How can I let docker container use codebuild IAM authentication to deploy to AWS?

user_5421539 0
Viewed 828

I am running CI/CD in codebuild project and I have configured a role for codebulid project to allow it to deploy resources e.g. lambda to AWS account.

But when I run the deploy command from docker container in the codebuild project, I got this error:

AWS provider credentials not found. Learn how to set up AWS provider credentials in our docs here: <http://slss.io/aws-creds-setup>.

I have searched that people says to use env var or aws credential profile. But my script is running from codebuild project with IAM authentication. How can I pass it to docker container?

aws-codebuild docker amazon-web-services
2 Answers

I would not give Codebuild direct access to modify resources, you can easily separate that out via a separate role to deploy stuff and make sure you have added the necessary permissions to assume the role. Below is the approach recommended by AWS.

version: 0.2
phases:
  install:
    runtime-versions:
      nodejs: 8
    commands:
      - ASSUME_ROLE_ARN="arn:aws:iam::$account_id:role/Secretassumerole"
      - TEMP_ROLE=`aws sts assume-role --role-arn $ASSUME_ROLE_ARN --role-session-name test`
      - export TEMP_ROLE
      - echo $TEMP_ROLE
      - export AWS_ACCESS_KEY_ID=$(echo "${TEMP_ROLE}" | jq -r '.Credentials.AccessKeyId')
      - export AWS_SECRET_ACCESS_KEY=$(echo "${TEMP_ROLE}" | jq -r '.Credentials.SecretAccessKey')
      - export AWS_SESSION_TOKEN=$(echo "${TEMP_ROLE}" | jq -r '.Credentials.SessionToken')
      - echo $AWS_ACCESS_KEY_ID
      - echo $AWS_SECRET_ACCESS_KEY
      - echo $AWS_SESSION_TOKEN
  pre_build:
    commands:
      - echo Build started on `date`
      - echo Building the Docker image...
      - docker build --build-arg AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID --build-arg AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY --build-arg AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN

Inside Dockefile

FROM amazonlinux:latest
RUN yum -y install aws-cli 
ARG AWS_DEFAULT_REGION 
ARG AWS_ACCESS_KEY_ID 
ARG AWS_SECRET_ACCESS_KEY 
ARG AWS_SESSION_TOKEN 
RUN echo $AWS_DEFAULT_REGION 
RUN echo $AWS_ACCESS_KEY_ID 
RUN echo $AWS_SECRET_ACCESS_KEY 
RUN echo $AWS_SESSION_TOKEN 
RUN aws sts get-caller-identity 
RUN aws secretsmanager get-secret-value --secret-id tutorials/AWSExampleSecret

How do I pass temporary credentials for AssumeRole into the Docker runtime with AWS CodeBuild?

OR

If you still wanna use the CodeBuild IAM permissions then you can parse the call to metadata service in buildspec.yml for your Codebuild project which will give you the credentials of your Codebuild IAM Service Role, eventually being passed to docker build command in a similar manner as above. Or if you wish you can store that in a credentials file and share them with the docker environment, where you can run commands by providing the profile.

version: 0.2
phases:
  install:
    commands:
      - TOKEN=$(curl http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI)
      - echo $TOKEN
      - export AWS_ACCESS_KEY_ID=$(echo "${TOKEN}" | jq -r '.AccessKeyId')
      - export AWS_SECRET_ACCESS_KEY=$(echo "${TOKEN}" | jq -r '.SecretAccessKey')
      - export AWS_SESSION_TOKEN=$(echo "${TOKEN}" | jq -r '.SessionToken')
  pre_build:
    commands:
      - echo Build started on `date`
      - echo Building the Docker image...
      - docker build --build-arg AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID --build-arg AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY --build-arg AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN

This will give you the credentials:

{
  "RoleArn": "AQICAHi8hGr15WsKx4aqJ3PRJImmR37T8bWHAVZQA8s9Lug",
  "AccessKeyId": "ASIA2WXKNDTKPASDADRT",
  "SecretAccessKey": "***",
  "Token": "IQoJb3JpZ2luX2VjENH//////////wEaCXVzLWVhc3QtMSJ",
  "Expiration": "2021-03-05T10:02:01Z"
}
user_22463450

A variation on the second of samtoddler's answers:

docker build --build-arg AWS_CONTAINER_CREDENTIALS_RELATIVE_URI=$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI --build-arg AWS_REGION=$AWS_REGION

and in the docker file:

ARG AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
ARG AWS_REGION

Basically CodeBuild/Docker are clever enough to do the commands Sam has in the install section automatically :)

user_388920
Related