AWS Role to be assumed not being read from configuration file.

[jwalters-gpsw]

Versions

Version: v1.3.2
AWS Plugin Version: 1.0.1
AWS EKS Version: 1.15

Description

Though my config file has role_arn and source_profile entries, it does not appear the role is being assumed.

Details

$ velero install --provider aws --plugins velero/velero-plugin-for-aws:v1.0.1 --bucket backup-velero --secret-file ./config

time="2020-04-07T23:01:43Z" level=info msg="Checking that all backup storage locations are valid" logSource="pkg/cmd/server/server.go:413"
An error occurred: some backup storage locations are invalid: backup store for location "default" is invalid: rpc error: code = Unknown desc = AccessDenied: Access Denied

./config

[default]
region = us-west-2
role_arn=arn:aws:iam::99999999999:role/IAM_CARole_XXX
source_profile=eks

[profile eks]
aws_access_key_id = AKIAXXXXXXXX
aws_secret_access_key = mfrXXXXXXXXXXXXXXXX

Additional Information

I ran up another pod in the same cluster using the mesosphere/aws-cli:latest docker image. Then execed into the image and copied the same config (pointed to with AWS_CONFIG_FILE environment variable ). All the aws s3 commands worked fine on the bucket.

I suspect the stscreds.NewCredentials call needs to be used as described in Assume Role section here.

[jwalters-gpsw]

I'm guessing something like what is being done in aws-okta needs to be done.
https://github.com/segmentio/aws-okta/blob/2840c02437b9069bede10682de2298cef7aa30f1/lib/provider.go#L303

I'll see if I can get a pull request together.

[carlisia]

Hey @jwalters-gpsw, would you still like to take a stab at this?

[luisdavim]

I've opened a PR on the AWS plugin to solve this: vmware-tanzu/velero-plugin-for-aws#168

[danfengliu]

I'm facing AccessDenied issue with merged PR #6598, @reasonerjt will submit a PR to fix it.

time="2023-08-17T08:37:32Z" level=error msg="Error listing backups in backup store" backupLocation=velero/default controller=backup-sync error="rpc error: code = Unknown desc = AccessDenied: Access Denied\n\tstatus code: 403, request id: xx, host id: xxxx=" error.file="/go/src/velero-plugin-for-aws/velero-plugin-for-aws/object_store.go:436" error.function="main.(*ObjectStore).ListCommonPrefixes" logSource="pkg/controller/backup_sync_controller.go:107"

[reasonerjt]

Seems this is b/c when velero is installed via CLI the credential file is set via environment variable.
This PR should fix the problem:
vmware-tanzu/velero-plugin-for-aws#171

[reasonerjt]

Closing this issue as fixed.