topic Re: Hide AWS KEYID and Secret when using Proc S3 in Administration and Deployment

Hide AWS KEYID and Secret when using Proc S3

McDiddles — Thu, 12 Nov 2020 13:57:03 GMT

Greetings,

I a SAS Viya 3.5 environment and need end users to use Proc s3 with key and secret. However I do not want the users to actually see the values of the ID and secret. whether you use a custom config file or configure the AWS cli. I will still need to grant users read access to the files.

this means with a simple filename statement, users will be able to see the credentials to S3 and I don't want that.

How is I secure these(hide them from end users) credentials and still have proc s3 read and use the files.

Re: Hide AWS KEYID and Secret when using Proc S3

SASKiwi — Thu, 12 Nov 2020 18:55:13 GMT

Please post an example of the issue, including the FILENAME and PROC S3 code.

Re: Hide AWS KEYID and Secret when using Proc S3

McDiddles — Fri, 13 Nov 2020 09:00:41 GMT

Step 1: configured AWS CLi on host.
which creates the config and credentiala file in /home/username/.aws/
the credential file contains the access KeyId and Secret which I don't want user to see

Step 2: run proc s3 which used those credentials to list a bucket and perform other operations;

Proc s3;
list "bucket-name";
run;

Step 3: This step is what I don't want users to be able to do but I cannot remove read permission on the credentials file;
filename secrets "/home/didie.muyco/.aws/credentials";
proc import datafile=secrets out=credentials dbms=dlm;
run;

The above import exports the credentials into SAS and end users can see it 😞

How can I work around this?

Re: Hide AWS KEYID and Secret when using Proc S3

KS4NCS — Wed, 02 Dec 2020 13:15:31 GMT

Hi
Which SAS release are you on?Possible to use IAM Roles?
Seem SAS has implemented it in the newer release.
https://documentation.sas.com/?cdcId=pgmsascdc&cdcVersion=9.4_3.5&docsetId=proc&docsetTarget=n1volodm4xnj3xn1s99poiemcha2.htm&locale=en#n1fyp40x7vdmdwn13c6slecd94yq
As i understand early of this year i still not able to use the IAM Roles.
Hope this help.

Re: Hide AWS KEYID and Secret when using Proc S3

SASKiwi — Wed, 02 Dec 2020 19:15:00 GMT

Have you raised this with SAS Tech Support? You'll get a quicker answer that way.