Use cloud-config files to configure a server
Cloud-config files are supported by our Metadata service and are used by cloud-init to automate server configuration. This guide covers creating cloud-config files, common modules, and examples to help get you started.
Syntax
Cloud-config data is written using the YAML syntax, a commonly used data serialization format that's more user-friendly and human-readable than alternatives (like JSON). YAML consists of key-value pairs. Each key is entered on its own line and a colon (:
) is used to separate the key from its value. The scope of the key is defined by its indentation. To learn more about YAML, review the latest YAML specification.
Cloud-config modules
A cloud-config file must contain #cloud-config
as the first line. Following that, you can use the keys provided by any of the cloud-init modules. Review the remaining sections of this guide for a list of common modules and how to configure them. For a full list of modules/keys, see the cloud-init module reference.
Create a new user and restrict root access
One of the most common security tasks for every new system deployment is configuring user accounts. This includes creating a limited user account for the system administrator, adding them to the sudo group, and enabling the user to log in over SSH using a public key instead of a password.
users
(list): Configure user accounts (Reference | Example)name
(string): The name of the user.passwd
(string): The hash of the password you want to configure for this user.groups
(string): The name of the group the user should belong to.sudo
: Define a sudo rule string or set toFalse
to deny sudo usage.lock_passwd
(boolean): If true (the default setting), prevents logging in with a password for that user.ssh_authorized_keys
(list): A list containing the public keys that should be configured for this user.
#Cloud-config
users:
- name: example-user
groups: sudo
sudo: ALL=(ALL) NOPASSWD:ALL
shell: /bin/bash
ssh_authorized_keys:
- [insert-public-key]
Update system
Updating the system is another common task that's performed after a system is deployed.
package_update
(boolean): Updates the apt database (cloud-init Docs)package_upgrade
(boolean): Upgrades the software on your system (by running the yum or apt upgrade command). See the cloud-init documentation.
#Cloud-config
package_update: true
package_upgrade: true
Install a software package
Almost all workloads running on a Compute Instance require additional software to be installed. You can automatically install software packages by adding them to your cloud-config file.
packages
(list): Installs the specified list of packages. See the cloud-init documentation.
#Cloud-config
packages:
- nginx
- mysql-server
- php
Run a command
runcmd
(list): Runs the specified commands during the first boot. See the cloud-init documentation.
#Cloud-config
runcmd:
- mkdir ~/new-folder/
Write to a file
write_files
(list): see the cloud-init documentation.content
: The entire content to include in the file.path
: The path for the file. If a file already exists at this location, it is overwritten.permissions
: Defines the file permissions in octal format (ex:0644
).
#Cloud-config
write_files:
- content: |
<html>
<h1>Hello world!</h1>
<p>This is the content of my web page.</p>
</html>
path: /var/www/html/index.html
Updated about 2 months ago