gradle-s3-build-cache
gradle-s3-build-cache copied to clipboard
myniva
AWS STS dependency is required to allow WebToken / Kubernetes AWS IRSA support
Solved my problem from #34, the problem was that even though the gradle job should have access to S3 to GET/PUT etc, it was being denied because it couldn't use its AWS WebToken effectively, only because the STS jar wasn't on the classpath.
So if you add it as a dependency it will work:
classpath 'com.amazonaws:aws-java-sdk-sts:1.11.751'
Warning is:
Unable to load credentials from WebIdentityTokenCredentialsProvider: To use assume role profiles the aws-java-sdk-sts module must be on the class path.
IRSA is a growing pattern with AWS Kubernetes deployments where it uses an OIDC flow to authenticate:
https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/
@nhoughto
Could you please clarify where did you add classpath 'com.amazonaws:aws-java-sdk-sts:1.11.751' to (which file/section)?
In my local gradle file, if you added it to the build.gradle of this project it would save other users of the plugin from the same trap
happy to PR if welcome, my other PR been open for a while so not sure if PRs are going to be accepted for not.