Authenticate with IAM Auto Discovery

CMP reads temporary credentials for the role from the EC2 instance metadata service, so nothing is stored in CMP, and nothing needs to be rotated. This suits AWS security guidance that favors roles over long-lived keys.

Prerequisites

• CMP installed on an AWS EC2 instance. This option works only there, because the credentials come from that instance’s metadata.
• An IAM role attached to that same EC2 instance, carrying the permissions listed under AWS permissions.

Create the IAM role in AWS

1. In the IAM console, select Roles, then Create role.
2. Select AWS service as the trusted entity type and EC2 as the use case, then select Next.
3. Attach a policy granting the permissions under AWS permissions, or select Create policy and paste them in as JSON.
4. Name the role and create it. You need its exact name in CMP.

Attach the role to the EC2 instance running CMP

1. In the AWS console, go to EC2 > Instances and open the instance CMP is installed on.
2. Go to Actions > Security > Modify IAM role.
3. Select the role you created and save.

The role must be on the instance CMP itself runs on, not on the instances CMP provisions.

Create the handler

1. Go to Admin > Resource Handlers and select Add.
2. Select the Amazon Web Services tile.
3. Set Credentials Type to IAM Auto Discovery.
4. Enter the EC2 Instance IAM Role Name, exactly as it appears on the instance’s Security tab in AWS.
5. Select Continue, then complete the handler’s settings and select at least one region, as described under Add an AWS resource handler.

(opens full-size image in a new tab)

The role name appears on the handler’s Overview tab. Use Verify Connection to confirm CMP can read the credentials.