AWS s3 authentication

[dheeg]

If the environment variables AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY are not set, the endpoint /api/v1/admin/backups?per_page=100 throws:

Request error error=Configuration error: Failed to load AWS credentials: Neither AWS_ACCESS_KEY_ID, nor AWS_ACCESS_KEY_ID exists in the environment code="CONFIG_ERROR"

However e.g. by using instance-roles on EC2, those environment variables are not needed. The AWS SDK will automatically use temporary credentials if an instance role is present. The AWS SDK should also enable the usage of Kubernetes IAM roles for service accounts.

I think it would be great if the authentication mechanism the AWS SDK offers could be used.

[brandonrc]

Looks like the rust-s3 crate does support the ~/.aws/credentials. I was just reading in our from_env().

Let me make these changes and kick a new RC for you to test!

[brandonrc]

This has been resolved! Here's a summary of what was done:

Fix

The backend was hardcoding a check for AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY environment variables via Credentials::from_env(). This was replaced with Credentials::default() which uses the AWS SDK default credential chain, supporting:

• EC2 instance roles (IMDS)
• EKS IAM Roles for Service Accounts (IRSA)
• ECS task roles
• ~/.aws/credentials file
• Environment variables (still works as before)

PRs

• main: #106 — Fix S3 auth to use AWS default credential chain
• 1.0.x backport: #107 — Fix S3 auth to use AWS default credential chain (backport)

Tracking

• Beads issue: artifact-keeper-jhe (closed)

Both PRs are merged. The fix is available on main and backported to the release/1.0.x maintenance branch.