",
                         "ec2:CreateRoute",
                         "ec2:DeleteRoute",
                         "ec2:CreateRouteTable",
                         "ec2:AssociateRouteTable",
                         "ec2:DisassociateRouteTable",
                         "ec2:DeleteRouteTable",
                         "ec2:CreateVpcEndpoint",
                         "ec2:DeleteVpcEndpoints",
                         "ec2:ModifyVpcEndpoint",
                         "ec2:Describe*"
                      ],
                      "Resource": "*",
                      "Effect": "Allow"
                   }
                ]
             }

Document Steps

Outputs

runScriptForLinux.Output

runScriptForWindows.Output

preScriptBackup.ImageId

postScriptBackup.ImageId