Introduction
AWS Cloud Shell was announced at the Werner Vogels Keynote at AWS re:Invent 2020.
🚀 AWS CloudShell – Command-Line Access to AWS Resources
https://aws.amazon.com/jp/blogs/aws/aws-cloudshell-command-line-access-to-aws-resources/
AWS CloudShell is a browser-based shell that can be launched directly from the AWS management console.
The shell can use Bash, PowerShell, Z shell, and comes preconfigured with tools to support the AWS CLI and other major development languages.
The pre-setup tools are described in the following document.
AWS CloudShell compute environment: specifications and software
https://docs.aws.amazon.com/cloudshell/latest/userguide/vm-specs.html
For example, kubectl is not installed.
Let's prepare the working environment for Amazon EKS by yourself.
Is the installation of additional software in a shell environment supported?
Yes, but it must be managed by the user. (Shared Responsibility model😎)
Setting up
Just click on the icon on the managed console to launch CloudShell.
- I installed what I could think of for now.
- Please change the version as needed.
- In this article, not discuss how to link clusters and IAM users/roles.
- If you want Docker, use Cloud9!
The installation directory is set to $HOME/.local/bin
This is because the persistent storage that is maintained between sessions is $HOME. (See the second half of this article for details.)
mkdir -p $HOME/.local/bin
cd $HOME/.local/bin
curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.18.13/bin/linux/amd64/kubectl
chmod +x kubectl
aws eks update-kubeconfig --name <YOUR_CLUSTER_NAME>
curl --silent --location "https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp
sudo mv /tmp/eksctl $HOME/.local/bin
export VERIFY_CHECKSUM=false
curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
sudo mv /usr/local/bin/helm $HOME/.local/bin
Packages installed by yum cannot be placed in persistent storage ($HOME), so they need to be installed for each new session.
You can write a command in your .bash_profile to automatically install them when you start CloudShell.
I want to use kubectl completion, so I installed bash-completion.
if [ -f ~/.bashrc ]; then
. ~/.bashrc
fi
PATH=$PATH:$HOME/.local/bin:$HOME/bin
export PATH
sudo yum install -y bash-completion > /dev/null 2>&1
The kubectl completion configuration can be saved to persistent storage.
kubectl completion bash > $HOME/.bash_completion
Notes on CloudShell
Persistent storage
- CloudShell can use 1 GB of persistent storage per region.
- Persistent storage is located in your home directory ($HOME) and is private. (It is not shared among users.)
- Only this area is guaranteed to be retained between sessions.
- Software and other data stored in directories other than the home directory will not be retained at the end of a session.
- The data in the persistent storage will be deleted after 120 days from the end of the last session.
CloudShell access permissions
As with any service, you need to explicitly grant CloudShell access to the target IAM user/role.
It is easiest to use the AWSCloudShellFullAccess AWS managed policy, but if you want to restrict file upload/download via CloudShell, you can use a custom policy like the following.
{
"Version": "2012-10-17",
"Statement": [{
"Sid": "CloudShellUser",
"Effect": "Allow",
"Action": [
"cloudshell:*"
],
"Resource": "*"
}, {
"Sid": "DenyUploadDownload",
"Effect": "Deny",
"Action": [
"cloudshell:GetFileDownloadUrls",
"cloudshell:GetFileUploadUrls"
],
"Resource": "*"
}]
}
Permissions to access AWS services from within CloudShell.
Automatically uses the IAM credentials you used to sign in to the AWS Management Console.
This means that the operating IAM user/role must have explicit permission to access the target AWS service.
Reference
AWS CloudShell - User Guide
https://docs.aws.amazon.com/cloudshell/latest/userguide/welcome.html
