Auto Scaling
Developer Guide (API Version 2011-01-01)
Did this page help you?  Yes | No |  Tell us about it...
« PreviousNext »
View the PDF for this guide.Go to the AWS Discussion Forum for this product.Go to the Kindle Store to download this guide in Kindle format.

Launch Auto Scaling Instances with an IAM Role

AWS Identity and Access Management (IAM) roles for EC2 instances make it easier for you to access other AWS services securely from within the EC2 instances. EC2 instances launched with an IAM role automatically have AWS security credentials available.

You can use IAM roles with Auto Scaling to automatically enable applications running on your EC2 instances to securely access other AWS resources.

To launch EC2 instances with an IAM role in Auto Scaling, you'll have to create an Auto Scaling launch configuration with an EC2 instance profile. An instance profile is simply a container for an IAM role. First, create an IAM role that has all the permissions required to access the AWS resources, then add your role to the instance profile.

For more information about IAM roles and instance profiles, see Delegating API Access by Using Roles in the Using IAM guide.

Prerequisites: Using IAM

Use these steps for launching Auto Scaling instances with an IAM role. Before you walk, be sure you've completed the following steps using IAM:

  • Create an IAM role.

  • Create an IAM instance profile.

  • Add the IAM role to the IAM instance profile.

  • Retrieve the IAM instance profile name or the full Amazon Resource Name (ARN) of the instance profile.

For more information about creating and managing an IAM role using the IAM console, the IAM CLI, or the IAM Query API, see Create a Role in the Using IAM guide.

If you plan to use the IAM CLI, be sure to install the IAM CLI. For more information, see AWS Identity and Access Management Command Line Interface Reference.

Steps for Launching Instances with an IAM role

After you have created the IAM role, the IAM instance profile, and have added the role to the instance profile, you are ready to launch Auto Scaling instances with the IAM role, using the following steps:

  • Create a launch configuration by specifying the IAM instance profile name or the full ARN of the IAM instance profile.

  • Create an Auto Scaling group with the launch configuration that you just created.

  • Verify that the EC2 instance was launched with the IAM role.

Launching Instances with the CLI

Use the following Auto Scaling commands to launch instances.

CommandsDescription

as-create-launch-config

Creates a new launch configuration with specified attributes.

as-create-auto-scaling-group

Creates a new Auto Scaling group with the specified name and other attributes.

as-describe-auto-scaling-groups

Describes the Auto Scaling groups, if the groups exist.

Create a Launch Configuration

If you're not familiar with how to create a launch configuration or an Auto Scaling group, we recommend that you go through the steps in the Getting Started with Auto Scaling Using the CLI. Use the basic scenario to get started with the infrastructure that you need in most Auto Scaling scenarios.

For this procedure, specify the following values for the as-create-launch-config command:

  • Launch configuration name = lc-with-instance-profile

  • Image ID = ami-baba68d3

    If you don't have an AMI, and you want to find a suitable one, follow the instructions in Finding a Suitable AMI.

  • Instance type = m1.small

  • Instance profile name = mytest-instance-profile.

Your command should look similar to the following example:

as-create-launch-config lc-with-instance-profile --image-id ami-baba68d3 --instance-type m1.small --iam-instance-profile mytest-instance-profile

You should get a confirmation like the following example:

OK-Created launch config

Create an Auto Scaling Group

Create your Auto Scaling group by using as-create-auto-scaling-group and then specifying the launch configuration you just created. For more information about the syntax of the as-create-auto-scaling-group command, see Create an Auto Scaling Group.

Specify these values for the command:

  • Auto Scaling group name = asg-using-instance-profile

  • Launch configuration name = lc-with-instance-profile

  • Availability Zone = us-east-1e

  • Max size = 1

  • Min size = 1

Your command should look similar to the following example:

as-create-auto-scaling-group asg-using-instance-profile --launch-configuration lc-with-instance-profile --availability-zones "us-east-1e" --max-size 1 --min-size 1 

You should get confirmation similar to the following example:

OK-Created AutoScalingGroup

Verify That the EC2 Instance Launches with the IAM Role

To confirm that Auto Scaling launches your EC2 instances using the IAM role you specify, use as-describe-auto-scaling-groups. The command shows details about the group and instances launched. For information about the as-describe-auto-scaling-groups command, see Verify Your Auto Scaling Group Creation.

Your command should look like the following example:

as-describe-auto-scaling-groups asg-using-instance-profile --headers

Note

Specify the --headers general option to show column headers that organize the describe command's information.

The information you get should be similar to the following example.

AUTO-SCALING-GROUP  GROUP-NAME            LAUNCH-CONFIG        AVAILABILITY-ZONES  MIN-SIZE  MAX-SIZE  DESIRED-CAPACITY
AUTO-SCALING-GROUP  asg-using-instance-profile  lc-with-instance-profile        us-east-1e                       1                 1                  1               
INSTANCE  INSTANCE-ID  AVAILABILITY-ZONE  STATE      STATUS   LAUNCH-CONFIG
INSTANCE  i-5d97a03b       us-east-1e                  InService  Healthy  lc-with-instance-profile   

You can see that Auto Scaling launched an instance using the lc-with-instance-profile launch configuration; and it is running (InService) and is healthy.

Clean Up

After you're finished using your instances and your Auto Scaling group, it is a good practice to clean up. Run the as-delete-auto-scaling-group command with the optional --force-delete parameter. Force delete specifies that EC2 instances that are part of the Auto Scaling group are deleted with the Auto Scaling group, even if the instances are still running. If you don't specify the --force-delete parameter, then you cannot delete your Auto Scaling group until you have terminated all instances in that Auto Scaling group.

Run the command with the following values:

  • Auto Scaling group name = asg-with-instance-profile

  • Force delete (optional parameter) = --force-delete

Your command should look like the following example:

as-delete-auto-scaling-group asg-with-instance-profile --force-delete

Confirm that you want to delete the Auto Scaling group. After you confirm that you want to delete the Auto Scaling group, Auto Scaling deletes the group, as the following example shows:

Are you sure you want to delete this AutoScalingGroup? [Ny]
OK-Deleted AutoScalingGroup