Support EC2 metadata service

[synfinatic]

"One of the main uses for us in aws-vault is the metadata service for running lambda's locally and/or vagrant machines"

[synfinatic]

IMDS uses a hard coded IP/port: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html

So under typical configurations, each host has access to a single IMDS and there really is no cross platform way to hand out different credentials to different processes- everything is truly global.

[marcelmindemann]

Hey @synfinatic,

thanks a lot for this tool. We have been trying it out in our company to replace aws-vault after migrating to AWS SSO. It's absolutely great, and fulfils 90% of our use case. However, the missing support for the local EC2 metadata serve is currently a show stopper to adopt it for the full company. Our data scientists rely on the EC2 metadata server functionality of aws-vault for Jupyter development, as this requires a long-running process constantly getting fresh credentials.

Can you estimate how long the implementation of this feature will take? Is there any way we can support the development of this feature, by code contribution or financial sponsoring?

[synfinatic]

Hi @marcelmindemann. Code contributions are definitely welcome!

That said, I'd love to understand if you just want parity with was-vault or if there is room for improvement.

[synfinatic]

@marcelmindemann I also meant to ask, is the EC2 metadata service the ideal solution or would be the ECS endpoint better? #398

[wparad]

@marcelmindemann I also meant to ask, is the EC2 metadata service the ideal solution or would be the ECS endpoint better? #398

The ECS metadata endpoint is required because EC2 requires sudo to run because it is hosted on a protected port 80. So the ECS metadata endpoint is really the better solution.

[synfinatic]

Deciding to do ECS (#398) instead of this ticket for now. Most likely will never do this, but leaving it open should people wish to chime in and argue this is important to them.

[synfinatic]

users wishing to vote for this feature should open a new ticket.