sqs-consumer icon indicating copy to clipboard operation
sqs-consumer copied to clipboard

AssumeRoleWithWebIdentity authentication does not work

Open fiatfilip opened this issue 3 years ago • 0 comments

Describe the bug If the AWS credential are missing, but the AWS_WEB_IDENTITY_TOKEN_FILE is present there seems to get an access denied error. The application is deployed with Kubernetes and the serviceAccount has a IAM role which has attached a IAM policy with all the actions assigned on a specified queue.

To Reproduce Steps to reproduce the behaviour:

  1. The service account is created like described in https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html
  2. Within the pod start the consumer
  3. AWS credential are not defined, but the AWS_WEB_IDENTITY_TOKEN_FILE env var is present
  4. The following error occurs error: uncaughtException: SQS receive message failed: Access to the resource https://sqs.eu-central-1.amazonaws.com/ is denied. SQSError: SQS receive message failed: Access to the resource https://sqs.eu-central-1.amazonaws.com/ is denied. at toSQSError (/home/[user]/[project-name]/node_modules/sqs-consumer/dist/consumer.js:45:22) at Consumer.receiveMessage (/home/[user]/[project-name]/node_modules/sqs-consumer/dist/consumer.js:155:19) at processTicksAndRejections (node:internal/process/task_queues:96:5)

Expected behaviour The authenticated call should be performed and the message should be read.

fiatfilip avatar Jan 07 '22 14:01 fiatfilip