{"action":"created","issue":{"url":"https://api.github.com/repos/aws/amazon-ecs-agent/issues/581","repository_url":"https://api.github.com/repos/aws/amazon-ecs-agent","labels_url":"https://api.github.com/repos/aws/amazon-ecs-agent/issues/581/labels{/name}","comments_url":"https://api.github.com/repos/aws/amazon-ecs-agent/issues/581/comments","events_url":"https://api.github.com/repos/aws/amazon-ecs-agent/issues/581/events","html_url":"https://github.com/aws/amazon-ecs-agent/issues/581","id":186843793,"number":581,"title":"Expose AWS credentials on a per-container basis","user":{"login":"dinvlad","id":137337,"avatar_url":"https://avatars.githubusercontent.com/u/137337?v=3","gravatar_id":"","url":"https://api.github.com/users/dinvlad","html_url":"https://github.com/dinvlad","followers_url":"https://api.github.com/users/dinvlad/followers","following_url":"https://api.github.com/users/dinvlad/following{/other_user}","gists_url":"https://api.github.com/users/dinvlad/gists{/gist_id}","starred_url":"https://api.github.com/users/dinvlad/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dinvlad/subscriptions","organizations_url":"https://api.github.com/users/dinvlad/orgs","repos_url":"https://api.github.com/users/dinvlad/repos","events_url":"https://api.github.com/users/dinvlad/events{/privacy}","received_events_url":"https://api.github.com/users/dinvlad/received_events","type":"User","site_admin":false},"labels":[{"id":231351362,"url":"https://api.github.com/repos/aws/amazon-ecs-agent/labels/feature%20request","name":"feature request","color":"209daa","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-11-02T16:02:04Z","updated_at":"2016-11-07T00:51:03Z","closed_at":null,"body":"In reference to #346, I'd like to create a feature request to make credentials even more granular.\r\n\r\nCurrently, all containers within a single task definition have to share the same set of permissions, so we cannot really use _multi-container_ task definitions in sensitive scenarios. That severely limits some applications, e.g. if we want to pair each \"application\" container with a co-pilot \"service\" container on the same host. I.e. instead of hosting an actual ECS service shared by multiple \"application\" containers, we would like to run one \"service\" container per each \"application\" container, with different permissions for each container in the pair. An example of that could be a custom logger, or an S3 management container, or a DB instance, paired with a client-facing application, where each application container and the corresponding \"service\" container should be completely isolated from others, while running on a dedicated _bridge_ network, and with sensitive permissions granted only to the backend. In that case, currently we have to split them in separate tasks, put them on the _host_ network (which provides less isolation) and write a custom scheduler that would place both tasks on the same EC2 instance.\r\n\r\nOf course, there are workarounds to that, e.g. running a single pair of tasks per each EC2 instance. Still, they may introduce an additional layer of complexity and/or unnecessary constrains on the instance size and the total number of instances (limited on the account level) .\r\n\r\nIt seems that adding \"_container_ role ARN\" as an option to \"container overrides\" would address this problem without changing the current API. This option could be used in isolation for each container when no _task_ role is configured, so no conflicts with the latter would come up. Or perhaps it could create a superset of the 2 roles, much like currently _task_ role policies apply in addition to _instance_ role policies. Or maybe it could even _override_ the _task_ role policies, though that would require more work to implement while preserving compatibility with the current behavior."},"comment":{"url":"https://api.github.com/repos/aws/amazon-ecs-agent/issues/comments/258725189","html_url":"https://github.com/aws/amazon-ecs-agent/issues/581#issuecomment-258725189","issue_url":"https://api.github.com/repos/aws/amazon-ecs-agent/issues/581","id":258725189,"user":{"login":"dinvlad","id":137337,"avatar_url":"https://avatars.githubusercontent.com/u/137337?v=3","gravatar_id":"","url":"https://api.github.com/users/dinvlad","html_url":"https://github.com/dinvlad","followers_url":"https://api.github.com/users/dinvlad/followers","following_url":"https://api.github.com/users/dinvlad/following{/other_user}","gists_url":"https://api.github.com/users/dinvlad/gists{/gist_id}","starred_url":"https://api.github.com/users/dinvlad/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dinvlad/subscriptions","organizations_url":"https://api.github.com/users/dinvlad/orgs","repos_url":"https://api.github.com/users/dinvlad/repos","events_url":"https://api.github.com/users/dinvlad/events{/privacy}","received_events_url":"https://api.github.com/users/dinvlad/received_events","type":"User","site_admin":false},"created_at":"2016-11-07T00:51:03Z","updated_at":"2016-11-07T00:51:03Z","body":"To add to this use case, per-_container_ \"role _overrides_\" would allow not only _\"static\"_ role assignments (i.e. through task _definition_), but rather define them at the _runtime_ (through `runTask`/`startTask`) of each _task_, without registering a new task _definition_. That would allow for a much more flexible system, where e.g. each running container could be assigned a new role, depending on which context/client it is instantiated for."}}
{"actor":{"display_login":"dinvlad"}}