Would like to use an IAM for Priam, don't know what ARNs are needed

[netflix]

Would like to use an IAM for Priam, don't know what ARNs are needed

[jasobrown]

Currently, there's nothing in the default implementation that allows you to use IAM. It's currently based off the credentials file. However, you can easily create an implementation of ICredential that fetches the accesskeyid/secretaccess key from the instance metadata (which is maintained via the IAM role that the instance launched with). It'd be even more awesome if you can submit a patch with that implementation, too!

[pcn]

I'm OK with using the credentials file. I do like the idea of using instance metadata, or using instance-based IAMs in the future, but at the moment I'm just looking to create an IAM whose credentials are:

• Less than access to everything the account has access to
• able to deal with the necessary S3 functions that Priam will use
• able to deal with the necessary SimpleDB operations that Priam will use
• able to deal with any other permissions Priam will use that I may not know of.

Thanks,

-Peter

[jasobrown]

Yeah, the instance metadata is much more flexible implementation than flat
files. Hence, that's what the concrete class for ICredential is pluggable;
we have a custom implementation at Netflix for our needs.

From what I gather about amazon IAMs, is that as long as the instance is
launched in a particular role, you can always get the current/updated keys
from the instance metadata URL, and that instance will have consistent
access to assigned resources as keys change/roll. Thus, I think if you have
an ICredential implementation that always uses the instance metadata
(whether or not you actually use IAM), you should be be good to go.

HTH,

-Jason

On Mon, Jun 25, 2012 at 11:19 AM, Peter N <
[email protected]

wrote:

I'm OK with using the credentials file. I do like the idea of using
instance metadata, or using instance-based IAMs in the future, but at the
moment I'm just looking to create an IAM whose credentials are:

• Less than access to everything the account has access to
• able to deal with the necessary S3 functions that Priam will use
• able to deal with the necessary SimpleDB operations that Priam will use
• able to deal with any other permissions Priam will use that I may not
  know of.

Thanks,

-Peter

---

Reply to this email directly or view it on GitHub:
#32 (comment)

[jasobrown]

Add the IAMCredential class a few weeks ago, that should fetch the IAM credentials via the amazon sdk jar. Hope that helps.