Using IAM Roles with Net::Amazon::S3

[elliotholden]

Hi All, new here so I hope this is the proper forum to ask a question.

My company is using the Net::Amazon::S3 module and I'm trying to simplify the way we interact with AWS and use Roles instead of applying policies to IAM Users. So I'd like my developers to be able to "assume" a role in their code.

My question is - Does Net::Amazon::S3 support where you can "assume" a role before making the S3 call. I see where there is a use_iam_role that can be set to "true" but I'm not understanding what that means. In other words "how" does one assume the role?

Thank you for any help you can provide.

Elliot

[happy-barney]

Hi @elliotholden

if use_iam_role is specified it uses VM::EC2::Security::CredentialCache to get credentials (see BUILD in Net/Amazon/S3.pm), whatever that means (to be honest I have zero experience with it).

You can also do it manually

my $s3 = Net::Amazon::S3->new (
	aws_access_key_id => ...,
	aws_secret_access_key => ...,
	aws_session_token => ...,
);

[elliotholden]

Hi Branislav,

Sincere thanks for providing some information. I will try to figure it out. Normally when you assume a role in AWS then it will return a new set of "temporary" credentials (access_key_id and sercret_access_key) along with a session_token. As far as VM::EC2::Security::CredentialCache I believe I know what that is referring to. So since we already have a role assigned to our EC2 instance then those temporary credentials I'm referring to are managed by AWS and stored as meta data that can be accessed from the instance. Those temporary credentials are rotated periodically. So from looking at the BUILD in Net/Amazon/S3.pm "if" I'm understanding it correctly all we need do is something like:

my $s3 = Net::Amazon::S3->new (
                use_iam_role => 1
);

And then the aws_access_key_id, aws_secret_access_key and aws_session_token will be set automatically to those temporary credentials retrieved from the EC2 instance meta data (behind the scenes using VM::EC2::Security::CredentialCache)

I will test this and see.

[Skeeve]

Did you succeed, @elliotholden?

I was granted access to s3 and can use it using the aws cli having set up ~/.aws/config.

Now I want to automate my retrieval of files using perl an I'm stuck. The information in my config file look similar to this:

aws_access_key_id = …
aws_secret_access_key = …
source_profile = default
role_arn = arn:aws:iam::123456789012:role/WhatEver
external_id = some-uuid-like-string
role_session_name = an_identifier

I have no clue how to authenticate with this.

[Skeeve]

I switched to using Paws

Having my credentials in ~/.aws/credentials, I can assume a role and access the data like so:

#!/usr/bin/env perl
use Paws;
use Paws::Credential::AssumeRole;

my %AssumeRole = (
    RoleSessionName => 'an_identifier',
    RoleArn         => 'arn:aws:iam::123456789012:role/WhatEver',
    ExternalId      => 'some-uuid-like-string',
);

my $s3 =
    Paws
    ->new( config => {
        credentials => Paws::Credential::AssumeRole->new( %AssumeRole ),
    })
    ->service('S3',
        region => 'us-east-1',
    )
;

use Data::Dumper;
print Dumper $s3->ListObjectsV2(
    Bucket => 'some',
    Prefix => 'long/path',
);