Project

General

Profile

Actions

Feature #15051

open

[a-d-c] EC2 driver supports AssumeRole

Added by Peter Amstutz almost 5 years ago. Updated 27 days ago.

Status:
New
Priority:
Normal
Assigned To:
-
Category:
-
Target version:
Story points:
2.0
Release:
Release relationship:
Auto

Description

Customer has a complex security policy that is too large to be assigned to individual user account. The workaround is to give the user account permission to use AssumeRole (https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) to an IAM role with the complete policy. This returns temporary credentials with the desired role. Because they are temporary, they need to be periodically refreshed.

Add support to the arvados-dispatch-cloud EC2 driver to create a session with the primary credentials, then call AssumeRole to get temporary credentials (with a 3600 second lifetime), which will then be used for subsequent cloud interaction (create/list/destroy instances). Credentials will need to be auto-refreshed once an hour.

Check if the AWS Go SDK has any support support this usage pattern of establishing a session, switching to an alternate role, and performing auto-refresh.

https://docs.aws.amazon.com/sdk-for-go/api/aws/session/

Assume Role values allow you to configure the SDK to assume an IAM role using a set of credentials provided in a config file via the source_profile field. Both "role_arn" and "source_profile" are required.

Internally to the SDK, I think this involves setting up "chained credentials" and then setting that on the aws.Config struct used to initialize the session:

https://docs.aws.amazon.com/sdk-for-go/api/aws/credentials/


Related issues

Related to Arvados - Idea #13908: [Epic] Replace SLURM for cloud job scheduling/dispatchingResolvedActions
Actions #1

Updated by Peter Amstutz almost 5 years ago

  • Status changed from New to In Progress
Actions #2

Updated by Peter Amstutz almost 5 years ago

  • Subject changed from [c-d-c] AWS driver supports AssumeRole to [c-d-c] EC2 driver supports AssumeRole
  • Description updated (diff)
  • Status changed from In Progress to New
Actions #3

Updated by Ward Vandewege almost 5 years ago

  • Subject changed from [c-d-c] EC2 driver supports AssumeRole to [a-d-c] EC2 driver supports AssumeRole
Actions #4

Updated by Ward Vandewege almost 5 years ago

  • Description updated (diff)
Actions #5

Updated by Peter Amstutz almost 5 years ago

  • Description updated (diff)
Actions #6

Updated by Tom Clegg almost 5 years ago

  • Related to Idea #13908: [Epic] Replace SLURM for cloud job scheduling/dispatching added
Actions #7

Updated by Tom Morris almost 5 years ago

  • Target version changed from To Be Groomed to Arvados Future Sprints
  • Story points set to 2.0
Actions #8

Updated by Eric Biagiotti almost 5 years ago

  • Target version changed from Arvados Future Sprints to 2019-04-10 Sprint
Actions #9

Updated by Tom Morris almost 5 years ago

  • Target version changed from 2019-04-10 Sprint to Arvados Future Sprints
Actions #10

Updated by Peter Amstutz over 2 years ago

  • Target version deleted (Arvados Future Sprints)
Actions #11

Updated by Peter Amstutz about 1 year ago

  • Release set to 60
Actions #12

Updated by Peter Amstutz 27 days ago

  • Target version set to Future
Actions

Also available in: Atom PDF