aquasecurity / aquasecurity/cloudsploit
Support AWS_CONTAINER_CREDENTIALS_RELATIVE_URI for running in ECS?
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 11d 9h
- Merged PRs (30d)
- 3
Description
The IAM role system for running in ECS makes use of and environment variable `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`.
From http://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html, performing:
```
curl 169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
```
will produce:
```
{
"AccessKeyId": "ACCESS_KEY_ID",
"Expiration": "EXPIRATION_DATE",
"RoleArn": "TASK_ROLE_ARN",
"SecretAccessKey": "SECRET_ACCESS_KEY",
"Token": "SECURITY_TOKEN_STRING"
}
```
This could then be directly assigned to the AWSConfig variable.
Could this method of obtaining creds be added as a default in `index.js`?
Thanks!
Contributor guide
Research direction
Start in index.js and inspect how the default AWSConfig credentials are obtained. Use AWS_CONTAINER_CREDENTIALS_RELATIVE_URI with the ECS metadata endpoint described in the issue, then verify that the returned credentials can be assigned to AWSConfig and used by the application.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, javascript
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100