search

awslabs / amazon-ecs-local-container-endpoints

A container that provides local versions of the ECS Task Metadata Endpoint and ECS Task IAM Roles Endpoint.
Apache License 2.0
496 stars 54 forks source link

Using amazon-ecs-local-container-endpoints with MFA authentication #49

Open niros1 opened 3 years ago

niros1 commented 3 years ago

Hi, I am working with compose based on scenario 1 (https://aws.amazon.com/blogs/compute/a-guide-to-locally-testing-containers-with-amazon-ecs-local-endpoints-and-docker-compose/), everything work well till I configured my environment to MFA authentication. Before MFA i just used the profile name and mounting the .aws directory, I change the docker-compose.override to use the current session, the problem is that I get (from Boto) ResourceNotFoundException when I am trying to work with Dynamo DB. any idea what am I missing?

in order to use the authentication session I did the following changes (see env vars below):

services:
# This container vends credentials to your containers
  ecs-local-endpoints:
    # The Amazon ECS Local Container Endpoints Docker Image
    image: amazon/amazon-ecs-local-container-endpoints
    volumes:
      # Mount /var/run so we can access docker.sock and talk to Docker
      - /var/run:/var/run
      # Mount the shared configuration directory, used by the AWS CLI and AWS SDKs
      # On Windows, this directory can be found at "%UserProfile%\.aws"
      - $HOME/.aws/:/home/.aws/
    environment:
      # define the home folder; credentials will be read from $HOME/.aws
      HOME: "/home"
      # You can change which AWS CLI Profile is used
      AWS_PROFILE: "DevAdmin"
      AWS_ACCESS_KEY_ID: "${AWS_ACCESS_KEY_ID}" ---- **Get the KEY_ID from the local machine after MFA authentication**
      AWS_SECRET_ACCESS_KEY: "${AWS_SECRET_ACCESS_KEY}" ---- **Get the ACCESS_KEY from the local machine after MFA** authentication
      AWS_SESSION_TOKEN: "${AWS_SESSION_TOKEN}" ---- **Get the SESSION_TOKEN from the local machine after MFA** authentication
      AWS_REGION: "eu-west-1"

10X in advance. Nir

cbcoutinho commented 3 years ago

Two things come to mind:

  1. I think you're conflating two ways of passing credentials: the first being via your ~/.aws/config file and AWS_PROFILE env var, which you would use to authenticate inside your container, and the second being the fact that you're passing the access key, secret, and token via env vars that you received from authenticating on your local host.

If you want to authenticate locally, then you don't need to pass your aws config and profile name to the container, as that information is contained in the key, secret, and token.

  1. The link you posted also includes a number of networking configuration so that your app container can access the was ECS local container endpoint. Could it be that the ecs container is operating fine, but your application container can't connect to it?