Credentials from EC2 Instance Metadata

[stocks29]

It would be great if the client would optionally pull credentials from EC2 instance metadata at the least, or optimally mimic the default credential provider chain:

http://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/credentials.html#using-the-default-credential-provider-chain

[cjbottaro]

Is that how the Ruby client doesn't require AWS_ACCESS_KEY and AWS_SECRET_ACCESS_KEY when running from an instance in AWS?

I came to ask for a feature: don't require AWS_*_KEYS when running from a machine in AWS.

[jkakar]

Indeed. For Erlang, I wrote https://github.com/jkakar/aws-erlang-metadata to do this. It'd be nice to replicate this for Elixir.

[cjbottaro]

So I wrote some code to query the AWS metadata url and fill in the AWS_ACCESS_KEY and AWS_SECRET_ACCESS_KEY... and it didn't work. I mean, the keys had the wrong IAM permissions.

Here's the code:

  def add_credentials(options, :meta) do
    path = "http://169.254.169.254/latest/meta-data/iam/security-credentials/"

    creds = with {:ok, response} <- HTTPoison.get(path),
      {:ok, response} <- HTTPoison.get("#{path}#{response.body}"),
      {:ok, creds} <- Poison.decode(response.body) do
      creds
    else
      _ -> %{}
    end

    options
      |> put_new(:access_key_id, creds["AccessKeyId"])
      |> put_new(:secret_access_key, creds["SecretAccessKey"])
  end

The returned options is a Map that gets turned into an Aws.Client struct.

The permission problem may be on my end; I'm not entirely sure how permissions work in ECS. I know that both an ECS instance and ECS service get an IAM role.

[uberbrodt]

I wrote and published this: https://github.com/uberbrodt/ex_aws_metadata

I tested it with AWS Elasticsearch and it worked. I plan to contribute a pull request to add it an option to this project when I have the time.

[jkakar]

@uberbrodt Sorry for taking so long to respond, but that looks great! I'd love to see a pull request to merge it here or to update the README to make it more easily discoverable to users of aws-elixir.