{"action":"created","issue":{"url":"https://api.github.com/repos/minio/minio/issues/6422","repository_url":"https://api.github.com/repos/minio/minio","labels_url":"https://api.github.com/repos/minio/minio/issues/6422/labels{/name}","comments_url":"https://api.github.com/repos/minio/minio/issues/6422/comments","events_url":"https://api.github.com/repos/minio/minio/issues/6422/events","html_url":"https://github.com/minio/minio/pull/6422","id":357412330,"node_id":"MDExOlB1bGxSZXF1ZXN0MjEzNDM0Mjc5","number":6422,"title":"Allow minio s3 gateway to use IAM instance creds","user":{"login":"jaym","id":27443,"node_id":"MDQ6VXNlcjI3NDQz","avatar_url":"https://avatars0.githubusercontent.com/u/27443?v=4","gravatar_id":"","url":"https://api.github.com/users/jaym","html_url":"https://github.com/jaym","followers_url":"https://api.github.com/users/jaym/followers","following_url":"https://api.github.com/users/jaym/following{/other_user}","gists_url":"https://api.github.com/users/jaym/gists{/gist_id}","starred_url":"https://api.github.com/users/jaym/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaym/subscriptions","organizations_url":"https://api.github.com/users/jaym/orgs","repos_url":"https://api.github.com/users/jaym/repos","events_url":"https://api.github.com/users/jaym/events{/privacy}","received_events_url":"https://api.github.com/users/jaym/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":12,"created_at":"2018-09-05T21:32:32Z","updated_at":"2018-09-12T21:27:56Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/minio/minio/pulls/6422","html_url":"https://github.com/minio/minio/pull/6422","diff_url":"https://github.com/minio/minio/pull/6422.diff","patch_url":"https://github.com/minio/minio/pull/6422.patch"},"body":"## Description\r\nWhen `MINIO_S3_GATEWAY_USE_IAM_INSTANCE_CREDS=true` is set in the\r\nenvironment, minio will use the IAM instance credentials to authenticate\r\nrequests with AWS. In this case `MINIO_ACCESS_KEY` and\r\n`MINIO_SECRET_KEY` will provide access to minio.\r\n\r\n## Motivation and Context\r\nThis is a solution to #6124, though it still requires credentials to minio to be explicitly set\r\n\r\n## How Has This Been Tested?\r\nI ran this change on an EC2 machine and attached an IAM profile that had access to read and write a bucket. I was able to use the minio browser to upload and download objects.\r\n\r\nThe role looked like this:\r\n```\r\n{\r\n    \"Version\": \"2012-10-17\",\r\n    \"Statement\": [\r\n        {\r\n            \"Sid\": \"VisualEditor0\",\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"s3:ListAllMyBuckets\",\r\n                \"s3:ListBucket\",\r\n                \"s3:HeadBucket\"\r\n            ],\r\n            \"Resource\": \"*\"\r\n        },\r\n        {\r\n            \"Sid\": \"VisualEditor1\",\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": \"s3:*\",\r\n            \"Resource\": \"arn:aws:s3:::mybucket/*\"\r\n        }\r\n    ]\r\n}\r\n```\r\n\r\n## Types of changes\r\n<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->\r\n- [ ] Bug fix (non-breaking change which fixes an issue)\r\n- [x] New feature (non-breaking change which adds functionality)\r\n- [ ] Breaking change (fix or feature that would cause existing functionality to change)\r\n\r\n## Checklist:\r\n<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->\r\n<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->\r\n- [ ] My code follows the code style of this project.\r\n- [x] My change requires a change to the documentation.\r\n- [x] I have updated the documentation accordingly.\r\n- [ ] I have added unit tests to cover my changes.\r\n- [ ] I have added/updated functional tests in [mint](https://github.com/minio/mint). (If yes, add `mint` PR # here: )\r\n- [ ] All new and existing tests passed."},"comment":{"url":"https://api.github.com/repos/minio/minio/issues/comments/420803974","html_url":"https://github.com/minio/minio/pull/6422#issuecomment-420803974","issue_url":"https://api.github.com/repos/minio/minio/issues/6422","id":420803974,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMDgwMzk3NA==","user":{"login":"harshavardhana","id":622699,"node_id":"MDQ6VXNlcjYyMjY5OQ==","avatar_url":"https://avatars0.githubusercontent.com/u/622699?v=4","gravatar_id":"","url":"https://api.github.com/users/harshavardhana","html_url":"https://github.com/harshavardhana","followers_url":"https://api.github.com/users/harshavardhana/followers","following_url":"https://api.github.com/users/harshavardhana/following{/other_user}","gists_url":"https://api.github.com/users/harshavardhana/gists{/gist_id}","starred_url":"https://api.github.com/users/harshavardhana/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/harshavardhana/subscriptions","organizations_url":"https://api.github.com/users/harshavardhana/orgs","repos_url":"https://api.github.com/users/harshavardhana/repos","events_url":"https://api.github.com/users/harshavardhana/events{/privacy}","received_events_url":"https://api.github.com/users/harshavardhana/received_events","type":"User","site_admin":false},"created_at":"2018-09-12T21:27:56Z","updated_at":"2018-09-12T21:27:56Z","author_association":"MEMBER","body":"> @harshavardhana i merged your change into mine\r\n> \r\n> I think this is what the UX looks like:\r\n> \r\n> * Deploy onto an ec2 instance that has an IAM instance role that lets it have access to some buckets\r\n> * run `minio gateway s3`. This will tell minio that it is to use the instance credentials when minio talks to S3. When gateway starts, you must parse the startup output for the credentials that minio expects clients to talk to it with.\r\n> * Using the credentials that were just parsed from the output of minio starting up, you should be able to run the following command on a machine that does not have access to aws s3: `AWS_ACCESS_KEY_ID=parsed_access_key_id AWS_SECRET_ACCESS_KEY=parsed_secret_key aws --endpoint-url http://myminioinstance:9000/ s3 ls`\r\n\r\nif its IAM there is nothing printed on the minio side, even your AWS CLI's should use IAM profile. \r\n\r\n> There's no way to authenticate against minio from what i can tell if it doesn't print out the credentials. Am I missing something?\r\n\r\nyes, that is on purpose since IAM creds will rotate and it's pointless to use them on a static basis."}}
{"actor":{"display_login":"harshavardhana"}}