Intended workflow for docker restart policy always

[ironhouzi]

Intended workflow for docker restart policy always

[dfuentes]

You have several options depending on your deployment scenario. I would avoid explicitly passing in credentials if possible, and instead rely on credentials provided by the EC2 metadata service (which will automatically generate new security tokens as necessary). How you do this will depend on how you are deploying your application:

For plain EC2 instances, there are EC2 Instance Roles.

If you are on ECS, there is a similar concept with Task Roles. When you attach an IAM role to your ECS task, it works similarly to EC2 instance roles in that chamber will pull credentials from the EC2 metadata service.

For local development, you can use aws-vault's --server flag to emulate the EC2 metadata service.

[ironhouzi]

Sorry, forgot to add the vital information of not running in my container in an AWS context .. Is chamber not intended to run outside of an AWS context, EC2 or ECS.. or whatever other offering AWS might have?

[dfuentes]

It's possible, but we don't currently do this (other than for local development). Without knowing more about your setup, I'm not sure how much help I'm going to be.

In general, you could use the key/secret of an IAM User rather than an IAM role, which would allow you to use static credentials that don't need to refresh. The downside there is that if those credentials are leaked, they are useable as is.

Roles are more secure in that they require a short term security token, but you would need some process to acquire the role access key id, secret, and security token and inject that into your docker container somehow.

[ironhouzi]

@dfuentes I was hoping chamber/APS would be a simple alternative to Hashicorp's Vault, securely providing secrets for microservices in automated deployments, managed through IAM concepts.

If fixed IAM user is the only option outside of deploying on AWS, then I'd need to keep looking for alternatives.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

Closing due to staleness. Closed does not mean "never", just that it has no momentum to get accomplished any time soon.
See CONTRIBUTING.md for more info.