awslabs / awslabs/amazon-kinesis-client-nodejs
KCL consumer on kubernetes does not pick up IAM role via serviceAccount.
- Dominant language
- JavaScript
- Stars
- 304
- Forks
- 198
- Avg merge
- 36m
- Merged PRs (30d)
- 2
Description
Deploying KCL consumer via kubernetes on aws EKS service does not pick up IAM role from serviceAccount with AWSCredentialsProvider = `DefaultAWSCredentialsProviderChain`, instead it uses node level role.
Following environment variables are present in the service, however it still doesn't seem to pick it up. However it works when I provide `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.
```
AWS_DEFAULT_REGION=
AWS_REGION=
AWS_ROLE_ARN=
AWS_WEB_IDENTITY_TOKEN_FILE=
```
Contributor guide
Research direction
Start by reproducing the KCL consumer on AWS EKS with a Kubernetes service account and the listed environment variables, then inspect how DefaultAWSCredentialsProviderChain selects credentials. Done means the consumer uses the service-account IAM role rather than the node-level role without explicit access keys.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, javascript, kubernetes
- Domain
- authentication, backend, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100