ACS::ECS::ModifyUserPasswordBySecretParameter.json

{
  "FormatVersion": "OOS-2019-06-01",
  "Description": {
    "en": "Use encrypted parameters to modify user password",
    "zh-cn": "使用加密参数修改用户密码",
    "name-en": "ACS::ECS::ModifyUserPasswordBySecretParameter",
    "name-zh-cn": "使用加密参数修改用户密码"
  },
  "Parameters": {
    "regionId": {
      "Description": {
        "en": "The ID of region",
        "zh-cn": "地域ID"
      },
      "Type": "String",
      "Default": "{{ ACS::RegionId }}"
    },
    "instanceId": {
      "Description": {
        "en": "The ID of ECS instance",
        "zh-cn": "ECS实例ID"
      },
      "Type": "String"
    },
    "username": {
      "Description": {
        "en": "The username of to modify password",
        "zh-cn": "要修改密码的用户名"
      },
      "Type": "String"
    },
    "passwordParameter": {
      "Description": {
        "en": "The password secret parameter",
        "zh-cn": "密码加密参数"
      },
      "Type": "String"
    }
  },
  "Tasks": [
    {
      "Name": "queryInstanceRamRole",
      "Action": "ACS::ExecuteApi",
      "Description": {
        "en": "Queries ECS instance ram role",
        "zh-cn": "查询ECS实例Ram角色"
      },
      "Properties": {
        "Service": "ECS",
        "API": "DescribeInstanceRamRole",
        "Parameters": {
          "RegionId": "{{ regionId }}",
          "InstanceIds": [
            "{{ instanceId }}"
          ]
        }
      },
      "Outputs": {
        "ramRoleName": {
          "Type": "String",
          "ValueSelector": "InstanceRamRoleSets.InstanceRamRoleSet[].RamRoleName"
        }
      }
    },
    {
      "Name": "whtherToCreateRamRole",
      "Action": "ACS::Choice",
      "Description": {
        "en": "Whethre to create ram role",
        "zh-cn": "是否创建RAM角色"
      },
      "Properties": {
        "DefaultTask": "queryInstanceOSType",
        "Choices": [
          {
            "When": {
              "Fn::Equals": [
                "",
                "{{ queryInstanceRamRole.ramRoleName }}"
              ]
            },
            "NextTask": "createECSRamRole"
          }
        ]
      }
    },
    {
      "Name": "createECSRamRole",
      "Action": "ACS::Template",
      "Description": {
        "en": "Create and attach policy by ROS resource stack.",
        "zh-cn": "通过Ros资源栈为ECS创建角色。"
      },
      "Properties": {
        "TemplateName": "ACS::ROS::CreateStack",
        "Parameters": {
          "stackName": {
            "Fn::Join": [
              "-",
              [
                {
                  "Fn::Select": [
                    0,
                    {
                      "Fn::Split": [
                        ".",
                        "OOS-{{ACS::ExecutionId}}"
                      ]
                    }
                  ]
                },
                {
                  "Fn::Select": [
                    1,
                    {
                      "Fn::Split": [
                        ".",
                        "OOS-{{ACS::ExecutionId}}"
                      ]
                    }
                  ]
                },
                {
                  "Fn::Select": [
                    2,
                    {
                      "Fn::Split": [
                        ".",
                        "OOS-{{ACS::ExecutionId}}"
                      ]
                    }
                  ]
                }
              ]
            ]
          },
          "parameters": [
            {
              "ParameterKey": "RoleName",
              "ParameterValue": {
                "Fn::Join": [
                  "-",
                  [
                    {
                      "Fn::Select": [
                        0,
                        {
                          "Fn::Split": [
                            ".",
                            "OOSServiceRole-{{ACS::ExecutionId}}"
                          ]
                        }
                      ]
                    },
                    {
                      "Fn::Select": [
                        1,
                        {
                          "Fn::Split": [
                            ".",
                            "OOSServiceRole-{{ACS::ExecutionId}}"
                          ]
                        }
                      ]
                    },
                    {
                      "Fn::Select": [
                        2,
                        {
                          "Fn::Split": [
                            ".",
                            "OOSServiceRole-{{ACS::ExecutionId}}"
                          ]
                        }
                      ]
                    }
                  ]
                ]
              }
            },
            {
              "ParameterKey": "PolicyName",
              "ParameterValue": {
                "Fn::Join": [
                  "-",
                  [
                    {
                      "Fn::Select": [
                        0,
                        {
                          "Fn::Split": [
                            ".",
                            "Policy-{{ACS::ExecutionId}}"
                          ]
                        }
                      ]
                    },
                    {
                      "Fn::Select": [
                        1,
                        {
                          "Fn::Split": [
                            ".",
                            "Policy-{{ACS::ExecutionId}}"
                          ]
                        }
                      ]
                    },
                    {
                      "Fn::Select": [
                        2,
                        {
                          "Fn::Split": [
                            ".",
                            "Policy-{{ACS::ExecutionId}}"
                          ]
                        }
                      ]
                    }
                  ]
                ]
              }
            }
          ],
          "disableRollback": true,
          "templateBody": "{\n  \"ROSTemplateFormatVersion\": \"2015-09-01\",\n  \"Description\": \"Create ECS Ram Role\",\n  \"Parameters\": {\n    \"RoleName\": {\n      \"Type\": \"String\",\n      \"Description\": \"Specifies the authorization role name\"\n    },\n    \"PolicyName\": {\n      \"Type\": \"String\",\n      \"Description\": \"Specifies the authorization policy name\"\n    }\n  },\n  \"Resources\": {\n    \"ECSRole\": {\n      \"Type\": \"ALIYUN::RAM::Role\",\n      \"Properties\": {\n        \"RoleName\": {\n          \"Ref\": \"RoleName\"\n        },\n        \"AssumeRolePolicyDocument\": {\n          \"Statement\": [\n            {\n              \"Action\": \"sts:AssumeRole\",\n              \"Effect\": \"Allow\",\n              \"Principal\": {\n                \"Service\": [\n                  \"oos.aliyuncs.com\",\n                  \"ecs.aliyuncs.com\"\n                ]\n              }\n            }\n          ],\n          \"Version\": \"1\"\n        },\n        \"Policies\": [\n          {\n            \"PolicyName\": {\n              \"Ref\": \"PolicyName\"\n            },\n            \"PolicyDocument\": {\n              \"Version\": \"1\",\n              \"Statement\": [\n                {\n                  \"Action\": [\n                    \"kms:*\",\n                    \"oos:*\"\n                  ],\n                  \"Resource\": [\n                    \"*\"\n                  ],\n                  \"Effect\": \"Allow\"\n                }\n              ]\n            }\n          }\n        ]\n      }\n    }\n  },\n  \"Metadata\": {\n    \"ALIYUN::ROS::Interface\": {\n      \"TemplateTags\": [\n        \"acs:integrate:oos:ecs_modify_user_password_by_secret_parameter\"\n      ]\n    }\n  }\n}\n"
        }
      },
      "Outputs": {
        "stackId": {
          "Type": "String",
          "ValueSelector": ".stackId"
        }
      }
    },
    {
      "Name": "attachInstanceRamRole",
      "Action": "ACS::ExecuteApi",
      "Description": {
        "en": "Attach instance ram role.",
        "zh-cn": "授予实例Ram角色。"
      },
      "Properties": {
        "Service": "ECS",
        "API": "AttachInstanceRamRole",
        "Parameters": {
          "RegionId": "{{ regionId }}",
          "RamRoleName": {
            "Fn::Join": [
              "-",
              [
                {
                  "Fn::Select": [
                    0,
                    {
                      "Fn::Split": [
                        ".",
                        "OOSServiceRole-{{ACS::ExecutionId}}"
                      ]
                    }
                  ]
                },
                {
                  "Fn::Select": [
                    1,
                    {
                      "Fn::Split": [
                        ".",
                        "OOSServiceRole-{{ACS::ExecutionId}}"
                      ]
                    }
                  ]
                },
                {
                  "Fn::Select": [
                    2,
                    {
                      "Fn::Split": [
                        ".",
                        "OOSServiceRole-{{ACS::ExecutionId}}"
                      ]
                    }
                  ]
                }
              ]
            ]
          },
          "InstanceIds": [
            "{{ instanceId }}"
          ]
        }
      }
    },
    {
      "Name": "queryInstanceOSType",
      "Action": "ACS::ExecuteApi",
      "Description": {
        "en": "Queries ECS instance OS type",
        "zh-cn": "获取操作系统类型"
      },
      "Properties": {
        "Service": "ECS",
        "API": "DescribeInstances",
        "Parameters": {
          "RegionId": "{{ regionId }}",
          "InstanceIds": [
            "{{ instanceId }}"
          ]
        }
      },
      "Outputs": {
        "OSType": {
          "Type": "String",
          "ValueSelector": "Instances.Instance[].OSType"
        }
      }
    },
    {
      "Name": "modifyUserPasswordOnLinuxInstance",
      "Description": {
        "en": "Modify password on linux instance",
        "zh-cn": "在linux实例中修改用户密码"
      },
      "When": {
        "Fn::Equals": [
          "{{ queryInstanceOSType.OSType }}",
          "linux"
        ]
      },
      "OnError": "whetherToDetachRamRole",
      "Action": "ACS::ECS::RunCommand",
      "Properties": {
        "instanceId": "{{ instanceId }}",
        "regionId": "{{ regionId }}",
        "commandType": "RunShellScript",
        "enableParameter": true,
        "commandContent": "echo '{{username}}:{{passwordParameter}}'|chpasswd\nif grep -q \"PasswordAuthentication no\" /etc/ssh/sshd_config;then\n  sed -i \"s/PasswordAuthentication no/PasswordAuthentication yes/g\" /etc/ssh/sshd_config\n  systemctl restart sshd\nfi"
      },
      "Outputs": {
        "commandOutput": {
          "Type": "String",
          "ValueSelector": "invocationOutput"
        }
      }
    },
    {
      "Name": "modifyUserPasswordOnWindowsInstance",
      "Description": {
        "en": "Modify password on Windows instance",
        "zh-cn": "在Windows实例中修改用户密码"
      },
      "When": {
        "Fn::Equals": [
          "{{ queryInstanceOSType.OSType }}",
          "windows"
        ]
      },
      "OnError": "whetherToDetachRamRole",
      "Action": "ACS::ECS::RunCommand",
      "Properties": {
        "regionId": "{{ regionId }}",
        "instanceId": "{{ instanceId }}",
        "commandType": "RunPowerShellScript",
        "enableParameter": true,
        "commandContent": "net user {{username}} \"{{passwordParameter}}\""
      },
      "Outputs": {
        "commandOutput": {
          "Type": "String",
          "ValueSelector": "invocationOutput"
        }
      }
    },
    {
      "Name": "whetherToDetachRamRole",
      "Action": "ACS::Choice",
      "Description": {
        "en": "Whether to detach ram role from instance",
        "zh-cn": "是否卸载RAM角色"
      },
      "Properties": {
        "DefaultTask": "ACS::END",
        "Choices": [
          {
            "When": {
              "Fn::Equals": [
                "",
                "{{ queryInstanceRamRole.ramRoleName }}"
              ]
            },
            "NextTask": "detachInstanceRamRole"
          }
        ]
      }
    },
    {
      "Name": "detachInstanceRamRole",
      "Action": "ACS::ExecuteApi",
      "Description": {
        "en": "Detaches instance ram role",
        "zh-cn": "卸载实例Ram角色"
      },
      "Properties": {
        "Service": "ECS",
        "API": "DetachInstanceRamRole",
        "Parameters": {
          "RegionId": "{{ regionId }}",
          "RamRoleName": {
            "Fn::Join": [
              "-",
              [
                {
                  "Fn::Select": [
                    0,
                    {
                      "Fn::Split": [
                        ".",
                        "OOSServiceRole-{{ACS::ExecutionId}}"
                      ]
                    }
                  ]
                },
                {
                  "Fn::Select": [
                    1,
                    {
                      "Fn::Split": [
                        ".",
                        "OOSServiceRole-{{ACS::ExecutionId}}"
                      ]
                    }
                  ]
                },
                {
                  "Fn::Select": [
                    2,
                    {
                      "Fn::Split": [
                        ".",
                        "OOSServiceRole-{{ACS::ExecutionId}}"
                      ]
                    }
                  ]
                }
              ]
            ]
          },
          "InstanceIds": [
            "{{ instanceId }}"
          ]
        }
      }
    },
    {
      "Name": "deleteStack",
      "Action": "ACS::ExecuteApi",
      "Description": {
        "en": "Delete stack",
        "zh-cn": "删除资源栈"
      },
      "Properties": {
        "Service": "ROS",
        "API": "DeleteStack",
        "Parameters": {
          "RegionId": "{{ regionId }}",
          "StackId": "{{ createECSRamRole.stackId }}",
          "RetainAllResources": false
        }
      }
    }
  ]
}