Using amazon-ecs-local-container-endpoints with MFA authentication

[niros1]

Hi,
I am working with compose based on scenario 1 (https://aws.amazon.com/blogs/compute/a-guide-to-locally-testing-containers-with-amazon-ecs-local-endpoints-and-docker-compose/), everything work well till I configured my environment to MFA authentication.
Before MFA i just used the profile name and mounting the .aws directory, I change the docker-compose.override to use the current session, the problem is that I get (from Boto) ResourceNotFoundException when I am trying to work with Dynamo DB. any idea what am I missing?

in order to use the authentication session I did the following changes (see env vars below):

services:
# This container vends credentials to your containers
ecs-local-endpoints:
  # The Amazon ECS Local Container Endpoints Docker Image
  image: amazon/amazon-ecs-local-container-endpoints
  volumes:
    # Mount /var/run so we can access docker.sock and talk to Docker
    - /var/run:/var/run
    # Mount the shared configuration directory, used by the AWS CLI and AWS SDKs
    # On Windows, this directory can be found at "%UserProfile%\.aws"
    - $HOME/.aws/:/home/.aws/
  environment:
    # define the home folder; credentials will be read from $HOME/.aws
    HOME: "/home"
    # You can change which AWS CLI Profile is used
    AWS_PROFILE: "DevAdmin"
    AWS_ACCESS_KEY_ID: "${AWS_ACCESS_KEY_ID}" ---- **Get the KEY_ID from the local machine after MFA authentication**
    AWS_SECRET_ACCESS_KEY: "${AWS_SECRET_ACCESS_KEY}" ---- **Get the ACCESS_KEY from the local machine after MFA** authentication
    AWS_SESSION_TOKEN: "${AWS_SESSION_TOKEN}" ---- **Get the SESSION_TOKEN from the local machine after MFA** authentication
    AWS_REGION: "eu-west-1"

10X in advance.
Nir

[cbcoutinho]

Two things come to mind:

1. I think you're conflating two ways of passing credentials: the first being via your ~/.aws/config file and AWS_PROFILE env var, which you would use to authenticate inside your container, and the second being the fact that you're passing the access key, secret, and token via env vars that you received from authenticating on your local host.

If you want to authenticate locally, then you don't need to pass your aws config and profile name to the container, as that information is contained in the key, secret, and token.

2. The link you posted also includes a number of networking configuration so that your app container can access the was ECS local container endpoint. Could it be that the ecs container is operating fine, but your application container can't connect to it?