Imagine a multi tenant environment using a CI (e.g. GitLab but can be any other) and AWS as a backend for test infrastructure.

With fixed users, it is easy: save credentials as secrets.

But what if you use federated roles, where STS credentials need to be auto refreshed every 12 hours?

  • Deploy gitlab runners on AWS and give those instances roles ? – Tensibai Dec 4 '18 at 10:17
  • so for every tenant, worst case every tenant's each account an own 24/7 runner? – Peter Dec 4 '18 at 10:59
  • 1
    Depends on the accounts architecture, at least one per region IMHO, that's not necessary but then you need a script to assume role and granting the instance role to assume roles in other accounts – Tensibai Dec 4 '18 at 13:24
  • @Tensibai considerably I am trying to understand what is happening before assuming the role, i.e. whether it is possible, and how to login the gitlab (or other) service itself through an identity provider using SAML. – Peter Dec 4 '18 at 13:56
  • 1
    IMHO you should avoid saml for automation, hence the 'native' role based authentification within AWS, so there's no access key stored somewhere, you just works with allowing role X in account A to assume role Y in account B, and you have some code doing the assume, which boils down to creating a small lived access key. – Tensibai Dec 4 '18 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.