向 ECS/Fargate 中的 AWS CLI 提供凭证
我想使用 Fargate 创建一个 ECS 任务，并使用 AWS CLI（除其他外）将文件上传到 S3。我知道可以创建任务角色，它可以为任务提供对 AWS 服务/资源的权限。同样，在 OpsWorks 中，AWS 开发工具包能够查询实例元数据以获取其实例配置文件的临时凭证。我还发现这些文档表明有些东西EC2 实例上的 AWS CLI 也可以实现类似的效果。
Fargate 是否有等效项 - 即，在 Fargate 容器中运行的 AWS CLI 是否可以查询元数据服务以获取临时凭证？如果没有，有什么好的方法可以进行身份验证以便我可以将文件上传到 S3？我是否应该为此任务创建一个用户并将 AWS_ACCESS_KEY_ID 和 AWS_SECRET_ACCESS_KEY 作为环境变量传递？
（我知道可以有一个由 EC2 支持的 ECS 任务，但这个任务是短暂的，可能每月运行一次；它似乎很适合 Fargate。）
I would like to create an ECS task with Fargate, and have that upload a file to S3 using the AWS CLI (among other things). I know that it's possible to create task roles, which can provide the task with permissions on AWS services/resources. Similarly, in OpsWorks, the AWS SDK is able to query instance metadata to obtain temporary credentials for its instance profile. I also found these docs suggesting that something similar is possible with the AWS CLI on EC2 instances.
Is there an equivalent for Fargate—i.e., can the AWS CLI, running in a Fargate container, query the metadata service for temporary credentials? If not, what's a good way to authenticate so that I can upload a file to S3? Should I just create a user for this task and pass in AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as environment variables?
(I know it's possible to have an ECS task backed by EC2, but this task is short-lived and run maybe monthly; it seemed a good fit for Fargate.)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您已经知道答案。ECS 任务角色并非特定于 EC2 部署，它也适用于 Fargate 部署。
您可以获取任务元数据，包括 IAM 访问密钥，通过 ECS 元数据服务。但您无需担心这一点，因为 AWS CLI 和任何 AWS 开发工具包在 ECS 任务内运行时都会自动提取该信息。
You already know the answer. The ECS task role isn't specific to EC2 deployments, it works with Fargate deployments as well.
You can get the task metadata, including IAM access keys, through the ECS metadata service. But you don't need to worry about that, because the AWS CLI, and any AWS SDK, will automatically pull that information when it is running inside an ECS task.