-
Notifications
You must be signed in to change notification settings - Fork 125
Description
Case:
Discover Consul servers in AWS via AWS IAM Roles Anywhere for Consul agents outside of AWS.
Example:
Currently, AWS CLI is able to use AWS_CONFIG_FILE and aws_signing_helper script as credential_process:
[profile roles-anywhere]
credential_process = C:/consul/bin/aws_signing_helper.exe credential-process --certificate "" --private-key "" --trust-anchor-arn "" --profile-arn "" --role-arn ""
# works
$env:AWS_CONFIG_FILE='C:/consul/roles_anywhere_config'
$env:AWS_PROFILE='roles-anywhere'
aws ec2 describe-instances
Currently, Consul supports AWS_SHARED_CREDENTIALS_FILE https://developer.hashicorp.com/consul/docs/deploy/server/cloud-auto-join#authentication-precedence, that doesn't support credential_process, but as example AWS CLI do:
[roles-anywhere]
credential_process = C:/consul/bin/aws_signing_helper.exe credential-process --certificate "" --private-key "" --trust-anchor-arn "" --profile-arn "" --role-arn ""
$env:AWS_SHARED_CREDENTIALS_FILE='C:/consul/roles_anywhere_credentials'
$env:AWS_PROFILE='roles-anywhere'
aws ec2 describe-instances
Advantages:
Use temporary credentials from AWS IAM Roles Anywhere instead of static AWS IAM User credentials to call EC2 API.
Options:
Either one of the options can be implemented:
- Support of AWS_CONFIG_FILE and credential_process parameter by go-discover (running scripts or etc)
- Mimic functionality from https://github.com/aws/rolesanywhere-credential-helper to go-discover. Also
retry_joinhttps://developer.hashicorp.com/consul/docs/deploy/server/cloud-auto-join#aws-ec2-and-ecs can be extended with:
retry_join ["provider=aws certificate= private-key= trust-anchor-arn= profile-arn= role-arn="]
- Support of credential_process in AWS_SHARED_CREDENTIALS_FILE
Links:
https://docs.aws.amazon.com/sdkref/latest/guide/access-rolesanywhere.html
https://docs.aws.amazon.com/sdkref/latest/guide/feature-process-credentials.html
https://docs.aws.amazon.com/rolesanywhere/latest/userguide/credential-helper.html#credential-helper-credential-process
https://github.com/aws/rolesanywhere-credential-helper