With CloudShare, you decide what goes inside the environment that each of your end users (students, POC users, etc.) work on, depending on the software you require based on Amazon Machine Images (AMIs).

You can choose any of the following:

• AWS public AMIs
• Your own custom AMIs on AWS
• Marketplace AMIs

An AWS key-pair is used to enable remote access to the VM (Linux) or password reset privileges (Windows). For each environment, CloudShare uses a keypair named cs-key which must be created for each VM in the Terraform script. See an example in the following snippet:

# Change "instance_type" according to your needs
# Change "ci-key-username" to your  AMI username
# The "Name" tag will be the VM name as seen in the CloudShare viewer.
data "aws_ami" "ubuntu" {
  most_recent = true
  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
  }
  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
  owners = ["099720109477"] # Canonical
}
resource "aws_instance" "web" {
  ami           = "${data.aws_ami.ubuntu.id}"
  instance_type = "t2.micro"
  key_name      = "cs-key"
  tags = {
    Name = "Ubuntu 20.04"
    ci-key-username = "ubuntu"
  }
}

Using Custom AMIs

Because we know that you will want to provide images containing your own software, CloudShare enables you to incorporate custom AMIs into your environments.

To use a custom AMI that you provide, perform the following steps:

Step 1: Create the AMI in your AWS account.

Step 2: Grant CloudShare permission to access your AMI.

1. In the Console of your AWS account, select IAM service > Roles > Create role
2. Choose Another AWS account and insert the CloudShare account ID into the Account ID field. Contact CloudShare Support for CloudShare’s account ID.
3. On the Create Policy page, use the following JSON:

   {
       "Version": "2012-10-17",
       "Statement": [{
           "Sid": "VisualEditor0", "Effect": "Allow",
           "Action": "ec2:ModifyImageAttribute", "Resource": "*"
        }]
   }

4. Name the newly-created role ‘ModifyImage’.

Step 3: Make the AMI accessible to your CloudShare account.

Add references to your custom AMIs through your CloudShare Admin interface:

1. Log in to your CloudShare account.
2. From the left side menu, click External Resources > AWS AMIs.
3. Click Add New on the top bar of the AMIs pages.
4. Enter the details of your custom AMI.
5. Optionally, if your AMI is encrypted, enter the encryption details of your AMI. (See more details in the following section.)

Upon completion of this procedure, your custom AMI will be accessible by CloudShare.

Encrypted AMIs

When your AMI is encrypted, it needs to be encrypted using a customer managed key (CMK).

In addition to the procedure detailed above in ‘Using Custom AMIs’, perform the following steps:

Step 1: Update the ModifyImage role by adding another policy with the following JSON:

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "VisualEditor0", 
         "Effect": "Allow", "Action": 
         [
            "kms:Encrypt", 
            "kms:Decrypt", 
            "kms:ReEncrypt*", 
            "kms:GenerateDataKey*", 
            "kms:DescribeKey", 
            "kms:PutKeyPolicy", 
            "kms:GetKeyPolicy"
         ],
         "Resource": "arn:aws:kms:REGION:KEY_ACCOUNT_ID:key/KEY_ID"
     }
  ]
}

Replace the REGION, KEY_ACCOUNT_ID and KEY_ID parameters above with the appropriate CMK data. For example:

arn:aws:kms:us-west-2:453078712345:key/9ec319c5-6179-4c17-a37b-398f37712a34

Step 2: Allow use of the key, and editing by the ModifyImage role on the key’s policy:

{
    "Sid": "Allow use of the key", 
    "Effect": "Allow", "Principal": 
    {
       "AWS": "arn:aws:iam::MODIFY_IMAGE_ROLE_ACCOUNT_ID:role/ModifyImage"
  },
  "Action": [
      "kms:Encrypt", 
      "kms:Decrypt", 
      "kms:ReEncrypt*", 
      "kms:GenerateDataKey*", 
      "kms:DescribeKey", 
      "kms:PutKeyPolicy", 
      "kms:GetKeyPolicy"
  ],
  "Resource": "*"
},
{
   "Sid": "Allow attachment of persistent resources", 
   "Effect": "Allow",
   Principal": {
      "AWS": "arn:aws:iam::MODIFY_IMAGE_ROLE_ACCOUNT_ID:role/ModifyImage"
   },
   "Action": [
       "kms:CreateGrant", 
       "kms:ListGrants", 
       "kms:RevokeGrant"
   ],
   "Resource": "*", 
   "Condition": {
       "Bool": {
          "kms:GrantIsForAWSResource": "true"
       }
    }
}

Replace the MODIFY_IMAGE_ROLE_ACCOUNT_ID parameter above with the ID of the account where the ModifyImage role was created.

Marketplace AMIs

CloudShare also enables you to utilize the massive selection of AMIs that are available from the AWS Marketplace, to your benefit.

If you need to use an AMI which requires a subscription, contact your CloudShare Support representative and provide one of the following details:

• the URL, or
• the Product ID of the Marketplace AMI.