AWS EC2: Do I need to run “aws configure” to assign access keys to if my instance already has an IAM role?

0
votes

I'm fairly new to AWS. I'm setting up an EC2 instance (an Ubuntu 18.04 LAMP server).

I've installed the aws CLI on the instance, so I can automate EBS snapshots for backup.

I've also created an IAM role with the needed permissions to run aws ec2 create-snapshot, and I've assigned this role to my EC2 instance.

My question: is there any need to run aws configure on the EC2 instance, in order to set the AWS Access Key ID and AWS Secret Access Key? I'm still wrapping my head around AWS IAM roles – but (since the EC2 instance has a role), it sounds like the instance will acquire the needed keys from IAM automagically. Therefore, I assume that there's never any need to run aws configure. (In fact, it seems like this would be counterproductive, since the keys set via aws configure would override the keys acquired automatically via the role.)

Is all of that accurate?

1
amazon-web-servicesamazon-ec2amazon-iamaws-cli

1 Answers

7
votes

No, the AWS CLI will progress through a list of credential providers. The instance metadata service will eventually be reached, even if you have not configured the AWS cli:

https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#config-settings-and-precedence

And yes, if you add keys to the AWSCLI config file, they will be used with higher priority than those obtained from the instance metadata service.