AWS CLI using Instance Profile Credentials

amazon-web-services amazon-ec2 aws-cli
DaveB picture DaveB · Mar 10, 2015 · Viewed 9.2k times · Source

How do I specify that I want to use Instance profile credentials when using the AWS CLI from within my EC2 instance? the docs say:

Instance profile credentials – these credentials can be used on EC2
instances with an assigned instance role, and are delivered through
the Amazon EC2 metadata service.

Is this automatic or do I need to call the metadata service and save the returned credentials to the ~/.aws/credentials file...then make the call?

Answer

tedder42 picture tedder42 · Mar 10, 2015

You are talking about IAM Roles. These are attached to the EC2 instance and the keys are rolled/rotated every four hours.

You do not need to pull those from the instance metadata and supply it to the aws-cli or a SDK, they will pull it automatically.

If you run aws-cli with the --debug flag, you should see the credentials being picked up:

$ aws --debug s3 ls
...
2015-03-10 18:15:04,459 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: iam-role
2015-03-10 18:15:04,465 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - INFO - Starting new HTTP connection (1): 169.254.169.254
2015-03-10 18:15:04,466 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/ HTTP/1.1" 200 37
2015-03-10 18:15:04,468 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - INFO - Starting new HTTP connection (1): 169.254.169.254
2015-03-10 18:15:04,469 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/myrole-snipped HTTP/1.1" 200 898
2015-03-10 18:15:04,469 - MainThread - botocore.credentials - INFO - Found credentials from IAM Role: myrole-snipped

Related questions

Error You must specify a region when running command aws ecs list-container-instances

I am trying to use aws container service as per the documentation in http://docs.aws.amazon.com/AmazonECS/latest/developerguide/ECS_GetStarted.html The below error is thrown when running the command: aws ecs list-container-instances --cluster default You must …

Read More
List public IP addresses of EC2 instances

I want to list the public IP addresses of my EC2 instances using Bash, separated by a delimiter (space or a new-line). I tried to pipe the output to jq with aws ec2 describe-instances | jq, but can't seem to isolate …

Read More
How to use awscli inside python script?

I'm using aws ec2 service with awscli. Now I want to put all the commands I type in the console into a python script. I see that if I write import awscli inside a python script it works fine but …

Read More