{"action":"created","issue":{"url":"https://api.github.com/repos/Neilpang/acme.sh/issues/453","repository_url":"https://api.github.com/repos/Neilpang/acme.sh","labels_url":"https://api.github.com/repos/Neilpang/acme.sh/issues/453/labels{/name}","comments_url":"https://api.github.com/repos/Neilpang/acme.sh/issues/453/comments","events_url":"https://api.github.com/repos/Neilpang/acme.sh/issues/453/events","html_url":"https://github.com/Neilpang/acme.sh/issues/453","id":193839681,"number":453,"title":"AWS DNS integration does not work with temporary access keys from IAM Roles","user":{"login":"AntonTimiskov","id":532157,"avatar_url":"https://avatars.githubusercontent.com/u/532157?v=3","gravatar_id":"","url":"https://api.github.com/users/AntonTimiskov","html_url":"https://github.com/AntonTimiskov","followers_url":"https://api.github.com/users/AntonTimiskov/followers","following_url":"https://api.github.com/users/AntonTimiskov/following{/other_user}","gists_url":"https://api.github.com/users/AntonTimiskov/gists{/gist_id}","starred_url":"https://api.github.com/users/AntonTimiskov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AntonTimiskov/subscriptions","organizations_url":"https://api.github.com/users/AntonTimiskov/orgs","repos_url":"https://api.github.com/users/AntonTimiskov/repos","events_url":"https://api.github.com/users/AntonTimiskov/events{/privacy}","received_events_url":"https://api.github.com/users/AntonTimiskov/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2016-12-06T17:50:19Z","updated_at":"2016-12-08T09:24:14Z","closed_at":null,"body":"Or simple: AWS DNS integration does not support AWS IAM Roles\r\n\r\nScenario:\r\nI have and AWS Instance run under IAM Role with all required rights to Route53.\r\nAs `acme.sh` does not support aws iam roles yet, i have to extract access key from them:\r\n```\r\nROLE=`curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/`\r\ncurl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE> /tmp/aws.keys\r\nexport AWS_ACCESS_KEY_ID=`cat /tmp/aws.keys | jq -j '.AccessKeyId'`\r\nexport AWS_SECRET_ACCESS_KEY=`cat /tmp/aws.keys | jq -j '.SecretAccessKey'`\r\nexport AWS_SESSION_TOKEN=`cat /tmp/aws.keys | jq -j '.Token'`\r\n```\r\nand then run the acme:\r\n```\r\nacme.sh --issue --dns dns_aws --debug -d <domain>\r\n```\r\nIt fails with an error:\r\n```\r\n[Tue Dec  6 17:30:59 UTC 2016] Response error:<?xml version=\"1.0\"?>\r\n<ErrorResponse xmlns=\"https://route53.amazonaws.com/doc/2013-04-01/\"><Error><Type>Sender</Type><Code>InvalidClientTokenId</Code><Message>The security token included in the request is invalid.</Message></Error><RequestId></RequestId></ErrorResponse>\r\n[Tue Dec  6 17:30:59 UTC 2016] invalid domain\r\n[Tue Dec  6 17:30:59 UTC 2016] Error add txt for domain:_acme-challenge.<domain>\r\n```\r\nAs I see the [dns_aws](https://github.com/Neilpang/acme.sh/blob/master/dnsapi/dns_aws.sh) does not take into account the `AWS_SESSION_TOKEN` environment variable that is required to process the call to Route53 under the IAM Role Access Keys.\r\n\r\nDo you have a plan to support the AWS IAM Roles or fix the issue with `AWS_SESSION_TOKEN`?\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/Neilpang/acme.sh/issues/comments/265693183","html_url":"https://github.com/Neilpang/acme.sh/issues/453#issuecomment-265693183","issue_url":"https://api.github.com/repos/Neilpang/acme.sh/issues/453","id":265693183,"user":{"login":"FernandoMiguel","id":168366,"avatar_url":"https://avatars.githubusercontent.com/u/168366?v=3","gravatar_id":"","url":"https://api.github.com/users/FernandoMiguel","html_url":"https://github.com/FernandoMiguel","followers_url":"https://api.github.com/users/FernandoMiguel/followers","following_url":"https://api.github.com/users/FernandoMiguel/following{/other_user}","gists_url":"https://api.github.com/users/FernandoMiguel/gists{/gist_id}","starred_url":"https://api.github.com/users/FernandoMiguel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FernandoMiguel/subscriptions","organizations_url":"https://api.github.com/users/FernandoMiguel/orgs","repos_url":"https://api.github.com/users/FernandoMiguel/repos","events_url":"https://api.github.com/users/FernandoMiguel/events{/privacy}","received_events_url":"https://api.github.com/users/FernandoMiguel/received_events","type":"User","site_admin":false},"created_at":"2016-12-08T09:24:14Z","updated_at":"2016-12-08T09:24:14Z","body":"it has to do with the way AWS deals with roles.\r\nwhen an user assumes a role, they dont have any permanent keys for that resource, the role does.\r\nand those tonkes get rotated every so often so incase a resource is compromised, the keys go out of rotation.\r\n\r\ni havent implemented API calls via user assumed roles, so I cant speak on the matter too much, although I'm setting up IAM policies exactly for that purpose for work this sprint, so i'll know more about it soon.\r\n\r\n\r\nI think @AntonTimiskov  can provide better feedback than me currently, and probably improve the PR to meet your requirement."}}
{"actor":{"display_login":"FernandoMiguel"}}