Pass Credentials to EC2 Image Builder - Connecting to a Network Share

Yes, you can achieve this without using AWS Lambda. The AWS-recommended best practice for this scenario is to use AWS Secrets Manager in combination with the IAM role assigned to your builder instance.

Here is the straightforward approach to securely pass credentials without storing them in your Image Builder Component:

1. Store Credentials:

Save your domain service account credentials securely as a key-value pair (e.g., username and password) in AWS Secrets Manager.

2. Update IAM Permissions:

Go to the Infrastructure Configuration of your Image Builder pipeline and check the attached IAM Instance Profile. Add an IAM policy to this role that grants the secretsmanager:GetSecretValue permission (ideally restricted to the specific ARN of your newly created secret).

3. Fetch Dynamically in your Component:

In your custom Component document (using an ExecutePowerShell action), retrieve the secret at runtime into memory, map the drive, grab your files, and disconnect.

Here is an example using PowerShell for a Windows Component:

# 1. Fetch secret from AWS Secrets Manager

$Secret = (Get-SECSecretValue -SecretId "your-service-account-secret").SecretString | ConvertFrom-Json
$Password = $Secret.password | ConvertTo-SecureString -AsPlainText -Force
$Credential = New-Object System.Management.Automation.PSCredential ("YOURDOMAIN\$($Secret.username)", $Password)

# 2. Mount network share securely

New-PSDrive -Name "NetShare" -PSProvider FileSystem -Root "\\your-server\share-path" -Credential $Credential

# 3. Copy your required files

Copy-Item -Path "NetShare:\*" -Destination "C:\YourLocalBuildPath" -Recurse

# 4. Cleanup

Remove-PSDrive -Name "NetShare"

Note: Ensure that the VPC, Subnet, and Security Groups specified in your Infrastructure Configuration allow outbound traffic to your network share (specifically TCP Port 445 for SMB, routed via VPN/Direct Connect/Transit Gateway) and to AWS Secrets Manager (either via a NAT Gateway or a VPC Interface Endpoint for Secrets Manager).