Recently I answered a question on the EC2 forums about how to give third parties access to EC2 instances. I noticed there’s not a lot of info out there about how to work with contractors, consultants, or even internal groups to whom you want to grant access to your AWS account. Here’s how.
First, a Caveat
Please be very selective when you choose a contractor. You want to make sure you choose a candidate who can actually do the work you need – and unfortunately, not everyone who advertises as such can really deliver the goods. Reuven Cohen’s post about choosing a contractor/consultant for cloud projects examines six key factors to consider:
- Experience: experience solving real world problems is probably more important than anything else.
- Code: someone who can produce running code is often more useful than someone who just makes recommendations for others to follow.
- Community Engagement: discussion boards are a great way to gauge experience, and provide insight into the capabilities of the candidate.
- Blogs & Whitepaper: another good way to determine a candidate’s insight and capabilities.
- Interview: ask the candidate questions to gauge their qualifications.
- References: do your homework and make sure the candidate really did what s/he claims to have done.
Reuven’s post goes into more detail. It’s highly recommended for anyone considering using a third-party for cloud projects.
What’s Your Skill Level?
The best way to allow a contractor access to your resources depends on your level of familiarity with the EC2 environment and with systems administration in general.
If you know your way around the EC2 toolset and you’re comfortable managing SSH keypairs, then you probably already know how to allow third-party access safely. This article is not meant for you. (Sorry!)
If you don’t know your way around the EC2 toolset, specifically the command-line API tools, and the AWS Management Console or the ElasticFox Firefox Extension, then you will be better off allowing the contractor to launch and configure the EC2 resources for you. The next section is for you.
Giving EC2 Access to a Third Party
[An aside: It sounds strange, doesn’t it? “Third party”. Did I miss two parties already? Was there beer? Really, though, it makes sense. A third party is someone who is not you (you’re the first party) and not Amazon (they’re the counterparty, or the second party). An outside contractor is a third party.]
Let’s say you want a contractor to launch some EC2 instances for you and to set them up with specific software running on them. You also want them to set up automated EBS snapshots and other processes that will use the EC2 API.
What you should give the contractor
Give the contractor your Access Key ID and your Secret Access Key, which you should get from the Security Credentials page:
The Access Key ID is not a secret – but the Secret Access Key is, so make sure you transfer it securely. Don’t send it over email! Use a private DropBox or other secure method.
Don’t give out the email address and password that allows you to log into the AWS Management Console. You don’t want anyone but you to be able to change the billing information or to sign you up for new services. Or to order merchandise from Amazon.com using your account (!).
What the contractor will do
Using ElasticFox and your Access Key ID and Secret Access Key the contractor will be able to launch EC2 instances and make all the necessary configuration changes on your account. Plus they’ll be able to put these credentials in place for automated scripts to make EC2 API calls on your behalf – like to take an EBS snapshot. [There are some rare exceptions which will require your X.509 Certificates and the use of the command-line API tools.]
For example, here’s what the contractor will do to set up a Linux instance:
- Install ElasticFox and put in your access credentials, allowing him access to your account.
- Set up a security group allowing him to access the instance.
- Create a keypair, saving the private key to his machine (and to give to you later).
- Choose an appropriate AMI from among the many available. (I recommend the Alestic Ubuntu AMIs).
- Launch an instance of the chosen AMI, in the security group, using the keypair.
- Once the instance is launched he’ll SSH into the instance and set it up. He’ll use the instance’s public IP address and the private key half of the keypair (from step 3), and the user name (most likely “root”) to do this.
The contractor can also set up some code to take EBS snapshots – and the code will require your credentials.
What deliverables to expect from the contractor
When he’s done, the contractor will give you a few things. These should include:
- the instance ids of the instances, their IP addresses, and a description of their roles.
- the names of any load balancers, auto scaling groups, etc. created.
- the private key he created in step 3 and the login name (usually “root”). Make sure you get this via a secure communications method – it allows privileged access to the instances.
Make sure you also get a thorough explanation of how to change the credentials used by any code requiring them. In fact, you should insist that this must be easy for you to do.
Plus, ask your contractor to set up the Security Groups so you will have the authorization you need to access your EC2 deployment from your location.
And, of course, before you release the contractor you should verify that everything works as expected.
What to do when the contractor’s engagement is over
When your contractor no longer needs access to your EC2 account you should create new access key credentials (see the “Create a new Access Key” link on the Security Credentials page mentioned above).
But don’t disable the old credentials just yet. First, update any code the contractor installed to use the new credentials and test it.
Once you’re sure the new credentials are working, disable the credentials given to the contractor (the “Make Inactive” link).
The above guidelines also apply to working with internal groups within your organization. You might not need to revoke their credentials, depending on their role – but you should follow the suggestions above so you can if you need to.