Different AWS CLI identity when running script via Java's Runtime.getRuntime() inside AWS ECS node that runs a Spring Boot app

0

I have the following setup:

  • A docker image on which Java 17 and AWS CLI v2 are installed.
  • The docker image also contains:
    • A Spring Boot app
    • A /test-identity.sh script that executes only aws sts get-caller-identity inside.
  • The image is deployed in AWS ECS and there is a task execution role and an EC2 instance role defined in IAM for the task and the service.

When I use the AWS SDK for Java within the Java code, then that is using the credentials of the task role, as expected.

I perform the following two tests:

  1. I SSH into the ECS node and I execute the following:

docker exec -it e15f498e4ca0 /bin/bash

/test-identity.sh

  1. I add some Java code in the Spring Boot like the following:

Runtime.getRuntime().exec("/bin/bash", "-lc", "/test-identity.sh")

The result of test #1 is different than #2. The output of test #1 gives me the service's task role (as exepcted) while the output of #2 gives me the EC2 instance role (not expected).

My goal is to make #2 output the task role too, since I want that script to use the same credentials as the Java code (when run via Java code).

Is this possible?

1개 답변
0

Hi,

You probably want to do 2 things to understand your situation:

Best,

Didier

profile pictureAWS
전문가
답변함 8달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠