aws / aws/amazon-cloudwatch-agent
CloudWatch agent should support SDK process credential provider
- Dominant language
- Go
- Stars
- 550
- Forks
- 271
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 13
Description
Currently, the agent only supports a subset of available forms of authentication provided by the AWS SDK for Go. One that's missing is [process credentials](https://docs.aws.amazon.com/sdkref/latest/guide/feature-process-credentials.html). The agent supports static credentials and assume role (temporary) credentials, but depends directly on the SDK `credentials` file, and doesn't invoke configured external processes that are set up in the SDK config. This can lead to obscure errors such as `SharedCredsLoad: failed to get profile` and `SharedCredsAccessKey: shared credentials the_role in /something/.aws/credentials did not contain aws_access_key_id`. When using process credentials, the SDK relies on the configured process to be invoked to populate the credential values in the credentials file, and the agent is not doing that, so it fails to find the profile or the credentials in the profile.
Contributor guide
Assessment
This issue has not been assessed yet.