Fixed EC2 Credentials

examples/terraform-ec2/data.tf

@@ -1,3 +1,5 @@
+data "aws_caller_identity" "current" {}
+
 data "aws_ami" "amznlinux" {
   most_recent = true
 
@@ -16,3 +18,7 @@ data "template_file" "user_data" {
     s3_uri  = "${local.s3_uri}"
   }
 }
+
+data "aws_iam_policy" "security_audit" {
+  arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/SecurityAudit"
+}

examples/terraform-ec2/iam.tf

@@ -33,6 +33,11 @@ resource "aws_iam_role" "fedrampup" {
 EOF
 }
 
+resource "aws_iam_role_policy_attachment" "fedrampup_audit_attachment" {
+  role = "${aws_iam_role.fedrampup.name}"
+  policy_arn = "${data.aws_iam_policy.security_audit.arn}"
+}
+
 resource "aws_iam_role_policy_attachment" "fedrampup_attachment" {
   role       = "${aws_iam_role.fedrampup.name}"
   policy_arn = "${aws_iam_policy.fedrampup.arn}"

examples/terraform-ec2/user-data.tpl

@@ -18,8 +18,8 @@ mkdir -p /opt/go/src /opt/go/pkg /opt/go/bin
 WRAPPER=/opt/fedrampup-wrapper
 cat << EOF > $WRAPPER
 #!/bin/bash
-AWS_REGION=${aws_region}
-OUTPUT_FILE=${s3_uri}
+export AWS_REGION=${aws_region}
+export OUTPUT_FILE=${s3_uri}
 
 /opt/go/bin/fedrampup
 EOF

main.go

@@ -6,6 +6,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/credentials/ec2rolecreds"
 	"github.com/aws/aws-sdk-go/aws/defaults"
+	"github.com/aws/aws-sdk-go/aws/ec2metadata"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/s3/s3manager"
 	"io/ioutil"
@@ -53,11 +54,13 @@ func main() {
 func GetSession() *session.Session {
 	var creds *credentials.Credentials
 	sess := session.Must(session.NewSession())
-
-	if len(os.Getenv("AWS_ACCESS_KEY_ID")) > 0 {
-		creds = credentials.NewEnvCredentials()
+	meta := ec2metadata.New(sess)
+	if meta.Available() {
+		creds = credentials.NewCredentials(&ec2rolecreds.EC2RoleProvider{
+			Client: meta,
+		})
 	} else {
-		creds = credentials.NewCredentials(&ec2rolecreds.EC2RoleProvider{})
+		creds = credentials.NewEnvCredentials()
 	}
 	if _, err := creds.Get(); err != nil {
 		log.Fatal(err)