Feature Request: Add support for AWS IAM roles (ECS Task Role / EC2 Instance Profile) for SQS authentication
Description
Currently, Outpost requires explicit AWS credentials (AWS_SQS_ACCESS_KEY_ID and AWS_SQS_SECRET_ACCESS_KEY) for SQS authentication. This prevents the use of AWS IAM roles, which is the recommended security practice for applications running on AWS infrastructure like ECS, EC2, or Lambda.
Current Behavior
When running Outpost on ECS Fargate without explicit credentials, the service fails with:
config validation error: message queue configuration is required
Looking at the source code in internal/config/mqconfig_aws.go, the IsConfigured() method requires non-empty credentials:
func (c *AWSSQSConfig) IsConfigured() bool {
return c.AccessKeyID != "" && c.SecretAccessKey != "" && c.Region != ""
}Expected Behavior
Outpost should support AWS IAM roles by:
- Detecting when running in an AWS environment with IAM roles available
- Using the AWS SDK's default credential provider chain
- Only requiring the region when IAM roles are available
Use Case
Many organizations follow AWS security best practices by:
- Using IAM roles instead of long-lived access keys
- Running containerized workloads on ECS with task roles
- Deploying on EC2 instances with instance profiles
- Following the principle of least privilege
Currently, we have to create IAM users with access keys specifically for Outpost, which:
- Goes against security best practices
- Requires additional secret management
- Increases the attack surface
- Makes credential rotation more complex
Proposed Solution
Modify the IsConfigured() method to support IAM roles:
func (c *AWSSQSConfig) IsConfigured() bool {
// Check if running with IAM role credentials
if hasIAMRoleCredentials() {
return c.Region != ""
}
// Fall back to explicit credentials
return c.AccessKeyID != "" && c.SecretAccessKey != "" && c.Region != ""
}
func hasIAMRoleCredentials() bool {
// ECS Task Role
if os.Getenv("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI") != "" {
return true
}
// EC2 Instance Profile
if os.Getenv("AWS_CONTAINER_CREDENTIALS_FULL_URI") != "" {
return true
}
// Lambda or other AWS services
if os.Getenv("AWS_EXECUTION_ENV") != "" {
return true
}
return false
}The AWS SDK for Go already handles credential resolution automatically through its default credential provider chain, so the SQS client initialization should work without explicit credentials when IAM roles are available.
Environment
- Outpost version: v0.4.1
- Deployment platform: AWS ECS Fargate
- AWS SDK: Already included in Outpost
Additional Context
This feature would align Outpost with AWS best practices and make it easier to deploy in production environments. Many similar tools (e.g., Fluent Bit, Prometheus, etc.) support IAM roles out of the box.
Workarounds
Current workarounds include:
- Creating IAM users with access keys (security anti-pattern)
- Using a sidecar container to provide credentials
- Forking Outpost to add IAM role support
None of these are ideal for production use.
References
Feature Request: Add support for AWS IAM roles (ECS Task Role / EC2 Instance Profile) for SQS authentication
Description
Currently, Outpost requires explicit AWS credentials (
AWS_SQS_ACCESS_KEY_IDandAWS_SQS_SECRET_ACCESS_KEY) for SQS authentication. This prevents the use of AWS IAM roles, which is the recommended security practice for applications running on AWS infrastructure like ECS, EC2, or Lambda.Current Behavior
When running Outpost on ECS Fargate without explicit credentials, the service fails with:
Looking at the source code in
internal/config/mqconfig_aws.go, theIsConfigured()method requires non-empty credentials:Expected Behavior
Outpost should support AWS IAM roles by:
Use Case
Many organizations follow AWS security best practices by:
Currently, we have to create IAM users with access keys specifically for Outpost, which:
Proposed Solution
Modify the
IsConfigured()method to support IAM roles:The AWS SDK for Go already handles credential resolution automatically through its default credential provider chain, so the SQS client initialization should work without explicit credentials when IAM roles are available.
Environment
Additional Context
This feature would align Outpost with AWS best practices and make it easier to deploy in production environments. Many similar tools (e.g., Fluent Bit, Prometheus, etc.) support IAM roles out of the box.
Workarounds
Current workarounds include:
None of these are ideal for production use.
References