cosmo icon indicating copy to clipboard operation
cosmo copied to clipboard

Add IAM IRSA Support for S3 Authentication in CDN Server

Open mlautur opened this issue 3 months ago • 1 comments

Component(s)

No response

Is your feature request related to a problem? Please describe.

When running the CDN server in Amazon EKS, users currently cannot leverage IAM roles for service accounts (IRSA) for S3 authentication. The server requires explicit S3 access key ID and secret access key environment variables, which forces users to either hardcode credentials or manage them separately from their Kubernetes IAM roles. This creates security and operational overhead for EKS deployments.

Describe the solution you'd like

Modify the S3 client configuration in the CDN server to support the AWS SDK's default credential provider chain when static credentials are not provided. This would allow the server to automatically use IRSA credentials when running in EKS, while maintaining backward compatibility for users who prefer to use static credentials. The changes would:

  1. Make S3 credentials optional in the configuration
  2. Only set config.credentials when both access key and secret are explicitly provided
  3. Fall back to the AWS SDK's default credential provider chain (which includes IRSA support) when credentials are not set
  4. Maintain support for region configuration through environment variables or URL parameters

Describe alternatives you've considered

No response

Additional context

No response

mlautur avatar Aug 20 '25 22:08 mlautur