Injecting own recipe as a yaml file

[kddiji]

I would like to inject a yaml file with many commands as a component of this project. I would appreciate any pointers on how to do that . The yaml file is something like the centoshardening

schemaVersion: 1.0

phases:
  - name: build
    steps:
      - name: CISBenchmarkHardening
        action: ExecuteBash
        inputs:
          commands:

            # §1.1
            - echo "install cramfs /bin/true" > /etc/modprobe.d/cramfs.conf
            - echo "install vfat /bin/true" > /etc/modprobe.d/vfat.conf
            - etc 

[sblack4]

The commands in the component get yamlencodeed so just list them: https://github.com/rhythmictech/terraform-aws-imagebuilder-component-shell/blob/main/component.yml.tpl#L13

don't forget to escape the double quotes

module "test_shell_component" {
  source  = "rhythmictech/imagebuilder-component-shell/aws"
  version = "~> 0.1.0"

  component_version = "1.0.0"
  description       = "Testing component"
  name              = "testing-component"
  commands          = ["echo \"install cramfs /bin/true\" > /etc/modprobe.d/cramfs.conf", "etc"]
  tags              = local.tags
}

[kddiji]

Thanks for the response. The problem with that is that I have 2 components yml files and each has ~ 200 lines of commands to hardened a centos OS which means I would have to hard code that way "echo \"install cramfs /bin/true\" > /etc/modprobe.d/cramfs.conf", "command", "command", "etc"]? Is there a way to just have those 2 yaml files seating somewhere in the repo and pass them in the component.yml.tpl and variables.tf.

[sblack4]

I see the use-case. that should be as easy as adding a new variable and a ternary for local.data
it looks like the same thing is possible by using var.data_uri but you'd have to upload your yml files to S3 first.

If you make the PR adding the new variable named data_override or something and change the local to use the contents of the new variable instead of the templatefile if the data_override is specified I'll approve and merge it

[kddiji]

@sblack4 thanks for the feedback that was helpful. The actual commands in my yaml are defined as below:

schemaVersion: 1.0

phases:
  - name: build
    steps:
      - name: Test
        action: ExecuteBash
        inputs:
          commands:

            # §1.1
            - echo "install cramfs /bin/true" > /etc/modprobe.d/cramfs.conf
            - echo "install vfat /bin/true" > /etc/modprobe.d/vfat.conf
            - echo "install squashfs /bin/true" > /etc/modprobe.d/squashfs.conf
            - echo "install udf /bin/true" > /etc/modprobe.d/udf.conf
            - echo "install usb-storage /bin/true" > /etc/modprobe.d/usb-storage.conf

and I decided to define them as indicated in the module list(string). See below

variable "commands" {
#  default     = ["echo test component"]
  description = "List of strings. Each string is a shell command"
  type        = list(string)
  default     = [
    "echo 'install cramfs /bin/true' > /etc/modprobe.d/cramfs.conf",
    "echo 'install vfat /bin/true' > /etc/modprobe.d/vfat.conf",
    "echo 'install squashfs /bin/true' > /etc/modprobe.d/squashfs.conf",
    "echo 'install udf /bin/true' > /etc/modprobe.d/udf.conf",
    "echo 'install usb-storage /bin/true' > /etc/modprobe.d/usb-storage.conf"  
  ]
}

Crossing fingers that each command line will work as expected as a shell command even though I am using a single quote inside the code block. Last question I have in the EC2 image builder console there is a function to specify the OS versions that this component is compatible with which is CentOs linux 8 for my stacks. Is there a way to specify it in this project? Thanks in advance really appreciate your feedback.

[kddiji]

was able to make it work see below:

locals {
  latest_component_minor_version = "${split(".", var.component_version)[0]}.${split(".", var.component_version)[1]}.x"

  data = templatefile("${path.module}/path-to-my-recipe/recipe.yml", { # update: point to specific yml within given path on tf-apply
    description = var.description
    name        = var.name
    commands    = var.commands
    phase       = var.phase
  })
}

resource "aws_cloudformation_stack" "this" {
  count              = var.create ? 1 : 0
  name               = "${var.name}-${uuid()}"
  on_failure         = "ROLLBACK"
  timeout_in_minutes = var.cloudformation_timeout

  tags = merge(
    var.tags,
    { Name : "${var.name}-stack" }
  )

  template_body = templatefile("${path.module}/cloudformation.yml.tpl", {
    change_description = var.change_description
    data               = var.data_uri == null ? local.data : null
    description        = var.description
    kms_key_id         = var.kms_key_id
    name               = var.name
    platform           = var.platform
    uri                = var.data_uri
    version            = var.component_version

    tags = merge(
      var.tags,
      { Name : var.name }
    )
  })

  lifecycle {
    create_before_destroy = true

    ignore_changes = [
      name
    ]
  }
}