Instance metadata credentials support

[dialtone]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue, please leave a comment

[twitu]

I'd love to work on this. I'll mostly be scratching my own itch since I often run code on an EC2 without creating a different set of user credentials.

I've take a look at the code base and I think this will need one more type of credential provider, something like InstanceMetadataCredentialsProvider that implements the ProviderCredentials trait.

This will require two inputs -

1. Role name attached to the instance
2. Default region to set

The provider logic will have to query instance metadata url http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>/, retrieve the values and create the credentials object from it.

Please let me know if you have any guidance or concerns related to this.

[twitu]

There's also this middle ground where the user might want to use Instance metadata to retrieve credentials. But set this up as an environment credentials through a config file as given here.

In this case the logic behind retrieving the credentials (either from environment variables or from instance metadata) will have to inferred at runtime by checking if credential_source = Ec2InstanceMetadata is set.

[joshtriplett]

You can get the instance's region from the instance metadata via placement/region; that seems like a good default.

[joshtriplett]

Also, it should be possible to determine the role name automatically as well.

[rcoh]

IMDS credentials support has landed and will go out in the next release. Thanks for the upvotes and the patience!

[jdisanti]

IMDS credentials landed with v0.0.19-alpha.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.