aws / aws/aws-toolkit-azure-devops

s3 upload and role to assume?

Open
#396 3 comments 0 reactions 0 assignees View on GitHub
investigating
Dominant language
TypeScript
Stars
258
Forks
114
PR merge metrics
No merged PRs in 30d

Description

####Task Permissions
This task requires permissions to call the following AWS service APIs (depending on selected task options, not all APIs may be used):
* s3:CreateBucket
* s3:HeadBucket

Content uploads are performed using S3's PutObject API and/or the multi-part upload APIs. The specific APIs used depend on the size of the individual files being uploaded.
2021-03-05T21:05:31.7167617Z ==============================================================================
2021-03-05T21:05:32.2450994Z Configuring credentials for task
2021-03-05T21:05:32.2451608Z ...configuring AWS credentials from service endpoint 'xxxxxxxxxxxxxxxxxxxxxx'
2021-03-05T21:05:32.2451962Z ...endpoint defines role-based credentials for role ***.
2021-03-05T21:05:32.2452332Z Configuring region for task
2021-03-05T21:05:32.2452695Z ...configured to use region us-east-1, defined in task.
2021-03-05T21:05:32.2452892Z Configuring region for task
2021-03-05T21:05:32.2453262Z ...configured to use region us-east-1, defined in task.
2021-03-05T21:06:56.7196637Z ##[error]Error: Bucket xxx123 does not exist or you do not have access. Auto-create option not set, cannot continue.

So in service connection I've defined:
Access Key
Secret Key
Role to assume
Role Session Name

But I feel like I'm not really assuming the role and therefore not being granted access.
Is there a simpler way to test if assume role in extensions is actually working?
Am I missing something here?

Thanks for any help provided

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the Azure DevOps AWS upload task with the service connection settings and compare its credential and region logs with the bucket-access error. Done means determining whether the configured role is assumed and whether the resulting credentials can access the named bucket and upload content.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
authorization, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.