Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for EC2 instance roles when pushing to ECR #1177

Closed
sithmein opened this issue Mar 21, 2019 · 1 comment
Closed

Support for EC2 instance roles when pushing to ECR #1177

sithmein opened this issue Mar 21, 2019 · 1 comment

Comments

@sithmein
Copy link
Contributor

It's already possible to push images to AWS ECR using access and secret key. In AWS EC2 it's possible to attach a role to the instance that grants this instance the appropriate permissions to push to ECR. Using the instance metadata service, you can get temporary access and secret keys that you can use in subsequent requests. Therefore instead of having to provide the keys as "plain text" to Maven you could determine them automatically. The process is straight forward:

  • curl -i http://169.254.169.254/latest/meta-data/iam/security-credentials returns the instance's role
  • curl -i http://169.254.169.254/latest/meta-data/iam/security-credentials/<role> returns the temporary credentials:
{
  "Code" : "Success",
  "LastUpdated" : "2019-03-21T13:47:55Z",
  "Type" : "AWS-HMAC",
  "AccessKeyId" : "ABCDEFG...",
  "SecretAccessKey" : "+r6wb...",
  "Expiration" : "2019-03-21T20:05:53Z"
}

I'm happy to work on a PR for this but would first ask for opinions on how this should be configured. An easy approach would be to try getting the instance credentials if the registry matches the ECR pattern but no username and password (access/secret key) are provided. This would not require any extra configuration.

@rhuss
Copy link
Collaborator

rhuss commented Apr 6, 2019

Closing at the PR is already merged (thanks !). Going to make a release over the weekend, so you can expect support for this soon.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants