From 4c30d75e647f42318fd0069613b3ed4f82c70ea0 Mon Sep 17 00:00:00 2001 From: Ward Vandewege Date: Wed, 20 Jan 2021 16:16:11 -0500 Subject: [PATCH] 17215: add IAM role support to arvados-dispatch-cloud on EC2. Arvados-DCO-1.1-Signed-off-by: Ward Vandewege --- ...install-dispatch-cloud.html.textile.liquid | 4 ++++ lib/cloud/ec2/ec2.go | 21 +++++++++++++------ lib/config/config.default.yml | 2 +- lib/config/generated_config.go | 2 +- 4 files changed, 21 insertions(+), 8 deletions(-) diff --git a/doc/install/crunch2-cloud/install-dispatch-cloud.html.textile.liquid b/doc/install/crunch2-cloud/install-dispatch-cloud.html.textile.liquid index a2186a42fe..51d4f8fbcf 100644 --- a/doc/install/crunch2-cloud/install-dispatch-cloud.html.textile.liquid +++ b/doc/install/crunch2-cloud/install-dispatch-cloud.html.textile.liquid @@ -82,8 +82,12 @@ The ImageID value is the compute node image that ImageID: ami-01234567890abcdef Driver: ec2 DriverParameters: + # If you are not using an IAM role for authentication, specify access + # credentials here. Otherwise, omit or set AccessKeyID and + # SecretAccessKey to an empty value. AccessKeyID: XXXXXXXXXXXXXXXXXXXX SecretAccessKey: YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY + SecurityGroupIDs: - sg-0123abcd SubnetID: subnet-0123abcd diff --git a/lib/cloud/ec2/ec2.go b/lib/cloud/ec2/ec2.go index b20dbfcc98..1e0de74024 100644 --- a/lib/cloud/ec2/ec2.go +++ b/lib/cloud/ec2/ec2.go @@ -19,6 +19,8 @@ import ( "git.arvados.org/arvados.git/sdk/go/arvados" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/credentials" + "github.com/aws/aws-sdk-go/aws/credentials/ec2rolecreds" + "github.com/aws/aws-sdk-go/aws/ec2metadata" "github.com/aws/aws-sdk-go/aws/session" "github.com/aws/aws-sdk-go/service/ec2" "github.com/sirupsen/logrus" @@ -65,12 +67,19 @@ func newEC2InstanceSet(config json.RawMessage, instanceSetID cloud.InstanceSetID if err != nil { return nil, err } - awsConfig := aws.NewConfig(). - WithCredentials(credentials.NewStaticCredentials( - instanceSet.ec2config.AccessKeyID, - instanceSet.ec2config.SecretAccessKey, - "")). - WithRegion(instanceSet.ec2config.Region) + + sess, err := session.NewSession() + if err != nil { + return nil, err + } + // First try any static credentials, fall back to an IAM instance profile/role + creds := credentials.NewChainCredentials( + []credentials.Provider{ + &credentials.StaticProvider{Value: credentials.Value{AccessKeyID: instanceSet.ec2config.AccessKeyID, SecretAccessKey: instanceSet.ec2config.SecretAccessKey}}, + &ec2rolecreds.EC2RoleProvider{Client: ec2metadata.New(sess)}, + }) + + awsConfig := aws.NewConfig().WithCredentials(creds).WithRegion(instanceSet.ec2config.Region) instanceSet.client = ec2.New(session.Must(session.NewSession(awsConfig))) instanceSet.keys = make(map[string]string) if instanceSet.ec2config.EBSVolumeType == "" { diff --git a/lib/config/config.default.yml b/lib/config/config.default.yml index 2aa53a4329..f464c7421c 100644 --- a/lib/config/config.default.yml +++ b/lib/config/config.default.yml @@ -1042,7 +1042,7 @@ Clusters: # Cloud-specific driver parameters. DriverParameters: - # (ec2) Credentials. + # (ec2) Credentials. Omit or leave blank if using IAM role. AccessKeyID: "" SecretAccessKey: "" diff --git a/lib/config/generated_config.go b/lib/config/generated_config.go index 34f0a0c92b..514fafaded 100644 --- a/lib/config/generated_config.go +++ b/lib/config/generated_config.go @@ -1048,7 +1048,7 @@ Clusters: # Cloud-specific driver parameters. DriverParameters: - # (ec2) Credentials. + # (ec2) Credentials. Omit or leave blank if using IAM role. AccessKeyID: "" SecretAccessKey: "" -- 2.30.2