Aiven-Open / Aiven-Open/cloud-storage-connectors-for-apache-kafka
AWS ECS Task or (likely) EKS pod with pre-mounted IAM credentials unsupported
- Langage dominant
- Java
- Étoiles
- 58
- Forks
- 39
- Merge moyen
- 2 j 10 h
- PR mergées (30 j)
- 5
Description
AWS ECS Task or (likely) EKS pod IAM credentials provided via container env variables that allow S3 access fails.
IAM:
```
// IAM Role: arn:aws:iam::XXXX:role/XXX-ecs-instance-role
// Trust
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": [
"ec2.amazonaws.com",
"ecs-tasks.amazonaws.com"
]
},
"Action": "sts:AssumeRole"
}
]
}
// Permission
{
"Statement": [
{
"Action": [
"s3:*"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::mybucket",
"arn:aws:s3:::mybucket/*"
]
}
],
"Version": "2012-10-17"
}
```
Should this support mounted IAM/STS credentials vs having to define explicitly long-term or short-term: https://github.com/aiven/s3-connector-for-apache-kafka#credentials
ECS Task IAM Ref: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
EKS Service Account Ref: https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html
---
Current behavior requires providing either long-term or short-term combo in the configs.
Running without them yields following error:
```
// Error
org.apache.kafka.common.config.ConfigException: Either {aws.access.key.id, aws.secret.access.key} or {aws.sts.role.arn, aws.sts.role.session.name} should be set
```
Attempting to assume a role using an assumed role does not work either (and even if it did doesn't feel elegant)
```
// config sample:
{
"aws.sts.role.arn":"arn:aws:iam::XXXX:role/XXX-ecs-instance-role",
"aws.sts.role.session.name":"aiven-connect-s3"
}
// Error
com.amazonaws.services.securitytoken.model.AWSSecurityTokenServiceException: User: arn:aws:sts::XXX:assumed-role/XXX-ecs-instance-role/i-0eXXXXXXXX is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::XXX:role/XXX-ecs-instance-role (Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: <>; Proxy: null)
```
Or am I missing something? Thanks!
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.