Page Comparison

You can use the AWS Credentials Variables task to provide managed temporary AWS security credentials for other tools by injecting them into AWS unaware tasks like the Bamboo Script task. This improves versatility for using tools that are not directly integrated with Identity Federation for AWS, but accept AWS credentials via the command line or environment variables.

Configuration

To configure an AWS Credentials Variables task:

1. Navigate to the Tasks configuration tab for the job (this will be the default job if creating a new plan).
2. Click the name of an existing AWS Credentials Variables task, or click Add Task and then AWS Credentials Variables to create a new task.

3. Complete the following settings:

   Task Description	(Optional) Identify the purpose of the task.
   Disable this task	Check, or clear, to selectively run this task.
   Source	Select the AWS Credentials Source (see below). Can be either Identity Federation for AWS or an IAM Role for EC2.
   Connector	Select the shared Identity Federation for AWS Connector. See also AWS Security Credentials Variations.

AWS Credentials Sources

You currently have two option to provide AWS Security Credentials:

Identity Federation for AWS

Refer to the Administrator's Guide for details on how to configure the connectors.

• this option requires at least one AWS Connector to be configured with System Scope to allow usage from Bamboo builds, where no user session is available
• a connector yields a set of temporary credentials on task execution (optionally limiting the IAM permissions)
• you can configure multiple connectors to provide credentials with different IAM permissions tailored for specific use cases

IAM Role for EC2 (Agent)

You can use IAM Roles for Amazon EC2 to optionally skip credentials configuration all together: if an agent happens to run on an EC2 instance started with an instance profile (IAM role), the tasks can be configured to facilitate those credentials. Of course, the underlying IAM role needs to have a sufficient policy attached to grant the the required permissions for the task at hand.

This feature requires the Amazon EC2 instance running the agent to be started with an EC2 instance profile. There are three different scenarios:

• local agents - requires the hosting Bamboo server itself to run on EC2
• remote/elastic agents - requires the remote agent to run on EC2
• elastic agents - requires the elastic agent to run on EC2
  • Elastic Bamboo only supports configuring elastic images with an instance profile as of Bamboo 5.6.

Usage

Bamboo variables

${bamboo.custom.aws.accessKeyId}
${bamboo.custom.aws.secretAccessKey.password}
${bamboo.custom.aws.sessionToken.password}
# alternative representation as JSON object:
${bamboo.custom.aws.credentials.json.password}

${bamboo.custom.aws.credentials.json.password}

${bamboo.custom.aws.accessKeyId}
${bamboo.custom.aws.secretAccessKey.password}
${bamboo.custom.aws.sessionToken.password}
# alternative representation as JSON object:
${bamboo.custom.aws.credentials.json.password}export AWS_ACCESS_KEY_ID=$bamboo_custom_aws_accessKeyId
export AWS_SECRET_ACCESS_KEY=$bamboo_custom_aws.secretAccessKey_password
export AWS_SESSION_TOKEN=$bamboo_custom_aws_sessionToken_password

$AWS_ACCESS_KEY_ID = $bamboo_custom_aws_accessKeyId
$bamboo$AWS_customSECRET_aws_secretAccessKey_passwordACCESS_KEY = $bamboo_custom_aws_sessionTokensecretAccessKey_password
# alternative representation as JSON object:
$AWS_SESSION_TOKEN = $bamboo_custom_aws_credentialssessionToken_json_password 

set AWS_ACCESS_KEY_ID=%bamboo_custom_aws_accessKeyId%
set %bambooAWS_customSECRET_aws_secretAccessKey_password%
ACCESS_KEY=%bamboo_custom_aws_sessionTokensecretAccessKey_password%
REM alternative representation as JSON object:
set AWS_SESSION_TOKEN=%bamboo_custom_aws_credentials_jsonsessionToken_password%

Frequently Asked Questions (FAQ)