# S3 Repository Plugin - Why both SecretAccess Key AND Role for calling Snapshot APIs?

**URL:** <https://discuss.elastic.co/t/s3-repository-plugin-why-both-secretaccess-key-and-role-for-calling-snapshot-apis/121720>\
**Category:** Elasticsearch\
**Created:** [February 27, 2018, 6:54pm UTC](https://discuss.elastic.co/t/s3-repository-plugin-why-both-secretaccess-key-and-role-for-calling-snapshot-apis/121720 "2018-02-27T18:54:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![titan1978](https://avatars.discourse-cdn.com/v4/letter/t/c37758/32.png) [@titan1978](https://discuss.elastic.co/u/titan1978)\
**Post date:** [February 27, 2018, 6:54pm UTC](https://discuss.elastic.co/t/s3-repository-plugin-why-both-secretaccess-key-and-role-for-calling-snapshot-apis/121720/1 "2018-02-27T18:54:50Z")

</div>

I've been going through quite a few tutorials on how to setup s3 plugin. HEre's one:

> [Configuring Elasticsearch to Use S3 for Snapshots | ObjectRocket](https://www.objectrocket.com/blog/elasticsearch/elasticsearch-s3)

I completely get that we have to install Roles to allow the plugin on the master nodes to essentially write to the buckets. But the tutorials ALSO indicate when calling the \_snapshot/ APIs, you need to pass the Secret Access Key and Access ID. What is the need (if at all) for passing in secret access keys when the EC2 Instances have been given the requisite roles?

```
PUT /_snapshot/s3_repository
{
  "type": "s3",
  "settings": {
    "bucket": "MYBUCKETNAME",
    "region": "us-east-1",
    "access_key": "KEY",
    "secret_key": "SECRET"
  }
}'

```

---

<div class="post-metadata">

**Author:** ![rjernst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rjernst/32/6363_2.png) [@rjernst](https://discuss.elastic.co/u/rjernst)\
**Post date:** [February 27, 2018, 8:35pm UTC](https://discuss.elastic.co/t/s3-repository-plugin-why-both-secretaccess-key-and-role-for-calling-snapshot-apis/121720/2 "2018-02-27T20:35:35Z")

</div>

Passing the access/secret key is not required. If not specified, authentication will fallback to roles through EC2.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 27, 2018, 8:36pm UTC](https://discuss.elastic.co/t/s3-repository-plugin-why-both-secretaccess-key-and-role-for-calling-snapshot-apis/121720/3 "2018-03-27T20:36:08Z")

</div>

Closed on March 27, 2018, 8:36pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.