pipeline-aws-plugin Upgrade aws-sdk version to >=1.11.704 to support IAM roles for Kubernetes Service Account

Description

ecrLogin not logging in to ECR with IAM role assigned to the Kubernetes service account

To use this feature, the aws-sdk has to be >= 1.11.704 https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-minimum-sdk.html

Steps to Reproduce

Install Kubernetes and Pipeline-aws plugins
Create a IAM role with all the permissions required for the Jenkins slave container
Create a service account and add annotation

annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::12345678901234:role/jenkins-agents

Run the pipeline

podTemplate(
        namespace: "namespace",
        serviceAccount: "serviceAccount",
        showRawYaml: false,
        yaml: """
        apiVersion: v1
        kind: Pod
        spec:
          containers:
            - name: "default"
              image: "slaveimage:latest"
              resources:
                limits:
                  cpu: 512m
                  memory: 800Mi
                requests:
                  cpu: 512m
                  memory: 800Mi
              tty: true
              env:
                - name: AWS_DEFAULT_REGION
                  value: "eu-west-1"
                - name: DOCKER_HOST
                  value: 'tcp://localhost:2375'
            - name: "dind"
              image: "dind:latest"
              command:
                - dockerd-entrypoint.sh
              resources:
                limits:
                  cpu: 100m
                  memory: 500Mi
                requests:
                  cpu: 50m
                  memory: 500Mi
              securityContext:
                privileged: true
              env:
                - name: DOCKER_TLS_CERTDIR
                  value: ''
          securityContext:
            fsGroup: 65534
        """,

        envVars: [
            envVar(
                key: 'JENKINS_TUNNEL',
                value: "jenkins:50000"
            )
        ]
    ) {
        node(POD_LABEL) {
           stage("Not working") {
            container('default') {
               def login = ecrLogin()
                sh "${login}"
            }
           }
           stage("Working") {
              container('default') {
                sh "\$(aws ecr get-login --no-include-email --region eu-west-1)"
            }
          }
        }
    }

Expected behavior: Expected the stage "Not working" uses the IAM role arn:aws:iam::12345678901234:role/jenkins-agents for aws ecr-login

Actual behavior: But it uses the IAM role assigned to the EKS node whereas the stage "Working" uses the IAM role arn:aws:iam::12345678901234:role/jenkins-agents for aws ecr-login

Environment

Jenkins-Version: 2.204

Java-Version:

Plugin-Version: 1.41

Master/Slave Setup: Yes

Mar 26 '20 14:03 gopisaba

Waiting for this too.

Apr 23 '20 19:04 wzooff

Any updates here? We could really use this. 👀

// CC @alexey-pelykh

Jun 02 '20 04:06 johncblandii

Any chance of this PR getting merged ? Not being able to use the EKS IAM roles for ServiceAccounts is being a major blocker for us being able to use this plugin.