Different AWS CLI identity when running script via Java's Runtime.getRuntime() inside AWS ECS node that runs a Spring Boot app

0

I have the following setup:

  • A docker image on which Java 17 and AWS CLI v2 are installed.
  • The docker image also contains:
    • A Spring Boot app
    • A /test-identity.sh script that executes only aws sts get-caller-identity inside.
  • The image is deployed in AWS ECS and there is a task execution role and an EC2 instance role defined in IAM for the task and the service.

When I use the AWS SDK for Java within the Java code, then that is using the credentials of the task role, as expected.

I perform the following two tests:

  1. I SSH into the ECS node and I execute the following:

docker exec -it e15f498e4ca0 /bin/bash

/test-identity.sh

  1. I add some Java code in the Spring Boot like the following:

Runtime.getRuntime().exec("/bin/bash", "-lc", "/test-identity.sh")

The result of test #1 is different than #2. The output of test #1 gives me the service's task role (as exepcted) while the output of #2 gives me the EC2 instance role (not expected).

My goal is to make #2 output the task role too, since I want that script to use the same credentials as the Java code (when run via Java code).

Is this possible?

1 Respuesta
0

Hi,

You probably want to do 2 things to understand your situation:

Best,

Didier

profile pictureAWS
EXPERTO
respondido hace 8 meses

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Pautas para responder preguntas