Creating a Log Export Container AWS AMI
-
Go to the EC2 management panel and click on Launch instances.
-
Search for “Ubuntu” and select the latest version.
-
Select your Instance Type and click on Next: Configure Instance Details.
-
This is the most important step. You can enter custom configurations or leave it with the defaults values, but under the Advanced Details > User data field you need to copy and paste the content from the file ami-cloud-init-user-data.sh. After that click on Next: Add Storage.
-
Configure your storage or leave it with the default values and click on Next: Add Tags.
-
Add tags if you want and click on Next: Configure Security Group.
-
Now you can configure a new security group or select an existing one. After that click on Review and Launch.
-
Take a look at everything and if it seems fine just click on the Launch button.
-
Configure your key pair for accessing the instance and click on Launch instances.
-
Now you need to SSH into the created container to keep track of the setup progress.
-
After logging into the container, enter the following command to see in real time the logs generated from the setup process:
$ tail -f /var/log/cloud-init-output.log
This step will take a while and you will know that it has finished when the “PLAY RECAP” message appears (see image below). 
After that Log Export Container should be up and running. And you can test it if you like, you just need to make the proper log configuration in StrongDM.
- Now we need to clean the container in order to generate the AMI. We need to get rid of any credentials and disable root login. To do that you need to run the clean-up-credentials.sh script inside the container:
$ sudo /clean-up-credentials.sh
-
Now you can exit the container and go back to the EC2 management console.
-
Right click on the container and click on Image and templates > Create image.
- Enter a name for your AMI and a description. After that click on Create image.
And that’s it. You have successfully created a Log Export Container AMI.