Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

(short issue description) #2579

Closed
ghost opened this issue Nov 22, 2022 · 4 comments
Closed

(short issue description) #2579

ghost opened this issue Nov 22, 2022 · 4 comments
Labels
bug This issue is a bug. needs-triage This issue or PR still needs to be triaged.

Comments

@ghost
Copy link

ghost commented Nov 22, 2022

Describe the bug

I created IAM policy to use S3 basic operations from EC2 and it works when I'm passing credentials to S3Client constructor.
const OPTIONS = [ 'version' => 'latest', 'region' => AWS_BUCKET_REGION, 'credentials' => [ 'key' => AWS_ACCESS_KEY, 'secret' => AWS_SECRET_KEY, ], ];
Part of function:
`$images = [];
$s3Client = new S3Client(OPTIONS);

$objectsListResponse = $s3Client->listObjects(['Bucket' => AWS_BUCKET_NAME]);
$objects = $objectsListResponse['Contents'] ?? [];
foreach ($objects as $object) {
$cmd = $s3Client->getCommand('GetObject', [
'Bucket' => AWS_BUCKET_NAME,
'Key' => $object['Key']
]);
$request = $s3Client->createPresignedRequest($cmd, '+20 minutes');
$images[] = (string)$request->getUri();
}`

EC2 instance details:
PHP:
PHP 8.1.2-1ubuntu2.8 (cli) (built: Nov 2 2022 13:35:25) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.1.2, Copyright (c) Zend Technologies
with Zend OPcache v8.1.2-1ubuntu2.8, Copyright (c), by Zend Technologies

AWS SDK:
aws/aws-sdk-php: 3.33.4

UBUNTU:
Distributor ID: Ubuntu
Description: Ubuntu 22.04.1 LTS
Release: 22.04
Codename: jammy

I think I tried everything. It's worth to mention that I can use CLI and it works, for example working command: 'aws s3 ls'.

I know about chain of credentials, so I allready checked other places and I couldn't find any env variables etc.

Command 'aws sts get-caller-identity' has same output from CLI as from PHP exec(). Arn field contains ':asumed-role/my-role-name'. That's why I think it's problem with SDK, not my AWS settings etc.

When I search for the answer, I can't find anyone with exact problem. Similar problems were resolved by not passing credentials to S3Client constructor, but in my case that is causing the problem.

It's not like only S3Client throws an error. Like I said, I was trying almost everything, including following (this code no longer exists in my EC2). Please, look here: https://docs.aws.amazon.com/zh_cn/aws-sdk-php/guide/latest/guide/credentials.html - Using Assume Role Credentials. new StsClient() throws same error as S3Client.

Expected Behavior

My problem is - I don't want to keep credentials in OPTIONS or anywhere hardcoded. So I created IAM role with full S3 permisions and I removed credentials from OPTIONS constant. AFAIK based on docs, examples, etc. it should be enough to work. Of course IAM role is connected to EC2.

Current Behavior

Line '$s3Client = new S3Client(OPTIONS);' throws error (Apache2 error.log):

[Tue Nov 22 06:35:47.188027 2022] [php:error] [pid 14175] [client 10.0.1.84:36056] PHP Fatal error: Uncaught Error: Unknown named parameter $instance in /var/www/html/vendor/aws/aws-sdk-php/src/Credentials/CredentialProvider.php:74
Stack trace:
#0 /var/www/html/vendor/aws/aws-sdk-php/src/Credentials/CredentialProvider.php(74): call_user_func_array()
#1 /var/www/html/vendor/aws/aws-sdk-php/src/ClientResolver.php(263): Aws\Credentials\CredentialProvider::defaultProvider()
#2 /var/www/html/vendor/aws/aws-sdk-php/src/AwsClient.php(158): Aws\ClientResolver->resolve()
#3 /var/www/html/vendor/aws/aws-sdk-php/src/S3/S3Client.php(257): Aws\AwsClient->__construct()
#4 /var/www/html/index.php(61): Aws\S3\S3Client->__construct()
#5 /var/www/html/vendor/leocavalcante/siler/src/Route/Route.php(149): {closure}()
#6 /var/www/html/vendor/leocavalcante/siler/src/Route/Route.php(41): Siler\Route\route()
#7 /var/www/html/index.php(39): Siler\Route\get()
#8 {main} thrown in /var/www/html/vendor/aws/aws-sdk-php/src/Credentials/CredentialProvider.php on line 74

Reproduction Steps

Working:

  1. create IAM policy
  2. use keys in OPTIONS constant as credentials
  3. try some S3 basic operations like listsObjects()
    It works!
  4. Create IAM role and connect it to EC2
    Still works!
  5. Remove credentials from OPTIONS
    Bum!

Possible Solution

Tell me please.

Additional Information/Context

I'm quite experienced backend developer but I'm new with whole AWS, I'm learning AWS.

SDK version used

aws/aws-sdk-php: 3.33.4

Environment details (Version of PHP (php -v)? OS name and version, etc.)

PHP 8.1.2, Apache2, Ubuntu 22.04.1 LTS

@ghost ghost added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels Nov 22, 2022
@SamRemis
Copy link
Member

Hi @damianosmok,
There's been a large number of changes since 3.33.4 and our current version, which is 3.247.0. The version you're using is over 5 years old, from Aug 21, 2017. Could you try updating and seeing if it works?
-Sam

@ghost
Copy link
Author

ghost commented Nov 22, 2022

OMG. I'm so sorry for taking your time. Thanks a lot, you're right. I was 100% sure I had fresh version, that's why I didn't check it, but I was wrong... Now it works.

@ghost ghost closed this as completed Nov 22, 2022
@github-actions
Copy link

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

@SamRemis
Copy link
Member

Great :) glad it worked and thanks for closing the issue out; I've seen composer installing some older versions of the SDK as the most recent lately, so I'll have to look into that.

This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug This issue is a bug. needs-triage This issue or PR still needs to be triaged.
Projects
None yet
Development

No branches or pull requests

1 participant