[GH-ISSUE #421] s3fs with iam_role uses Profile name where it should use Role name #226

New issue

Closed

opened 2026-03-04 01:43:25 +03:00 by kerem · 1 comment

kerem commented

2026-03-04 01:43:25 +03:00

Owner

Originally created by @nturner on GitHub (May 24, 2016).
Original GitHub issue: https://github.com/s3fs-fuse/s3fs-fuse/issues/421

When using an instance with an IAM Role, transient credentials can be found in http://169.254.169.254/latest/meta-data/ at iam/security-credentials/role-name and s3fs tries to do this. However, it is using the profile-name where role-name is needed. In many cases the role and profile name are the same, but they are not always.

The simplest way to find the role name appears to be to GET http://169.254.169.254/latest/meta-data/iam/security-credentials/ itself, which returns a listing of the role names for which temporary credentials exist. (I think there will probably only be one, but we probably want to split on newlines and take the first one here in case that assumption is not valid). This is the approach the AWS SDK appears to use (based on WireShark analysis).

Originally created by @nturner on GitHub (May 24, 2016). Original GitHub issue: https://github.com/s3fs-fuse/s3fs-fuse/issues/421 When using an instance with an IAM Role, transient credentials can be found in http://169.254.169.254/latest/meta-data/ at iam/security-credentials/_role-name_ and s3fs tries to do this. However, it is using the _profile-name_ where _role-name_ is needed. In many cases the role and profile name are the same, but they are not always. The simplest way to find the role name appears to be to GET http://169.254.169.254/latest/meta-data/iam/security-credentials/ itself, which returns a listing of the role names for which temporary credentials exist. (I think there will probably only be one, but we probably want to split on newlines and take the first one here in case that assumption is not valid). This is the approach the AWS SDK appears to use (based on WireShark analysis).

kerem closed this issue

2026-03-04 01:43:25 +03:00

kerem commented

2026-03-04 01:43:26 +03:00

Author

Owner

@ggtakec commented on GitHub (May 29, 2016):

@nturner Thanks for your help.
The process getting iam role name has become very simple.:-)
I merged #420 and #422 to master branch.

@ggtakec commented on GitHub (May 29, 2016): @nturner Thanks for your help. The process getting iam role name has become very simple.:-) I merged #420 and #422 to master branch.