As I understand it, an instance needs to be granted access to cloudformation:*
resources in order to do anything with CloudFormation.
But when I run this on a Beanstalk web server instance:
cfn-get-metadata -s awseb-e-xxxxxxxxx-stack -r AWSEBAutoScalingGroup
I get a full metadata dump, no problem.
- I don't specify any access/secret keys in the command line.
- My instance role was manually created (by me) and definitely does NOT grant any permissions on
cloudformation:*
resources.
How come I can still read any CF metadata?
I noticed that in the client code, the script goes to use instance credentials (self.using_instance_identity
is True)
signer = CFNSigner() \
if self.using_instance_identity \
else V4Signer(region, 'cloudformation')
Is it some CF-specific magic going on, or I'm missing some place where CF permissions are granted?