Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IAMProvider accepts ECS IAM Task roles #960

Merged

Conversation

NickLavrov
Copy link
Contributor

@NickLavrov NickLavrov commented Aug 17, 2020

Per this issue #956

This PR adds the is_ecs_task arg to IAMProvider. When it is set to True, it follows a slightly different URL path to get credentials.

If you run a task on AWS ECS without a given task role, then curl http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI from within the container return a 404 error, and this would be caught by the error handling already in this class.

This would also require updates to the documentation on IAMProvider.

Since AWS_CONTAINER_CREDENTIALS_RELATIVE_URI is so long, the 80-char line limit was challenging :)

I have verified this works in an ECS task with an IAM role with:

client = Minio(
    "s3.amazonaws.com",
    secure=True,
    credentials=Credentials(
        provider=IAMProvider(is_ecs_task=True)
        )
    )

Copy link
Member

@balamurugana balamurugana left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can take this PR as is. I am working on adding WebIdentity provider and modifying IAM provider to support to complete.

@kannappanr kannappanr merged commit ec60a37 into minio:master Aug 22, 2020
@NickLavrov NickLavrov deleted the iam-provider-handles-ecs-task-role branch August 22, 2020 16:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants