aws / aws/amazon-neptune-gremlin-java-sigv4
Timed out while waiting for an available host
- Dominant language
- Java
- Stars
- 28
- Forks
- 13
- PR merge metrics
- No merged PRs in 30d
Description
I cannot connect to AWS Neptune from my java-based lambda using sigv4. It is the same exception as reported in issue #25, although I'm using higher version numbers (shown at the end). I am using role based authentication (instead of user based) so I created a custom `SigV4WebSocketChannelizer` class, which I've called `AssumeRoleSigV4WebSocketChannelizer`, to get the `access_key_id` and `secred_access_key` like so:
```
protected AWSCredentialsProvider getCredentialsProvider() {
String roleArn = System.getenv(ROLE_ARN);
String roleSessionName = "neptune-load-session";
Region region = Region.US_EAST_1;
StsClient stsClient = StsClient.builder()
.region(region)
.build();
AssumeRoleRequest roleRequest = AssumeRoleRequest.builder()
.roleArn(roleArn)
.roleSessionName(roleSessionName)
.build();
AssumeRoleResponse roleResponse = stsClient.assumeRole(roleRequest);
Credentials credentials = roleResponse.credentials();
BasicSessionCredentials sessionCredentials = new BasicSessionCredentials(
credentials.accessKeyId(),
credentials.secretAccessKey(),
credentials.sessionToken()
);
return new AWSStaticCredentialsProvider(sessionCredentials);
}
```
Here is the code snippet that used `AssumeRoleSigV4WebSocketChannelizer` to build the cluster:
```
private Cluster createCluster() {
Cluster.Builder builder =
Cluster.build()
.addContactPoint(System.getenv(NEPTUNE_ENDPOINT))
.port(Integer.parseInt(System.getenv(NEPTUNE_PORT)))
.enableSsl(true)
.minConnectionPoolSize(1)
.maxConnectionPoolSize(1)
.serializer(Serializers.GRAPHBINARY_V1D0)
.reconnectInterval(Integer.parseInt(System.getenv(NEPTUNE_RECONNECT_INTERVAL))) // 2000
.channelizer(AssumeRoleSigV4WebSocketChannelizer.class);
return builder.create();
}
```
I'm then using the version of `AwsSigV4ClientHandshaker`, the version described in issue #34, that accepts an `AWSCredentialsProvider` object. My AWS Neptune cluster has IAM db authentication enabled and the role assigned to the lambda has been added to the database "Manage IAM roles" section. Additionally, the role has the correct permissions to connect to the Neptune database, as shown below:
```
{
"Effect": "Allow",
"Action": [
"neptune-db:*"
],
"Resource": [
"arn:aws:neptune-db:us-east-1::*/database"
]
}
```
Note that I've replaced my actual cluster resource id with ''. Also note that I followed the steps for [constructing my cluster resource id](https://docs.aws.amazon.com/neptune/latest/userguide/iam-auth-arn.html), which I originally formatted like `arn:aws:neptune-db:us-east-1:/*` but it was modified automatically to what is shown above.
Here are my relevant library versions in `pom.xml`:
```
com.amazonaws
aws-lambda-java-core
1.2.1
org.apache.tinkerpop
gremlin-driver
3.4.8
com.amazonaws
amazon-neptune-sigv4-signer
2.1.1
com.amazonaws
amazon-neptune-gremlin-java-sigv4
2.1.1
software.amazon.awssdk
sts
2.16.39
```
Both my lambda and my Neptune cluster are in the same VPC. I've confirmed that when I disable IAM db authentication I can query the database without issue. It is only when I enable IAM db authentication and utilize the sigv4 signing process that I run into this timeout issue. I'm not sure what's going on here but I'm pretty sure I have everything set up correctly for my lambda to query my Neptune query successfully when IAM db authentication is enabled. Any thoughts on what's going on? Thank you.
Contributor guide
Research direction
Start with issue #25 and issue #34, then inspect the custom AssumeRoleSigV4WebSocketChannelizer and the AwsSigV4ClientHandshaker version that accepts an AWSCredentialsProvider. Reproduce the timeout with the listed Gremlin, Neptune SigV4, STS, and Lambda dependency versions, comparing IAM-enabled and IAM-disabled connections. Done means identifying the cause of the available-host timeout and documenting a working role-based connection path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, java
- Domain
- authentication, cloud, databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100