5 ms·
Could you elaborate a bit more how you get the containers into their own IAM roles?
by xmodem 5y ago
Could you elaborate a bit more how you get the containers into their own IAM roles?
- lox 5y agoYup, we have a sidecar process/container that runs for each job and assumes an AWS IAM Role for that specific pipeline (with constraints like whether it’s an approved PR as well). The credentials are provided to the job container via a volume mount. This allows us to have shared agents with very granular roles per-pipeline and job.
- nijave 5y agoNot sure if this applies to the parent, but one way this Buildkite Queues map pipelines to agents. Agents can be assigned IAM roles. If you want a certain build to run as an IAM role, you give it a queue where the agents have that role. For AWS, Buildkite has as a Cloud Formation stack that sets up auto scaling groups and some other resources for your agents to run.
- xmodem 5y agoMost CI systems will have some way of assigning builds to groups of agents. But it would in some cases be useful to grant different privileges to different containers running on the same agent, which is what I understood OP to have.
- orf 5y agoAWS has IAM service accounts for containers. Comes for free with EKS, not sure how you’d do it without EKS. Basically it adds a signed web identity file into the container which can be used to assume roles.
- captn3m0 5y agoRef: https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-f...
- otterley 5y agoAmazon ECS also offers task roles which do the same thing: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html https://docs.aws.amazon.com/AmazonECS/latest/developerguide/...
- selecsosi 5y agoFor ECS: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html https://docs.aws.amazon.com/AmazonECS/latest/developerguide/...