codenotary / immudb

immudb - immutable database based on zero trust, SQL/Key-Value/Document model, tamperproof, data change history
https://immudb.io
Other
8.52k stars 337 forks source link

Support AWS role authentication #1094

Open SimoneLazzaris opened 2 years ago

SimoneLazzaris commented 2 years ago

What would you like to be added or enhanced Support AWS role authentication

Why is this needed

The recommended way to interact with S3 is to assign a role to the EC2 instance hosting the application. Ephemeral credentials are then obtained using a well-known URL. At the moment this is not supported by immudb

Additional context

From AWS documentation

When the application runs, it obtains temporary security credentials from Amazon EC2 instance metadata, as described in Retrieving Security Credentials from Instance Metadata. These are temporary security credentials that represent the role and are valid for a limited period of time. With some AWS SDKs, the developer can use a provider that manages the temporary security credentials transparently. (The documentation for individual AWS SDKs describes the features supported by that SDK for managing credentials.) Alternatively, the application can get the temporary credentials directly from the instance metadata of the EC2 instance. Credentials and related values are available from the iam/security-credentials/role-name category (in this case, iam/security-credentials/Get-pics) of the metadata. If the application gets the credentials from the instance metadata, it can cache the credentials.

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#instance-metadata-security-credentials

angelAtSequent commented 2 months ago

Any chance to implement this feature?

ostafen commented 2 months ago

Hey, @angelAtSequent, we already took this issue into consideration and plan to implement this soon. Stay tuned!