# AWS CloudFormation Init and chef-client

**URL:** <https://discourse.chef.io/t/aws-cloudformation-init-and-chef-client/6415>\
**Category:** Chef Infra (archive)\
**Created:** [March 17, 2015, 3:38pm UTC](https://discourse.chef.io/t/aws-cloudformation-init-and-chef-client/6415 "2015-03-17T15:38:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_Lindsay](https://avatars.discourse-cdn.com/v4/letter/m/dec6dc/32.png) [@Michael\_Lindsay](https://discourse.chef.io/u/Michael_Lindsay)\
**Post date:** [March 17, 2015, 3:38pm UTC](https://discourse.chef.io/t/aws-cloudformation-init-and-chef-client/6415/1 "2015-03-17T15:38:46Z")

</div>

Hello All,

I have ami’s that I’m creating from chef scripts, and I would like them to  
re-register themselves with my chef server on boot. It looks as though it  
ought to be a pretty straightforward thing, but I haven’t seen any examples  
out there. All of the examples appear to assume a base image without  
chef-client and all it’s goodness. So my question is, what is the minimum  
required to have an instance spun up from an ami register and come under  
control of chef server? I’d like to stuff that into CloudFormation  
UserData and speed up my deployments.

Thanks, again,

- Michael

---

<div class="post-metadata">

**Author:** ![luckymike](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/luckymike/32/134_2.png) [@luckymike](https://discourse.chef.io/u/luckymike)\
**Post date:** [March 17, 2015, 3:56pm UTC](https://discourse.chef.io/t/aws-cloudformation-init-and-chef-client/6415/2 "2015-03-17T15:56:12Z")

</div>

Hey Michael,

You can use cfn-init to install the omnibus chef-client, copy the validation.pem from S3 (unless it's pre-baked in your ami), and write a client.rb config file and a first-run.json.

Then you just need a cfn command of 'chef-client -c -j

AWS definitely has some example cfn code to do something like this.

--  
Michael F. Weinberg | Director of Operations  
[http://heavywaterops.com](http://heavywaterops.com) | @heavywaterops

> On Mar 17, 2015, at 8:38 AM, Michael Lindsay [mlindsay@metrodigi.com](mailto:mlindsay@metrodigi.com) wrote:
> 
> Hello All,
> 
> I have ami's that I'm creating from chef scripts, and I would like them to re-register themselves with my chef server on boot. It looks as though it ought to be a pretty straightforward thing, but I haven't seen any examples out there. All of the examples appear to assume a base image without chef-client and all it's goodness. So my question is, what is the minimum required to have an instance spun up from an ami register and come under control of chef server? I'd like to stuff that into CloudFormation UserData and speed up my deployments.
> 
> Thanks, again,
> 
> - Michael

---

<div class="post-metadata">

**Author:** ![jdunn](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/jdunn/32/1800_2.png) [@jdunn](https://discourse.chef.io/u/jdunn)\
**Post date:** [March 19, 2015, 9:38pm UTC](https://discourse.chef.io/t/aws-cloudformation-init-and-chef-client/6415/3 "2015-03-19T21:38:58Z")

</div>

This presentation from re:Invent is a little old (like please don't  
install Chef directly from Rubygems anymore in this way), but it's  
pretty similar to what you want to do.

[![](https://us1.discourse-cdn.com/flex016/uploads/chef/original/2X/7/7ddb9f7293df4dc93787265f26a1c3a17fbc3b24.jpeg "AWS re: Invent ARC 204: AWS Infrastructure Automation") ](https://www.youtube.com/watch?v=Lpcg3X4_MGI)

Skip to around the 40 minute mark.

- Julian

On Tue, Mar 17, 2015 at 11:38 AM, Michael Lindsay  
[mlindsay@metrodigi.com](mailto:mlindsay@metrodigi.com) wrote:

> Hello All,
> 
> I have ami's that I'm creating from chef scripts, and I would like them to  
> re-register themselves with my chef server on boot. It looks as though it  
> ought to be a pretty straightforward thing, but I haven't seen any examples  
> out there. All of the examples appear to assume a base image without  
> chef-client and all it's goodness. So my question is, what is the minimum  
> required to have an instance spun up from an ami register and come under  
> control of chef server? I'd like to stuff that into CloudFormation UserData  
> and speed up my deployments.
> 
> Thanks, again,
> 
> - Michael

--  
[Julian C. Dunn [jdunn@aquezada.com](mailto:jdunn@aquezada.com) \* Sorry, I'm ]  
[WWW: [Julian Dunn's Blog - Commentary on media, technology, and everything in between.](http://www.aquezada.com/staff/julian) \* only Web 1.0 ]  
[gopher://sdf.org/1/users/keymaker/ \* compliant!]  
[PGP: 91B3 7A9D 683C 7C16 715F 442C 6065 D533 FDC2 05B9]

---

<div class="post-metadata">

**Author:** ![pmocek](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@pmocek](https://discourse.chef.io/u/pmocek)\
**Post date:** [March 21, 2015, 10:32pm UTC](https://discourse.chef.io/t/aws-cloudformation-init-and-chef-client/6415/4 "2015-03-21T22:32:44Z")

</div>

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512

Michael Lindsay wrote:

> what is the minimum required to have an [Amazon EC2] instance  
> spun up from an ami register and come under control of chef  
> server?

Such requirements for a virtual machine managed by AWS are no  
different than those for any other physical or virtual machine.  
Your question might be better asked as, "How does one [bootstrap  
a node](https://docs.chef.io/install_bootstrap.html)?" or "How does one [bootstrap a node in an unattended  
manner](https://docs.chef.io/install_bootstrap.html#unattended-installs)?"

Assuming that you want the new machine to initiate contact with  
the Chef server rather than having something on the Chef server  
or another chef workstation connect to then new machine and start  
the process, you'll need to have chef-client installed on the new  
machine and for it to connect to and authenticate with a Chef  
server, providing a run list and unique node name. There are  
multiple ways to accomplish that.

I perform Chef bootstrapping of CloudFormation-launched EC2  
instances by using a combination of [CloudInit](https://help.ubuntu.com/community/CloudInit) and the  
[CloudFormation helper scripts](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-helper-scripts-reference.html) to create a file containing a  
copy of the server's [chef-validator key](https://docs.chef.io/chef_client.html#chef-validator), download and install  
the applicable chef-client package, and initiate a chef-client  
run. I trigger all of that upon first boot by providing [user  
data](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html) to the machine for CloudInit to read by defining it in  
the [UserData section](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-instance.html#cfn-ec2-instance-userdata) of the Properties section of my  
instance's definition in my stack template. For Ubuntu machines,  
I use one of the Ubuntu-provided AMIs, which have CloudInit  
installed. For CentOS, I make my own AMI, starting with a machine  
launched from one of the CentOS maintainers' images, enabling the  
EPEL repository, installing the cloud-init package, shutting down,  
and imaging that machine.

Also, when asking a question on a technical mailing list, [putting  
your question in the message subject](http://catb.org/~esr/faqs/smart-questions.html#bespecific) helps people know what  
information you seek and thus makes it more likely that those who  
can help will read the body of your message. It also helps other  
people who have the same question find the answer later.

References:

* * *

Phil Mocek  
[https://mocek.org](https://mocek.org)  
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJVDfGMAAoJECo3+Y/AS212pZwP/0WEYtpZgS4K8AtBqraI+tq2  
7LdbGmZHsE1Cs5EkRLimGkSNcG/nAM4b0AdnlBqRtQnk5wyny19ayooY2iNmhsXn  
9fLjy1q0HLqUwWNpaPahfscfmWcFLR5H3BqbPkcZMMG6SswITK4u/oiXAPORgx37  
CPoc+lwt3JgvHo5B2xEcBW2q6NWwo1nxrdnLFWhvoO0aMSlHOEhpoz6BMdF7o/B2  
khtbi8TuomjZtvyOp0zucm/uPv7tj3olB1jYrkESE6UaTZgZKq/Ei5AmBI3fXvcI  
/dAqU1YSbinkBFECEfwuXC5jx8+duvkYIyeGxNMTvptP4JhYqkLkfb5EtmQn3iXk  
V2pEADzBAdGdurmmTmDLoW+L2psi21sIyXJ8XAb/mKiOhbo/p/9q9QiVQ6GeUk6Z  
+YrQIRoBc1zs6btYCO+7hKl7g3p1FHPVz1wUmoLXW7WYumPySdvz1e1jxowFJ47p  
zRHUxqy72az0aFtgldqGaUoQvxJj7zbdRhrloFZRdf3u71soAv0ha/UcGmQtdcqW  
baYqAjDGG3tlo8J0Z9Z5wCGBxfnHiLX1mmfUPbyrePky7fWuGt20fdA+4fDXwE+s  
vCrf51+4pSwg980UtAEidV8IGoC9jRWR4KrMMp7OPZaeIUN1oUD1BgvFlDWXUwCI  
hDpMKR14QQ96+eGNZOz3  
=eTya  
-----END PGP SIGNATURE-----