0

Going through AWS documentation (not sure how to test it) I'm not 100% clear how the interaction between EC2 and STS works in relation to security credentials being stored in the Instance Metadata. The specific question is whether the regional STS endpoint is used once it is enabled (details about default and manual enablement would also be great) or, on the other hand, it uses the global sts.amazonaws.com STS endpoint. How about other AWS services using STS for temporary credentials? Do they also use regional STS endpoints automatically once they are enabled?

Thanks a lot!

Unable to get into internal AWS specifics (IMDBv2-STS) and not getting the proper documentation.

Samuel Osorio
  • 9
  • 1
  • When using EC2 Instance Metadata, there is no need for your code to call STS -- the credentials are provided automatically. Thus, it is not clear why you are asking about STS endpoints. – John Rotenstein Jul 13 '23 at 22:38
  • As long as I understand, there is a call to STS service to get the temporary token when an IAM Role is assigned to an EC2 instance. This token is stored in the metadata service and later used by the EC2 instance. Isn't it? – Samuel Osorio Jul 14 '23 at 07:33

1 Answers1

0

Any software that uses an AWS SDK (including the AWS CLI) will automatically retrieve credentials from the Instance Metadata service. Those credentials will be temporary credentials associated with the IAM Role.

Therefore, your code can simply use the SDK or CLI without having to provide credentials. There is no need to call STS to obtain credentials.

For example, you could simply use the AWS CLI:

aws s3 ls

Similarly, you could use an AWS SDK like this:

import boto3

s3_client = boto3.client('s3')

response = s3_client.list_buckets()

In both cases, credentials will be automatically retrieved from the Instance Metadata service.

John Rotenstein
  • 241,921
  • 22
  • 380
  • 470
  • any SDK can configure the STS endpoint to query, be it global or regional. The point of the question was whether internal AWS mechanisms (IMDBv2-STS) will make use of regional STS endpoints or not. – Samuel Osorio Jul 14 '23 at 09:36