Skip to content

I want to connect my AWS services to my local computers

0

I already have the infrastructure needed for computing power, but I would like to use AWS' other services in conjunction with it. How would I do so?

asked a year ago1.1K views
3 Answers
1

The simple answer to your question is that you will need to configure access to AWS on your on-premises resources. The simple way to do this is creating IAM users/roles, creating API keys for the user and configuring AWS CLI on your on-premises resources.

IAM API Keys: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html

WARNING! This does not scale well!
DO NOT use the same API Key across multiple servers. You need to be able to track which resource is accessing which AWS services and this requires separate access keys.

WARNING! Configuring keys on your on-premises resources puts the keys on those hosts in plain text and your must manage user access on those resources to control access to the keys.

A better option is to setup a secrets engine on-premises that controls access to retrieve short term API keys from AWS. One option for this is Hashi Corp's Vault product. This is a solution that requires experience and has a lot of configuration.

Another route to go is to use IAM Roles Anywhere

You can use AWS Identity and Access Management Roles Anywhere to obtain temporary security credentials in IAM for workloads such as servers, containers, and applications that run outside of AWS. Your workloads can use the same IAM policies and IAM roles that you use with AWS applications to access AWS resources. Using IAM Roles Anywhere means you don't need to manage long-term credentials for workloads running outside of AWS.

To use IAM Roles Anywhere, your workloads must use X.509 certificates issued by your certificate authority (CA). You register the CA with IAM Roles Anywhere as a trust anchor to establish trust between your public-key infrastructure (PKI) and IAM Roles Anywhere. You can also use AWS Private Certificate Authority (AWS Private CA) to create a CA and then use that to establish trust with IAM Roles Anywhere. AWS Private CA is a managed private CA service for managing your CA infrastructure and your private certificates. For more information, see What is AWS Private CA.

See documentation here: https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html

AWS
EXPERT
answered a year ago
EXPERT
reviewed a year ago
EXPERT
reviewed a year ago
  • I'll look into that. Thanks for the documentation as well

0

Do you mean that you have compute capacity outside AWS, such as in an on-premises data centre, and you would like to connect from there to resources in AWS? If so, would you please clarify if your question is about how to authenticate the on-premises resources to AWS services, options for arranging network connectivity, reliability of a hybrid cloud/on-premises solution, security considerations, or something entirely different?

EXPERT
answered a year ago
  • I want to run a program on my local infrastructure given some input from AWS services and send output to those services if that makes sense. I suppose I am asking how to connect and authenticate my infrastructure to AWS services

0

Okay, clear. Which AWS services are you intending to connect to from your local infrastructure? Would you be using standard AWS APIs, such as custom code via the AWS SDK, or by using third-party software with built-in support for services, such as S3?

You are probably primarily looking at connecting to AWS over the public internet. If that is correct, have you got static public IP addresses towards the internet from your local infrastructure, or do your internet-facing IP addresses change from time to time?

The reason I'm asking is that different services support different ways to connect and secure connections. For example, an RDS database might be connected to simply with a database-internal username/password combination, while S3 would use AWS IAM, typically with static access keys for on-premises workloads, for authentication. S3 would also always support TLS-encrypted connections, while a database might support product-specific methods for using and controlling encryption and even allow completely unencrypted connections that wouldn't be safe to run over the public internet.

EXPERT
answered a year ago
  • I want to play around with Amazon Connect and S3 bucket if that helps. If its not too much trouble, could you detail a static and dynamic IP address situation?

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.