hello i'm david a cloud support engineer
here at the AWS office in northern
virginia sometimes customers ask me it
is possible to run the code employed
host agents service as an avid user it
is and today we'll look at the service
configuration to learn how we can make
this change and we'll also review a
script we can use in our user data to
automate this change let's take a look
at the ec2 dashboard in the AWS
management console here we have the ec2
dashboard we're going to click the
running instances link from our
resources heading from here we can see
an instance I've already created that
has the code deploy agent pre-installed
let's go ahead and use the terminal to
connect to the instance here we are at
our terminal
let's SSH into our instance now that
we're logged onto our ec2 instance we'll
need to ensure that our code deploy
agent is in this top state
here we see that the agent is stopped
now will leverage them to look at the
configuration file the
three Russian files salad into Etsy / in
addy directory
here we have the configuration file open
in our vent text editor if we scroll
down we can find the co deploy
underscore user variable it is currently
set to a no value distal value allows
the co deploy agent to run as the root
service today we'll modify this variable
to be ec2 user the easy to user is a
predefined account or user on the ec2
instance when using AWS Linux let's
close out of them for now next
dream editor to modify the configuration
file
adding the ec2 user to the service
here we're setting the value null as a
search parameter for the stream editor
next we'll define what we want to
replace that value with
you
SFI dadsy directory so this example will
need to ensure that we're executing this
using the sudo command
return to our vem text editor to see if
the change took place now when we scroll
down on the credible user we see ec2
users defined let's go ahead and close
out of the vim text editor and we'll
start the agent again and ensure that
it's running under the correct user
context now that we've updated the
configuration file with our easy-to-use
ER we'll need to update the permissions
on a couple of directories
well leverage the change owner command
to make these changes
the first directory is the co deploy
agent root directory found under opt
code apply agent the second directory
will be VAR log AWS
now the
we've maybe changes we can start the
agent
next we're going to confirm the status
that concludes our process and manually
updating the code deploy service to run
as an on review sir
now let's take a look at how we can make
this change programmatically so we can
bootstrap the changes to our instance
and avoid manually making this change
let's return to the AWS management
console now that were they at the AWS
management console
let's select services and locate ec2
under the compute heading next we'll
find and choose launch configurations
from the left-side menu
here will click create an auto scaling
group on this page will select create
launch configuration for today's example
we'll leverage the Amazon Linux ami I'll
use the select button on the right hand
side of the screen today's demonstration
will stick with the free tier eligible
t2 micro
we'll now name our launch configuration
and we'll also select an IM role and I
am role for Co deploy generally is used
to access s3 buckets I have one
pre-configured here that I'll select
I'll also choose to advanced details
here I can add additional commands to be
executed in the user data section this
is where we'll install the code deploy
agent and ensure the user is changed
from root to a new user called C deploy
user I'll have a script already created
that I'll leverage for this example now
that I've captured my code I'll be
inserting it here in the user data
from the top we'll see that we have a
region variable set that queries the
instances metadata to determine the
availability zone next we run young to
install our prerequisites here we have
Ruby in the AWS CLI after this we
navigate to the ec2 user home directory
well download the code deploy agent from
s3 will modify the install script to
make it executable and then install the
co deploy agent next we'll stop the
service then we'll add a new user see
the Puli underscore user again we'll
leverage the stream editor to modify the
contents of our script next we'll use
the set editor to modify the
configuration file as before we'll also
use the change owner command to modify
the directory permissions
after this is done well execute a
service start and the agent should be
running has a new user will continue on
and click Next ad storage here we'll
leave the defaults we can click skip to
review but in the real world deployment
you should review your security group
settings to ensure you are protecting
your ec2 instance by restricting access
to SSH and other critical ports
here we can review our
configuration here we specified our
Amazon Linux AMI our free tier t2 micro
and our launch configuration details
including our user data and our IM
policy
let's click create launch configuration
now we arrive at the create auto scaling
group we'll need to specify a group name
we'll leave the group size with a single
instance for this for this demonstration
next we'll need to select a subnet no
further configurations are necessary at
this time so we can proceed by clicking
next configure scaling policies here we
want to keep the group at its initial
size so we'll continue to review
here we see we have a group name called
demo ASG with a group size of 1
supplied subnet and our default settings
let's click create auto scaling group on
the bottom right-hand side
our scanner groups completed let's click
the view your auto-scaling groups under
the view heading
now we can allow our instance a few
moments to launch and then we will log
on to that instance using SSH to confirm
that the code apply agent is running
this may take a few minutes to spin up
and complete the bootstrapping process
we're now back the bootstrapping process
and the instance loading took
approximately five minutes with the T to
micro from the auto scaling group
console we can see our demo IHG has
launched a single instance if we scroll
down
we can select the instance in this tab
on the lower half of the screen here we
identify the instance ID that we'll use
so let's click here to get the SSH
information
navigate us to the ec2 console where we
can gather the public DNS name will
capture this information and we'll open
up our terminal to SSA Chen we've opened
our terminal window and we'll pull up
our ssh command to login
consoled in will check to the code
service agencies running
here we see the agent is running and it
has a pit identified let's also double
check that our user configuration has
been applied to our config file again
we'll leverage the bim text editor to
view this information
if we scroll down to the page and locate
the co deploy user variable we can see
that it is now set to see deploy
underscore user exactly what we
configured in our user data script we'll
go ahead and close out of the text
editor this completes our demonstration
of how to modify the code apply agent in
its script to run the service as a non
root user
thanks for watching and happy cloud
computing from all of us here at AWS