Ref T5155. Add support for instance profile credentials to PhutilAWSFuture. This should allow the use of instance profile credentials (provided by the EC2 role) instead of specifying an access key and corresponding private key. This was based on https://github.com/aws/aws-sdk-php/blob/master/src/Aws/Common/InstanceMetadata/InstanceMetadataClient.php.
Details
Details
- Reviewers
epriestley - Group Reviewers
Blessed Reviewers - Maniphest Tasks
- T5155: Evaluate support for AWS IAM Roles in S3 Client
This is not yet tested, and I'm not quite sure how to test this. I think we should probably write some unit tests here.
Diff Detail
Diff Detail
- Repository
- rPHU libphutil
- Branch
- aws-token
- Lint
Lint Warnings Severity Location Code Message Warning src/future/aws/PhutilAWSFuture.php:184 TXT3 Line Too Long - Unit
Tests Passed - Build Status
Buildable 2596 Build 2600: [Placeholder Plan] Wait for 30 Seconds
Event Timeline
Comment Actions
This is basically-but-not-quite ready. Specifically, I am not sure exactly how/when we should use the instance profile credentials. Some possibilities are:
- Add a useInstanceProfileCredentials method to turn this behavior on/off.
- Attempt to use instance profile credentials whenever a keypair hasn't been explicitly provided.
- Something else?
Comment Actions
Looks generally reasonable to me.
Offhand, I think we should probably make the API here explicit (e.g., an explicit method to activate instance credential use), and then maybe make higher layers do the little "use a certificate if it exists, or try instance credentials if it doesn't" dance, if that seems reasonable?
| src/future/aws/PhutilAWSFuture.php | ||
|---|---|---|
| 168–173 | This should probably be implode? | |