1

Currently, we use ec2 instances in our environment.

For the purpose to avoid credentials exposed to source code, we use IAM Roles to delegate access to users, applications, or services.

However, there are also several on-premises intances in our envioronment. Can they also use IAM role just like what EC2 does?

I know that CodeDeploy support to register on-premises instances with IAM roles, but in this way, it is code deploy agent to manage IAM roles to get credentials.

So, my questions is that:

  1. How does applications on on-premise instances deployed by CodeDeploy get credentials? e.g. get object from S3...

  2. Can I also use IAM on my local machine and applications to get credentials just like on an EC2 do?

1

You can't do an IAM role per-se, but you can attach the exact same policy/policies to a user and then generate a set of access keys for that user. From there, supply the keys to the AWS CLI or other tools and they will have the same permissions.

It's strongly recommended to whitelist the IP range of the policies for the keys which will be used so if they are breached (code leak/public git commit/etc.), they cannot be used outside of your stack.

0

IAM service roles are for only IAM services!!

There is an option of getting temp creds based on the long term IAM users access/secret key. A typical use is in a proxy application that gets temporary security credentials on behalf of distributed applications inside a corporate network.

https://docs.aws.amazon.com/cli/latest/reference/sts/get-federation-token.html

it can have maximum 36 hrs of validity. You can automate to generate the creds and than distribute it accordingly in your local systems.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.