Can't use ~/.aws/credentials file with discovery-ec2 plugin #21041
Description
Elasticsearch version: 5.0.0
Plugins installed: discovery-ec2
While I was working on #21039, I observed that loading key/secret from the default location ~/.aws/credentials is not possible.
[2016-10-20T13:42:07,749][DEBUG][c.a.a.AWSCredentialsProviderChain] Unable to load credentials from com.amazonaws.auth.profile.ProfileCredentialsProvider@bcbbaf: access denied ("java.io.FilePermission" "/home/ubuntu/.aws/credentials" "read")
I tried to work around this and added the following lines in plugin-security.policy file but it still does not work:
grant {
// AWS ProfileCredentialsProvider needs read access to this dir ~/.aws/credentials
permission java.io.FilePermission "~/.aws/credentials", "read";
};
I also tried with the following (just for testing purpose) and it is also failing:
grant {
// AWS ProfileCredentialsProvider needs read access to this dir ~/.aws/credentials
permission java.io.FilePermission "/home/ubuntu/.aws/credentials", "read";
};
I wrap the code with:
SecurityManager sm = System.getSecurityManager();
if (sm != null) {
// unprivileged code such as scripts do not have SpecialPermission
sm.checkPermission(new SpecialPermission());
}
descInstances = AccessController.doPrivileged(new PrivilegedAction<DescribeInstancesResult>() {
@Override
public DescribeInstancesResult run() {
return client.describeInstances(buildDescribeInstancesRequest());
}
});I'm unsure if this is supposed to work or if we simply can't support this authentification method anymore.
Metadata
Metadata
Assignees
Type
Fields
Give feedbackNo fields configured for issues without a type.