cockroachdb / cockroachdb/cockroach
cloud/amazon: auth fails when URI contains AWS_ENDPOINT and ASSUME_ROLE auth
- Dominant language
- Go
- Stars
- 32.5k
- Forks
- 4.1k
- PR merge metrics
- PR metrics pending
Description
To reproduce, spin up demo and watch a backup succeed with ASSUME_ROLE auth without an endpoint:
```
s3://mb-assume-role?AWS_ACCESS_KEY_ID={user that can assume the role}&AWS_SECRET_ACCESS_KEY={blah2}&ASSUME_ROLE=arn:aws:iam::{blahblah}:role/mb_backup_role
```
but then, if you specify the endpoint and region to the s3 bucket we already know that we can reach (`https://s3.us-east-2.amazonaws.com`), the command fails:
```
s3://mb-assume-role?AWS_ACCESS_KEY_ID={user that can assume the role}&AWS_SECRET_ACCESS_KEY={blah2}&ASSUME_ROLE=arn:aws:iam::{blahblah}:role/mb_backup_role&AWS_ENDPOINT=https://s3.us-east-2.amazonaws.com&AWS_REGION=us-east-2
```
with:
```
ERROR: failed to get s3 object: UnknownError: AssumeRole: operation error S3: GetObject, get identity: get credentials: failed to refresh cached credentials, operation error STS: AssumeRole, get identity: get credentials: failed to refresh cached credentials, operation error STS: AssumeRole, https response error StatusCode: 400, RequestID: 2MKDBQKQ56V2MSXM, api error UnknownError: UnknownError
```
I wonder if we need to explicitly plumb the assume role auth to the endpoint during s3 client setup via `config.WithEndpointCredentialOptions()`. I also took a stab a cleaning up config setup but this did not help. https://github.com/cockroachdb/cockroach/compare/master...msbutler:cockroach:butler-exp-s3-endpoint?expand=1
Jira issue: CRDB-56974
Contributor guide
Assessment
This issue has not been assessed yet.