How to Script EC2 Joining Active Directory?

To script an EC2 instance joining an Active Directory using Pulumi in TypeScript, we will follow these steps:

1. Introduction: Provide an overview of the solution and the key services involved.
2. Step-by-Step Explanation: Detail the steps required to achieve the goal.
3. Key Points: Highlight important considerations and tips.
4. Conclusion: Summarize the solution and its benefits.

Introduction

In this solution, we will use Pulumi to automate the process of launching an EC2 instance and joining it to an Active Directory domain. The key services involved are AWS EC2 for the virtual machine, AWS Directory Service for the Active Directory, and Pulumi for infrastructure as code.

Step-by-Step Explanation

1. Set up Pulumi and AWS Provider: Initialize a new Pulumi project and configure the AWS provider.
2. Create an Active Directory: Use AWS Directory Service to create an Active Directory domain.
3. Launch an EC2 Instance: Define and launch an EC2 instance with the necessary configurations.
4. Join EC2 to Active Directory: Use a user data script to join the EC2 instance to the Active Directory domain upon launch.

Key Points

• Ensure that the EC2 instance has the necessary IAM role and permissions to join the Active Directory.
• The EC2 instance must be in the same VPC and subnet as the Active Directory or have network connectivity to it.
• Use secure methods to handle sensitive information such as domain credentials.

Conclusion

By using Pulumi to script the process of joining an EC2 instance to an Active Directory domain, we can achieve a repeatable and automated solution. This approach enhances efficiency, reduces manual errors, and ensures consistency across deployments.

Full Code Example

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create an Active Directory
const directory = new aws.directoryservice.Directory("exampleDirectory", {
    name: "example.com",
    password: "SuperSecretPassword123!",
    size: "Small",
    vpcSettings: {
        vpcId: "vpc-12345678",
        subnetIds: ["subnet-12345678", "subnet-87654321"],
    },
});

// User data script to join the instance to the Active Directory
const userData = `
<powershell>
$domain = "example.com"
$password = ConvertTo-SecureString "SuperSecretPassword123!" -AsPlainText -Force
$username = "Admin"
$credential = New-Object System.Management.Automation.PSCredential("$domain\$username", $password)
Add-Computer -DomainName $domain -Credential $credential -Restart
</powershell>
`;

// Create an EC2 instance
const ec2Instance = new aws.ec2.Instance("exampleInstance", {
    ami: "ami-0c55b159cbfafe1f0",
    instanceType: "t2.micro",
    subnetId: "subnet-12345678",
    userData: userData,
    vpcSecurityGroupIds: ["sg-12345678"],
    iamInstanceProfile: "exampleInstanceProfile",
    tags: {
        Name: "exampleInstance",
    },
});

export const ec2InstanceId = ec2Instance.id;
export const directoryId = directory.id;