15

We are using IAM roles to maintain the machines. We now planning to mount the s3 to our ec2 instances and do the processing as per our need. We been using s3fs tool for mounting.

But that doesn't seems to be working with the IAM roles. Are there any ways to make s3fs work with the IAM roles? Did anyone done with this?

Thanks in advance.

sriram
  • 277
  • 1
  • 3
  • 9

5 Answers5

11

This worked for me iam_role=auto

Here is my /etc/fstab entry

s3fs#my_bucket /s3mount_path fuse _netdev,allow_other,iam_role=auto 0 0

Just make sure you IAM role has proper permissions

Abhijit
  • 211
  • 2
  • 2
6

There seems to be an iam_role option in the man page:

iam_role (default is no role) - set the IAM Role that will supply the credentials from the instance meta-data.

A cursory overview of the source suggests that it will get the token and rotate as they expire...

also, see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#instance-metadata-security-credentials for details on getting these credentials, token, etc yourself

Nicholas Terry
  • 161
  • 1
  • 5
  • 3
    This worked for me. I launched an EC2 with server role 'allowS3Full' and then on that server used the command line ``s3fs -o iam_role='allowS3Full' -o use_cache=/tmp/s3fs mybucket /mnt`` – Vorsprung Apr 14 '16 at 12:05
  • Excellent! Good to know that the iam stuff works for s3fs – Nicholas Terry Apr 14 '16 at 17:10
2

Maybe a little late to the party but since majority of the answers are very old; just wanted to share the command that works right now :-

So, to manually mount the s3 bucket using an IAM role you will need to fire the following command :-

$ sudo s3fs <bucket-name> /<folder-path>/<folder-name> -o iam_role="<Role-name>" -o url="https://s3-<region-name>.amazonaws.com" -o endpoint=<region-name> -o dbglevel=info -o curldbg

Now, for example if my bucket-name is "Test-Bucket" and the folder path is "/root/Test-Bucket" and my IAM Role name is "ec2_to_s3" and the region in which I have the s3 bucket is "Asia-Pacific Mumbai", then the above specified command will be used as :-

$ sudo s3fs Test-Bucket /root/Test-Bucket -o iam_role="ec2_to_s3" -o url="https://s3-ap-south-1.amazonaws.com" -o endpoint=ap-south-1 -o dbglevel=info -o curldbg

and the bucket will be mounted successfully.

Now, if you want the bucket to get mounted on system reboot by its own; you will need to add this string in "/etc/fstab".

<bucket-name> /<folder-path>/<folder-name> fuse.s3fs _netdev,allow_other,use_path_request_style,iam_role=auto 0 0

Now, as per the previous example, the string that needs to be added in "/etc/fstab" would be :-

Test-Bucket /root/Test-Bucket fuse.s3fs _netdev,allow_other,use_path_request_style,iam_role=auto 0 0

Hope this helps...

Srini K
  • 21
  • 2
1

IAM roles require the use of a token in addition to the access key id and secret access key.

This means that s3fs source will need be to be modified from its current state in order to support IAM roles.

Fortunately, s3fs is released under the GPLv2, so you are free to do so.

Eric Hammond
  • 10,901
  • 34
  • 56
  • Thanks for the answer. Are there any format in which I need to call the S3 bucktes along with the token? I couln't able to see any call in the code something like `Accesskey:SecretKey`. – sriram Oct 24 '12 at 09:26
  • @GroovyUser: Sorry, but I can't understand that question as it is phrased. The actual source code for s3fs needs to be enhanced to support calling the AWS API with additional information. – Eric Hammond Oct 24 '12 at 23:08
  • Oops! My question is What is the header format of the request to be along with the session token? The code that there already works with by creating the header part of the request with `Accesskey:SecretKey`. But I need the format for the session tokens too. Or else are there tools that does the same job? – sriram Oct 25 '12 at 02:59
0

If you haven't found a solution then I have added iam-role support to s3fs-c at

https://github.com/franc-carter/s3fs-c.git

There are two branches that may be of interest there:-

iam-role: this has the iam role extension

memory-fix: this has the iam role extension and work to reduce the number of memory leaks

I've done basic, but not extensive testing. Importantly the iam-role branch does not have the memory fixes as I am trying to make it a clean diff for a pull-request

cheers

Franc Carter
  • 1
  • 1