1485986 - EC2-Manager should allow credential generation based on Instance Identity Documents

Status: RESOLVED WONTFIX

(Taskcluster :: Services, enhancement)

Description

[John Ford [:jhford] CET/CEST Berlin Time]

Once we have bug 1485984 resolved, we should add an endpoint to EC2-Manager which allows EC2 instances to get a set of credentials specific to its instance id.

Comment 1

[John Ford [:jhford] CET/CEST Berlin Time]

Attachment: PR

Link to PR

Comment 2

[John Ford [:jhford] CET/CEST Berlin Time]

Hi Wander.  The node.js library is complete for doing the validations.  Do you have time to finish up PR#54 or should I pick it up?  Thanks.

Comment 3

[Wander Lairson Costa]

(In reply to John Ford [:jhford] CET/CEST Berlin Time from comment #2)
> Hi Wander.  The node.js library is complete for doing the validations.  Do
> you have time to finish up PR#54 or should I pick it up?  Thanks.

I am currently porting docker-worker to GCP, not sure when I will finish, but I believe not after end of next week.

Comment 4

[John Ford [:jhford] CET/CEST Berlin Time]

Attachment: rsa2048-keys.zip

These are the public keys for us-[east]-[1,2] and eu-central-1

Comment 5

[Wander Lairson Costa]

I am not able to verify new documents, it feels like something changed on Amazon side or I am doing something wrong. Could you please double check by downloading a new pair of document/rsa2048 and verify it?

Comment 6

[John Ford [:jhford] CET/CEST Berlin Time]

(In reply to Wander Lairson Costa [:wcosta] from comment #5)
> I am not able to verify new documents, it feels like something changed on
> Amazon side or I am doing something wrong. Could you please double check by
> downloading a new pair of document/rsa2048 and verify it?

I would have to boot a new instance, specially for this.  Could you log into a Docker-Worker instance and download them?

Comment 7

[Wander Lairson Costa]

(In reply to John Ford [:jhford] CET/CEST Berlin Time from comment #6)
> (In reply to Wander Lairson Costa [:wcosta] from comment #5)
> > I am not able to verify new documents, it feels like something changed on
> > Amazon side or I am doing something wrong. Could you please double check by
> > downloading a new pair of document/rsa2048 and verify it?
> 
> I would have to boot a new instance, specially for this.  Could you log into
> a Docker-Worker instance and download them?

You can get the docs and keys here https://github.com/walac/ec2-manager/tree/secrets-endpoint/test/testdata
That are the ones I am using.

Comment 8

[Chris Cooper [:coop] (he/him)]

Pete: I'm not sure where this fits in to the remove-provisioner-secrets puzzle, but figured you should at least be cc-ed.