Use cloud-config files to configure a server

Suggest Edits

Cloud-config files are supported by our Metadata service and are used by cloud-init to automate server configuration. This guide covers creating cloud-config files, common modules, and examples to help get you started.

Syntax

Cloud-config data is written using the YAML syntax, a commonly used data serialization format that's more user-friendly and human-readable than alternatives (like JSON). YAML consists of key-value pairs. Each key is entered on its own line and a colon (:) is used to separate the key from its value. The scope of the key is defined by its indentation. To learn more about YAML, review the latest YAML specification.

Cloud-config modules

A cloud-config file must contain #cloud-config as the first line. Following that, you can use the keys provided by any of the cloud-init modules. Review the remaining sections of this guide for a list of common modules and how to configure them. For a full list of modules/keys, see the cloud-init module reference.

Create a new user and restrict root access

One of the most common security tasks for every new system deployment is configuring user accounts. This includes creating a limited user account for the system administrator, adding them to the sudo group, and enabling the user to log in over SSH using a public key instead of a password.

users (list): Configure user accounts (Reference | Example)
- name (string): The name of the user.
- passwd (string): The hash of the password you want to configure for this user.
- groups (string): The name of the group the user should belong to.
- sudo: Define a sudo rule string or set to False to deny sudo usage.
- lock_passwd (boolean): If true (the default setting), prevents logging in with a password for that user.
- ssh_authorized_keys (list): A list containing the public keys that should be configured for this user.

#Cloud-config
users:
- name: example-user
  groups: sudo
  sudo: ALL=(ALL) NOPASSWD:ALL
  shell: /bin/bash
  ssh_authorized_keys:
  - [insert-public-key]

Update system

Updating the system is another common task that's performed after a system is deployed.

package_update (boolean): Updates the apt database (cloud-init Docs)
package_upgrade (boolean): Upgrades the software on your system (by running the yum or apt upgrade command). See the cloud-init documentation.

#Cloud-config
package_update: true
package_upgrade: true

Install a software package

Almost all workloads running on a Compute Instance require additional software to be installed. You can automatically install software packages by adding them to your cloud-config file.

packages (list): Installs the specified list of packages. See the cloud-init documentation.

#Cloud-config
packages:
- nginx
- mysql-server
- php

Run a command

runcmd (list): Runs the specified commands during the first boot. See the cloud-init documentation.

#Cloud-config
runcmd:
- mkdir ~/new-folder/

Write to a file

write_files (list): see the cloud-init documentation.
- content: The entire content to include in the file.
- path: The path for the file. If a file already exists at this location, it is overwritten.
- permissions: Defines the file permissions in octal format (ex: 0644).

#Cloud-config
write_files:
- content: |
    <html>
    <h1>Hello world!</h1>

    <p>This is the content of my web page.</p>
    </html>
  path: /var/www/html/index.html

Updated 2 days ago