We Keep Coding

Is there a way to retrieve AWS Credentials information from AWS SDK?

I'm trying to setup healthchecks for some required services to my dotnet core 3.1 API and I'm struggling on Amazon DynamoDB check.
We're using the Xabaril healthcheck packages and the DynamoDb one ask for a DynamoDBOptions that requires the AccessKey, SecretKey and RegionEndpoint.
I know the AWS SDK get this information from the environment Credentials profile configuration:
using Amazon.DynamoDBv2;
//... other usings
public void ConfigureServices(IServiceCollection services)
{
// ... other stufs
services.AddAWSService<IAmazonDynamoDB>();
// ...
}
...But I need get it too in order to set up my dependency healthcheck like this:
services.AddHealthChecks()
.AddDynamoDb(dynamoDbOptions =>
{
dynamoDbOptions .AccessKey = "<???>";
dynamoDbOptions .RegionEndpoint = Amazon.RegionEndpoint.EUWest2; // <???>
dynamoDbOptions .SecretKey = "<???>";
}, "DynamoDB");
How can I get this <???> infos from AWS SDK packages?

After spend some more time in the official docs, I found the topic that covers exactly this need: Accessing credentials and profiles in an application.
To actively retrieve profiles and credentials, use classes from the Amazon.Runtime.CredentialManagement namespace.
In fact, we can use the SharedCredentialsFile class to find a profile in a file that uses the AWS credentials file format, the NetSDKCredentialsFile class to find a profile in the SDK Store or even CredentialProfileStoreChain to search in both.
You can see the examples in the link above. I got this in my case:
private static AWSCredentials GetAccountCredentials(string profileName = "default")
{
var chain = new CredentialProfileStoreChain();
if (chain.TryGetAWSCredentials(profileName, out AWSCredentials awsCredentials))
return awsCredentials;
// ToDo: Error Handler
return null;
}

Yes, the AWS SDKs give programmatic access to IAM AccessKey and SecretKey credentials stored in the local shared AWS credentials file.
I am not a c# dev, but perhaps see the .net sdk AWSCredentialsFactory.GetAWSCredentials method or this blogpost.

Best way to store passwords for ASP.NET Core app on Azure

I have developed some application and I am using there a external service to send emails (SendGrid). To use this service I need login and password to use SendGrid api. In developmnet environment I have used .Net Core secrets (https://learn.microsoft.com/pl-pl/aspnet/core/security/app-secrets?view=aspnetcore-2.2&tabs=windows) but now after publish I need to deliver login and password in other way. I know that there is a Azure Key Vault, but what if app will be published somwhere else?

FOR PRODUCTION: Use Managed Identity for Azure Resources to avoid storing connection strings. It is a clean solution for managing secrets in Key Vault.
Access Key for Key Vault or other similar resources is never shared, not even to Services or DevOps Engineer to deploy or run the applications in production
Create a Azure Key Vault and store your secrets
Enable System Managed Identity in your Azure App Service. It will register your web application at AAD internally
Search for Managed Service Identity Application ID at Key Vault and allow intended access to it
Initialize connection to your Key Vault by following snippet
Program.cs
using Microsoft.Azure.Services.AppAuthentication;
using Microsoft.Azure.KeyVault;
using Microsoft.Extensions.Configuration.AzureKeyVault;
...
public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
WebHost.CreateDefaultBuilder(args)
.ConfigureAppConfiguration((context, config) =>
{
if (context.HostingEnvironment.IsProduction())
{
var builtConfig = config.Build();
var azureServiceTokenProvider = new AzureServiceTokenProvider();
var keyVaultClient = new KeyVaultClient(
new KeyVaultClient.AuthenticationCallback(
azureServiceTokenProvider.KeyVaultTokenCallback));
config.AddAzureKeyVault(
$"https://{builtConfig["KeyVaultName"]}.vault.azure.net/",
keyVaultClient,
new DefaultKeyVaultSecretManager());
}
})
.UseStartup<Startup>();
Startup.cs
public class Startup
{
public Startup(IConfiguration configuration)
{
Configuration = configuration;
}
public IConfiguration Configuration { get; }
}
Now, secrets from Key Vault will be loaded into Configuration variable. You can use it like, Configuration["YourKeyVaultKeyName"].
FOR DEVELOPMENT: You can optionally use Dotnet-user-secrets tool to store\ manage the secrets in local machine.

What credential type should I use to login to AWS API?

I'm trying to integrate AWS API (AWSSDK 2.3.55.2) to my asp.net mvc4 project and I'm not sure what type of credential I should use. Manually i log-in to AWS using the third-party app (okta), so I don't have credentials directly from the AWS. Can I get\generate access key or smth else for login throught API by myself ? Or I should ask my AWS admin anyway to provide some creds ?
What is the simpliest way to login in this situation ?
Now I have smth like:
public static void RestartInstance()
{
var ec2Client = new AmazonEC2Client();
try
{
var response = ec2Client.RebootInstances(new RebootInstancesRequest
{
// Frankfurt
InstanceIds = new List<string> {
"MYInstanceID"
}
});
}
catch (AmazonEC2Exception ex)
{
if ("InvalidInstanceID.NotFound" == ex.ErrorCode)
{
Logger.Instance.Info($"AWS1 Error during rebooting. Please, check the Instance ID Ex: {ex.Message}");
}
}
}
I have 2 choices according to client realization: http://prntscr.com/kt13al . But as far as I understand I cannot use "AWSCredentials", because I don't have this one (I log-in using another app), so I need awsAccessKeyId and awsSecretAccessKey ? Is it right ?

AWS has concept of IAM (Identity Access Management) for authentication and authrozation. AWS IAM documentation.
Locally you need to have AWS Access keys(Access key and Secret access key) generated for your IAM user, this can be done for example from the AWS web console, and you need to configure the credentials. See AWS CLI Documentation for help
If you are running your application in the AWS EC2/ECS/Fargate/Elastic Beanstalk You need to specify IAM Role for the server/service to access private AWS resources. See for example AWS documentation for EC2 IAM
Configuring credentials for C# see documentation
Generally SDK looks for named environment variables for access key and secret key and uses them to access AWS resources.
And yes you need the access key and secret access key to locally use SDK.

Azure SDK for .NET authentication - where to keep the generated service principal?

I'm trying to understand how to authenticate with Azure during development and production.
For development I followed the instructions here: documentation
I now have a file and an environment variable that the Azure SDK uses for authentication.
However for production I don't know where to put this file. In this case, production is itself a set of Azure Functions which uses the Azure SDK. In the documentation the service principal is stored on C:\.
Should I forgo the environment variable and instead place the service principal file in my src directory (and exclude it from commits of course) and then make sure the file is copied to the output so that it is present for both development and production?
var credentials = SdkContext.AzureCredentialsFactory
.FromFile("service-principle.json"); // same dir as the Azure Function DLLs

As Thomas mentioned that you could add the setting in the Azure function appsetting in the Azure portal.
Then you could use the following command get the credentials. How to use azure function appsettings, please refer to this document.
Note: Need to save the setting after add them. Then we could use SdkContext.AzureCredentialsFactory.FromServicePrincipal(clientId, clientSecret, tenantId, environment: AzureEnvironment.AzureGlobalCloud); to get the credentials.
Following is the demo code.
var clientId = Environment.GetEnvironmentVariable("clientId");
var clientSecret = Environment.GetEnvironmentVariable("clientSecret");
var tenantId = Environment.GetEnvironmentVariable("tenantId");
var credentials = SdkContext.AzureCredentialsFactory.FromServicePrincipal(clientId, clientSecret, tenantId, environment: AzureEnvironment.AzureGlobalCloud);
It is not recommended to publish the Credentials file to azure function, if you still want to do that. You could use the Azure function kudu tool. And Azure function D:\home is shared, you could upload your service-principle.json to the folder you want.

How to set credentials on AWS SDK on NET Core?

I'm new to AWS SDK and I'm trying to follow the AWS documentation, but gives little to none on what exactly I need to setup.
The official docs tell me to add this to the appsettings.json:
{
"AWS": {
"Profile": "local-test-profile",
"Region": "us-west-2"
}
}
And then create the client:
var options = Configuration.GetAWSOptions();
IAmazonS3 client = options.CreateServiceClient<IAmazonS3>();
This causes an exception to be thrown saying it cannot find the credentials. Where do I put the Api ID and Key? What is this profile?
Please, bear in mind I have no preferences on how to set this up. I'm just trying to follow the official documentation for .NET Core, and their only example doesn't work. The docs seem to imply I should have prior knowledge of many of their terms and settings or that I'm migrating an existing app and already have everything setup.
Can someone please point me to what is missing from this example just to make the API correctly connect to AWS?

Maybe this is too late for you but if you are using docker or have some other environment/setup where it's not possible/easy to use AWS profiles then you can still use environment vars. Eg:
var awsOptions = Configuration.GetAWSOptions();
awsOptions.Credentials = new EnvironmentVariablesAWSCredentials();
services.AddDefaultAWSOptions(awsOptions);
services.AddAWSService<IAmazonS3>();
Then set AWS_ACCESS_KEY_ID & AWS_SECRET_ACCESS_KEY & AWS_REGION in your environment.
It seems that Amazon have made this harder to find in the docs than it needs to be.
Running in AWS for reals is ok because you should be using a role but if your using docker for dev then setting up a profile in the container is a PITA.

The json file is $"appsettings.{env.EnvironmentName}.json", so you should call it appsettings.Development.json and have the environment variable set.
Did you define your"local-test-profile" profile in the AWS credentials file.
Should be in C:\Users\{USERNAME}\.aws\credentials
[local-test-profile]
aws_access_key_id = your_access_key_id
aws_secret_access_key = your_secret_access_key
If you don't want it in the default location, you can set the 'ProfilesLocation' json config file.

This helps to avoid getting credentials from environment using the appsettings for development purpose
var awsOption = Configuration.GetAWSOptions();
awsOption.Credentials = new BasicAWSCredentials(Configuration["AWS:AccessKey"], Configuration["AWS:SecretKey"]);
services.AddDefaultAWSOptions(awsOption);

AWS SDK for .NET uses following order to load credentials:
1. AWSOptions.Credentials property
AWSOptions awsOptions = new AWSOptions
{
Credentials = new BasicAWSCredentials("yourAccessKey", "yourAccessSecret")
};
builder.Services.AddDefaultAWSOptions(awsOptions);
2. AWSOptions.Profile property
AWSOptions awsOptions = new AWSOptions
{
Profile = "custom",
ProfilesLocation = #"c:\temp\credentials"
};
builder.Services.AddDefaultAWSOptions(awsOptions);
If the profile location is not specified, it will look at the default location C:\Users\.aws\credentials.
3. Credential Profile Store Chain
If both AWSOptions.Credentials and AWSOptions.Profile are not supplied or AWSOptions object itself is null. In this case, credential profile name will be loaded from the environment variable AWS_PROFILE.
Profile Name: If there is no such AWS_PROFILE environment variable, then default will be used as a profile name.
Profile Location: C:\Users\.aws\credentials
4. Environment Variables AWS Credentials
If SDK still hasn't got the credentials, then it checks for the following environment variables to load the AWS credentials.
ENVIRONMENT_VARIABLE_ACCESSKEY = "AWS_ACCESS_KEY_ID";
ENVIRONMENT_VARIABLE_SECRETKEY = "AWS_SECRET_ACCESS_KEY";
ENVIRONMENT_VARIABLE_SESSION_TOKEN = "AWS_SESSION_TOKEN";
5. EC2 Instance Profile / ECS Task Profile
Finally, this is the most important place where the SDK looks for the credentials. This would be the best place for the applications that are running in the AWS environment. In this case, SDK loads the AWS credentials from the EC2 instance profile or ECS task role.
I have also written a blog on the same topic, you can checkout that from here - Understanding Credential Loading in AWS SDK for .NET

Same documentation also includes a section for setting up the credentials.
Check it out here http://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/net-dg-config-creds.html
It doesn't give an example of setting up the credentials using the appSettings.json file because they don't think it's the right (secure) way to do it.
Here is from the introduction part of the section about setting up the credentials:
Don't put literal access keys in your application, including the
project's App.config or Web.config file. If you do, you create a risk
of accidentally exposing your credentials if, for example, you upload
the project to a public repository.