S3 Blobstore: can I use IAM instance profile instead of supplying key/secret?

[artemave]

The reason for that is that IAM instance profile access can scripted in cloud formation template.

[dereke]

to clarify the EC2 instance has an IAM role assigned to it so can access S3 without needing credentials, I think all that flynn needs to be able to do is to disable the check for the credentials.

[titanous]

Try ec2_role=true instead of access_key_id/secret_access_key. I'm not sure when it was tested last, but the intention was that this should work:

flynn -a blobstore env set BACKEND_S3MAIN="backend=s3 region=us-east-1 ec2_role=true bucket=flynnblobstore"

[artemave]

Nice one!

This got me further but still not quite all the way there:

[2017-12-11T17:45:01.02021Z]     2017/12/11 17:45:01 blobstore: error checking S3 bucket "bs-pr-apps-flynn-stack-flynnblobstore-16u5r9o614986" existence, ensure that it exists and these actions are authorized: s3:ListBucket, s3:PutObject, s3:GetObject, s3:DeleteObject, s3:ListMultipartUploadParts, s3:AbortMultipartUpload, s3:ListBucketMultipartUploads; RequestError: send request failed
[2017-12-11T17:45:01.020273Z]    caused by: Head https://bs-pr-apps-flynn-stack-flynnblobstore-16u5r9o614986.s3-eu-west-1a.amazonaws.com/: dial tcp: lookup bs-pr-apps-flynn-stack-flynnblobstore-16u5r9o614986.s3-eu-west-1a.amazonaws.com on 100.100.48.1:53: no such host

[titanous]

Drop -1a from the region.

[artemave]

Dropping -1a didn't work, but dropping a did!

apps@LONAGENT03:~$ flynn -a blobstore env set BACKEND_S3MAIN="backend=s3 region=eu-west-1 bucket=bs-pr-apps-flynn-stack-flynnblobstore-16u5r9o614986 ec2_role=true"
Created release 70c303f6-53c2-415b-8ca5-8da1e749c5b6.

Thanks a lot! Is there a documentation that describes ec2_role=true trick (and perhaps some others too)?

[dereke]

We should add that option in the error message. I might try and do that as I need an excuse to try some go and make a first commit to flynn 😀

…

On 11 Dec 2017 6:09 pm, "artem avetisyan" ***@***.***> wrote: Dropping -1a didn't work, but dropping a did! ***@***.***:~$ flynn -a blobstore env set BACKEND_S3MAIN="backend=s3 region=eu-west-1 bucket=bs-pr-apps-flynn-stack-flynnblobstore-16u5r9o614986 ec2_role=true" Created release 70c303f6-53c2-415b-8ca5-8da1e749c5b6. Thanks a lot! Is there a documentation that describes ec2_role=true trick (and perhaps some others too)? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#4303 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAI2Gh6bEi8F4vYKPJZ2yBOHEcTRBk_Qks5s_W_MgaJpZM4Q9Sqa> .