sqs-consumer
sqs-consumer copied to clipboard
AssumeRoleWithWebIdentity authentication does not work
Describe the bug If the AWS credential are missing, but the AWS_WEB_IDENTITY_TOKEN_FILE is present there seems to get an access denied error. The application is deployed with Kubernetes and the serviceAccount has a IAM role which has attached a IAM policy with all the actions assigned on a specified queue.
To Reproduce Steps to reproduce the behaviour:
- The service account is created like described in https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html
- Within the pod start the consumer
- AWS credential are not defined, but the AWS_WEB_IDENTITY_TOKEN_FILE env var is present
- The following error occurs
error: uncaughtException: SQS receive message failed: Access to the resource https://sqs.eu-central-1.amazonaws.com/ is denied. SQSError: SQS receive message failed: Access to the resource https://sqs.eu-central-1.amazonaws.com/ is denied. at toSQSError (/home/[user]/[project-name]/node_modules/sqs-consumer/dist/consumer.js:45:22) at Consumer.receiveMessage (/home/[user]/[project-name]/node_modules/sqs-consumer/dist/consumer.js:155:19) at processTicksAndRejections (node:internal/process/task_queues:96:5)
Expected behaviour The authenticated call should be performed and the message should be read.