{"action":"created","issue":{"url":"https://api.github.com/repos/awslabs/aws-codedeploy-plugin/issues/39","labels_url":"https://api.github.com/repos/awslabs/aws-codedeploy-plugin/issues/39/labels{/name}","comments_url":"https://api.github.com/repos/awslabs/aws-codedeploy-plugin/issues/39/comments","events_url":"https://api.github.com/repos/awslabs/aws-codedeploy-plugin/issues/39/events","html_url":"https://github.com/awslabs/aws-codedeploy-plugin/issues/39","id":115677406,"number":39,"title":"Documentation on \"Use temporary credentials\"","user":{"login":"dashfwd","id":1413752,"avatar_url":"https://avatars.githubusercontent.com/u/1413752?v=3","gravatar_id":"","url":"https://api.github.com/users/dashfwd","html_url":"https://github.com/dashfwd","followers_url":"https://api.github.com/users/dashfwd/followers","following_url":"https://api.github.com/users/dashfwd/following{/other_user}","gists_url":"https://api.github.com/users/dashfwd/gists{/gist_id}","starred_url":"https://api.github.com/users/dashfwd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dashfwd/subscriptions","organizations_url":"https://api.github.com/users/dashfwd/orgs","repos_url":"https://api.github.com/users/dashfwd/repos","events_url":"https://api.github.com/users/dashfwd/events{/privacy}","received_events_url":"https://api.github.com/users/dashfwd/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/awslabs/aws-codedeploy-plugin/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/awslabs/aws-codedeploy-plugin/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-07T16:55:41Z","updated_at":"2015-12-02T00:49:58Z","closed_at":null,"body":"The \"Use temporary credentials\" feature of the plugin needs better documentation.\r\n\r\nIf this uses the AWS Security Token Service, could you provide some example of how to set that up?  It looks like the Security Token Service needs to be specifically enabled for each region, and then you need to create a Trust Policy (http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html).  \r\n\r\nI'm not at all clear on what role I need, what permissions are needed for that role, or how to configure the trust policy -- could you add that to the docs?\r\n\r\nAlso The help text has this documentation:\r\n\r\n> This plugin uses temporary access keys via the AWS Security Token Service. For instructions on setting this up, see the help text on the \"IAM Role ARN\" field above\r\n\r\nThere is no \"IAM Role ARN\" field above to refer to, and thus no additional help text.\r\n\r\nThank you."},"comment":{"url":"https://api.github.com/repos/awslabs/aws-codedeploy-plugin/issues/comments/161144079","html_url":"https://github.com/awslabs/aws-codedeploy-plugin/issues/39#issuecomment-161144079","issue_url":"https://api.github.com/repos/awslabs/aws-codedeploy-plugin/issues/39","id":161144079,"user":{"login":"suryanarayanan","id":598138,"avatar_url":"https://avatars.githubusercontent.com/u/598138?v=3","gravatar_id":"","url":"https://api.github.com/users/suryanarayanan","html_url":"https://github.com/suryanarayanan","followers_url":"https://api.github.com/users/suryanarayanan/followers","following_url":"https://api.github.com/users/suryanarayanan/following{/other_user}","gists_url":"https://api.github.com/users/suryanarayanan/gists{/gist_id}","starred_url":"https://api.github.com/users/suryanarayanan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/suryanarayanan/subscriptions","organizations_url":"https://api.github.com/users/suryanarayanan/orgs","repos_url":"https://api.github.com/users/suryanarayanan/repos","events_url":"https://api.github.com/users/suryanarayanan/events{/privacy}","received_events_url":"https://api.github.com/users/suryanarayanan/received_events","type":"User","site_admin":false},"created_at":"2015-12-02T00:49:58Z","updated_at":"2015-12-02T00:49:58Z","body":"I installed the latest version of this plugin (1.8) and the IAM Role ARN field help text clearly explains about the role and permissions required. Here's the content of that help text\r\n\r\n    In order to keep your application(s) more secure, this plugin only uses temporary credentials via STS, scoped to each application. To set this up: \r\n    Log into the AWS Management Console, and navigate to the Identity and Access Management console.\r\n    Click on Roles, then click Create New Role.\r\n    Give an appropriate name for this role (for example, \"JenkinsCodeDeployProject\").\r\n    In the \"Select Role Type\" screen, click \"Role for Cross-Account Access\" then select Allows IAM users from a 3rd party AWS account to access this account.\r\n    The account and external IDs for this Jenkins project are listed below\r\n    In the policy screen, select Custom Policy and copy-paste the following policy:\r\n        {\"Version\": \"2012-10-17\", \"Statement\": [{\"Effect\": \"Allow\", \"Action\": [\"codedeploy:*\", \"s3:*\"], \"Resource\": \"*\"}]}\r\n    Click Create Role, then copy-paste the Role ARN into the below field.\r\n    Click the Test Connection button to ensure that the permissions are set up properly.\r\n\r\n"}}