-
Notifications
You must be signed in to change notification settings - Fork 44
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Please document how to serve real credentials in the mocked data #184
Comments
@joshtriplett I actually have a blog post about to be published doing exactly this with real credentials and responds the same way as an ec2 instance (all the SDKs pick it up as native instance profile). I am putting the finishing touches on it and should have it done in the next day or so. Edit: finished it up and published it showing how to do this https://medium.com/@slimm609/aws-instance-profile-for-local-development-f144b0a7b8b9 |
@slimm609 That sounds great! Thank you. |
@slimm609 That's a great use case! Would you be open to adding to our Community Use Cases section with the content? Or would you mind if someone from our team added a section if you don't have bandwidth? In either case, we would attribute you for the content, but I'm reluctant to simply link the blog post because of the overhead for our team to maintain the integrity of said links. |
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If you want this issue to never become stale, please ask a maintainer to apply the "stalebot-ignore" label. |
Still here, still interested. |
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If you want this issue to never become stale, please ask a maintainer to apply the "stalebot-ignore" label. |
This issue was closed because it has become stale with no activity. |
Speaking on behalf of the company I work for, we're very interested in this too. We use ecs-local-container-endpoints and the aws-sdk-v2 (node) works fine when using the IMDS service from the following projects:
However, aws-sdk-v3 (node) does not seem to work. The default chain never finds a valid credential from the 2 services above. Our security policies do not allow us to pass This is our # Original source from: https://aws.amazon.com/blogs/compute/a-guide-to-locally-testing-containers-with-amazon-ecs-local-endpoints-and-docker-compose/
version: "2.1"
networks:
default:
driver: bridge
ipam:
driver: default
credentials_network:
driver: bridge
ipam:
config:
- subnet: "169.254.170.0/24"
gateway: 169.254.170.1
services:
ecs-local-endpoints:
image: amazon/amazon-ecs-local-container-endpoints
volumes:
- /var/run:/var/run
env_file:
- .env
environment:
AWS_EC2_METADATA_SERVICE_ENDPOINT: http://host.docker.internal:8081/
AWS_PROFILE: ${AWS_PROFILE}
networks:
credentials_network:
# This special IP address is recognized by the AWS SDKs and AWS CLI
ipv4_address: "169.254.170.2"
app:
depends_on:
- ecs-local-endpoints
networks:
credentials_network:
ipv4_address: "169.254.170.3"
extra_hosts:
- "host.docker.internal:host-gateway"
environment:
# AWS_REGION: ${AWS_REGION} -- We already load using `env_file` in docker-compose.yml
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI: "/creds"
AWS_EC2_METADATA_SERVICE_ENDPOINT: http://host.docker.internal:8081
ECS_CONTAINER_METADATA_URI: "http://169.254.170.2/v3" We run either As I said, it works fine with sdk v2, but not with v3. Since I haven't figured out the reason yet (already invested 6-8 hours), I went after alternatives and arrived here. |
@jweyrich DId you look at the blog post above? There are several things that are outside the scope of what this tool would do (creating loopback virtual interfaces, templated configs, etc). I created a repo that wraps around ec2-metadata-mock to wrap it all together and works natively on the system with the AWS SDKs. Its in the blog post above as well but here is the repo https://github.com/slimm609/mock-instance-profile |
@slimm609 I don't think a loopback virtual interface is necessary. See A Guide to Locally Testing Containers with Amazon ECS Local Endpoints and Docker Compose. We define a Docker bridge network in the same CIDR as the IMDS and change the default metadata service endpoint via env var |
@brycahta would it make sense for the project to support providing valid tokens? I ask because the project name contains "mock" - so it may be far from the initial idea/proposal. |
For the purposes of testing an application relying on the IMDS metadata service, I'd like to be able to serve valid AWS credentials via the mocked IMDS.
I'd love to have documentation for how to translate
~/.aws/credentials
into the relevant pieces of the mock configuration, or better yet, an option to serve up a particular profile from those credentials as the mocked data.The text was updated successfully, but these errors were encountered: