Description
If an AMI has been prepared using Packer and Ansible with the MindPointGroup.RHEL7-CIS role applied, CodeDeploy fails to start up and no deployments happen.
Because of this, the code in #18 destined for master has that role commented out in ansible/bakery.yml:
- name: Harden Server
hosts: 127.0.0.1
connection: local
become: yes
roles:
- extra-cis-remediation
#- MindPointGroup.RHEL7-CIS
- scan-openscap
@obscurerichard took a first crack at fixing this by forking https://github.com/ModusCreateOrg/ansible-aws-codedeploy-agent from https://github.com/cbdr/ansible-aws-codedeploy-agent and fixing up script download locations so that it was not running a script from /tmp which is marked with noexec with the CIS remediations. That did not seem to do the trick on its own though.
Troubleshooting this might involve looking at boot logs, adjusting timeouts, ssh'ing into an instance as it boots up, and figuring out why the CodeDeploy agent is not working as expected when the CIS baseline lockdown is in effect.