lyft / metadataproxy

A proxy for AWS's metadata service that gives out scoped IAM credentials from STS
Other
456 stars 69 forks source link

Add an option to patch boto to support ecs-server mode of aws-vault #109

Closed ryan-lane closed 3 years ago

ryan-lane commented 3 years ago

aws-vault supports running as an ecs-server, which runs on a random port, on localhost, with a required token. It puts the URL into the environment, and metadataproxy will use that URL, if it's set in the environment. However, docker for mac only allows access to the host through a special hostname. Botocore limits access to a hardcoded set of hostnames and IPs for the URL.

This change patches botocore to inject a provided hostname, if it's set in the environment.