Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Modify Docker image on DockerHub to use AWS Metadata Service for credentials #26

Open
acannistra opened this issue Aug 13, 2020 · 2 comments
Assignees

Comments

@acannistra
Copy link
Owner

The current workflow for building the Docker image that is used in Sagemaker and in Terraform deployments "bakes in" a set of credentials, which breaks for anyone using the image on infrastructure that isn't ours.

Possible avenues for a fix:

  • Short Term: build new images for each set of credentials
  • Longer Term: investigate whether the EC2 instance service can be accessed from Docker containers + add code to the Docker image that uses the EC2CredentialSource as the source of credentials for the default profile (see: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-metadata.html)
  • Longer Term: investigate whether the SageMaker runtime environment also hosts some sort of credential metadata service similar to the EC2 metadata service for accessing credentials (this way the SageMaker role provides permissions)

cc: @ajijohn thanks for the report about this.

@acannistra acannistra self-assigned this Aug 13, 2020
@acannistra
Copy link
Owner Author

Confirmed that aws cli within docker container can access EC2 IAM roles.

@acannistra
Copy link
Owner Author

Working on this in #25 [045be20]. Removing dependencies on credentials in dockerfile. This likely changes the tutorial contents' dependency on having a configured profile.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant