Ice ignoring credentials in ice.properties on EC2 instance about ice HOT 6 OPEN

@rfein-h As specified in readme, ice.s3AccessKeyId and ice.s3SecretKey need to be set as runtime parameters. They should not be defined in ice.properties file.

Thanks
-Fang

from ice.

@fangji Is there a reason why they can't be defined in ice.properties? That would be a neat way to hide them if you're not using AWS instance metadata. If you pass them as runtime java parameters any user able to list the running processes will be able to see the credentials, it's usually not best practice to pass sensitive data in command line options precisely because of this.

Thanks,
Nuno

from ice.

@nmcserra The idea is that you don't need to specify aws credentials while running Ice in the cloud. Providing the option to specify credentials as runtime parameters is only to enable people debugging/running ice on their local desktop.

from ice.

some of us run ice outside of aws, oddly enough. this is problematic because it means that your keys will be visible to anyone who can see the task's command line (i.e. anyone on the box)

from ice.

I just created a quick and dirty fix here - nyetsche@e6eb58f

I didn't add a pull request because I just ignored the System.getProperty() option so you can only use the ice.properties file. If there's interest I can rewrite and do a pull request.

Otherwise, there's a quick solution if you want to keep your credentials in that file.

from ice.

@fangji The documentation (https://github.com/Netflix/ice#basic-setup) says:

1.4 If running locally, set the following system properties at runtime. ice.s3AccessToken is optional.

ice.s3AccessKeyId=<accessKeyId>
ice.s3SecretKey=<secretKey>
ice.s3AccessToken=<accessToken>

I think it's a valid assumption that these will work if not running "locally" as well... at the least, this could be made more clear in the docs.

from ice.