Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

support assumeRole #53

Closed
ghost opened this issue Sep 30, 2019 · 3 comments
Closed

support assumeRole #53

ghost opened this issue Sep 30, 2019 · 3 comments

Comments

@ghost
Copy link

ghost commented Sep 30, 2019

Orb version

6.3.0

What happened

my setup involves the IAM ci user used by circle having no permissions except assumeRole, and a ci role having permissions to ECR, as common practice for segregating access control.
I had assumed that the profile-name param in concert with a custom awscli config file (containing a profile definition that specifies a role_arn) would serve exactly this purpose but I've been unable to find a way to make it work.
seeing issue #9 open I'd think that this use case is not supported at all, is this the case?

Expected behavior

I believe this user-role segregation with assumeRole is a common and recommended security pattern and it would be great to see it supported in an official orb.

@lokst
Copy link
Contributor

lokst commented Mar 31, 2020

@foo-tw Hi, apologies for the great delay in response. We have just resolved issue #9 , would you mind trying out circleci/aws-ecr@6.8.0 to see if it works for you? Please feel free to reopen the issue if it is still an issue for you.

@lokst lokst closed this as completed Mar 31, 2020
@zlahham
Copy link

zlahham commented Feb 2, 2021

Hi @lokst, also trying to understand how to use the assume role as intended with this orb? I was not able to fully see how the profile-name is to be used here. As in where would I specify the config for a given profile (e.g. role arn) in order to use that profile's name in the orb?

cc: @Denyer

@Ogaday
Copy link

Ogaday commented Feb 17, 2022

Looks like #170 should resolve this

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants