mesos2iam: IAM Credentials for Containers Running Inside a Mesos Cluster
summary
mesos2iam runs on Mesos agents and returns per-task temporary AWS credentials so containers never store keys; it uses the AWS instance metadata/STs flow, a privileged credentials host that performs assume-role via privileged credentials host, and a lookup table (currently Dynamo, migrating to Strongbox credential store) mapping container/task IDs to IAM roles. Demo shows a container gaining access to a single S3 bucket while the agent remains minimally privileged. Code is open source at mesos2iam and is actively used in production.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:25About the company
- 1:47About the team
- 3:14Maintenance Primitives
- 4:35Mesos
- 5:46IAM Roles
- 8:07Use Case
- 13:45Recap
- 14:16Credential Options
- 15:32Emerald Forest
- 16:24Mesos IAM
- 18:25Container ID
- 20:20Demo
- 24:28Questions
related talks
57mA first-principles approach: AWS Identity and Access Management (IAM)
28mYour journey to temporary credentials in the cloud
01h 02mWhy IAM is the new perimeter, and how to govern it
45mManaging hybrid workloads with IAM Roles Anywhere, featuring
55mHandling secrets in cloud-based applications
38mSecure Shell Access Without SSH
35mIdentity and Access Management for the Decade Ahead
31mIAM and why it is important in Cloud environments