Repository navigation
role_arn cannot be parsed from config #1288
Description
Describe the bug
aws default credential chain is able to parse role_arn from config file with following versions:
aws-config = { version = "=1.5.18", default-features = false, features = ["rustls","rt-tokio"] }
aws-credential-types = {version = "=1.2.1", default-features = false}But I start to get below error on CI tests on MinIO when I update to the latest versions aws-config = 1.6.2 and aws-credential-types = 1.2.3.
ERROR: failed to load aws credentials: ProviderError(ProviderError { source: Unhandled(Unhandled { source: "ARN must have 6 components delimited by `:`" }) })It seems role_arn is somehow not parsed properly.
Regression Issue
- Select this option if this issue appears to be a regression.
Expected Behavior
aws default credential chain is able to parse role_arn from config file with following versions:
aws-config = { version = "=1.5.18", default-features = false, features = ["rustls","rt-tokio"] }
aws-credential-types = {version = "=1.2.1", default-features = false}Current Behavior
But I start to get below error on CI tests on MinIO when I update to the latest versions aws-config = 1.6.2 and aws-credential-types = 1.2.3.
ERROR: failed to load aws credentials: ProviderError(ProviderError { source: Unhandled(Unhandled { source: "ARN must have 6 components delimited by `:`" }) })Reproduction Steps
Below are the code, config file and env vars that I use:
let sdk_config = PG_BACKEND_TOKIO_RUNTIME
.block_on(async { aws_config::defaults(BehaviorVersion::latest()).load().await });
let mut access_key_id = None;
let mut secret_access_key = None;
let mut session_token = None;
let mut expire_at = None;
if let Some(credential_provider) = sdk_config.credentials_provider() {
let cred_res = PG_BACKEND_TOKIO_RUNTIME
.block_on(async { credential_provider.provide_credentials().await });
if let Ok(credentials) = cred_res {
access_key_id = Some(credentials.access_key_id().to_string());
secret_access_key = Some(credentials.secret_access_key().to_string());
session_token = credentials.session_token().map(|t| t.to_string());
expire_at = credentials.expiry();
} else {
pgrx::error!(
"failed to load aws credentials: {:?}",
cred_res.unwrap_err()
);
}
}[profile dummy-source]
aws_access_key_id=admin
aws_secret_access_key=admin123
[profile dummy]
region=us-east-1
source_profile=dummy-source
role_arn=arn:aws:iam::128716708097:role/cli-role
endpoint_url=http://localhost:9000% printenv | grep AWS
AWS_ALLOW_HTTP=true
AWS_PROFILE=dummy
AWS_CONFIG_FILE= ..../dummy.cfgPossible Solution
No response
Additional Information/Context
No response
Version
`aws-config = 1.6.2` and `aws-credential-types = 1.2.3`
Environment details (OS name and version, etc.)
24.4.0 Darwin Kernel aarm64
Logs
No response
Activity
aajtodd commentedon May 5, 2025
Thanks for the report, could be related to the recently released account ID support (here). Working on reproducing
aajtodd commentedon May 5, 2025
I was able to reproduce this against minio but not actual AWS services.
Indeed it's related to the new account ID arn parsing that expects the output has a role arn in the response.
Minio does not faithfully model the API response and instead returns something like this:
This is indeed a regression against minio but not AWS itself.
Update rustup and deps (#141)