Page Comparison

AWS Credentials Sources

You currently have three options to provide AWS Security Credentials:

Identity Federation for AWS

Refer to  the Identity Federation for AWS Administrator's Guide for details on how to configure the connectors.

• this option requires at least one AWS Connector to be configured with System Scope to allow usage from Bamboo builds, where no user session is available
• a connector yields a set of temporary credentials on task execution (optionally limiting the IAM permissions)
• you can configure multiple connectors to provide credentials with different IAM permissions tailored for specific use cases
• you can also facilitate Bamboo variables to ease managing connectors as outlined in How to parametrize the AWS connector via a Bamboo variable

IAM Role for EC2 (Agent)

As of release 2.5, you You can use IAM Roles for Amazon EC2 to optionally skip credentials configuration all together: if an agent happens to run on an EC2 instance started with an instance profile (IAM role), the tasks can be configured to facilitate those credentials. Of course, the underlying IAM role needs to have a sufficient policy attached to grant the the required permissions for the task at hand.

This feature requires the

This credentials source requires the agent to be running on an Amazon EC2 instance running the agent to be started with an EC2 instance profile. There are three different an instance profile, which yields three scenarios:

• local agents agent - requires the hosting Bamboo server itself to run on EC2
• remote /elastic agents agent - requires the remote agent to run on EC2
• elastic agents agent - requires the elastic agent to run on EC2
  •  As of release 2.10, you  You can optionally specify the ARN of another role that the agent's IAM role for EC2 should assume via the EC2 instance profile credentials - this enables various scenarios, notably switching to roles to roles across your own AWS accounts and third-party.AWS accounts (cross-account IAM roles). Elastic Bamboo only supports configuring elastic images with an instance profile as of Bamboo 5.6.

Inline

If you prefer this solution, you might still want to ease credentials reuse a bit via variable substitution as follows:

• configure Access Key and Secret Key as e.g. ${bamboo.awsAccessKeyPassword} and ${bamboo.awsSecretKeyPassword}
• define plan and/or global variables for the configured variable names (i.e. awsAccessKeyPassword and awsSecretKeyPassword given this example) with the actual credentials, which will then be substituted on task execution accordingly

AWS China (Beijing) Region

AWS GovCloud (US) Region