Traefik + Lego on AWS Lightsail

[Clement-Jean]

I'm currently using Traefik and Lego in order to have HTTPS connection to my docker containers.

In the following documentation, it's mentioned that I need to use the following provider to do DNS Challenge.

Now, I did this but I get this error:

AccessDeniedException: User: arn:aws:sts::***:assumed-role/AmazonLightsailInstanceRole/*** is not authorized to perform: lightsail:CreateDomainEntry on resource: arn:aws:lightsail:us-east-1:***

and another for DeleteDomainEntry, even though I have lightsail:* on Resource: * permission on the IAM user used for configuration.

If I understand correctly Lightsail is managed separately for the other AWS services and thus we need to use STS for connecting to it. So my question is this, how can I set the permissions for the temporary token to be able to do CreateDomainEntry and DeleteDomainEntry?

[Clement-Jean]

The Policy part does not give any detail on where these Policy should be attached to

[dicksonleong]

The AmazonLightsailInstanceRole is a service-linked role that is managed by AWS outside of user AWS account. So I don't think it is possible to assume role using this role (not 100% sure though, AWS doc isn't very clear on this).

Furthermore, to use STS the client will have to call assume role API first, then use the temporary credential from the response to call CreateDomainEntry API. Both Lego and traefik didn't perform this action.

For me, I just simply create a IAM user and attached that policy to it, then set the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY of this user when running Traefik.

[Clement-Jean]

I have this policy in the IAM user I'm using for configuration:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "lightsail:*"
            ],
            "Resource": "*"
        }
    ]
}

It should work right ?

Also I'm using AWS_ACCESS_KEY_ID_FILE and AWS_SECRET_ACCESS_KEY_FILE but this shouldn't change anything I guess.

[dicksonleong]

The policy should works, though i recommend using the more restrictive one once you tested it is okay.

I don't think the _FILE suffix works for the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY since those are read by the AWS SDK directly (https://docs.aws.amazon.com/sdk-for-go/api/aws/credentials/#EnvProvider).