credentials static web identity credentials not picked up without an explicit profile option
Los mantenedores suelen responder en 1 día
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 3/5
- Tiempo estimado
- 1-2 días
- Aptitud para principiantes
- 48/100
- Tipo de issue
- Error
- Claridad
- Bastante claro
- Estado de actividad
- Estancado
- Stack tecnológico
- aws, ruby
- Área
- authentication, cloud
Línea de trabajo
Comienza con gems/aws-sdk-core/lib/aws-sdk-core/credential_provider_chain.rb y gems/aws-sdk-core/lib/aws-sdk-core/plugins/credentials_configuration.rb; después, revisa el comportamiento de la configuración compartida descrito en la reproducción. Usa las dos llamadas a Aws::SQS::Client.new con la configuración de identidad web para verificar las solicitudes actuales de STS. Se considera terminado cuando se usa la configuración compartida predeterminada sin un perfil explícito y los clientes repetidos no se actualizan por separado cada uno.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
Describe the bug
We're using STS web identity token credentials to manage AWS SDK service call authentication via SigV4 (aws-sdk-core (3.211.0), should be the relevant bit). We noticed however, during load testing, some rate limiting happening, which we narrowed down to multiple calls to the STS token refresh endpoint, exacerbated by the scaling up of certain services. After some investigation, we figured out that multiple clients (for SQS, SNS, etc) were instantiated, and the token refresh path was called for each of them. This is not ideal, as there should be a single "refresh" happening, and the token should at best be shared across the multiple clients.
In the process, we found out that the AWS SDKs already support that via "shared config", and we proceeded to change our approach using it, replacing the env var setup using AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN with a AWS_CONFIG_FILE pointing to a file like this:
[default]
web_identity_token_file = $AWS_WEB_IDENTITY_TOKEN_FILE
role_arn = $AWS_ROLE_ARN
Expected Behavior
This should have worked, as in, when instantiating clients multiple times, there should only be one call to STS. This can be observed using this script:
Aws.config[:http_wire_trace] = true
Aws::SQS::Client.new
# one STS request log
Aws::SQS::Client.new
# no STS request log
Current Behavior
when instantiating two client instances, two STS requests are made.
While we noticed that Aws.shared_config was correctly filled up with the expected values, unfortunately calling i.e. Aws::SQS::Client.new was still going through this strategy and generating a token + refresh loop per client, because of this clause, i.e. the routine expects a profile to be set, however it's nil as per the option setup, although the docs say it's "default".
I believe this is a bug, as if "default", this would have worked. I also tried setting the AWS_PROFILE env var, but that doesn't fill it up either.
FWIW, setting Aws.config[:profile] = "default", or explicit option set a la Aws::SQS::Client.new(profile: "default"), work as expected (shared config is picked up). However, I'm looking for a "no config code" setup that can be rolled out across multiple services.
Reproduction Steps
Aws.config[:http_wire_trace] = true
Aws::SQS::Client.new
# one STS request log
Aws::SQS::Client.new
# no STS request log
Possible Solution
Perhaps initializing the profile option to whatever AWS_PROFILE defines?
Additional Information/Context
No response
Gem name ('aws-sdk', 'aws-sdk-resources' or service gems like 'aws-sdk-s3') and its version
aws-sdk-core 3.211.0
Environment details (Version of Ruby, OS environment)
"ruby 3.3.0 (2023-12-25 revision 5124f9ac75) [x86_64-linux]"
- Lenguaje dominante
- Ruby
- Estrellas
- 3.7k
- Forks
- 1.2k
- Merge medio
- 1 d 16 h
- PR fusionados (30 d)
- 25
Preparar el entorno
- Sin Dockerfile ni archivo de Docker Compose
- Tiene una plantilla de pull request
- Leer la guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de aws/aws-sdk-ruby
-
service-api
Dificultad 2/5 1-3 horas Aptitud para principiantes 68/100
aws/aws-sdk-ruby#3395 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
BedrockAgentCore: invoke_agent_runtime buffers entire response instead of streaming in real-timeAbiertodocumentation p3 queued
Dificultad 4/5 3-5 días Aptitud para principiantes 48/100
aws/aws-sdk-ruby#3348 · 6 comentarios · 1 reacción ·
Los mantenedores suelen responder en 1 día
-
investigating service-api
Dificultad 4/5 3-5 días Aptitud para principiantes 35/100
aws/aws-sdk-ruby#3217 · 4 comentarios ·
Los mantenedores suelen responder en 1 día
-
service-api
Dificultad 5/5 Más de una semana Aptitud para principiantes 25/100
aws/aws-sdk-ruby#3191 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
feature-request
Dificultad 3/5 1-2 días Aptitud para principiantes 35/100
aws/aws-sdk-ruby#3190 · 3 comentarios ·
Los mantenedores suelen responder en 1 día
Todos los issues de aws/aws-sdk-ruby
Issues similares
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
up-for-grabs/up-for-grabs.net#6330 ·
Los mantenedores suelen responder en 1 día
-
Voice note recordings with codec parameters in mimeType get assigned incorrect file extensionAbierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 75/100
Los mantenedores suelen responder en 1 día
-
Dificultad 1/5 1-3 horas Aptitud para principiantes 72/100
TheOdinProject/curriculum#31490 ·
Los mantenedores suelen responder en 1 día
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 68/100
hotwired/turbo-rails#791 ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 85/100
FinanceFlash/unvibecode#273 ·