credentials static web identity credentials not picked up without an explicit profile option
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 48/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 停滞
- 技术栈
- aws, ruby
- 领域
- authentication, cloud
调研方向
从 gems/aws-sdk-core/lib/aws-sdk-core/credential_provider_chain.rb 和 gems/aws-sdk-core/lib/aws-sdk-core/plugins/credentials_configuration.rb 开始，然后检查 reproduction 中描述的共享配置行为。使用带有 web identity 配置的两个 Aws::SQS::Client.new 调用来验证当前的 STS 请求。当不指定显式 profile 时使用默认共享配置，并且重复创建的客户端不会分别单独刷新时，即表示完成。
由索引模型根据 Issue 内容生成。
描述
Describe the bug
We're using STS web identity token credentials to manage AWS SDK service call authentication via SigV4 (aws-sdk-core (3.211.0), should be the relevant bit). We noticed however, during load testing, some rate limiting happening, which we narrowed down to multiple calls to the STS token refresh endpoint, exacerbated by the scaling up of certain services. After some investigation, we figured out that multiple clients (for SQS, SNS, etc) were instantiated, and the token refresh path was called for each of them. This is not ideal, as there should be a single "refresh" happening, and the token should at best be shared across the multiple clients.
In the process, we found out that the AWS SDKs already support that via "shared config", and we proceeded to change our approach using it, replacing the env var setup using AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN with a AWS_CONFIG_FILE pointing to a file like this:
[default]
web_identity_token_file = $AWS_WEB_IDENTITY_TOKEN_FILE
role_arn = $AWS_ROLE_ARN
Expected Behavior
This should have worked, as in, when instantiating clients multiple times, there should only be one call to STS. This can be observed using this script:
Aws.config[:http_wire_trace] = true
Aws::SQS::Client.new
# one STS request log
Aws::SQS::Client.new
# no STS request log
Current Behavior
when instantiating two client instances, two STS requests are made.
While we noticed that Aws.shared_config was correctly filled up with the expected values, unfortunately calling i.e. Aws::SQS::Client.new was still going through this strategy and generating a token + refresh loop per client, because of this clause, i.e. the routine expects a profile to be set, however it's nil as per the option setup, although the docs say it's "default".
I believe this is a bug, as if "default", this would have worked. I also tried setting the AWS_PROFILE env var, but that doesn't fill it up either.
FWIW, setting Aws.config[:profile] = "default", or explicit option set a la Aws::SQS::Client.new(profile: "default"), work as expected (shared config is picked up). However, I'm looking for a "no config code" setup that can be rolled out across multiple services.
Reproduction Steps
Aws.config[:http_wire_trace] = true
Aws::SQS::Client.new
# one STS request log
Aws::SQS::Client.new
# no STS request log
Possible Solution
Perhaps initializing the profile option to whatever AWS_PROFILE defines?
Additional Information/Context
No response
Gem name ('aws-sdk', 'aws-sdk-resources' or service gems like 'aws-sdk-s3') and its version
aws-sdk-core 3.211.0
Environment details (Version of Ruby, OS environment)
"ruby 3.3.0 (2023-12-25 revision 5124f9ac75) [x86_64-linux]"
- 主要语言
- Ruby
- 星标
- 3.7k
- 派生
- 1.2k
- 平均合并
- 1 天 16 小时
- 30 天内合并 PR
- 25
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
aws/aws-sdk-ruby 的其他 Issue
-
service-api
难度 2/5 1-3 小时 新手友好度 68/100
aws/aws-sdk-ruby#3395 · 1 条评论 ·
维护者通常 1 天内回复
-
BedrockAgentCore: invoke_agent_runtime buffers entire response instead of streaming in real-time未关闭documentation p3 queued
难度 4/5 3-5 天 新手友好度 48/100
aws/aws-sdk-ruby#3348 · 6 条评论 · 1 个 reaction ·
维护者通常 1 天内回复
-
investigating service-api
难度 4/5 3-5 天 新手友好度 35/100
aws/aws-sdk-ruby#3217 · 4 条评论 ·
维护者通常 1 天内回复
-
service-api
难度 5/5 一周以上 新手友好度 25/100
aws/aws-sdk-ruby#3191 · 1 条评论 ·
维护者通常 1 天内回复
-
feature-request
难度 3/5 1-2 天 新手友好度 35/100
aws/aws-sdk-ruby#3190 · 3 条评论 ·
维护者通常 1 天内回复
相似的 Issue
-
难度 1/5 1 小时以内 新手友好度 84/100
-
难度 2/5 1-3 小时 新手友好度 65/100
-
难度 2/5 1-3 小时 新手友好度 67/100
-
难度 1/5 1 小时以内 新手友好度 88/100
TheOdinProject/curriculum#31487 · 2 条评论 ·
维护者通常 1 天内回复
-
Bug: Assistant replies lose the space before numbers ("Oct7", "as of10-22-2026") with OpenAI models未关闭
难度 2/5 1-3 小时 新手友好度 84/100
we-promise/sure#4441 ·
维护者通常 1 天内回复