Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fall back to IAM policy #1

Open
lllama opened this issue Aug 14, 2017 · 7 comments
Open

Fall back to IAM policy #1

lllama opened this issue Aug 14, 2017 · 7 comments

Comments

@lllama
Copy link

lllama commented Aug 14, 2017

Boto on an EC2 instance can grab its credentials from AWS directly, rather than from environment variables.

Would it be possible to allow for this? I've monkey patched my local version to just ignore the env vars, but it's not a great solution.

@Photonios
Copy link
Member

I've just pushed a commit that makes this possible :)

b3badb5

@Photonios
Copy link
Member

Please let me know if this works for you. If so, I'll publish a new version on PyPi.

@lllama
Copy link
Author

lllama commented Aug 15, 2017

I think that setting the access key and secret to "None" in the aws config dict will stop boto from authenticating (well it tries to auth with "None" and "None").

I'll try the commit to confirm though. Will try to get to it asap.

@Photonios
Copy link
Member

That's pretty much what happens now. If you don't supply the environment variables, it will use None, which will cause Boto to fall back to other methods, such as reading the ~/.aws/credentials file.

@lllama
Copy link
Author

lllama commented Aug 16, 2017

So this seems to work, though I have errors about the describe_regions call, but that's because my IAM profile doesn't have those permissions.

@dexterous
Copy link

Has this been pushed out to PyPi?

@dexterous
Copy link

Simply removing the check for mandatory existence of the AWS_CLOUDWATCH_ACCESS_KEY and AWS_CLOUDWATCH_SECRET_KEY should do the job, the dummy call to ec2.describe_regions() is unnecessary. It could alternatively be replaced with a call to logs.describe_log_groups() instead.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants