Credentials for instance with AWS IAM role?

[jossoco]

Hi,

I'm really puzzled as to how to use Slingshot on an EC2 instance with an IAM role granting it access to S3. I have tried retrieving credentials through EC2MetadataCredentials and passing them to Slingshot, but this is ineffective ("Error: Failed to upload file to cloud storage [ - 0]").

I know that the IAM role policy is correct; I can, for example, delete items from S3 with aws-sdk without configuring additional credentials.

I may be missing something obvious or completely unrelated to Slingshot, but is this something you've gotten to work before, and if so how?

Thanks!

[gsuess]

Can you please inspect the POST request that is failing in your browsers developer tools? It should bring you to an XML document that contains more details on why it is failing.

[jossoco]

The issue is that a request using temporary security credentials needs to include the session token. This fixes it.

[gsuess]

Okay, please help me understand this...

From EC2MetaCredentials you get the properties accessKeyId, secretAccessKey and sessionToken, right? So how come that the signature generated from accessKeyId and secretAccessKey is not sufficient for the upload? And if you already have a sessionToken, which to my understanding is a token that provides temporary full access of the user that owns it, why would you need a signature then?

[jossoco]

Per this doc:

You can use temporary security credentials to make programmatic requests for AWS resources using the AWS SDKs or using API calls, the same way that you can use long-term security credentials such as IAM user credentials. However, there are a few differences:

When you make a call using temporary security credentials, the call must include a session token, which is returned along with those temporary credentials. AWS uses the session token to validate the temporary security credentials.

[gsuess]

Okay, so the accessKeyId and secretAccessKey are temporary too and AWS won't accept anything signed by them without the being given the corresponding sessionToken?

[jossoco]

That is my understanding, yes.