aquasecurity / aquasecurity/cloudsploit

Support AWS_CONTAINER_CREDENTIALS_RELATIVE_URI for running in ECS?

Open
#81 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

The IAM role system for running in ECS makes use of and environment variable `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`.

From http://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html, performing:

```
curl 169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
```

will produce:

```
{
"AccessKeyId": "ACCESS_KEY_ID",
"Expiration": "EXPIRATION_DATE",
"RoleArn": "TASK_ROLE_ARN",
"SecretAccessKey": "SECRET_ACCESS_KEY",
"Token": "SECURITY_TOKEN_STRING"
}
```

This could then be directly assigned to the AWSConfig variable.

Could this method of obtaining creds be added as a default in `index.js`?

Thanks!

Contributor guide

Open the contributing guide

Research direction

Start in index.js and inspect how the default AWSConfig credentials are obtained. Use AWS_CONTAINER_CREDENTIALS_RELATIVE_URI with the ECS metadata endpoint described in the issue, then verify that the returned credentials can be assigned to AWSConfig and used by the application.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, javascript
Domain
cloud, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.