iamacube
Refresh IAM Role When Using Assume Role + S3 Presign
I have setup the AWS config for IAM role using GitHub - ex-aws/ex_aws_sts · GitHub and pre signing S3 URLs with expiration time of 7 days.
The pre signed URLs are getting expired way before the expiration time set for them, I get tokenExpired error which means that the IAM role credentials are getting expired, and URLs are being pre signed with an expired token.
How can I manage refreshing these credentials? I was not able to find example using the elixir SDK for AWS.
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Bringing learning, work and compliance together since 1987.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #elixirconf-us
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #performance
- #security
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Practical resources that improve the lives of professional developers.
Develop your skills with books, videos, and courses.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
First Post!
evadne
You need to make a fountain that releases and replenishes fresh tokens on demand.
Example GitHub - duomark/epocxy: Erlang Patterns of Concurrency · GitHub
You need to have a pool of one-shot processes that expire and you need to dynamically populate them / expire them based on load
Alternatively if you can eat the latency then only make them when you need.
Also note once you have created STS credentials they will expire, if this is not appropriate then change your design.
For S3 link signing purposes, for displaying images in a browser, it is not necessary to sign the URL with STS tokens.
I speculate you will find it useful to use browser cache in the normal way e.g. GET /images/1 → GET signed s3 link (HTTP 302 redirect) with 24h cache expiry.