Update a golden AMI using Automation, AWS Lambda, and Parameter Store

Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

In the navigation pane, choose Policies, and then choose Create policy.

Choose the JSON tab.

Replace the default contents with the following policy. Replace each example resource placeholder with your own information.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": "arn:aws:logs:region:123456789012:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:region:123456789012:log-group:/aws/lambda/function name:*"
            ]
        }
    ]
}

Choose Next: Tags.

(Optional) Add one or more tag-key value pairs to organize, track, or control access for this policy.

Choose Next: Review.

On the Review policy page, for Name, enter a name for the inline policy, such as amiLambda.

Choose Create policy.

Repeat steps 2 and 3.

Paste the following policy. Replace each example resource placeholder with your own information.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ssm:PutParameter",
            "Resource": "arn:aws:ssm:region:123456789012:parameter/latestAmi"
        },
        {
            "Effect": "Allow",
            "Action": "ssm:DescribeParameters",
            "Resource": "*"
        }
    ]
}

Choose Next: Tags.

(Optional) Add one or more tag-key value pairs to organize, track, or control access for this policy.

Choose Next: Review.

On the Review policy page, for Name, enter a name for the inline policy, such as amiParameter.

Choose Create policy.

In the navigation pane, choose Roles, and then choose Create role.

Immediately under Use case, choose Lambda, and then choose Next.

On the Add permissions page, use the Search field to locate the two policies you created earlier.

Select the check box next to the policies, and then choose Next.

For Role name, enter a name for your new role, such as lambda-ssm-role or another name that you prefer.

(Optional) Add one or more tag key-value pairs to organize, track, or control access for this role, and then choose Create role.

Sign in to the AWS Management Console and open the AWS Lambda console at https://console.aws.amazon.com/lambda/.

Choose Create function.

On the Create function page, choose Author from scratch.

For Function name, enter Automation-UpdateSsmParam.

For Runtime, choose Python 3.8.

For Architecture, select the type of computer processor for Lambda to use to run the function, x86_64 or arm64,

In the Permissions section, expand Change default execution role.

Choose Use an existing role, and then choose the service role for Lambda that you created in Task 2.

Choose Create function.

In the Code source area, on the lambda_function tab, delete the pre-populated code in the field, and then paste the following code sample.

from __future__ import print_function

import json
import boto3

print('Loading function')


#Updates an SSM parameter
#Expects parameterName, parameterValue
def lambda_handler(event, context):
    print("Received event: " + json.dumps(event, indent=2))

    # get SSM client
    client = boto3.client('ssm')

    #confirm  parameter exists before updating it
    response = client.describe_parameters(
       Filters=[
          {
           'Key': 'Name',
           'Values': [ event['parameterName'] ]
          },
        ]
    )

    if not response['Parameters']:
        print('No such parameter')
        return 'SSM parameter not found.'

    #if parameter has a Description field, update it PLUS the Value
    if 'Description' in response['Parameters'][0]:
        description = response['Parameters'][0]['Description']
        
        response = client.put_parameter(
          Name=event['parameterName'],
          Value=event['parameterValue'],
          Description=description,
          Type='String',
          Overwrite=True
        )
    
    #otherwise just update Value
    else:
        response = client.put_parameter(
          Name=event['parameterName'],
          Value=event['parameterValue'],
          Type='String',
          Overwrite=True
        )
        
    responseString = 'Updated parameter %s with value %s.' % (event['parameterName'], event['parameterValue'])
        
    return responseString

Choose File, Save.

To test the Lambda function, from the Test menu, choose Configure test event.

For Event name, enter a name for the test event, such as MyTestEvent.

Replace the existing text with the following JSON. Replace AMI ID with your own information to set your latestAmi parameter value.

{
   "parameterName":"latestAmi",
   "parameterValue":"AMI ID"
}

Choose Save.

Choose Test to test the function. On the Execution result tab, the status should be reported as Succeeded, along with other details about the update.

Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/.

In the navigation pane, choose Documents.

For Create document, choose Automation.

For Name, enter UpdateMyLatestWindowsAmi.

Choose the Editor tab, and then choose Edit.

Choose OK when prompted.

In the Document editor field, replace the default content with the following YAML sample runbook content.

---
description: Systems Manager Automation Demo - Patch AMI and Update ASG
schemaVersion: '0.3'
assumeRole: '{{ AutomationAssumeRole }}'
parameters:
  AutomationAssumeRole:
    type: String
    description: '(Required) The ARN of the role that allows Automation to perform the actions on your behalf. If no role is specified, Systems Manager Automation uses your IAM permissions to execute this document.'
    default: ''
  SourceAMI:
    type: String
    description: The ID of the AMI you want to patch.
    default: '{{ ssm:latestAmi }}'
  SubnetId:
    type: String
    description: The ID of the subnet where the instance from the SourceAMI parameter is launched.
  SecurityGroupIds:
    type: StringList
    description: The IDs of the security groups to associate with the instance that's launched from the SourceAMI parameter.
  NewAMI:
    type: String
    description: The name of of newly patched AMI.
    default: 'patchedAMI-{{global:DATE_TIME}}'
  InstanceProfile:
    type: String
    description: The name of the IAM instance profile you want the source instance to use.
  SnapshotId:
    type: String
    description: (Optional) The snapshot ID to use to retrieve a patch baseline snapshot.
    default: ''
  RebootOption:
    type: String
    description: '(Optional) Reboot behavior after a patch Install operation. If you choose NoReboot and patches are installed, the instance is marked as non-compliant until a subsequent reboot and scan.'
    allowedValues:
      - NoReboot
      - RebootIfNeeded
    default: RebootIfNeeded
  Operation:
    type: String
    description: (Optional) The update or configuration to perform on the instance. The system checks if patches specified in the patch baseline are installed on the instance. The install operation installs patches missing from the baseline.
    allowedValues:
      - Install
      - Scan
    default: Install
mainSteps:
  - name: startInstances
    action: 'aws:runInstances'
    timeoutSeconds: 1200
    maxAttempts: 1
    onFailure: Abort
    inputs:
      ImageId: '{{ SourceAMI }}'
      InstanceType: m5.large
      MinInstanceCount: 1
      MaxInstanceCount: 1
      IamInstanceProfileName: '{{ InstanceProfile }}'
      SubnetId: '{{ SubnetId }}'
      SecurityGroupIds: '{{ SecurityGroupIds }}'
  - name: verifyInstanceManaged
    action: 'aws:waitForAwsResourceProperty'
    timeoutSeconds: 600
    inputs:
      Service: ssm
      Api: DescribeInstanceInformation
      InstanceInformationFilterList:
        - key: InstanceIds
          valueSet:
            - '{{ startInstances.InstanceIds }}'
      PropertySelector: '$.InstanceInformationList[0].PingStatus'
      DesiredValues:
        - Online
    onFailure: 'step:terminateInstance'
  - name: installPatches
    action: 'aws:runCommand'
    timeoutSeconds: 7200
    onFailure: Abort
    inputs:
      DocumentName: AWS-RunPatchBaseline
      Parameters:
        SnapshotId: '{{SnapshotId}}'
        RebootOption: '{{RebootOption}}'
        Operation: '{{Operation}}'
      InstanceIds:
        - '{{ startInstances.InstanceIds }}'
  - name: stopInstance
    action: 'aws:changeInstanceState'
    maxAttempts: 1
    onFailure: Continue
    inputs:
      InstanceIds:
        - '{{ startInstances.InstanceIds }}'
      DesiredState: stopped
  - name: createImage
    action: 'aws:createImage'
    maxAttempts: 1
    onFailure: Continue
    inputs:
      InstanceId: '{{ startInstances.InstanceIds }}'
      ImageName: '{{ NewAMI }}'
      NoReboot: false
      ImageDescription: Patched AMI created by Automation
  - name: terminateInstance
    action: 'aws:changeInstanceState'
    maxAttempts: 1
    onFailure: Continue
    inputs:
      InstanceIds:
        - '{{ startInstances.InstanceIds }}'
      DesiredState: terminated
  - name: updateSsmParam
    action: aws:invokeLambdaFunction
    timeoutSeconds: 1200
    maxAttempts: 1
    onFailure: Abort
    inputs:
        FunctionName: Automation-UpdateSsmParam
        Payload: '{"parameterName":"latestAmi", "parameterValue":"{{createImage.ImageId}}"}'
outputs:
- createImage.ImageId

Choose Create automation.

In the navigation pane, choose Automation, and then choose Execute automation.

In the Choose document page, choose the Owned by me tab.

Search for the UpdateMyLatestWindowsAmi runbook, and select the button in the UpdateMyLatestWindowsAmi card.

Choose Next.

Choose Simple execution.

Specify values for the input parameters.

Choose Execute.

After the automation completes, choose Parameter Store in the navigation pane and confirm that the new value for latestAmi matches the value returned by the automation. You can also verify the new AMI ID matches the Automation output in the AMIs section of the Amazon EC2 console.