thelastpickle / tlp-cluster

tlp-cluster, a tool for launching Cassandra clusters in AWS
http://thelastpickle.com/tlp-cluster/
Other
21 stars 11 forks source link

Enable IAM (temporary) credentials #172

Open pgorla opened 4 years ago

pgorla commented 4 years ago

I'm having trouble with my AWS credentials in tlp-cluster. Unless there's another part I'm missing, I think this is because the AWS SDK is expecting keys with root access, whereas my credentials are temporary and generated by gimme-aws-credentials that expire in an hour, which are IAM credentials, and which give me aws_access_key_id, aws_secret_access_key, aws_session_token, and aws_security_token.

This may be related to #45.

This is the line in User.kt where the command is failing

val ec2 = EC2(awsAccessKey, awsSecret, region)

I'm not familiar with Kotlin or the AWS SDK, or what roles mean, but this doc looked relevant. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html#using-temp-creds-sdk

Here is the clipped error I am seeing.

Attempting to validate credentials and generate tlp-cluster login keys
Exception in thread "main" software.amazon.awssdk.services.ec2.model.Ec2Exception: AWS was not able to validate the provided access credentials (Service: Ec2, Status Code: 401, Request ID: 7800404c-8ba7-4feb-a2f2-47efaa070b1f)
        at
<snip>
        at com.thelastpickle.tlpcluster.configuration.User$Companion.createInteractively(User.kt:60)
        at com.thelastpickle.tlpcluster.Context$userConfig$2.invoke(Context.kt:61)
        at com.thelastpickle.tlpcluster.Context$userConfig$2.invoke(Context.kt:15)
        at kotlin.SynchronizedLazyImpl.getValue(LazyJVM.kt:74)
        at com.thelastpickle.tlpcluster.Context.getUserConfig(Context.kt)
        at com.thelastpickle.tlpcluster.commands.Init.initializeDirectory(Init.kt:152)
        at com.thelastpickle.tlpcluster.commands.Init.execute(Init.kt:82)
        at com.thelastpickle.tlpcluster.MainKt.main(Main.kt:51)