Different AWS CLI identity when running script via Java's Runtime.getRuntime() inside AWS ECS node that runs a Spring Boot app

0

I have the following setup:

  • A docker image on which Java 17 and AWS CLI v2 are installed.
  • The docker image also contains:
    • A Spring Boot app
    • A /test-identity.sh script that executes only aws sts get-caller-identity inside.
  • The image is deployed in AWS ECS and there is a task execution role and an EC2 instance role defined in IAM for the task and the service.

When I use the AWS SDK for Java within the Java code, then that is using the credentials of the task role, as expected.

I perform the following two tests:

  1. I SSH into the ECS node and I execute the following:

docker exec -it e15f498e4ca0 /bin/bash

/test-identity.sh

  1. I add some Java code in the Spring Boot like the following:

Runtime.getRuntime().exec("/bin/bash", "-lc", "/test-identity.sh")

The result of test #1 is different than #2. The output of test #1 gives me the service's task role (as exepcted) while the output of #2 gives me the EC2 instance role (not expected).

My goal is to make #2 output the task role too, since I want that script to use the same credentials as the Java code (when run via Java code).

Is this possible?

1 Antwort
0

Hi,

You probably want to do 2 things to understand your situation:

Best,

Didier

profile pictureAWS
EXPERTE
beantwortet vor 8 Monaten

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen