AWS Identity and Access Management (IAM) Roles for Amazon EC2

bogotobogo.com site search:

Note

We'll learn how to create and use an IAM role. In this tutorial, we'll use a code which creates a S3 bucket via Python boto module: the first sample with credentials hard coded, and the other one using IAM which requires no credentials.

IAM Roles

When an application needs AWS resources, it must sign their API requests with AWS credentials. So, as an application developer, we need a strategy for managing credentials for our applications that run on EC2 instances.

Another example may be when a user from one AWS account needs access to resources of another AWS account.

However, it's challenging to securely distribute credentials to each instance while can do this easily by providing the security credentials within the application itself.

Also, this approach is not safe because somebody can peek the credentials and use them.

We can resolve this situation by using IAM roles. A role describes the permissions to access resources. However the permissions are not linked to any IAM user or group.

By doing this, the applications or services assume the role (permissions) at run time. This means that AWS is providing to the application or the user temporary security credentials that can be used whenever they need access to those resources.

IAM roles are designed so that our applications can securely make API requests from our instances, without requiring us to manage the security credentials that the applications use. Instead of creating and distributing our AWS credentials, wean delegate permission to make API requests using IAM roles as follows:

Create an IAM role.
Define which accounts or AWS services can assume the role.
Define which API actions and resources the application can use after assuming the role.
Specify the role when we launch our instances.
Have the application retrieve a set of temporary credentials and use them.

Sample A - Not using IAM

The following Python script on an EC2 instance that doesn't use IAM role. The credentials are hard coded inside the script:

import boto.s3
from boto.s3.connection import S3Connection
from boto.s3.key import Key

# 1, Hard coded credentials
conn = boto.s3.connection.S3Connection(aws_access_key_id='AK***E26A',
                                       aws_secret_access_key='Jepc***xLe43y')

# 2, Using env. config
#aws_access_key_id = boto.config.get('Credentials', 'aws_access_key_id')
#aws_secret_access_key = boto.config.get('Credentials', 'aws_secret_access_key')
#conn = boto.connect_s3(aws_access_key_id, aws_secret_access_key)

my_bucket = conn.create_bucket('iam_role_test')

# Represents a key (object) in an S3 bucket : boto.s3.key.Key
write = Key(my_bucket)
write.key = 'test_file'
write.set_contents_from_string('Python boto')
read = Key(my_bucket)
read.key = 'test_file'
print('The content of a S3 bucket has been created by %s!' % (read.get_contents_as_string()))

Notw that we provided the access key ID and secret access key inside code.

Let's run the script:

$ python s3-boto.py
The content of a S3 bucket has been created by Python boto!

As we can see a S3 bucket is created (iam_role_test) with an object inside (test_file).

Sample B - using IAM

So let's create a new role that allows our script on an EC2 instance to run without the access keys.

From the IAM console, choose Roles and then Create New Role.

After giving the role a name and click on Next Step, and select Amazon EC2::

Then keep the default Attach Policy template and find Amazon S3 Full Access and select it:

The next step will show us what the policy looks like:

Create the role.

Now that the role has been created, let's launch another EC2 instance with this role. Note that we need to specify the role assigned to the EC2 instance:

Here is the code without any credentials:

# Testing AIM
# Access S3 using AIM
# No security credentials needed
# Run from an instance with AIM role defined

import boto.s3
from boto.s3.connection import S3Connection
from boto.s3.key import Key

# 1, Hard coded credentials
# conn = boto.s3.connection.S3Connection(aws_access_key_id='AK***E26A',
#                                      aws_secret_access_key='Jepc***xLe43y')

# 2, Using env. config such as .boto
#aws_access_key_id = boto.config.get('Credentials', 'aws_access_key_id')
#aws_secret_access_key = boto.config.get('Credentials', 'aws_secret_access_key')
#conn = boto.connect_s3(aws_access_key_id, aws_secret_access_key)

# 3, Using AIM - no credentials given
conn = boto.s3.connection.S3Connection()
my_bucket = conn.create_bucket('iam_role_test_2')

# Represents a key (object) in an S3 bucket : boto.s3.key.Key
write = Key(my_bucket)
write.key = 'test_file'
write.set_contents_from_string('Python boto')
read = Key(my_bucket)
read.key = 'test_file'
print('The content of a S3 bucket has been created by %s!' % (read.get_contents_as_string()))

We get the same output:

ubuntu@ip-172-31-8-26:~$ python s3-boto-2.py
The content of a S3 bucket has been created by Python boto!

Retrieving Instance Metadata

Because our instance metadata is available from our running instance, we do not need to use the Amazon EC2 console or the AWS CLI. This can be helpful when were writing scripts to run from our instance. For example, we can access the local IP address of our instance from instance metadata to manage a connection to an external application.

To view all categories of instance metadata from within a running instance, use the following URI:

ubuntu@ip-172-31-8-26:~$ curl http://169.254.169.254/latest/meta-data/
ami-id
ami-launch-index
ami-manifest-path
block-device-mapping/
hostname
iam/
instance-action
instance-id
instance-type
local-hostname
local-ipv4
mac
metrics/
network/
placement/
profile
public-hostname
public-ipv4
public-keys/
reservation-id
security-groups

The security credentials regarding our s3_role:

ubuntu@ip-172-31-8-26:~$ curl http://169.254.169.254/latest/meta-data/iam/security-credentials/s3_role
{
  "Code" : "Success",
  "LastUpdated" : "2015-04-20T20:01:32Z",
  "Type" : "AWS-HMAC",
  "AccessKeyId" : "ASI***IWQ",
  "SecretAccessKey" : "z7d***69",
  "Token" : "AQoDY***QU=",
  "Expiration" : "2015-04-21T02:36:39Z"