1

I'm trying to use the aws-sdk-go in my application. It's running on EC2 instance. Now in the Configuring Credentials of the doc,https://docs.aws.amazon.com/sdk-for-go/api/, it says it will look in

*Environment Credentials - Set of environment variables that are useful when sub processes are created for specific roles.

* Shared Credentials file (~/.aws/credentials) - This file stores your credentials based on a profile name and is useful for local development.

*EC2 Instance Role Credentials - Use EC2 Instance Role to assign credentials to application running on an EC2 instance. This removes the need to manage credential files in production.`

Wouldn't the best order be the reverse order? But my main question is do I need to ask the instance if it has a role and then use that to set up the credentials if it has a role? This is where I'm not sure of what I need to do and how.

I did try a simple test of creating a empty config with essentially only setting the region and running it on the instance with the role and it seems to have "worked" but in this case, I am not sure if I need to explicitly set the role or not.

awsSDK.Config{
    Region:      awsSDK.String(a.region),
    MaxRetries:  awsSDK.Int(maxRetries),
    HTTPClient:  http.DefaultClient,
}

I just want to confirm is this the proper way of doing it or not. My thinking is I need to do something like the following

   role = use sdk call to get role on machine
   set awsSDK.Config { Credentials: credentials form of role,
            ...
       }

   issue service command with returned client.

Any more docs/pointers would be great!

1
  • Thank you Daniel and retgits both for the help.
    – Victor
    Jan 30, 2019 at 3:53

2 Answers 2

2

I have never used the go SDK, but the AWS SDKs I used automatically use the EC2 instance role if credentials are not found from any other source.

Here's an AWS blog post explaining the approach AWS SDKs follow when fetching credentials: https://aws.amazon.com/blogs/security/a-new-and-standardized-way-to-manage-credentials-in-the-aws-sdks/. In particular, see this:

If you use code like this, the SDKs look for the credentials in this order:

  1. In environment variables. (Not the .NET SDK, as noted earlier.)
  2. In the central credentials file (~/.aws/credentials or %USERPROFILE%.awscredentials).
  3. In an existing default, SDK-specific configuration file, if one exists. This would be the case if you had been using the SDK before these changes were made.
  4. For the .NET SDK, in the SDK Store, if it exists.
  5. If the code is running on an EC2 instance, via an IAM role for Amazon EC2. In that case, the code gets temporary security credentials from the instance metadata service; the credentials have the permissions derived from the role that is associated with the instance.
2
  • Yes, that essentially what the docs say. I'm just confused as to if I have to explicitly query for a role on the instance and then somehow create credentials for it, or if I need to specify a role explicitly and no creds, or nothing at all. I normally use the keys but that's not that secure correct?
    – Victor
    Jan 30, 2019 at 0:02
  • 1
    If you specify nothing, it should automatically use the EC2 instance role. You can only have 1 EC2 instance role, so there's no need to specify it. Jan 30, 2019 at 0:28
0

In my apps, when I need to connect to AWS resources, I tend to use an access key and secret key that have specific predefined IAM roles. Assuming I have those two, the code I use to create a session is:

awsCredentials := credentials.NewStaticCredentials(awsAccessKeyID, awsSecretAccessKey, "")
awsSession = session.Must(session.NewSession(&aws.Config{
            Credentials: awsCredentials,
            Region:      aws.String(awsRegion),
        }))

When I use this, the two keys are usually specified as either environment variables (if I deploy to a docker container).

A complete example: https://github.com/retgits/flogo-components/blob/master/activity/amazons3/activity.go

2
  • Thanks for the sample. I normally use the keys to connect as well, but my requirements have changed and I'm just confused as how to create a client and session without credentials and just a role. I'm not sure if I need to create the session by specifying the role or just let the SDK decide.
    – Victor
    Jan 30, 2019 at 0:05
  • 1
    Ah okay, in that case I misunderstood, sorry! Does your code already run on AWS? In my Lambda's I use awsSession = session.Must(session.NewSession(&aws.Config{Region: aws.String(awsRegion),})) and it will automatically assume the role that my Lambda got when I deployed it.
    – retgits
    Jan 30, 2019 at 0:08

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.