Provide AWS security credentials via an IAM role for EC2/ECS

You can now enable the IAM role for EC2/ECS credentials provider via a feature flag. If you have provisioned Bamboo on Amazon EC2, Amazon ECS, or AWS Fargate, you can now benefit from the convenience and flexibility of providing AWS security credentials via IAM roles for Amazon EC2 instances and IAM roles for Amazon ECS tasks.

This feature is provided by Identity Federation for AWS (Bamboo), which is bundled and free for Tasks for AWS licensees, see the resp. FAQ for details.

Security assessment

The convenience of IAM roles for Amazon EC2 instances has the downside of a less explicit security posture and more indirect regression potential, as further outlined in UAA-49fac61c2e-db0a-39da-bb3c-e0dc0ef556f0System Jira . The feature currently requires an opt-in via a feature flag accordingly, and we also recommend the principal type 'Assume Role' rather than 'Provided' to gain the actual permissions via another role instead of the one directly attached to the EC2 instance. Either way, please make sure you have thoroughly assessed the security configuration of your underlying EC2 instance(s) and the attached or assumed IAM roles.

Feature flag status

Labs featureYellowtrue

We are committed to fully support this feature going forward, which is the first exploratory step in our journey to offer more choices and flexibility in providing AWS security credentials via a dedicated SPI. However, due to requiring architectural changes, we are releasing an opt-in early version as a labs feature so that we can provide it sooner and gather feedback around usability and security questions before bringing it front and center to all customers. Please provide feedback via the built-in Jira integration, or contact us directly.

Browser not supported