|
1 | 1 | # AWS Credentials |
2 | 2 |
|
3 | | -Plugins that interact with AWS services will fetch credentials from various providers in the following order. |
4 | | -Only the first provider that is able to provide credentials will be used. |
| 3 | +Plugins that interact with AWS services fetch credentials from the following providers |
| 4 | +in order. Only the first provider that provides credentials is used. |
5 | 5 |
|
6 | | -All AWS plugins additionally support a `role_arn` (or `AWS_ROLE_ARN`, for [Elasticsearch](../pipeline/outputs/elasticsearch.md)) configuration parameter. If specified, the fetched credentials will then be used to assume the given role. |
| 6 | +- [Environment variables](#environment-variables) |
| 7 | +- [Shared configuration and credentials files](#shared-configuration-and-credentials-files) |
| 8 | +- [EKS Web Identity Token (OIDC)](#eks-web-identity-token-oidc) |
| 9 | +- [ECS HTTP credentials endpoint](#ecs-http-credentials-endpoint) |
| 10 | +- [EC2 Instance Profile Credentials (IMDS)](#ec2-instance-profile-credentials-imds) |
7 | 11 |
|
8 | | -## 1. Environment Variables |
| 12 | +All AWS plugins additionally support a `role_arn` (or `AWS_ROLE_ARN`, for |
| 13 | +[Elasticsearch](../pipeline/outputs/elasticsearch.md)) configuration parameter. If |
| 14 | +specified, the fetched credentials are used to assume the given role. |
9 | 15 |
|
10 | | -Uses the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` (and optionally `AWS_SESSION_TOKEN`) environment variables if set. |
| 16 | +## Environment variables |
11 | 17 |
|
12 | | -## 2. Shared Configuration and Credentials Files |
| 18 | +Plugins use the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` (and optionally |
| 19 | +`AWS_SESSION_TOKEN`) environment variables if set. |
13 | 20 |
|
14 | | -Reads the shared config file at `$AWS_CONFIG_FILE` (or `$HOME/.aws/config`) and the shared credentials file at `$AWS_SHARED_CREDENTIALS_FILE` (or `$HOME/.aws/credentials`) to fetch the credentials for the profile named `$AWS_PROFILE` or `$AWS_DEFAULT_PROFILE` (or "default"). See https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html. |
| 21 | +## Shared configuration and credentials files |
15 | 22 |
|
16 | | -The shared settings will be evaluated in the following order. |
| 23 | +Plugins read the shared `config` file at `$AWS_CONFIG_FILE` (or `$HOME/.aws/config`), |
| 24 | +and the shared credentials file at `$AWS_SHARED_CREDENTIALS_FILE` (or |
| 25 | +`$HOME/.aws/credentials`) to fetch the credentials for the profile named |
| 26 | +`$AWS_PROFILE` or `$AWS_DEFAULT_PROFILE` (or "default"). See |
| 27 | +[Configuration and credential file settings in the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html). |
17 | 28 |
|
18 | | -Setting|File|Description |
19 | | ----|---|--- |
20 | | -`credential_process`|config| See https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html.<br/>Supported on Linux only. |
21 | | -`aws_access_key_id`<br/>`aws_secret_access_key`<br/>*`aws_session_token`*|credentials|Access key ID and secret key to use to authenticate.<br/>The session token must be set for temporary credentials. |
| 29 | +The shared settings evaluate in the following order: |
22 | 30 |
|
23 | | -At this time, no other settings are supported. |
| 31 | +| Setting | File | Description | |
| 32 | +|---|---|---| |
| 33 | +| `credential_process` | `config` | Linux only. See [Sourcing credentials with an external process in the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html). | |
| 34 | +| `aws_access_key_id`<br />`aws_secret_access_key`<br />`aws_session_token` | `credentials` | Access key ID and secret key to use to authenticate. The session token must be set for temporary credentials. | |
24 | 35 |
|
25 | | -## 3. EKS Web Identity Token (OIDC) |
| 36 | +No other settings are supported. |
26 | 37 |
|
27 | | -Fetches credentials via a signed web identity token for a Kubernetes service account. |
28 | | -See https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html. |
| 38 | +## EKS Web Identity Token (OIDC) |
29 | 39 |
|
30 | | -## 4. ECS HTTP Credentials Endpoint |
| 40 | +Credentials are fetched using a signed web identity token for a Kubernetes service account. |
| 41 | +See [IAM roles for service accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). |
31 | 42 |
|
32 | | -Fetches credentials for the ECS task's role. |
33 | | -See https://docs.aws.amazon.com/AmazonECS/latest/userguide/task-iam-roles.html. |
| 43 | +## ECS HTTP credentials endpoint |
34 | 44 |
|
35 | | -## 5. EC2 Instance Profile Credentials (IMDS) |
| 45 | +Credentials are fetched for the ECS task's role. See |
| 46 | +[Amazon ECS task IAM role](https://docs.aws.amazon.com/AmazonECS/latest/userguide/task-iam-roles.html). |
36 | 47 |
|
37 | | -Fetches credentials for the EC2 instance profile's role. |
38 | | -See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html. |
39 | | -As of Fluent Bit version 1.8.8, IMDSv2 is used by default and IMDSv1 may be disabled. Prior versions of Fluent Bit require enabling IMDSv1 on EC2. |
| 48 | +## EC2 instance profile credentials (IMDS) |
| 49 | + |
| 50 | +Fetches credentials for the EC2 instance profile's role. See |
| 51 | +[IAM roles for Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html). |
| 52 | +As of Fluent Bit version 1.8.8, IMDSv2 is used by default and IMDSv1 might be disabled. |
| 53 | +Prior versions of Fluent Bit require enabling IMDSv1 on EC2. |
0 commit comments