{"id":4252,"date":"2017-02-15T08:45:53","date_gmt":"2017-02-15T13:45:53","guid":{"rendered":"https:\/\/www.redline13.com\/blog\/?p=4252"},"modified":"2017-02-15T08:45:53","modified_gmt":"2017-02-15T13:45:53","slug":"improved-security-with-instance-profiles","status":"publish","type":"post","link":"https:\/\/www.redline13.com\/blog\/2017\/02\/improved-security-with-instance-profiles\/","title":{"rendered":"Improved Security with Instance Profiles"},"content":{"rendered":"

To provide finer grain control over\u00a0what instances RedLine13 can start, stop, terminate we have added support for launching\u00a0EC2 load agents with instance profiles.<\/p>\n

Advanced Topic<\/h2>\n

This is an advanced topic and only supported for premium customers.<\/p>\n

You can read the AWS Blog Post on Restricting with IAM Policy and instance-profiles<\/a>.<\/p>\n

To get started you must set up an\u00a0instance profile, which is documented at “How to create IAM instance Profile<\/a>“.<\/p>\n

Setting up Policy<\/h2>\n

To use this feature you will have to update your policy. \u00a0 Add<\/p>\n

\"iam:PassRole\",<\/pre>\n
to the section that gives permission to the RedLine13 role.<\/p>\n
Then limit the ability to\u00a0stop\u00a0or terminate your instances by\u00a0using a condition:<\/p>\n
{\n    \"Action\": [\n        \"ec2:StopInstances\",\n        \"ec2:TerminateInstances\"\n    ],\n    \"Effect\": \"Allow\",\n    \"Resource\": \"*\",\n    \"Condition\": {\n        \"StringEquals\": {\n            \"ec2:InstanceProfile\": \"arn:aws:iam::ACCOUNT:instance-profile\/INSTANCE_PROFILE_NAME\"\n        }\n    }\n}<\/pre>\n
For a list of all permissions we require and detailed full policy you can read our\u00a0Key Setup Instructions<\/a>.<\/p>\n
Using in RedLine Load Tests<\/h2>\n
This plugin is available for all tests, but you can setup defaults for your account.<\/p>\n
a) Go to account settings:\u00a0https:\/\/www.redline13.com\/Account\/settings<\/a><\/p>\n
b) Configure your instance profile name or\u00a0instance profile ARN<\/p>\n