# Getting AWS credentials from keystore for discovery-ec2 plugin? **URL:** \ **Category:** Elasticsearch\ **Created:** [June 1, 2017, 5:30pm UTC](https://discuss.elastic.co/t/getting-aws-credentials-from-keystore-for-discovery-ec2-plugin/87958 "2017-06-01T17:30:12Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Jaff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaff/32/18382_2.png) [@Jaff](https://discuss.elastic.co/u/Jaff)\ **Post date:** [June 1, 2017, 5:30pm UTC](https://discuss.elastic.co/t/getting-aws-credentials-from-keystore-for-discovery-ec2-plugin/87958/1 "2017-06-01T17:30:12Z")
We are upgrading to ES 5.4.x after having used 1.7.3 and 2.3.3 in production. Having learned that including AWS credentials in config/elasticsearch.yml has been discouraged, I setup a keystore to hold those settings. But it seems the discovery-ec2 plugin is not using that resource to obtain credentials. Am I missing a setting somewhere to allow that behavior? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 1, 2017, 5:57pm UTC](https://discuss.elastic.co/t/getting-aws-credentials-from-keystore-for-discovery-ec2-plugin/87958/2 "2017-06-01T17:57:34Z")
It should work OOTB. What exactly did you configure in the keystore? Can you list the settings you have? ---
**Author:** ![Jaff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaff/32/18382_2.png) [@Jaff](https://discuss.elastic.co/u/Jaff)\ **Post date:** [June 1, 2017, 7:08pm UTC](https://discuss.elastic.co/t/getting-aws-credentials-from-keystore-for-discovery-ec2-plugin/87958/3 "2017-06-01T19:08:23Z")
I added these settings: (command and output) ./elasticsearch-keystore list cloud.aws.access\_key cloud.aws.region cloud.aws.secret\_key Using chef to provision the host, executed commands as follows: #{es\_home\_dir}/bin/elasticsearch-keystore create /bin/echo #{es\_aws\_access\_key} | #{es\_home\_dir}/bin/elasticsearch-keystore add --stdin cloud.aws.access\_key /bin/echo #{es\_aws\_secret\_access\_key} | #{es\_home\_dir}/bin/elasticsearch-keystore add --stdin cloud.aws.secret\_key /bin/echo 'us-east-1' | #{es\_home\_dir}/bin/elasticsearch-keystore add --stdin cloud.aws.region ---
**Author:** ![Jaff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaff/32/18382_2.png) [@Jaff](https://discuss.elastic.co/u/Jaff)\ **Post date:** [June 1, 2017, 7:12pm UTC](https://discuss.elastic.co/t/getting-aws-credentials-from-keystore-for-discovery-ec2-plugin/87958/4 "2017-06-01T19:12:19Z")
When I issue the list command, should I also see the values with the keys? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 1, 2017, 7:23pm UTC](https://discuss.elastic.co/t/getting-aws-credentials-from-keystore-for-discovery-ec2-plugin/87958/5 "2017-06-01T19:23:53Z")
I see. Sadly the documentation has not been updated yet. It needs to be: - `discovery.ec2.access_key` - `discovery.ec2.secret_key` `cloud.aws.region` should not be used anymore but `discovery.ec2.endpoint` needs to be set in `elasticsearch.yml` file. See [https://github.com/elastic/elasticsearch/blob/5.4/plugins/discovery-ec2/src/main/java/org/elasticsearch/discovery/ec2/AwsEc2Service.java#L181-L188](https://github.com/elastic/elasticsearch/blob/5.4/plugins/discovery-ec2/src/main/java/org/elasticsearch/discovery/ec2/AwsEc2Service.java#L181-L188) I hope this helps. cc @rjernst in case I'm saying something wrong 🙂 ---
**Author:** ![Jaff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaff/32/18382_2.png) [@Jaff](https://discuss.elastic.co/u/Jaff)\ **Post date:** [June 1, 2017, 9:15pm UTC](https://discuss.elastic.co/t/getting-aws-credentials-from-keystore-for-discovery-ec2-plugin/87958/6 "2017-06-01T21:15:46Z")
Unfortunately, changing keystore names did not solve the issue. We have solved the problem by entering the updated key names in elasticsearch.yml. ---
**Author:** ![rjernst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rjernst/32/6363_2.png) [@rjernst](https://discuss.elastic.co/u/rjernst)\ **Post date:** [June 2, 2017, 4:08am UTC](https://discuss.elastic.co/t/getting-aws-credentials-from-keystore-for-discovery-ec2-plugin/87958/7 "2017-06-02T04:08:11Z")
@Jaff What do you mean by `We have solved the problem by entering the updated key names in elasticsearch.yml`? David is correct that the keystore settings should be `discovery.ec2.access_key` and `discovery.ec2.secret_key`. Any of the old settings will not work there (unfortunately we do not yet have validation of settings in the keystore, so you will not get an error if you add settings that should not be there). But setting eg `discovery.ec2.access_key` in `elasticsearch.yml` should not work. This setting should only be allowed in the keystore. ---
**Author:** ![Jaff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaff/32/18382_2.png) [@Jaff](https://discuss.elastic.co/u/Jaff)\ **Post date:** [June 2, 2017, 4:26pm UTC](https://discuss.elastic.co/t/getting-aws-credentials-from-keystore-for-discovery-ec2-plugin/87958/8 "2017-06-02T16:26:18Z")
We are OK with discovery-ec2 plugin, however repository-s3 authentication is failing. I have set keystore values for cloud.aws.s3.access\_key and cloud.aws.s3.secret\_key and still getting failure. ---
**Author:** ![rjernst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rjernst/32/6363_2.png) [@rjernst](https://discuss.elastic.co/u/rjernst)\ **Post date:** [June 2, 2017, 5:32pm UTC](https://discuss.elastic.co/t/getting-aws-credentials-from-keystore-for-discovery-ec2-plugin/87958/9 "2017-06-02T17:32:42Z")
Ok, repository-s3 has different settings. This is due to that plugin allow for multiple credential sets. There you need to set `s3.client.default.access_key` and `s3.client.default.secret_key`. ---
**Author:** ![Jaff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaff/32/18382_2.png) [@Jaff](https://discuss.elastic.co/u/Jaff)\ **Post date:** [June 2, 2017, 9:11pm UTC](https://discuss.elastic.co/t/getting-aws-credentials-from-keystore-for-discovery-ec2-plugin/87958/11 "2017-06-02T21:11:01Z")
The different keystore settings did affect the result, now able to create bucket. Here is keystore list output: /mnt/elasticsearch# bin/elasticsearch-keystore list discovery.ec2.access\_key discovery.ec2.secret\_key s3.client.default.access\_key s3.client.default.secret\_key Here is result of running shell script to create the repository bucket: /mnt/elasticsearch# bin/s3-repo-create.sh es-lineartv\_test {"acknowledged":true} ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 30, 2017, 9:11pm UTC](https://discuss.elastic.co/t/getting-aws-credentials-from-keystore-for-discovery-ec2-plugin/87958/12 "2017-06-30T21:11:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.