rust-s3
rust-s3 copied to clipboard
durch
aws-creds's `Credentials` initilaized with `from_instance_metadata` are broken after 6 hours.
Describe the bug
aws-creds's Credentials initilaized with from_instance_metadata are broken after 6 hours, because they expire, as explained here:
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
To Reproduce
Initialize Credentials with from_instance_metadata. Wait 6 hours. Attempt an action that requires these credentials to be valid.
Expected behavior still works
Environment
- Rust version: latest stable (
1.49) - lib version: aws-creds
0.26.0
Solving
Credentials should probably be an structure containing either:
- constant credentials
- that they should be fetched from the instance, that the current are these, and that they expire at
Expiration. (Expirationis one of the keys returned by the call to169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI).
In the second case, they should be automatically re-fetched whenever they expire.
@Ten0 another great catch, I'll look into automatically refreshing these, that is the expected behavior for sure.
@Ten0 sorry for going AWOL on this, work/life asserted themselves, will try and pick it up next week
No worries, thanks for your dedication :)
In the meantime I've got a disgusting workaround rebuilding the Bucket every 6 hours.
Question, does this mean accessing buckets after 6 hours will not work and you will need to re-create and populate the bucket every 6 hours?
Question, does this mean accessing buckets after 6 hours will not work and you will need to re-create and populate the bucket every 6 hours?
Not "bucket" in the sense of "AWS bucket", but Bucket in the sense aws_s3::Bucket. The struct has to be rebuilt, because the credentials stored inside become invalid after 6 hours so it just stops working.
So we're actually having issues with this because in fact credentials duration isn't always 6 hours, it's sometimes less (and specified by the Expiration key). So it would be great to have a fix for this, that relies on the Expiration key, or at least to have access to the expiration on the credentials.
I have https://github.com/Ten0/rust-s3/tree/FIX-AllowAccessToCredentialsExpiration for that and would open a PR, but it's based on #200 which is still not merged.