0

I'm setting up a docker container which requires a cronjob to do a backup using awscli (authenticated via environment variables).

Since cron doesn't see my docker variables I'm printing them to a file and sourcing them before I run the aws command.

I have confirmed that the variables are set from cron yet awscli doesn't see them.

Here is a minimal project demonstrating the issue.

Dockerfile:

FROM debian:jessie

# Install aws and cron
RUN apt-get -yqq update
RUN apt-get install -yqq awscli cron rsyslog

# Create cron job
ADD crontab /etc/cron.d/hello-cron
RUN chmod 0644 /etc/cron.d/hello-cron

# Output environment variables to file
# Then start cron and watch log
CMD printenv > /env && cron && service rsyslog start && tail -F /var/log/*

crontab:

# Demonstrates that cron can see variables
*/2 * * * * root /usr/bin/env bash -c '. /env && echo $AWS_DEFAULT_REGION' >> /test1 2>&1

# Attempt to list s3 buckets knowing environment variables are set
*/2 * * * * root /usr/bin/env bash -c '. /env && aws s3 ls' >> /test2 2>&1

I end up getting back Unable to locate credentials. You can configure credentials by running "aws configure". Yet if I run the same command inside the docker container, I get back a list of buckets.

This is is the .env file I'm passing to docker.

.env:

## AWS SETTINGS
AWS_ACCESS_KEY_ID=(key removed)
AWS_SECRET_ACCESS_KEY=(secret removed)
AWS_DEFAULT_REGION=us-west-2

Does anyone have an idea as to why awscli can't see the environment variables, but only inside cron?

Improve this question

1 Answer 1

Reset to default
3

Environment variables can be set directly in the crontab(5); this will avoid the cost and complication of the additional shell execution and source steps. That is, your hello-cron file would instead contain something like

AWS_ACCESS_KEY_ID=(key removed)
AWS_SECRET_ACCESS_KEY=(secret removed)
AWS_DEFAULT_REGION=us-west-2

*/2 * * * * root echo $AWS_DEFAULT_REGION >> /test1 2>&1
*/2 * * * * root aws s3 ls >> /test2 2>&1
Improve this answer
3
  • any idea how to use this when awscli has permission through the instance using aws roles?
    – holmberd
    Commented Nov 28, 2018 at 19:02
  • @holmberd no idea, never used AWS so do not know what aws roles allows for
    – thrig
    Commented Nov 28, 2018 at 20:10
  • roles allows you to set custom permission on your server instances so that you don't need to store any aws credentials on the actual instance, it is all handled by roles. Turns out my assumption about my problem was wrong. Roles with awscli will run perfectly fine from a cronjob.
    – holmberd
    Commented Nov 28, 2018 at 20:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .