如何使用 IAM 角色在 Spring 启动应用程序中轮换 AWS 密钥

Question

I want to use an IAM role for using AWS services like S3, SNS etc in my task rather than specifying the secret keys of the user.

I have seen this article https://docs.aws.amazon.com/AmazonECS/latest/userguide/task-iam-roles.html but I am not sure about how to implement this in the spring boot environment.

Currently, I have the keys in properties file which are used for bean creation at the startup and the same bean is used for all the AWS service interaction (which I believe is not a good practice).

Can someone suggest the way to achieve this.

Answer 1

Firstly, you will need to create an IAM role that is usable by ecs. Grant it the permissions you previously used with the IAM key.

Then in your ECS task definition set the task execution role to the role ARN.

Finally make sure your code removes references to IAM key and IAM secret. If these are not specified (and assuming you're using the SDK) then the SDK will check the IAM role credentials automatically.