Amazon AWS SDK Manual do Utilizador descarregar pdf (Página 13)

• Walkthrough: Using IAM Roles to Retrieve an Amazon S3 Object from an EC2 Instance (p. 10)

Using IAM Roles for EC2 Instances to Manage Your

Credentials

You can use the AWS Management Console to create an IAM role and configure it with the permissions

that your software requires. Permissions for IAM roles are specified in a way similar to permissions for

IAM users. For more information, see IAM Users and Groups in Using IAM.

EC2 can access credentials using EC2's Instance Metadata Service (IMDS), which can securely provide

credentials using the IAM role you create. The instance metadata service is part of the default credential

provider chain, so you don't need to change your code to use it if you're already using the default provider

chain for your application.

Note

The default credential provider chain is explained in detail in the topic: Specifying

Credentials (p. 6).

You can also specify the EC2 provider explicitly, by passing an instance of EC2Provider to either

AWS.config or to your service object during initialization. For example:

AWS.config(:credential_provider => AWS::Core::CredentialProviders::EC2Pro

vider.new)

The EC2Provider object uses the IMDS to retrieve temporary credentials that have the same permissions

as those associated with the IAM role. Although the credentials are temporary and eventually expire, the

SDK periodically refreshes them so that they continue to enable access. This refresh is completely

transparent to your code—you don't need to initiate it yourself.

Note

AWS CloudFormation does not support calling its API with an IAM role.You must call the AWS

CloudFormation API as a regular IAM user.

Walkthrough: Using IAM Roles to Retrieve an

Amazon S3 Object from an EC2 Instance

In this walkthrough, we'll begin with a program that retrieves an object from Amazon S3 using regular

account credentials loaded from the environment.Then, we'll use the IMDS in conjunction with an IAM

role to get credentials.

Important

This tutorial assumes that you have installed the AWS SDK for Ruby and a compatible Ruby

interpreter. If you have not done so, install the SDK (p. 3) before proceeding.

Create the sample program

Here's the program:

require 'rubygems'

require 'aws-sdk'

s3 = AWS::S3.new

Version v1.0.0

AWS SDK for Ruby Developer Guide

Using IAM Roles for EC2 Instances to Manage Your

Credentials

1 2 ... 8 9 10 11 12 13 14 15 16 17 18 ... 28 29

Sem comentários

Amazon AWS SDK Manual do Utilizador Página 13