Checking in code for rt 7.27.3 version

This commit is contained in:
Vinay Aggarwal
2021-10-04 13:05:03 -07:00
parent 161f222b2a
commit 4cb7e10617
393 changed files with 31569 additions and 0 deletions

View File

@@ -0,0 +1,28 @@
// Change the following attributes.
:quickstart-project-name: quickstart-linux-bastion
:partner-product-name: Linux Bastion Hosts
// For the following attribute, if you have no short name, enter the same name as partner-product-name.
:partner-product-short-name: Linux bastion hosts
// If there's no partner, comment partner-company-name and partner-contributors.
// :partner-company-name: Example Company Name, Ltd.
:doc-month: March
:doc-year: 2021
// For the following two "contributor" attributes, if the partner agrees to include names in the byline,
// enter names for both partner-contributors and quickstart-contributors.
// If partner doesn't want to include names, delete all placeholder names and keep only
// "{partner-company-name}" and "AWS Quick Start team."
// Use the comma before "and" only when three or more names.
//:partner-contributors: Shuai Ye, Michael McConnell, and John Smith, {partner-company-name}
:aws-contributors: Santiago Cardenas, AWS Serverless Partners
:quickstart-contributors: Tony Vattathil and Ian Hill, AWS Quick Start team
// For deployment_time, use minutes if deployment takes an hour or less,
// for example, 30 minutes or 60 minutes.
// Use hours for deployment times greater than 60 minutes (rounded to a quarter hour),
// for example, 1.25 hours, 2 hours, 2.5 hours.
:deployment_time: 5 minutes
:default_deployment_region: us-west-2
:parameters_as_appendix:
// Uncomment the following two attributes if you are using an AWS Marketplace listing.
// Additional content will be generated automatically based on these attributes.
// :marketplace_subscription:
// :marketplace_listing_url: https://example.com/

View File

@@ -0,0 +1,109 @@
// Add steps as necessary for accessing the software, post-configuration, and testing. Dont include full usage instructions for your software, but add links to your product documentation for that information.
//Should any sections not be applicable, remove them
== Post-deployment steps
// If post-deployment steps are required, add them here. If not, remove the heading
Log in to the bastion host. Use one of the following user names, depending on your
choice of Linux distribution:
* Amazon Linux: *ec2-user*
* CentOS: *centos*
* Ubuntu: *ubuntu*
The Linux distribution is specified in the *Bastion AMI operating system* parameter when you deploy the templates. For more information, see link:#_parameter_reference[Parameter reference].
=== Enabling and customizing the Linux bastion host banner
:xrefstyle: short
This Quick Start provides the default banner illustrated in <<banner>> for the Linux bastion
hosts. The banner is disabled by default. To enable it, set the
*Bastion banner* parameter to *true* during deployment.
[#banner]
.Customizing the Linux bastion host banner
image::../images/banner.png[banner,width=100%,height=100%]
To customize the banner, create an ASCII text file with your own banner content. Then upload it to an S3 bucket or other publicly accessible location, and verify that it is accessible from the host.
=== Bastion logging
The bastion hosts deployed by this Quick Start provide a command logger in the
`/var/log/audit/audit.log` file. This log file contains the
date, SSH client connection IP address, user name, working directory, and the
commands issued.
For added security, the contents of the `/var/log/audit/audit.log` file is also stored
in a CloudWatch Logs log group in the AWS Cloud, and remains available in case the
bastion hosts fail.
The log includes a history of the commands that are run when you log in. <<logging>> shows an example.
:xrefstyle: short
[#logging]
.Bastion logging
image::../images/logging.png[Regloggingion,width=100%,height=100%]
To notify your users that all their commands will be monitored and logged, we recommend that you enable the bastion host banner. For more information, see link:#_enabling_and_customizing_the_linux_bastion_host_banner[Enabling and Customizing the Linux bastion host banner]. The default banner text includes the alert shown in <<banner>>, which you can customize.
The `bastion.log` file is an immutable file that cannot be easily deleted or tampered with. However, in case this happens, there is a shadow file with a copy of `bastion.log` located in `/var/log/audit/audit.log`. And, the Quick Start also stores the contents of `bastion.log` remotely using the CloudWatch Logs service. Log files can be found under CloudWatch Logs using the instance ID as the log stream name.
== Best practices for using {partner-product-short-name} on AWS
// Provide post-deployment best practices for using the technology on AWS, including considerations such as migrating data, backups, ensuring high performance, high availability, etc. Link to software documentation for detailed information.
The architecture built by this Quick Start supports AWS best practices for high availability and security.
* Linux bastion hosts are deployed in two Availability Zones to support immediate access across the VPC. You can configure the number of bastion host instances at launch.
* An Auto Scaling group ensures that the number of bastion host instances always matches the desired capacity you specify during launch.
* Bastion hosts are deployed in the public (DMZ) subnets of the VPC.
* Elastic IP addresses are associated with bastion instances to allow these IP addresses from on-premises firewalls. When an instance is shut down, the Auto Scaling group launches a new instance, and the existing Elastic IP addresses are associated with it. This ensures that the same trusted Elastic IP addresses are used at all times.
* Inbound access to bastion hosts is locked down to known CIDR scopes. This is achieved by associating the bastion instances with a security group. The Quick Start creates a BastionSecurityGroup resource for this purpose.
* Ports are limited to allow only the necessary access to the bastion hosts. For Linux bastion hosts, TCP port 22 for SSH connections is typically the only port allowed.
We recommend that you follow these best practices when using the architecture built by the Quick Start:
* When you add new instances to the VPC that require management access from the bastion host, associate a security group inbound rule with each instance. The rule should reference the bastion security group as the source. It is also important to limit access to the required ports for administration.
* During deployment, the public key from the Amazon EC2 key pair is associated with the user ec2-user in the Linux instance. For additional users, create users with the required permissions and associate them with their individual authorized public keys for SSH connectivity.
* For the bastion host instances, select the number and type of instances according to the number of users and operations to be performed. The Quick Start creates one bastion host instance and uses the t2.micro instance type by default, but you can change these settings during deployment.
NOTE: You can also change the number and type of bastion host instances after deployment by updating the AWS CloudFormation stack and changing the parameters. Reconfiguring the bastion host instances updates the related Elastic IP addresses and changes the bootstrapping logic in the launch configuration and Auto Scaling group. However, before you update the stack, you must shut down the instances you want to replace while keeping the Elastic IP addresses. When you update the stack, the Auto Scaling group launches the new instances with the updated instance type. Bootstrapping will assign the Elastic IP addresses from the existing pool of IP addresses that were provisioned during the initial deployment.
* Set your desired expiration time directly in the CloudWatch Logs log group for the logs collected from each bastion instance. This ensures that bastion log history is retained only for the amount of time you need.
* Keep CloudWatch log files for each bastion host instance separate so that you can filter and isolate log messages from individual bastion hosts. Every instance that is launched by the bastion Auto Scaling group will create its own log stream based on the instance ID.
== Security
// Provide post-deployment best practices for using the technology on AWS, including considerations such as migrating data, backups, ensuring high performance, high availability, etc. Link to software documentation for detailed information.
This Quick Start provisions one Linux bastion host in each Availability Zone with a single
security group as a virtual firewall. This security group is required for remote access from
the Internet. The security group is configured as follows:
=== Inbound
|===
|Source|Protocol|Ports
|Remote access CIDR|TCP|22
|Remote access CIDR|ICMP|N/A
|===
=== Outbound
|===
|Destination|Protocol|Ports
|0.0.0.0/0 |All|All
|===
For more information, see https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Security.html[Internetwork traffic privacy in Amazon VPC^].
== Other useful information
//Provide any other information of interest to users, especially focusing on areas where AWS or cloud usage differs from on-premises usage.
* https://aws.amazon.com/documentation/cloudformation/[AWS CloudFormation Documentation^]
* Amazon EC2
** https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/[What is Amazon EC2?^]
** https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html[Elastic IP addresses^]
* https://aws.amazon.com/documentation/vpc/[Amazon Virtual Private Cloud Documentation^]
** https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html[Security groups for your VPC^]
** https://blogs.aws.amazon.com/security/post/Tx3N8GFK85UN1G6/Securely-connect-to-Linux-instances-running-in-a-private-Amazon-VPC[Securely Connect to Linux Instances Running a Private Amazon VPC^]

View File

@@ -0,0 +1,30 @@
Deploying this Quick Start for a new virtual private cloud (VPC) with
default parameters builds the following {partner-product-short-name} environment in the
AWS Cloud.
// Replace this example diagram with your own. Send us your source PowerPoint file. Be sure to follow our guidelines here : http://(we should include these points on our contributors giude)
:xrefstyle: short
[#architecture1]
.Quick Start architecture for {partner-product-short-name} on AWS
image::../images/architecture_diagram.png[Architecture,width=100%,height=100%]
As shown in <<architecture1>>, the Quick Start sets up the following:
* A highly available architecture that spans two Availability Zones.*
* A VPC configured with public and private subnets, according to AWS
best practices, to provide you with your own virtual network on AWS.*
* An internet gateway to allow access to the internet. This gateway is used by the bastion
hosts to send and receive traffic.*
* Managed NAT gateways to allow outbound internet access for resources in the private
subnets.*
* A Linux bastion host in each public subnet with an Elastic IP address. These allow inbound
SSH (Secure Shell) access to EC2 instances in public and private subnets.
* A security group for fine-grained inbound access control.
* An Amazon EC2 Auto Scaling group with a configurable number of instances.
* A set of Elastic IP addresses that match the number of bastion host instances. If the
Auto Scaling group relaunches any instances, these addresses are reassociated with the
new instances.
* An Amazon CloudWatch Logs log group to hold the Linux bastion host shell history logs.
// Add bullet points for any additional components that are included in the deployment. Make sure that the additional components are also represented in the architecture diagram. End each bullet with a period.
[.small]#*The template that deploys the Quick Start into an existing VPC skips the components marked by asterisks and prompts you for your existing VPC configuration.#

View File

@@ -0,0 +1,47 @@
// We need to work around Step numbers here if we are going to potentially exclude the AMI subscription
=== Sign in to your AWS account
. Sign in to your AWS account at https://aws.amazon.com with an IAM user role that has the necessary permissions. For details, see link:#_planning_the_deployment[Planning the deployment] earlier in this guide.
. Make sure that your AWS account is configured correctly, as discussed in the link:#_technical_requirements[Technical requirements] section.
// Optional based on Marketplace listing. Not to be edited
ifdef::marketplace_subscription[]
=== Subscribe to the {partner-product-short-name} AMI
This Quick Start requires a subscription to the AMI for {partner-product-short-name} in AWS Marketplace.
. Sign in to your AWS account.
. Open the page for the {marketplace_listing_url}[{partner-product-short-name} AMI in AWS Marketplace^], and then choose *Continue to Subscribe*.
. Review the terms and conditions for software usage, and then choose *Accept Terms*. +
A confirmation page loads, and an email confirmation is sent to the account owner. For detailed subscription instructions, see the https://aws.amazon.com/marketplace/help/200799470[Getting started^] in the AWS Marketplace Buyer Guide.
. When the subscription process is complete, exit out of AWS Marketplace without further action. *Do not* provision the software from AWS Marketplace—the Quick Start deploys the AMI for you.
endif::marketplace_subscription[]
// \Not to be edited
=== Launch the Quick Start
// Adapt the following warning to your Quick Start.
WARNING: If you are using the CentOS operating system, subscribe to the https://aws.amazon.com/marketplace/pp/B00O7WM7QW[CentOS AMI in AWS
Marketplace.]
WARNING: When deploying this Quick Start into an existing VPC, ensure that your VPC has two private subnets in different Availability Zones for the workload instances and that the subnets are not shared. This Quick Start does not support https://docs.aws.amazon.com/vpc/latest/userguide/vpc-sharing.html[shared subnets^]. These subnets require https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html[NAT gateways^] in their route tables to allow the instances to download packages and software without exposing them to the internet. Also ensure that the domain name option is configured as explained in http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_DHCP_Options.html[DHCP options sets^]. You provide your VPC settings when you launch the Quick Start.
Each deployment takes about {deployment_time} to complete.
. Sign in to your AWS account, and choose one of the following options to launch the AWS CloudFormation template. For help with choosing an option, see link:#_deployment_options[Deployment options] earlier in this guide.
[cols="3,1"]
|===
^|https://fwd.aws/rQWep[Deploy {partner-product-short-name} into a new VPC on AWS^]
^|https://fwd.aws/Jrm54[View template^]
^|https://fwd.aws/Jwzqv[Deploy {partner-product-short-name} into an existing VPC on AWS^]
^|https://fwd.aws/vWMxm[View template^]
|===
[start=2]
. Check the AWS Region thats displayed in the upper-right corner of the navigation bar, and change it if necessary. This Region is where the network infrastructure for {partner-product-short-name} is built. The template is launched in the {default_deployment_region} Region by default. For other choices, see link:#_supported_regions[Supported Regions] earlier in this guide.
[start=3]
. On the *Create stack* page, keep the default setting for the template URL, and then choose *Next*.
. On the *Specify stack details* page, change the stack name if needed. Review the parameters for the template. Provide values for the parameters that require input. For all other parameters, review the default settings and customize them as necessary. For details on each parameter, see the link:#_parameter_reference[Parameter reference] section of this guide. When you finish reviewing and customizing the parameters, choose *Next*.

View File

@@ -0,0 +1,8 @@
// Edit this placeholder text to accurately describe your architecture.√
This Quick Start provides two deployment options:
* *Deploy {partner-product-short-name} into a new VPC*. This option builds a new AWS environment consisting of the VPC, subnets, NAT gateways, security groups, bastion hosts, and other infrastructure components. It then deploys {partner-product-short-name} into this new VPC.
* *Deploy {partner-product-short-name} into an existing VPC*. This option provisions {partner-product-short-name} in your existing AWS infrastructure.
The Quick Start provides separate templates for these options. It also lets you configure Classless Inter-Domain Routing (CIDR) blocks, instance types, and Linux bastion host settings, as discussed later in this guide.

View File

@@ -0,0 +1,23 @@
// Add any tips or answers to anticipated questions.
== FAQ
*Q.* I encountered a *CREATE_FAILED* error when I launched the Quick Start.
*A.* If AWS CloudFormation fails to create the stack, relaunch the template with *Rollback on failure* set to *Disabled*. This setting is under *Advanced* in the AWS CloudFormation console on the *Configure stack options* page. With this setting, the stacks state is retained, and you can troubleshoot the issue.
WARNING: When you set *Rollback on failure* to *Disabled*, you continue to incur AWS charges for this stack. Ensure that you delete stack after troubleshooting.
For more information, see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html[Troubleshooting AWS CloudFormation^].
*Q.* I encountered a size-limitation error when I deployed the AWS CloudFormation templates.
*A.* Launch the Quick Start templates from the links in this guide or from another S3 bucket. If you deploy the templates from a local copy on your computer or from a location other than an S3 bucket, you might encounter template-size limitations. For more information, see http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cloudformation-limits.html[AWS CloudFormation quotas^].
*Q.* I changed the instance type parameter after deployment and updated the stack, but the
instance types did not change or the Elastic IP addresses were not reassociated after the stack
update.
*A.* Terminate your bastion host instances. They will be replaced by Auto Scaling. A bootstrap action is performed on the new
instances to configure security settings and
CloudWatch logs and associate Elastic IP addresses.

View File

@@ -0,0 +1,3 @@
// Include details about any licenses and how to sign up. Provide links as appropriate. If no licenses are required, clarify that. The following paragraphs provide examples of details you can provide. Remove italics, and rephrase as appropriate.
No licenses are required to deploy this Quick Start. All AWS service resources consumed during the launch of the Quick Start incur AWS service usage costs.

View File

@@ -0,0 +1,15 @@
// Replace the content in <>
// Identify your target audience and explain how/why they would use this Quick Start.
//Avoid borrowing text from third-party websites (copying text from AWS service documentation is fine). Also, avoid marketing-speak, focusing instead on the technical aspect.
This Quick Start deployment guide provides instructions for deploying Linux bastion hosts
in an Amazon Virtual Private Cloud (Amazon VPC) environment on the Amazon Web
Services (AWS) Cloud. The Quick Start also provides http://aws.amazon.com/cloudformation/[AWS CloudFormation^] templates that
automate the deployment.
The guide is for IT infrastructure architects, DevOps engineers, and administrators who want to deploy Linux bastion hosts to manage their AWS Cloud deployments remotely.
http://aws.amazon.com/quickstart/[Quick Starts^] are automated reference deployments for AWS Cloud infrastructure
components and key enterprise workloads on the AWS Cloud. Each Quick Start launches,
configures, and runs AWS compute, network, storage, and other services, using AWS best
practices for security and availability.

View File

@@ -0,0 +1,37 @@
// If no preperation is required, remove all content from here
=== Prepare your AWS account
==== Choose a Region
* Before deploying the stack, in the AWS Management Console, choose an AWS Region from the top toolbar.
+
:xrefstyle: short
[#region]
.Selecting an AWS Region
image::../images/region.png[region,width=25%,height=25%,align="center"]
+
NOTE: Consider choosing a Region closest to your data center or corporate network to
reduce network latency between systems running on AWS and the systems and users
on your corporate network.
==== Create a key pair
To create a http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html[key pair] in your preferred Region, do the following:
[start=1]
. In your AWS Management Console, choose an AWS Region.
. On the *Services* menu, choose *EC2*.
. Under *Network and Security*, choose *Key Pairs*.
. Choose *Create Key Pair*.
. Enter a name and choose *Create*.
+
:xrefstyle: short
[#keypair]
.Creating a key pair
image::../images/keypair.png[keypair,width=100%,height=100%]
+
Amazon EC2 uses public-key cryptography to encrypt and decrypt login information. To
be able to log in to your instances, you must create a key pair. On Linux, the key pair is
used to authenticate SSH login.

View File

@@ -0,0 +1,22 @@
// Replace the content in <>
// Briefly describe the software. Use consistent and clear branding.
// Include the benefits of using the software on AWS, and provide details on usage scenarios.
This Quick Start provides Linux bastion host functionality for AWS Cloud infrastructures. It
deploys a virtual private cloud (VPC) using the https://fwd.aws/9VdxN[Amazon VPC Quick Start reference
deployment]. Then, it sets up private and public subnets and deploys Linux bastion instances into
the VPC. You can also choose to deploy Linux bastion hosts into your existing AWS
infrastructure.
The bastion hosts provide secure access to Linux instances located in the private and public
subnets. The Quick Start architecture deploys Linux bastion host instances into every public
subnet to provide readily available administrative access to the environment. The Quick
Start sets up a Multi-AZ environment consisting of two Availability Zones. If highly
available bastion access is not necessary, you can stop the instance in the second
Availability Zone and start it up when needed.
You can use this Quick Start as a building block for your own Linux-based deployments.
You can add other infrastructure components and software layers to complete your Linux
environment in the AWS Cloud. To build an AWS Cloud infrastructure for accessing
Microsoft Windows-based instances, see the https://fwd.aws/5VrKP[Quick Start for Remote Desktop (RD)
Gateway].

View File

@@ -0,0 +1,31 @@
This Quick Start supports the following Regions:
[cols=2*,options="header"]
|===
|Code
|Name
|us-east-2 |US East (Ohio)
|us-east-1 |US East (N. Virginia)
|us-west-1 |US West (N. California)
|us-west-2 |US West (Oregon)
|af-south-1 |Africa (Cape Town)
|ap-east-1 |Asia Pacific (Hong Kong)
|ap-south-1 |Asia Pacific (Mumbai)
|ap-northeast-3 |Asia Pacific (Osaka-Local)
|ap-northeast-2 |Asia Pacific (Seoul)
|ap-southeast-1 |Asia Pacific (Singapore)
|ap-southeast-2 |Asia Pacific (Sydney)
|ap-northeast-1 |Asia Pacific (Tokyo)
|ca-central-1 |Canada (Central)
|eu-central-1 |Europe (Frankfurt)
|eu-west-1 |Europe (Ireland)
|eu-west-2 |Europe (London)
|eu-south-1 |Europe (Milan)
|eu-west-3 |Europe (Paris)
|eu-north-1 |Europe (Stockholm)
|me-south-1 |Middle East (Bahrain)
|sa-east-1 |South America (São Paulo)
|===
//Full list: https://docs.aws.amazon.com/general/latest/gr/rande.html

View File

@@ -0,0 +1,12 @@
// Replace the <n> in each row to specify the number of resources used in this deployment. Remove the rows for resources that arent used.
|===
|Resource |This deployment uses
// Space needed to maintain table headers
|VPCs |1
|Elastic IP addresses |1
|Security groups |1
|AWS Identity and Access Management (IAM) roles |1
|Auto Scaling groups |1
|<type> instances |1
|===

View File

@@ -0,0 +1,13 @@
// Replace the content in <>
// For example: “familiarity with basic concepts in networking, database operations, and data encryption” or “familiarity with <software>.”
// Include links if helpful.
// You don't need to list AWS services or point to general info about AWS; the boilerplate already covers this.
This Quick Start also assumes familiarity with the following AWS services and components:
* http://aws.amazon.com/documentation/vpc/[Amazon Virtual Private Cloud (Amazon VPC)]
* http://aws.amazon.com/documentation/ec2/[Amazon Elastic Compute Cloud (Amazon EC2)]
* http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AmazonEBS.html[Amazon Elastic Block Storage (Amazon EBS)]
* http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-nat-gateway.html[NAT gateways]
* http://docs.aws.amazon.com/autoscaling/latest/userguide/[Amazon EC2 Auto Scaling]
* http://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/[Amazon CloudWatch Logs]