- So now let's take a look at another
really important and powerful
feature within AWS called roles.
Roles could be thought of as an
alternate form of authentication.
They provide us with what we call temporary credentials.
Now, let's first start with what not to do.
When we have a credential such as a
username and password, we have
access keys that we'll talk about later on.
What we don't wanna do is embed those within our code,
because if they're in our code and
we go and publish our code to a repo,
it's possible for other people to find them.
It's possible for other people to use them
in ways that they weren't intended.
So we don't want to embed our keys in the code.
Even from a logistical standpoint,
a good practice is to rotate our credentials regularly.
Changing passwords, changing access keys.
And by doing that, it means that we
have to go and update code.
If we embed them within the code,
or in environment variables, now it
adds an extra step that we have to take care of.
So, we don't wanna do that.
We also don't want to share credentials with other people.
And I've seen customers do this,
and it causes a lot of problems downstream.
If you're having multiple people use one
set of credentials and then they change
a password or whatever, it just
causes a lot of downstream effects.
So what we want is a way to authenticate
and authorize a user, but without having
to give them, or without having to embed
or share some long term credentials.
So the answer to that is using roles.
Roles can be used in a number of different ways.
We can attach a role to an EC2 instance,
or a virtual machine, and have that
machine authenticate via that role.
That way, we don't have to embed credentials.
We can have other AWS services
leverage roles on our behalf.
We could have a user assume a role
so that their normal day to day
is done with their account, but if
they wanna do something special, or
switch over in to another account, then
perhaps they would use a role to do that.
You can also use roles to authenticate
for third party accounts as well.
So let's take a look at an EC2 role example.
In this example, let's start with an EC2
instance, or a virtual machine.
Now again, we don't want to embed credentials,
any kind of long term credentials, in this machine.
We don't want to embed it in to environment variables.
We don't want it in our code.
So what we're going to do at
the time we create this machine,
we're going to attach a role to it.
And we're going to give the role the
permissions that this machine needs to access.
Such as, in this particular example,
perhaps this EC2 instance needs to
communicate, upload and/or download
files and objects to the Amazon simple storage service.
So the way that the role works is that
using either the AWS, CLI tools or leveraging the SDK,
If our application is leveraging the SDK,
then either one of these will automatically
detect that this machine has this role attached.
It will then, behind the scenes,
completely automated, done for us.
We don't have to worry about how all this works.
It's just done for us.
The CLI of the SDK will go to the
AWS security token service and request
temporary credentials based on that role.
The AWS Security Token Service will
deliver those temporary credentials.
The CLI and/or the SDK will then
apply those credentials, and then
use them in order to authenticate against
whatever service that we're trying to reach.
In this example, Amazon S3.
The CLI and the SDK will also automatically
renew those credentials when they expire.
So again, temporary credentials, in this case
using a role, these credentials
generally live for about 15 minutes.
In other cases, we can control that and
push that time out to a longer period,
but in most cases, they will default to 15 minutes.
And then, of course, these tools will
cache those credentials, and once they expire,
they will automatically renew them for us.
And so leveraging roles in this way
is a really powerful and really flexible feature
that enables a very high degree of security
without us having to embed keys and credentials
into our code or environment variables.