Adding Role policy handling in addition to explicitly set user credentials #28
Conversation
credentials through roles
unparameterized constructors to follow the AWS order to establish the credentials. If credentials are set explicelty, such will be exported into the AWS specified system properties and can then be used as such by the AWS SDK. This allows using Role based permissions and letting the SDK automatically reestablish the credentials once rotated by the Instance Metadata Service.
accidental whitespaces
There was a problem hiding this comment.
You can remove this method.
|
Hi DrGranit, I think the change is pretty good. My comments are about that we can remove those deprecated methods. We are still at the early stage of this project so removing these methods should not cause many backward-compatibility issues. Also, please add Javadoc comments to the constructor of AWSClient to explain how the credentials are obtained there. And please also add comments in client.properties to explain that if no AWS credentials are set there, how the monkeys will obtain the credentials at runtime. Thanks for contributing! |
AWSClient constructor about credentials acquisition; added comment to clients.properties to mention Instance Roles configuration.
|
Hello Michael, I made the changes as discussed, thanks for taking the time to look through this. I would update the Wiki, perhaps with an example policy and a mention of the ability to use instance roles, once the pull is completed. kind regards |
Adding Role policy handling in addition to explicitly set user credentials
|
Hi DrGranit, Looks great! Please update the wiki with an example. Let me know if you don't have permissions for the wiki. Thanks, |
Changed all usages of AWS SDK client constructors with credentials to use the default constructor, such that credentials are chosen in the following order:
(taken from: http://docs.aws.amazon.com/AWSSdkDocsJava/latest/DeveloperGuide/java-dg-roles.html)
If the credentials are set explicitly within the client.properties, they are exposed as Java System property and will as such be picked up by the AWS SDK call. Should the property not exist, be empty or only hold spaces, then the InstanceProfileCredentialsProvider is used. It uses credentials provided by the Instance Meta Data Service, we can not store these within the code as such are rotated and will be rechecked for every time an SDK call is made. Hence the removal of all in memory storage of the credentials and deprecation of their getters. Also deprecated the constructor taking credentials as arguments in favor of the one establishing the credentials via the AWS SDK.
kind regards
DrGranit