MAAP-Project / Community

Issue for MAAP (Zenhub)
2 stars 1 forks source link

Add Assumed Role to ADE workspaces for s3 DAAC access #1001

Open bsatoriu opened 1 month ago

bsatoriu commented 1 month ago

Update the AWS config files in ADE workspaces to support the "maap-data-reader" assumed role. This will allow workspaces to access certain DAAC buckets without requiring credentials or manual token refreshing.

Since AWS does not allow the credential_source property to be set via environment variables, this feature requires adding an aws config file to the /projects directory of workspaces. The existence of this file should be checked on workspace startup and created if not found:

mkdir /projects/.aws && cat >> /projects/.aws/config <<CONFIG
[profile maap-data-reader]
region = us-west-2
role_arn = {arn}
credential_source = Ec2InstanceMetadata
CONFIG