aws / aws/aws-sdk-java-v2

DefaultCredentialProvider does not work with source_profile to web identity role

Open
#3,319 6 comments 0 reactions 0 assignees View on GitHub
bug p2
Dominant language
Java
Stars
2.6k
Forks
1k
Avg merge
2d 9h
Merged PRs (30d)
51

Description

### Describe the bug

For our Jenkins builds, we have AWS config where there is an "agent" profile that uses a web-identity role, and other profiles that assume their own roles based on this source - in particular one is for ECR to get authentication to push built images. When using the CLI we can get an ECR auth-token just fine. But if our Gradle script that includes the Java SDK tries to do the same thing, it errors saying the source profile (aka "agent") does not have permission to do the ECR call.

Manually specifying a `ProfileCredentialsProvider`, or building `WebIdentityTokenFileCredentialsProvider` / `StsProfileCredentialsProvider` chains work as expected.

### Expected Behavior

Generically: if the CLI works for an operation, then the equivalent Java SDK should as well.

In this particular case: The DefaultCredentialsProvider should properly resolve authentication when specifying a PROFILE with a RoleARN and SourceProfile, where the SourceProfile has RoleARN and WebIdentityTokenFile

### Current Behavior

Trying to do an operation the named/child profile is allowed to do, but the parent/source is not, fails with an error that parent/source is not allowed to do the operation

### Reproduction Steps

Note: This example will be for ECR just for concreteness.

Given a `.config` file that looks like:

```
[profile agent]
role_arn=arn:aws:iam::12345
web_identity_token_file=/var/run/secrets/identity-token

[profile ecr]
role_arn=arn:aws:iam::67890
source_profile=agent
```

And setting `AWS_PROFILE=ecr`, then the following Java code will fail:

```
private static AuthorizationData getEcrAuthToken() {
EcrClient ecrClient = EcrClient.builder().build()

try {
return ecrClient.getAuthorizationToken().authorizationData().get(0)
}
finally {
ecrClient.close()
}
}
```

...with an error like:
```
User: arn:aws:sts::12345/aws-sdk-java-0000 is not authorized to perform: ecr:GetAuthorizationToken on resource: * because no identity-based policy allows the ecr:GetAuthorizationToken action (Service: Ecr, Status Code: 400, Request ID: xxxxx)
```

### Possible Solution

As a workaround, since we know we are using profiles, building the client with:

```
builder().credentialsProvider(ProfileCredentialsProvider.builder().build())
```

makes it work.

### Additional Information/Context

_No response_

### AWS Java SDK version used

2.17.209

### JDK version used

11.0.6

### Operating System and version

openjdk:11-jdk-stretch

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.