You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It's already possible to push images to AWS ECR using access and secret key. In AWS EC2 it's possible to attach a role to the instance that grants this instance the appropriate permissions to push to ECR. Using the instance metadata service, you can get temporary access and secret keys that you can use in subsequent requests. Therefore instead of having to provide the keys as "plain text" to Maven you could determine them automatically. The process is straight forward:
curl -i http://169.254.169.254/latest/meta-data/iam/security-credentials returns the instance's role
curl -i http://169.254.169.254/latest/meta-data/iam/security-credentials/<role> returns the temporary credentials:
I'm happy to work on a PR for this but would first ask for opinions on how this should be configured. An easy approach would be to try getting the instance credentials if the registry matches the ECR pattern but no username and password (access/secret key) are provided. This would not require any extra configuration.
The text was updated successfully, but these errors were encountered:
It's already possible to push images to AWS ECR using access and secret key. In AWS EC2 it's possible to attach a role to the instance that grants this instance the appropriate permissions to push to ECR. Using the instance metadata service, you can get temporary access and secret keys that you can use in subsequent requests. Therefore instead of having to provide the keys as "plain text" to Maven you could determine them automatically. The process is straight forward:
curl -i http://169.254.169.254/latest/meta-data/iam/security-credentials
returns the instance's rolecurl -i http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>
returns the temporary credentials:I'm happy to work on a PR for this but would first ask for opinions on how this should be configured. An easy approach would be to try getting the instance credentials if the registry matches the ECR pattern but no username and password (access/secret key) are provided. This would not require any extra configuration.
The text was updated successfully, but these errors were encountered: