This feature also eliminates the need for third-party solutions such as kiam or kube2iam.
great
Pardefault les credentials temporaires donnés par un assume role sont valables 1h
C'est un peu juste en dev, pour augmenter cette periode :
1) dans le role en question, autoriser a demander +
2) au moment de faire le assume role en CLI, il faut passer un param pour demander +
SELECT r.rolname as username,r1.rolname as "role"
FROM pg_catalog.pg_roles r LEFT JOIN pg_catalog.pg_auth_members m
ON (m.member = r.oid)
LEFT JOIN pg_roles r1 ON (m.roleid=r1.oid)
WHERE r.rolcanlogin
ORDER BY 1;
Use role in script
Suite d'article sur le pattern role profile
http://garylarizza.com/blog/2014/02/17/puppet-workflow-part-2/
http://garylarizza.com/blog/2014/02/18/puppet-workflow-part-3/
http://garylarizza.com/blog/2014/03/07/puppet-workflow-part-3b/
http://garylarizza.com/blog/2014/10/24/puppet-workflows-4-using-hiera-in-anger/