0

I'm setting up a new EC2 instance and it's asking me if I want to associate an IAM role with the instance.

Why would or would this not be a good idea? What is the purpose?

4

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html

We designed IAM roles so that your applications can securely make API requests from your instances, without requiring you to manage the security credentials that the applications use.

It's a very good idea if anything on your instances are going to call out to the various AWS APIs, as you don't have to put (or rotate) any credentials directly on the instance.

  • So for example, I want to access S3, previously I would have had to store secret access key etc in my app, now i can just create an IAM that allows bucket access? But what if I have multiple buckets and multiple apps on my server? And I only want each app to have access to its relevant bucket - would this still need to be managed on an app level? – panthro Oct 5 '16 at 11:23
  • @panthro Correct, with an IAM role that grants S3 access, no need for keys/secrets - AWS provides them automatically to the instance as-needed (and in a way that the AWS SDKs know to look for). Multiple apps on one server with separate permissions would still need to be managed on an app level, yes (or split amongst multiple servers, which is likely to be a better long-term infrastructure for scaling and security). – ceejayoz Oct 5 '16 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.