{"action":"created","issue":{"url":"https://api.github.com/repos/minio/minio/issues/6422","repository_url":"https://api.github.com/repos/minio/minio","labels_url":"https://api.github.com/repos/minio/minio/issues/6422/labels{/name}","comments_url":"https://api.github.com/repos/minio/minio/issues/6422/comments","events_url":"https://api.github.com/repos/minio/minio/issues/6422/events","html_url":"https://github.com/minio/minio/pull/6422","id":357412330,"node_id":"MDExOlB1bGxSZXF1ZXN0MjEzNDM0Mjc5","number":6422,"title":"Allow minio s3 gateway to use IAM instance creds","user":{"login":"jaym","id":27443,"node_id":"MDQ6VXNlcjI3NDQz","avatar_url":"https://avatars0.githubusercontent.com/u/27443?v=4","gravatar_id":"","url":"https://api.github.com/users/jaym","html_url":"https://github.com/jaym","followers_url":"https://api.github.com/users/jaym/followers","following_url":"https://api.github.com/users/jaym/following{/other_user}","gists_url":"https://api.github.com/users/jaym/gists{/gist_id}","starred_url":"https://api.github.com/users/jaym/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaym/subscriptions","organizations_url":"https://api.github.com/users/jaym/orgs","repos_url":"https://api.github.com/users/jaym/repos","events_url":"https://api.github.com/users/jaym/events{/privacy}","received_events_url":"https://api.github.com/users/jaym/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":16,"created_at":"2018-09-05T21:32:32Z","updated_at":"2018-09-12T21:59:54Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/minio/minio/pulls/6422","html_url":"https://github.com/minio/minio/pull/6422","diff_url":"https://github.com/minio/minio/pull/6422.diff","patch_url":"https://github.com/minio/minio/pull/6422.patch"},"body":"## Description\r\nWhen `MINIO_S3_GATEWAY_USE_IAM_INSTANCE_CREDS=true` is set in the\r\nenvironment, minio will use the IAM instance credentials to authenticate\r\nrequests with AWS. In this case `MINIO_ACCESS_KEY` and\r\n`MINIO_SECRET_KEY` will provide access to minio.\r\n\r\n## Motivation and Context\r\nThis is a solution to #6124, though it still requires credentials to minio to be explicitly set\r\n\r\n## How Has This Been Tested?\r\nI ran this change on an EC2 machine and attached an IAM profile that had access to read and write a bucket. I was able to use the minio browser to upload and download objects.\r\n\r\nThe role looked like this:\r\n```\r\n{\r\n    \"Version\": \"2012-10-17\",\r\n    \"Statement\": [\r\n        {\r\n            \"Sid\": \"VisualEditor0\",\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"s3:ListAllMyBuckets\",\r\n                \"s3:ListBucket\",\r\n                \"s3:HeadBucket\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        },\r\n        {\r\n            \"Sid\": \"VisualEditor1\",\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": \"s3:*\",\r\n            \"Resource\": \"arn:aws:s3:::mybucket/*\"\r\n        }\r\n    ]\r\n}\r\n```\r\n\r\n## Types of changes\r\n<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->\r\n- [ ] Bug fix (non-breaking change which fixes an issue)\r\n- [x] New feature (non-breaking change which adds functionality)\r\n- [ ] Breaking change (fix or feature that would cause existing functionality to change)\r\n\r\n## Checklist:\r\n<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->\r\n<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->\r\n- [ ] My code follows the code style of this project.\r\n- [x] My change requires a change to the documentation.\r\n- [x] I have updated the documentation accordingly.\r\n- [ ] I have added unit tests to cover my changes.\r\n- [ ] I have added/updated functional tests in [mint](https://github.com/minio/mint). (If yes, add `mint` PR # here: )\r\n- [ ] All new and existing tests passed."},"comment":{"url":"https://api.github.com/repos/minio/minio/issues/comments/420812079","html_url":"https://github.com/minio/minio/pull/6422#issuecomment-420812079","issue_url":"https://api.github.com/repos/minio/minio/issues/6422","id":420812079,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMDgxMjA3OQ==","user":{"login":"harshavardhana","id":622699,"node_id":"MDQ6VXNlcjYyMjY5OQ==","avatar_url":"https://avatars0.githubusercontent.com/u/622699?v=4","gravatar_id":"","url":"https://api.github.com/users/harshavardhana","html_url":"https://github.com/harshavardhana","followers_url":"https://api.github.com/users/harshavardhana/followers","following_url":"https://api.github.com/users/harshavardhana/following{/other_user}","gists_url":"https://api.github.com/users/harshavardhana/gists{/gist_id}","starred_url":"https://api.github.com/users/harshavardhana/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/harshavardhana/subscriptions","organizations_url":"https://api.github.com/users/harshavardhana/orgs","repos_url":"https://api.github.com/users/harshavardhana/repos","events_url":"https://api.github.com/users/harshavardhana/events{/privacy}","received_events_url":"https://api.github.com/users/harshavardhana/received_events","type":"User","site_admin":false},"created_at":"2018-09-12T21:59:54Z","updated_at":"2018-09-12T21:59:54Z","author_association":"MEMBER","body":"Oh I know why because it's not possible . Since globalServiceConfig is used to validate the incoming signature. \r\n\r\nFrom what it looks like it is not possible to support unless we support IAM at signature validation level. For now it is not possible.."}}
{"actor":{"display_login":"harshavardhana"}}