Open rfein-hearst opened 11 years ago
@rfein-h As specified in readme, ice.s3AccessKeyId and ice.s3SecretKey need to be set as runtime parameters. They should not be defined in ice.properties file.
Thanks -Fang
@fangji Is there a reason why they can't be defined in ice.properties? That would be a neat way to hide them if you're not using AWS instance metadata. If you pass them as runtime java parameters any user able to list the running processes will be able to see the credentials, it's usually not best practice to pass sensitive data in command line options precisely because of this.
Thanks, Nuno
@nmcserra The idea is that you don't need to specify aws credentials while running Ice in the cloud. Providing the option to specify credentials as runtime parameters is only to enable people debugging/running ice on their local desktop.
some of us run ice outside of aws, oddly enough. this is problematic because it means that your keys will be visible to anyone who can see the task's command line (i.e. anyone on the box)
I just created a quick and dirty fix here - https://github.com/nyetsche/ice/commit/e6eb58f971a3f9d3dcc882abc0ed3190498acc89
I didn't add a pull request because I just ignored the System.getProperty()
option so you can only use the ice.properties
file. If there's interest I can rewrite and do a pull request.
Otherwise, there's a quick solution if you want to keep your credentials in that file.
@fangji The documentation (https://github.com/Netflix/ice#basic-setup) says:
1.4 If running locally, set the following system properties at runtime. ice.s3AccessToken is optional.
ice.s3AccessKeyId=<accessKeyId>
ice.s3SecretKey=<secretKey>
ice.s3AccessToken=<accessToken>
I think it's a valid assumption that these will work if not running "locally" as well... at the least, this could be made more clear in the docs.
I'm having an issue where I set ice.s3AccessKeyId and ice.s3SecretKey in the ice.properties file, but on startup it attempts to use an IAM role anyhow.
if I pass those properties on at startup with -D, it works as expected.