1

We have a set of services hosted in docker in AWS Fargate. One of our requirements is to support SAML2 SSO for the user. Thus, Identity provider generated SAML metadata for dev env. SAML libraries are able to read all settings from this file, so there is no need to configure SAML authentication manually. Since we are building services in docker images and would like to re-use the same image across several environments, SAML metadata cannot be included in the image. How to store this file securely in AWS and in the way to easily change it per requirement or per Identity Provider request?

I see several options here, but none is the optimal:

  1. Store SAML metadata in S3 bucket and encrypt it with KMS. Since SAML libraries have integration only with local file system, we will need to add some "proxy-file" reader before feed meta to the library
  2. Split SAML metadata file into several variables (like EntityId, login url, logout url, etc) and store them as encrypted variables in AWS SSM Parameter Store. This solution complicates configuration for both devops (for new environment) and developer (initial library configuration). Also, it will be impossible to change configuration schema in run-time.

I'm looking for the solution where SAML metadata can be securely stored in AWS and easily changed for new environments (stage, prod, etc.) with no need to rebuild initial code.

1 Answer 1

1

It seems that you can use AWS EFS (elastic file system) it can be shared across multiple instance and supports full block level file system.

Advantages of EFS in your user case :

  • supports full block file system so no need to write proxy file reader

  • Encryption at rest is available

  • EFS is made to be shared by multiple host concurrent access so is suited for fargate

  • For prod and dev environment you can use two different EFS volume

for more information go to following link

Amazon Elastic File System

The question you have asked is interesting, let me know if you need to discuss further I'm open for discussion

7
  • 1
    It looks very promising. The only question is if file is encrypted in EFS, will service need to decrypt it before use it? For example, SSM Parameter Store may have encrypted setting, but AWS SDK decrypts it if service has enough rights. I believe that in order to use similar approach here, I have to use either AWS SDK to access encrypted file in EFS or decrypt it by myself. is it correct? Or can it be configured during mounting to docker? Dec 31, 2018 at 17:02
  • Yes, it is. Thank you. Jan 1, 2019 at 10:12
  • It appears that AWS Fargate doesn't support EFS. Any thoughts? Jan 2, 2019 at 14:12
  • well in my knowledge fargate use normal ec2 machines as its underlying container and ecs volumes can be mount into them with NFS protocol so it should work
    – varnit
    Jan 2, 2019 at 14:24
  • yes, I also thought so. but according to discussion on forum (link from comment above), integration is not supported. I think the only option I have now is S3 with encryption. Jan 3, 2019 at 17:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.