cockroachdb / cockroachdb/cockroach

cloud/amazon: auth fails when URI contains AWS_ENDPOINT and ASSUME_ROLE auth

Open
#157,841 3 comments 0 reactions 0 assignees View on GitHub
A-disaster-recovery O-support P-3 T-disaster-recovery
Dominant language
Go
Stars
32.5k
Forks
4.1k
PR merge metrics
PR metrics pending

Description

To reproduce, spin up demo and watch a backup succeed with ASSUME_ROLE auth without an endpoint:
```
s3://mb-assume-role?AWS_ACCESS_KEY_ID={user that can assume the role}&AWS_SECRET_ACCESS_KEY={blah2}&ASSUME_ROLE=arn:aws:iam::{blahblah}:role/mb_backup_role
```

but then, if you specify the endpoint and region to the s3 bucket we already know that we can reach (`https://s3.us-east-2.amazonaws.com`), the command fails:
```
s3://mb-assume-role?AWS_ACCESS_KEY_ID={user that can assume the role}&AWS_SECRET_ACCESS_KEY={blah2}&ASSUME_ROLE=arn:aws:iam::{blahblah}:role/mb_backup_role&AWS_ENDPOINT=https://s3.us-east-2.amazonaws.com&AWS_REGION=us-east-2
```
with:
```
ERROR: failed to get s3 object: UnknownError: AssumeRole: operation error S3: GetObject, get identity: get credentials: failed to refresh cached credentials, operation error STS: AssumeRole, get identity: get credentials: failed to refresh cached credentials, operation error STS: AssumeRole, https response error StatusCode: 400, RequestID: 2MKDBQKQ56V2MSXM, api error UnknownError: UnknownError
```

I wonder if we need to explicitly plumb the assume role auth to the endpoint during s3 client setup via `config.WithEndpointCredentialOptions()`. I also took a stab a cleaning up config setup but this did not help. https://github.com/cockroachdb/cockroach/compare/master...msbutler:cockroach:butler-exp-s3-endpoint?expand=1

Jira issue: CRDB-56974

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.