This feature also eliminates the need for third-party solutions such as kiam or kube2iam.
great
-
https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.htmlPardefault les credentials temporaires donnés par un assume role sont valables 1h
C'est un peu juste en dev, pour augmenter cette periode :
1) dans le role en question, autoriser a demander +
2) au moment de faire le assume role en CLI, il faut passer un param pour demander +
-
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-sessionSELECT r.rolname as username,r1.rolname as "role"
FROM pg_catalog.pg_roles r LEFT JOIN pg_catalog.pg_auth_members m
ON (m.member = r.oid)
LEFT JOIN pg_roles r1 ON (m.roleid=r1.oid)
WHERE r.rolcanlogin
ORDER BY 1;
-
https://dba.stackexchange.com/questions/136858/postgresql-display-role-membersUse role in script
-
http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html?shortFooter=true#using-temp-creds-sdk-cliSuite d'article sur le pattern role profile
http://garylarizza.com/blog/2014/02/17/puppet-workflow-part-2/
http://garylarizza.com/blog/2014/02/18/puppet-workflow-part-3/
http://garylarizza.com/blog/2014/03/07/puppet-workflow-part-3b/
http://garylarizza.com/blog/2014/10/24/puppet-workflows-4-using-hiera-in-anger/
-
http://garylarizza.com/blog/2014/02/17/puppet-workflow-part-1/