Adding the servers to the Active Directory is a common scenario, especially when servers are running in an auto-scaling group; it becomes more critical as the server needs to be added to the domain as soon as they come up.
This blog will show how to automatically enable an EC2 Auto Scaling group to join newly launched instances to a target domain. We are using the Active Directory domain managed in AWS.
Step 1: Create an IAM policy.
- Open IAM Console, click on Policies, and click on Create Policy.
- On the Create Policy page, click Import Managed Policy.
- In the Search Policies field, type AmazonEC2RoleforSSM. Select the Policy and click on import.
- Click on the JSON tab, and add the SSM: CreateAssociation permission.
- Click on Review Policy. Give the policy name as AmazonEC2RoleforSSM-ASGDomainJoin.
- Click on create Policy.
Step 2: Create an IAM role for EC2
- Open the IAM console, click on it, and click Create New Role.
- On the Select Role Type page in the AWS Service Role section, choose Amazon EC2 and click on next.
- In the Filter box, type AmazonEC2RoleforSSM-ASGDomainJoin. Choose the checkbox next to your Policy, and click on Next.
- In the Role Name field, type EC2SSMRole-ASG, then type a role description.
- Review the role details, and then choose Create Role.
Step3: Replace the default SSM document
If you previously used the launch wizard to launch the instances and join the domain, you will have a default SSM document. The following command will check whether the default SSM document exists for your domain.
aws ssm get-document –name \”awsconfig_Domain_<directoryId>_<directoryName>\”
If the default document exists:
You will get a JSON as an output, something similar to the following.
You can save this JSON for your reference.
Delete the existing default SSM document:
Delete the existing default document by running the following command.
aws ssm delete-document –name \”awsconfig_Domain_<directoryId>_<directoryName>\”
Create new document with new JSON:
Create a JSON file with the following content
- directoryId is the ID of a directory (or AD Connector) you created in AWS Directory Service.
- directoryName is the name of the domain (for example, example.com).
- directoryOU is the organizational unit for the domain.
- dnsIpAddresses includes the IP addresses for the DNS servers you specified when you created your directory (or AD Connector) in Directory Service.
Finally create the SSM document with the above JSON content. You can do that by running the following command.
aws ssm create-document –content file://path/to/new-ssm-doc.json –name \”awsconfig_Domain_<directoryId>_<directoryName>\”
Step 4: Create Auto Scaling group launch configuration
- Go to the EC2 console and click on Launch Configurations.
- Click on Create Launch Configuration, choose the image, instance type, and proceed to configure details.
- For the IAM role, select EC2SSMRole-ASG (which we created earlier).
- Expand the Advanced Details section. Add a Windows PowerShell script which will be executed when new instances are launched as the Auto Scaling group.
- Customize the following script and paste it into the User data.
| <powershell>
Set-DefaultAWSRegion -Region <region> Set-Variable -name instance_id -value (Invoke-Restmethod -uri http://169.254.169.254/latest/meta-data/instance-id) New-SSMAssociation -InstanceId $instance_id -Name \”<ssmDocumentName>\” </powershell> | |
<powershell>
Set-DefaultAWSRegion -Region <region> Set-Variable -name instance_id -value (Invoke-Restmethod -uri http://169.254.169.254/latest/meta-data/instance-id) New-SSMAssociation -InstanceId $instance_id -Name \”<ssmDocumentName>\” </powershell> |
- Region: This is the region in which instance will be launched (Example: ap-south-1)
- ssmDocumentName: It is the name of SSM document that we have created.
- Now, complete the launch configuration creation process by giving appropriate details.
- Once the launch configuration is created, attach it to the Auto Scaling group and set the desired capacity to 1.
Step 5: Verify if the server is joined to the domain.
Follow this step to verify that the newly launched server has been joined to the domain.
- Copy the instance ID of the server that has been launched by Auto Scaling group and wait until Status checks show 2/2 check passed.
- Now, run the following command to check if the association has been successfully created.
aws ssm list-associations –association-filter-list key=Name,value= \”awsconfig_Domain_<directoryId>_<directoryName>\” - The above command will give you the JSON output. Analyze the JSON and check if the instanceID, which the auto-scaling group launches, are present, and it should contain the sub-attribute named Status with a value of Success.
[Read Next: Benefits Of Using AWS Systems Manager Parameter Store ]
Written by – Atin Mittal
To get the latest insights, research and expert articles on AWS Services, Cloud Migration, DevOps and other technologies, subscribe to our Blog Newsletter here. For AWS Case studies and success stories, visit Case Study Section
buy generic tricor 200mg tricor 160mg over the counter order generic fenofibrate 200mg
buy cheap generic ketotifen ziprasidone 80mg price buy tofranil 25mg pills
cialis 10mg canada purchase tadalafil pill viagra 100mg pill
buy acarbose for sale buy acarbose 50mg sale griseofulvin for sale online
minoxidil where to buy order cialis 20mg online causes of erectile dysfunction
aspirin over the counter aspirin online order buy generic imiquimod for sale
order dipyridamole 100mg for sale buy lopid 300mg pravastatin 10mg canada
meloset generic buy melatonin pills purchase danocrine
buy generic florinef buy cheap generic florinef purchase loperamide
duphaston medication cheap jardiance pill jardiance
order prasugrel 10 mg for sale chlorpromazine sale order detrol
Your article gave me a lot of inspiration, I hope you can explain your point of view in more detail, because I have some doubts, thank you.
buy etodolac no prescription order generic monograph buy pletal cheap
order ferrous sulfate 100mg online cheap ascorbic acid 500 mg oral order betapace 40 mg without prescription
enalapril 5mg uk lactulose generic buy duphalac paypal
buy pyridostigmine without a prescription buy rizatriptan online cheap buy generic maxalt 5mg
Your article gave me a lot of inspiration, I hope you can explain your point of view in more detail, because I have some doubts, thank you.
betahistine medication betahistine 16mg without prescription probalan pills
order generic zovirax order exelon 6mg generic buy rivastigmine online cheap
buy generic prilosec 20mg purchase montelukast pill metoprolol uk
order premarin 600 mg sale where to buy cabergoline without a prescription buy sildenafil for sale
telmisartan 80mg pill molnunat online molnunat 200mg canada
cenforce 50mg ca cheap cenforce 100mg chloroquine 250mg canada
tadalafil for women cialis 5mg pill buy viagra 100mg online
order cefdinir without prescription how to buy prevacid buy lansoprazole for sale
buy provigil generic purchase promethazine deltasone 40mg canada
buy accutane 10mg pills accutane 10mg cost azithromycin 500mg for sale
purchase atorvastatin without prescription order amlodipine 10mg online oral amlodipine 5mg
azithromycin 250mg for sale buy generic azithromycin order gabapentin 600mg online
order protonix 20mg buy phenazopyridine 200 mg sale purchase pyridium online cheap
doubleu casino roulette online free order furosemide 40mg sale