Versions Compared

Old Version 2

changes.mady.by.user Steffen Opel [Utoolity]

Saved on

compared with

New Version Current

changes.mady.by.user Steffen Opel [Utoolity]

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Added link to connector variable How to

As of release 2.4, Tasks for AWS integrates with Identity Federation for AWS (Bamboo) to provide shared AWS Security Credentials management.

Include Page
_IFAWSNoChargeNote
_IFAWSNoChargeNote

 

Panel
bgColor#eeeeee

On this page:

Table of Contents

AWS Credentials Sources

This results in two option for providing AWS Security Credentials:

You currently have three options to provide AWS Security Credentials:

Identity Federation for AWS

Tip
titleFederated Amazon Web Services access

This is the recommended approach to share and manage AWS credentials:

  • It provides benefits like easy credentials sharing and reuse, fine grained access control for AWS resources, strong encryption and more (please refer to the Identity Federation for AWS Documentation for more information regarding the available features and implied advantages).

Image AddedPlease refer to  the Identity Federation for AWS Administrator's Guide for details on how to configure the connectors.

  • (info) this option requires at least one AWS Connector to be configured with System Scope to allow usage from Bamboo builds, where no user session is available
  • a connector yields a set of temporary credentials on task execution (optionally limiting the IAM permissions)
  • you can configure multiple connectors to provide credentials with different IAM permissions tailored for specific use cases
  • (lightbulb) you can also facilitate Bamboo variables to ease managing connectors as outlined in How to parametrize the AWS connector via a Bamboo variable

IAM Role for EC2 (Agent)

As of release 2.5, you can use IAM Roles for Amazon EC2 to optionally skip credentials configuration all together: if an agent happens to run on an EC2 instance started with an instance profile (IAM role), the tasks can be configured to facilitate those credentials. Of course, the underlying IAM role needs to have a sufficient policy attached to grant the the required permissions for the task at hand.

Image AddedThis feature requires the Amazon EC2 instance running the agent to be started with an EC2 instance profile. There are three different scenarios:

  • local agents - requires the hosting Bamboo server itself to run on EC2
  • remote/elastic agents - requires the remote agent to run on EC2
  • elastic agents - requires the elastic agent to run on EC2
    • (warning) Elastic Bamboo only supports configuring elastic images with an instance profile as of Bamboo 5.6.

Inline

Note
titleNo Real Encryption

This is not recommended, but easy to get started with:

  • The common pair of AWS security credentials (an AWS Access Key Id and an AWS Secret Key) is entered directly in each task and persisted after being processed with the Bamboo
Encryption Image Removed
  • (warning) Please note that this naming is misleading for the time being - as properly phrased in the method details, these just provide means to obfuscate sensitive data. Real encryption is available by using the integration with Identity Federation for AWS (Bamboo) instead.
Include Page_CNRegionsNote_CNRegionsNote

Insert excerpt
_BambooEncryptionServiceAPINote
_BambooEncryptionServiceAPINote
nopaneltrue

Image AddedIf you prefer this solution, you might still want to ease credentials reuse a bit via variable substitution as follows:

  • configure Access Key and Secret Key as e.g. ${bamboo.awsAccessKeyPassword} and ${bamboo.awsSecretKeyPassword}
  • define plan and/or global variables for the configured variable names (i.e. awsAccessKeyPassword and awsSecretKeyPassword given this example) with the actual credentials, which will then be substituted on task execution accordingly

Identity Federation for AWS

Tip
titleFederated Amazon Web Services access

This is the recommended approach to share and manage AWS credentials:

It provides all sorts of benefits like easy credentials sharing and reuse, fine grained access control for AWS resources, strong encryption and more. Please refer to the Identity Federation for AWS Documentation for details.

Image RemovedPlease refer to the Identity Federation for AWS Administrator's Guide for details on how to configure the connectors.

  • (info) this option requires at least one System Scope AWS Connector to be configured within the Identity Federation for AWS add-on
  • a connector yields a set of temporary credentials on task execution (optionally limiting the IAM permissions)
  • you can configure multiple connectors to provide credentials with different IAM permissions tailored for specific use cases

 

 

AWS China (Beijing) Region

Include Page
_ChinaRegions
_ChinaRegions

AWS GovCloud (US) Region

Include Page
_GovCloudRegions
_GovCloudRegions