About providing temporary AWS credentials inline , the use of task for AWS in Bamboo
Asked by Shao Cai:

Hi There,

Regarding to [https://community.atlassian.com/t5/Bamboo-questions/About-SAML-2-0-based-Federation-and-Bamboo-s-solution-for-AWS/qaq-p/1121392](https://community.atlassian.com/t5/Bamboo-questions/About-SAML-2-0-based-Federation-and-Bamboo-s-solution-for-AWS/qaq-p/1121392 "About work around of Identity Federation for AWS")

Speak of work around, as to providing temporary AWS credentials inline, I am not seeing the choice of "inline" available for me, see attached below for screen-shot, the only I can see is one for Federation and the other for EC2 IAM Role". I tried from "AWS Credentials Variables Configuration" Task.

I just recently downloaded "task for aws" plugin, it is Version:2.18.2. Am I missing any other plugin or this is not the latest version?

Thanks very much.

Shao

![NoInlineOption.PNG](/t5/image/serverpage/image-id/60235iB8561887552DA7A3/image-size/large?v=v2&px=999 "NoInlineOption.PNG")


Answers:
author: Steffen Opel _Utoolity_
body: Hi Shao,  

Thanks for the detailed inquiry, much appreciated. You are not missing anything, unfortunately I've not been precise enough when I described the [potential workaround](https://community.atlassian.com/t5/Bamboo-questions/Re-About-SAML-2-0-based-Federation-and-Bamboo-s-solution/qaq-p/1122415/comment-id/23777#M23777) on the referenced question, which turns out to be slightly misleading and surfaces a usability issue, sorry about that:

**App dependencies**

All our AWS integrations like [Tasks for AWS (Bamboo)](https://marketplace.atlassian.com/apps/1211585/tasks-for-aws-bamboo) and [Automation with AWS](https://marketplace.atlassian.com/search?query=%22Automation+with+AWS%22) are using another app [Identity Federation for AWS](https://marketplace.atlassian.com/search?query=%22Identity%20Federation%20for%20AWS%22) as a shared component to provide temporary AWS credentials at runtime (it's included for free, which [works automatically](https://utoolity.atlassian.net/wiki/spaces/UAA/pages/139853839)).

However, Identity Federation for AWS also provides additional features on its own, for example the [AWS Credentials Variables task](https://utoolity.atlassian.net/wiki/spaces/IFAWS/pages/42434587/Using+the+AWS+Credentials+Variables+task+in+Bamboo) that you used to explore the workaround.

Now, given that app's core value proposition is to provide temporary AWS credentials for others, we considered it inappropriate to also offer the use of the older 'inline' credentials variation there, because using long-term AWS credentials directly is at odds with the security best practices we aim to promote (back then we didn't offer the 'Provide session token variable' option).

**Inline security credentials**

Long story short, the [inline AWS security credentials](https://utoolity.atlassian.net/wiki/spaces/TAWS/pages/22773776/Providing+AWS+Security+Credentials#ProvidingAWSSecurityCredentials-Inline) option referenced in the workaround is available for [all tasks in Tasks for AWS (Bamboo)](https://utoolity.atlassian.net/wiki/spaces/TAWS/pages/19464213/Using+Tasks+for+AWS#UsingTasksforAWS-Usingtasks), except for those [provided by Identity Federation for AWS (Bamboo)](https://utoolity.atlassian.net/wiki/spaces/IFAWS/pages/8814622/Using+Identity+Federation+for+AWS#UsingIdentityFederationforAWS-Bamboo) - here's how the credentials section looks for the former (e.g. the [CloudFormation task](https://utoolity.atlassian.net/wiki/spaces/TAWS/pages/19464198/Using+the+AWS+CloudFormation+Stack+task+in+Bamboo)):  
![UAA-383.png](https://community.atlassian.com/t5/image/serverpage/image-id/60293i73E4DAC0595A9158/image-dimensions/538x494?v=v2 "UAA-383.png")  

I hope this helps to get you going - please don't hesitate to [contact us](https://utoolity.atlassian.net/wiki/spaces/UAA/pages/17235999/Support+SLA) directly in case you prefer to discuss any details in private.

comments: author: Shao Cai
body: [@Steffen Opel _Utoolity_](/t5/user/viewprofilepage/user-id/781567) Thanks for the info. I will definitely give it a try today and get back to you. Thanks


author: Shao Cai
body: [@Steffen Opel _Utoolity_](/t5/user/viewprofilepage/user-id/781567) Thanks so much. I tried the inline for AWS Security Credentials, and it worked, at least, for the cases I tried via S3 operations.

For the purpose of POC, it is okay to inject credentials for each task, however, to promote the solution, we at least want to have one place to inject credentials. So, inject once at one place, used for all tasks.

I recall in some posts that, you mentioned that, bamboo credential variables name are significant, so do we have any way to set the credentials variables which can be automatically used by all tasks?

Regardless, I am happy that I have progressed so much that I can explore all the AWS tasks to provide enough show cases for the decision-making.

Thanks for the help!

Shao


author: Steffen Opel _Utoolity_
body: [@Shao Cai](/t5/user/viewprofilepage/user-id/3404084) - glad you got this to work!

We have a page documenting the general approach of [Injecting task configuration via Bamboo variables](https://utoolity.atlassian.net/wiki/spaces/TAWS/pages/19464201/Injecting+task+configuration+via+Bamboo+variables) (which btw. not only works for credentials, but also most other parameters, thereby providing one of three options to [Providing task configuration as code](https://utoolity.atlassian.net/wiki/spaces/TAWS/pages/123232844/Providing+task+configuration+as+code)).

The main takeaway is that you can achieve **variable reuse across tasks** by providing either **global** or **plan** level [Bamboo variables](https://confluence.atlassian.com/bamboo/bamboo-variables-289277087.html) so that you can reference the same variable names in each task and only need to update the variables in one place.

The only relevant naming constraint is that you should add the magic phrase "password" to variables containing sensitive information so that they will be masked with "\*\*\*\*\*\*\*\*" in the build logs (this is unfortunately not mentioned in the official docs).

For example, we have defined the following global variables in our related test scenarios (the access key ID is not considered a secret, but you could also mask it of course):

```
awsAccessKeyId
awsSecretAccessKeyPassword
awsSessionTokenPassword
```

You would then use these variables from our tasks via the following references (note the 'bamboo' prefix required here):

```
${bamboo.awsAccessKeyId}
${bamboo.awsSecretAccessKeyPassword}
${bamboo.awsSessionTokenPassword}
```

I hope this helps to simplify your workaround, and also illustrates using variables for general configuration reuse in Bamboo builds and deployments.

That being said, the main value proposition of our Identity Federation for AWS apps is to provide a secure and convenient way to use temporary AWS credentials derived from centrally managed long-term credentials so that you do not need such workarounds via variables at all - I'll provide an answer to your resp. [follow up question](https://community.atlassian.com/t5/Bamboo-questions/Re-Re-About-SAML-2-0-based-Federation-and-Bamboo-s-solu/qaq-p/1129700/comment-id/23889#M23889) later today.

Cheers,  
Steffen


Tags: addon-net.utoolity.atlassian.bamboo.tasks-for-aws