Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support IAM instance profile credentials #42

Closed
copumpkin opened this issue Feb 16, 2017 · 6 comments
Closed

Support IAM instance profile credentials #42

copumpkin opened this issue Feb 16, 2017 · 6 comments

Comments

@copumpkin
Copy link

I'm trying to use awless from a machine that has valid (temporary) credentials on the standard 169.254.169.254 endpoint and it complains:

command hook failed: Your AWS credentials seem undefined!
AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY need to be exported in your CLI environment

My expectation from all other AWS tools and SDKs is that it would respect explicitly provided credentials if provided, but would fall back on the instance metadata credentials if those weren't provided.

@copumpkin
Copy link
Author

A corollary to this would be to also optionally support a third environment variable for the session token provided by temporary credentials.

@copumpkin
Copy link
Author

@jefe78 why the thumbs-down?

@fxaguessy
Copy link
Contributor

We intentionally disabled this way to log into AWS, as it was slowing significantly the CLI, when no credentials were provided. It was freezing several minutes (trying to connect to 169.254.*) before throwing an error.
If we find a workaround to add this credential provider without slowing the CLI, we will put it back.

@copumpkin
Copy link
Author

copumpkin commented Feb 17, 2017

Weird, the standard AWS SDKs don't slow down at all; not sure what they do, but aws-sdk-go is one example in Go that I use all the time (in other tools) and I've never seen the freezing behavior.

@copumpkin
Copy link
Author

It looks like they do this:

		cfg.HTTPClient = &http.Client{
			// use a shorter timeout than default because the metadata
			// service is local if it is running, and to fail faster
			// if not running on an ec2 instance.
			Timeout: 5 * time.Second,
		}

@fxaguessy
Copy link
Contributor

fxaguessy commented Feb 28, 2017

This should be fixed in the last version of awless. Could you please test if it is working as expected ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants