awslabs / awslabs/amazon-kinesis-client-nodejs

KCL consumer on kubernetes does not pick up IAM role via serviceAccount.

Open
#79 1 comment 8 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
304
Forks
198
Avg merge
36m
Merged PRs (30d)
2

Description

Deploying KCL consumer via kubernetes on aws EKS service does not pick up IAM role from serviceAccount with AWSCredentialsProvider = `DefaultAWSCredentialsProviderChain`, instead it uses node level role.

Following environment variables are present in the service, however it still doesn't seem to pick it up. However it works when I provide `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.

```
AWS_DEFAULT_REGION=
AWS_REGION=
AWS_ROLE_ARN=
AWS_WEB_IDENTITY_TOKEN_FILE=
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the KCL consumer on AWS EKS with a Kubernetes service account and the listed environment variables, then inspect how DefaultAWSCredentialsProviderChain selects credentials. Done means the consumer uses the service-account IAM role rather than the node-level role without explicit access keys.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, javascript, kubernetes
Domain
authentication, backend, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.