aws / aws/aws-sdk-ruby

credentials static web identity credentials not picked up without an explicit profile option

Open
#3,241 5 comments 0 reactions 0 assignees View on GitHub
feature-request needs-major-version
Dominant language
Ruby
Stars
3.7k
Forks
1.2k
Avg merge
1d 4h
Merged PRs (30d)
5

Description

### Describe the bug

We're using STS web identity token credentials to manage AWS SDK service call authentication via SigV4 (`aws-sdk-core (3.211.0)`, should be the relevant bit). We noticed however, during load testing, some rate limiting happening, which we narrowed down to multiple calls to the STS token refresh endpoint, exacerbated by the scaling up of certain services. After some investigation, we figured out that multiple clients (for SQS, SNS, etc) were instantiated, and the token refresh path was called for each of them. This is not ideal, as there should be a single "refresh" happening, and the token should at best be shared across the multiple clients.

In the process, we found out that the AWS SDKs already support that via "shared config", and we proceeded to change our approach using it, replacing the env var setup using `AWS_WEB_IDENTITY_TOKEN_FILE` and `AWS_ROLE_ARN` with a `AWS_CONFIG_FILE` pointing to a file like this:

```
[default]
web_identity_token_file = $AWS_WEB_IDENTITY_TOKEN_FILE
role_arn = $AWS_ROLE_ARN
```

### Expected Behavior

This should have worked, as in, when instantiating clients multiple times, there should only be one call to STS. This can be observed using this script:

```ruby
Aws.config[:http_wire_trace] = true

Aws::SQS::Client.new
# one STS request log
Aws::SQS::Client.new
# no STS request log
```

### Current Behavior

when instantiating two client instances, two STS requests are made.

While we noticed that `Aws.shared_config` was correctly filled up with the expected values, unfortunately calling i.e. `Aws::SQS::Client.new` was still going through [this strategy](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-core/lib/aws-sdk-core/credential_provider_chain.rb#L30) and generating a token + refresh loop per client, because of [this clause](static_profile_assume_role_web_identity_credentials), i.e. the routine expects a profile to be set, however it's `nil` as per [the option setup](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-core/lib/aws-sdk-core/plugins/credentials_configuration.rb#L17), **although the docs say it's "default"**.

I believe this is a bug, as if "default", this would have worked. I also tried setting the `AWS_PROFILE` env var, but that doesn't fill it up either.

FWIW, setting `Aws.config[:profile] = "default"`, or explicit option set a la `Aws::SQS::Client.new(profile: "default")`, work as expected (shared config is picked up). However, I'm looking for a "no config code" setup that can be rolled out across multiple services.

### Reproduction Steps

```ruby
Aws.config[:http_wire_trace] = true

Aws::SQS::Client.new
# one STS request log
Aws::SQS::Client.new
# no STS request log
```

### Possible Solution

Perhaps initializing the profile option to whatever `AWS_PROFILE` defines?

### Additional Information/Context

_No response_

### Gem name ('aws-sdk', 'aws-sdk-resources' or service gems like 'aws-sdk-s3') and its version

aws-sdk-core 3.211.0

### Environment details (Version of Ruby, OS environment)

"ruby 3.3.0 (2023-12-25 revision 5124f9ac75) [x86_64-linux]"

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.