Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support OIDC Web Identity Token File as a means of picking up credentials #26292

Open
exussum12 opened this issue Jun 30, 2023 · 11 comments
Open
Assignees
Labels
effort/large Large work item – several weeks of effort feature-request A feature should be added or improved. p1 package/tools Related to AWS CDK Tools or CLI

Comments

@exussum12
Copy link

Describe the bug

When using OIDC as the following

aws configure set web_identity_token_file ${AWS_WEB_IDENTITY_TOKEN_FILE}

aws CLI commands work for example aws sts get-caller-identity

but CDK does not correctly pick this up from the profile and needs to be manually set as env vars to be picked up

I would have expected the CLI behaviour to match CDK

Expected Behavior

when using oidc, aws-cli works, cdk should work in the same way

Current Behavior

cdk misses the credentials and carries on down the chain

Reproduction Steps

This can be reproduced on bitbucket (or any provider with OIDC installed)

bitbucket pipeline example
oidc: true
script:
- export AWS_WEB_IDENTITY_TOKEN_FILE=$(pwd)/web-identity-token
- echo $BITBUCKET_STEP_OIDC_TOKEN > $AWS_WEB_IDENTITY_TOKEN_FILE
- chmod 400 ${AWS_WEB_IDENTITY_TOKEN_FILE}
- aws configure set web_identity_token_file ${AWS_WEB_IDENTITY_TOKEN_FILE}
- aws sts get-caller-identity
- npx run cdk deploy

Possible Solution

No response

Additional Information/Context

No response

SDK version used

2.85.0

Environment details (OS name and version, etc.)

Bitbucket

@exussum12 exussum12 added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels Jun 30, 2023
@peterwoodworth peterwoodworth transferred this issue from aws/aws-sdk-js Jul 7, 2023
@github-actions github-actions bot added the package/tools Related to AWS CDK Tools or CLI label Jul 7, 2023
@peterwoodworth
Copy link
Contributor

What error message are you receiving?

@peterwoodworth peterwoodworth added response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. p1 and removed needs-triage This issue or PR still needs to be triaged. labels Jul 7, 2023
@github-actions
Copy link

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

@github-actions github-actions bot added the closing-soon This issue will automatically close in 4 days unless further comments are made. label Jul 10, 2023
@exussum12
Copy link
Author

exussum12 commented Jul 10, 2023

@peterwoodworth As its running on bitbucket, they appear to use EC2. The error message is around not being able to get permissions for the account (expected as the EC2 would be theirs not ours). Changing the env variables to match

return Boolean(process.env.AWS_ROLE_ARN && process.env.AWS_WEB_IDENTITY_TOKEN_FILE);

Works. but this should be picked up before that point (specifically here

...iniFileCredentialFactories(implicitProfile, options.httpOptions),
)

@peterwoodworth
Copy link
Contributor

The specific error message would be helpful in knowing how / if I'm reproducing the same behavior

@peterwoodworth peterwoodworth added response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. and removed closing-soon This issue will automatically close in 4 days unless further comments are made. response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. labels Jul 10, 2023
@exussum12
Copy link
Author

 ❌ Deployment failed: Error: Need to perform AWS calls for account xxxxxx, but no credentials have been configured
    at SdkProvider.forEnvironment (/opt/atlassian/pipelines/agent/build/node_modules/aws-cdk/lib/index.js:325:46159)
    at async Deployments.cachedSdkForEnvironment (/opt/atlassian/pipelines/agent/build/node_modules/aws-cdk/lib/index.js:415:12792)
    at async Deployments.prepareSdkFor (/opt/atlassian/pipelines/agent/build/node_modules/aws-cdk/lib/index.js:415:7866)
    at async Deployments.isSingleAssetPublished (/opt/atlassian/pipelines/agent/build/node_modules/aws-cdk/lib/index.js:415:11963)
    at async /opt/atlassian/pipelines/agent/build/node_modules/aws-cdk/lib/index.js:415:139187
Need to perform AWS calls for account xxxxxx, but no credentials have been configured

With verbose

[00:28:07] Determining if we're on an EC2 instance.
[00:28:07] Looks like an EC2 instance.
[00:28:07] Toolkit stack: CDKToolkit
[00:28:07] Setting "CDK_DEFAULT_REGION" environment variable to ap-southeast-2
[00:28:07] Resolving default credentials
[00:28:07] Notices refreshed
[00:28:07] Failed to store notices in the cache: Error: ENOENT: no such file or directory, open '/root/.cdk/cache/notices.json'
[00:28:15] Unable to determine the default AWS account (TimeoutError): EC2 Metadata roleName request returned error

Both of those example above aws sts get-caller-identity returns as expected

@github-actions github-actions bot removed the response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. label Jul 11, 2023
@peterwoodworth peterwoodworth added needs-review feature-request A feature should be added or improved. effort/large Large work item – several weeks of effort and removed bug This issue is a bug. needs-review labels Jul 11, 2023
@peterwoodworth peterwoodworth changed the title Unable to easily use OIDC Support OIDC Web Identity Token File as a means of picking up credentials Jul 12, 2023
@peterwoodworth
Copy link
Contributor

We don't currently support this - We rely on the SDKs, and they take some different calls to be able to use this feature that I don't think we've set up. This is possible in both JS v2 and v3 SDKs.

@exussum12
Copy link
Author

@peterwoodworth
Copy link
Contributor

That's the same page I linked 🙂

@mpashkovskiy
Copy link

I spent several days fighting with the same issue 🤦‍♂️ .

First of the all AWS_ROLE_ARN should be defined. But that's not all! AWS_REGION, it is the lack of AWS_REGION that was the main issue for me.

That's a working snippet:

image: node:16.3.0
pipelines:
  branches:
    main:
      - step:
          name: Deployment
          oidc: true
          script:
              - export AWS_REGION=...
              - export AWS_ROLE_ARN=....
              - export AWS_WEB_IDENTITY_TOKEN_FILE=$(pwd)/web-identity-token
              - echo $BITBUCKET_STEP_OIDC_TOKEN > $AWS_WEB_IDENTITY_TOKEN_FILE
              - aws sts get-caller-identity
              - npx run cdk deploy

You don't even need chmod and aws configure lines.

@rumesh-athu
Copy link

I spent several days fighting with the same issue 🤦‍♂️ .

First of the all AWS_ROLE_ARN should be defined. But that's not all! AWS_REGION, it is the lack of AWS_REGION that was the main issue for me.

That's a working snippet:

image: node:16.3.0
pipelines:
  branches:
    main:
      - step:
          name: Deployment
          oidc: true
          script:
              - export AWS_REGION=...
              - export AWS_ROLE_ARN=....
              - export AWS_WEB_IDENTITY_TOKEN_FILE=$(pwd)/web-identity-token
              - echo $BITBUCKET_STEP_OIDC_TOKEN > $AWS_WEB_IDENTITY_TOKEN_FILE
              - aws sts get-caller-identity
              - npx run cdk deploy

You don't even need chmod and aws configure lines.

Thank you @mpashkovskiy
Export the AWS_REGION was resolved my issue as well

@TheRealAmazonKendra
Copy link
Contributor

This support will be added as soon as #31702 is merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
effort/large Large work item – several weeks of effort feature-request A feature should be added or improved. p1 package/tools Related to AWS CDK Tools or CLI
Projects
None yet
Development

No branches or pull requests

5 participants