failed to load region from IMDS

[vbmade2000]

I am running a following code.

pub async fn get_new_s3_client(cfg: &Config) -> aws_sdk_s3::Client {

   let testing = false;
    let credentials_provider = DefaultCredentialsChain::builder()
        .profile_name(&s3_profile)
        .build()
        .await;

    let retry_config = aws_sdk_s3::config::retry::RetryConfig::standard()
        .with_max_attempts(3)
        .with_initial_backoff(Duration::from_secs(10));

    // It always successfully receives region from cfg.s3_region.0.
    let region_provider = RegionProviderChain::first_try(cfg.s3_region.0.clone()).or_default_provider();

   let sdk_config = aws_config::from_env().region(region_provider).load().await;

   let mut s3_config_builder = aws_sdk_s3::config::Builder::from(&sdk_config).credentials_provider(credentials_provider);

   s3_config_builder.set_retry_config(Some(retry_config));

   if testing {
        s3_config_builder = s3_config_builder.endpoint_url("http://0.0.0.0:9000");
    }
   aws_sdk_s3::Client::from_conf(s3_config_builder.build())

}

Above code works successfully but it throws following warning.
Sep 04 06:18:04.164 WARN failed to load region from IMDS err=failed to load IMDS session token: dispatch failure: timeout: error trying to connect: HTTP connect timeout occurred after 1s: HTTP connect timeout occurred after 1s: timed out (FailedToLoadToken(FailedToLoadToken { source: DispatchFailure(DispatchFailure { source: ConnectorError { kind: Timeout, source: hyper::Error(Connect, HttpTimeoutError { kind: "HTTP connect", duration: 1s }) } }) }))

I don't understand why it tries to load region from IMDS while it is already receiving region from cfg.s3_region.0.

While testing with real AWS, it works fine but while testing with Minio, it breaks with above error. I thought that it is going into default_provider part and so it tries to load region from IMDS but it successfully receives region from cfg.s3_region.0 so it should not go further.

Kindly help me resolve this issue.

[jdisanti]

I think you also need to give the region to the DefaultCredentialsChain builder: https://docs.rs/aws-config/0.56.1/aws_config/default_provider/credentials/struct.Builder.html#method.region

Also, is the cfg.s3_region.0 value actually populated when you encounter this warning? It looks like you have it set up to fall back to the default region resolution chain if it's not.

[vbmade2000]

Thanks for reply.

Also, is the cfg.s3_region.0 value actually populated when you encounter this warning? It looks like you have it set up to fall back to the default region resolution chain if it's not.

Yes it is. I had a same doubt so double checked it.

I think you also need to give the region to the DefaultCredentialsChain builder: https://docs.rs/aws-config/0.56.1/aws_config/default_provider/credentials/struct.Builder.html#method.region

Let me try that.

[rcoh]

BTW, I don't think you need to customize the credential chain, at least in the case you highlighted above. If you solely want to set the profile name, you can do that at the top level—aws_config::from_env().profile_name(...)

[vbmade2000]

@rcoh Thanks for reply.

Apology for late reply.
I need to fetch Creds first from env vars and if not available then profile so I modified code to use following.

+    let credentials_provider = CredentialsProviderChain::first_try(
+        "Environment",
+        EnvironmentVariableCredentialsProvider::new(),
+    )
+    .or_else(
+        "Profile",
+        ProfileFileCredentialsProvider::builder()
+            .profile_name(&cfg.s3_profile)
+            .build(),
+    );

Does it look good?

[rcoh]

this is what will happen automatically already because of the behavior of the default credential chain. You should not need to override the default chain at all, just set .profile_name on the ConfigLoader returned from aws_config::from_env