Update stack from outside AWS

[vascoptorres]

I need to allow some people from my organization to toggle our hubs instance between online and offline. Maybe even let them change the EC2 instance type. But they don't have access to AWS.

Is it possible to update the stack from outside AWS? maybe with a lambda function or some other service from AWS?

If this is doable and someone could point me in the right direction, I would really appreciate it :)

Thank you

[yalegria]

Check if Cloudformation has a API that allows you make changes to a stack. Then you will be able to create a script to use the API.

[yalegria]

I dont see why not. You might not even need to create a script, if your local computer is setup with AWS CLI, you just need to execute that command with correct parameters. One thing I can think of is that you might need to setup a special permission with the user you are using to be able to perform operations to the stack.

[vascoptorres]

But I don't want to use it from my machine, that I can do right now without a problem. I want to be able to call it from outside of my machine, for example, I want to be able to call it from within a back-office that I have. So that my colleagues can just click a button and change it. They don't know anything about AWS and I don't want to give them privileges either.

[yalegria]

ok, then create a single page application with a button, that when clicked calls the execution of that stack update command.

[vascoptorres]

Are you knowledgeable about this? if yes, can you actually point towards useful information? Because writing what I say in a different format doesn't really help

[johnshaughnessy]

I don't know of any pre-built way to allow people to change or update your stack. Yalegria's "create a single page application with a button" suggestion sounds like "write some code that allows people to run a script that has access to your AWS credentials". That's possible, though it sounds more difficult than creating IAM logins for the people who need specific capabilities.

I don't know what information would help you accomplish this. If you set up a server that had your AWS credentials, you could expose an endpoint that allows people to trigger some code to run on that server. The code you want to run is a script that invokes AWS CLI utilities to change stack properties.

To me, this sounds less secure than setting up estricted IAM logins but it might be your preference anyway. I'm going to mark yalegria's response as the answer because I don't know of any other way to do what you're asking to do.