I'm deploying Mattermost on AWS using IAM Roles to provide temporary credentials to the instances. I was hoping it would work out of the box and, when it didn't, I created a script to retrieve the temporary credentials periodically and update the Mattermost config.json with the credentials so it can store files in S3. However, the config only supports AccessKeyId and SecretAccessKey. The temporary credentials require the inclusion of a Session Token as well.

I see two possible solutions to this:

The simple solution would be to add an optional AmazonS3SessionToken configuration option in the FileSettings and update the authentication to provide this value if it exists.

The better solution, in my mind, would be to have Mattermost natively support credential lookup for AWS instance roles, managing the token expiration and auth configuration internally so temporary credentials are not exposed in the System Console or config.json file. Not sure if goamz supports this natively or if it would be a solution like providing the role name in config.json and having Mattermost retrieve the credentials.