Salt Reactor: accept minion key from S3 bucket, sync grains and run highstate

new_minion.sls

# Only act on minions with default EC2 hostname
{% if data['id'].endswith('.compute.internal') %}

{% if data.get('act') == 'pend' %}

# Copy minion public key from trusted bucket and remove "pending" minion key
# tgt and s3 bucket edited for privacy
accept_minion_public_key:
  local.cmd.run:
    - tgt: salt.example.com
    - arg:
      - aws s3 cp s3://salt-bucket/minion/{{ data['id'] }}.pub /etc/salt/pki/master/minions/{{ data['id'] }} && rm -f /etc/salt/pki/master/minions_pre/{{ data['id'] }}

{% endif %} # End act pend

{% if data.get('act') == 'accept' %}

# When the key is accepted, run highstate right away
ec2-instance-highstate:
  local.state.highstate:
    - tgt: {{ data['id'] }}

{% endif %} # End act accept

{% endif %} # End data id ends with

Salt Reactor key management

# Salt master config (partial)

reactor:
  - 'salt/auth':
    - /srv/salt/reactor/new_minion.sls
  - 'minion_start':
    - /srv/salt/reactor/sync_grains.sls

sync_grains.sls

sync_grains:
  local.saltutil.sync_grains:
    - tgt: {{ data['id'] }}