CODEWITHSUNDEEP
amazon-web-servicesaws-sdk
Amit
Amit

Reputation: 1885

How to specify AWS credentitals for .NET AWS SDK

AWS .Net SDK specifies several ways to specify credentials. One of them is SDK store - http://docs.aws.amazon.com/AWSSdkDocsNET/V3/DeveloperGuide/net-dg-config-creds.html#net-dg-config-creds-sdk-store

In that same document two seemingly contradictory things are written:

"SDK Store profiles are specific to a particular user on a particular host. They cannot be copied to other hosts or other users. For this reason, SDK Store profiles cannot be used in production applications."

"The associated credentials are incorporated into the application during the build process."

IF the credentials are incorporated in the program at the build time, then why can't I use the SDK store method in production environment?

That leaves me with either storing credentials in .config files, or credentials files, or using roles.

Upvotes: 1

Views: 637

Answers (1)

Anthony Neace
Anthony Neace

Reputation: 26031

To clarify, the documentation is stating that if you are only using the SDK store, you can't simply pick up your application and move it to any other machine while expecting it to work as-is. If you are using profile names, your application is referencing the profile name in the local SDK store (or, failing that, the credentials file used by other AWS resources like the AWS CLI).

For example, if you created a profile named dev-Amit on your personal computer and then moved to another machine in production, dev-Amit wouldn't exist there unless you had already configured the SDK store on that machine with the same profile name.

This behavior is contrary to the recommended practice of passing credentials in EC2, using temporary credentials via IAM Roles. Using this method, you can reliably pass credentials to your applications on EC2 instances by simply attaching an IAM role to the instance that has sufficient permissions to do whatever your application needs to do. This method is preferred because you don't have to login to the instance to configure anything; you simply attach the IAM role at creation time.

Further Resources:

Upvotes: 2

Related Questions