Amazon EC2 Auto Scaling | Security

Question 1

If you don’t use Elastic Load Balancing (ELB) how would users be directed to the other servers in a group if there was a failure?

Security

Amazon EC2 Auto Scaling | Compute

Answer 1

You can integrate with Route53 (which Amazon EC2 Auto Scaling does not currently support out of the box, but many customers use). You can also use your own reverse proxy, or for internal microservices, can use service discovery solutions.

Question 2

How do I control access to Amazon EC2 Auto Scaling resources?

Security

Amazon EC2 Auto Scaling | Compute

Answer 2

Amazon EC2 Auto Scaling integrates with AWS Identity and Access Management (IAM), a service that enables you to do the following:

Create users and groups under your organization’s AWS account

Assign unique security credentials to each user under your AWS account

Control each user’s permissions to perform tasks using AWS resources

Allow the users in another AWS account to share your AWS resources

Create roles for your AWS account and define the users or services that can assume them

Use existing identities for your enterprise to grant permissions to perform tasks using AWS resources

For example, you could create an IAM policy that grants the Managers group permission to use only the DescribeAutoScalingGroups, DescribeLaunchConfigurations, DescribeScalingActivities, and DescribePolicies API operations. Users in the Managers group could then use those operations with any Amazon EC2 Auto Scaling groups and launch configurations. With Amazon EC2 Auto Scaling resource-level permissions, you can restrict access to a particular EC2 Auto Scaling group or launch configuration.

For more information, see the Controlling Access to Your Auto Scaling Resources section of the Amazon EC2 Auto Scaling user guide.

Question 3

Can you define a default admin password on Windows instances with Amazon EC2 Auto Scaling?

Security

Amazon EC2 Auto Scaling | Compute

Answer 3

You can use the Key Name parameter to CreateLaunchConfiguration to associate a key pair with your instance. You can then use the GetPasswordData API in EC2. This is also possible through the AWS Management Console.