using iamlive in proxy mode with localstack

[phynias]

I am currently trying to get iamlive in proxy mode working with localstack, but I am having a problem. I think it has something to do with aws endpoint url and from what I can tell I can't figure out how to set that for iamlive to pickup.

I am just curious if anyone has gotten this working or is there a setting I am overlooked?

[iann0036]

Hey @phynias,

There isn't a setting for that at the moment, but it shouldn't be too hard to implement. The filter is located here:

iamlive/iamlivecore/proxy.go

Line 159 in 10ed9e2

isAWSHostname, _ := regexp.MatchString(`^.*\.amazonaws\.com(?:\.cn)?$`, req.Host)

You could compile your own version with this modification using Go, otherwise let me know which OS you're on and I can compile you a version.

[phynias]

ubuntu 20. thanks!!!!

anyway we can turn this into an optional or perm setting?
I would rather not have to compile my own every time it's updated.

[iann0036]

Hey @phynias,

Give this one a try. Add the argument similar to the following (adjust address pattern as necessary):

iamlive --mode proxy --proxy-endpoint-pattern "^127\\.0\\.0\\.1$"
# or
iamlive --mode proxy --proxy-endpoint-pattern "^localhost$"

Note that S3 endpoint detection might break here, so let me know if this works for services like EC2 and I can adjust.

iamlive.zip

[phynias]

doesn't look like it's working. no policy is created.
i can tell the aws cli is sending it to iamlive because if i stop iamlive then aws complains about failing to connect to the proxy.

i tried just a simple 'ec2 describe-instances' and it returns a reservation json, but iamlive prints no policies.

[AbubakrSamsodien]

i am also not able to use iamlive with localstack.

i have localstack hosted on my server on my network, which is working since i can create resources.

could an example of using iamlive with localstack be added to the docs?

[rulio]

@iann0036 Iamlive is great thank you for creating it and making it available.

I was interested in using it with Localstack and I set up a way to do this using Docker. It did require adding a command line arg to Iamlive that allows you to set the host that AWS request will be forwarded to. I use that argument to forward AWS requests to rewrite the request in the proxy so they are routed to Localhost rather than AWS.

I have submitted a PR with this change. I hope you can review it. Happy to make any needed changes to get it merged.

I also have created a repo that shows how this new arg can be used with docker. With it you can run terraform scripts against Localstack and have Iamlive output the IAM policies associated with the actions taken. Here is a link to that repo: https://github.com/rulio/iamlive-localstack/