I’m having an issue with AWS container credentials...

# http4k

[dmcg]

I’m having an issue with AWS container credentials. GetCredentialsResponse is parsing fine, but the ARN in the response is not an ARN. We’re seeing responses like

{
  "RoleArn": "AQICAH... lots of chars ...N62A==",
  "AccessKeyId": "ASIA...",
  "SecretAccessKey": "***",
  "Token": "IQo....",
  "Expiration": "2024-01-09T14:51:19Z"
}

The token appears to be valid as far as I can see, but RoleArn is failing to parse as an ARN and throwing a wobbly before the token can be used. I note that the type is declared as a String? in the response object - maybe that’s significant (@Andrew O'Hara ?)

[Andrew O'Hara]

I think that's more of a @dave question!

[dmcg]

He suggested you!

[dave]

lol

[Andrew O'Hara]

image.png

[dmcg]

More Mexican I think

[dave]

well that role arn is a encrypted base64 binary value. The docs (as far as I can see (which is this at the moment) say that value is an ARN (arn://....

[dave]

more: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html

[dave]

{
  "AccessKeyId": "ACCESS_KEY_ID",
  "Expiration": "EXPIRATION_DATE",
  "RoleArn": "TASK_ROLE_ARN",
  "SecretAccessKey": "SECRET_ACCESS_KEY",
  "Token": "SECURITY_TOKEN_STRING"
}

[dave]

from that ^

[Andrew O'Hara]

So Dave are you saying the ARN in the response seems valid to you?

[dave]

no - I'm saying that the value @dmcg is seeing is NOT what seems to be documented

[dmcg]

Yeah, the response I posted was from that curl both in and outside the container. I’m pretty convinced that it is what the endpoint is returning

[Andrew O'Hara]

Gotcha. Duncan, is that causing a runtime error? Or is it just something you've noticed?

[dave]

yep - it get's busted when attempting to create an ARN from that value

[dmcg]

Yes it’s failing because of asCredentials

data class GetCredentialsResponse(
    val Token: SessionToken,
    val AccessKeyId: AccessKeyId,
    val SecretAccessKey: SecretAccessKey,
    val Expiration: Expiration,
    val RoleArn: String?
) {
    fun asCredentials(): Credentials {
        val roleArn = when (RoleArn) {
            "NOT_SUPPLIED", null -> null
            else -> ARN.of(RoleArn)
        }
        return Credentials(Token, AccessKeyId, SecretAccessKey, Expiration, roleArn)
    }
}

[dmcg]

If I patch that out I can use Credentials with a null roleArn

[Andrew O'Hara]

So, to be clear, you're running against real AWS? I've never seen this issue before. Could there be something unique about the role you're using?

[dmcg]

IAM unique yes, but I don’t think it’s particularly special. It is in real AWS

[dmcg]

A role for CodeBuild FWIW

[dave]

@dmcg you could patch it out so that if it blows up you return the same credentials without the arn

[dave]

and then PR it 😉

[dmcg]

That’s pretty much what I have, and I’m happy to PR, but wanted to check that I’m not being a numpty before I do

[dave]

well it does seem strange, but if AWS are doing undocumented random stuff then we need to work around it somehow

[Andrew O'Hara]

Seems reasonable to me

[dmcg]

https://github.com/http4k/http4k-connect/pull/347