title: Can IAM role temporary credentials be used in cloudformation templates?
body: <p>I'm building a stack that needs access to a private S3 bucket to download the most current version of my application. I'm using <a href="https://stackoverflow.com/questions/11365730/how-can-i-securely-download-a-private-s3-asset-onto-a-new-ec2-instance-with-cl">IAM roles</a>, a relatively new AWS feature that allows EC2 instances to be assigned specific roles, which are then coupled with IAM policies. Unfortunately, these roles come with temporary API credentials generated at instantiation. It's not crippling, but it's forced me to do things like this cloud-init script (simplified to just the relevant bit):</p>
  
  <pre><code>#!/bin/sh
  
  # Grab our credentials from the meta-data and parse the response
  CREDENTIALS=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/s3access)
  S3_ACCESS_KEY=$(echo $CREDENTIALS | ruby -e "require 'rubygems'; require 'json'; puts JSON[STDIN.read]['AccessKeyId'];")
  S3_SECRET_KEY=$(echo $CREDENTIALS | ruby -e "require 'rubygems'; require 'json'; puts JSON[STDIN.read]['SecretAccessKey'];")
  S3_TOKEN=$(echo $CREDENTIALS | ruby -e "require 'rubygems'; require 'json'; puts JSON[STDIN.read]['Token'];")
  
  # Create an executable script to pull the file
  cat &lt;&lt; EOF &gt; /tmp/pullS3.rb
  require 'rubygems'
  require 'aws-sdk'
  AWS.config(
      :access_key_id     =&gt; "$S3_ACCESS_KEY",
      :secret_access_key =&gt; "$S3_SECRET_KEY",
      :session_token     =&gt; "$S3_TOKEN")
  s3 = AWS::S3.new()
  myfile = s3.buckets['mybucket'].objects["path/to/my/file"]
  File.open("/path/to/save/myfile", "w") do |f|
      f.write(myfile.read)
  end
  EOF
  
  # Downloading the file
  ruby /tmp/pullS3.rb
  </code></pre>
  
  <p>First and foremost: This works, and works pretty well. All the same, I'd love to use CloudFormation's existing support for source access. Specifically, <a href="http://docs.amazonwebservices.com/AWSCloudFormation/latest/UserGuide/aws-resource-init.html#aws-resource-init-sources" rel="nofollow noreferrer"><code>cfn-init</code></a> supports the use of <a href="http://docs.amazonwebservices.com/AWSCloudFormation/latest/UserGuide/aws-resource-authentication.html" rel="nofollow noreferrer">authentication resources</a> to get at protected data, including S3 buckets. Is there anyway to get at these keys from within <code>cfn-init</code>, or perhaps tie the IAM role to an authentication resource?</p>
  
  <p>I suppose one alternative would be putting my source behind some other authenticated service, but that's not a viable option at this time.</p>
  
  <p>Another promising lead is the <a href="http://docs.amazonwebservices.com/AWSCloudFormation/latest/UserGuide/quickref-iam.html#scenario-iam-accesskey" rel="nofollow noreferrer">AWS::IAM::AccessKey resource,</a> but the docs don't suggest it can be used with roles. I'm going to try it anyway.</p>