Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AWS STS dependency is required to allow WebToken / Kubernetes AWS IRSA support #35

Open
nhoughto opened this issue Jul 3, 2020 · 3 comments

Comments

@nhoughto
Copy link

nhoughto commented Jul 3, 2020

Solved my problem from #34, the problem was that even though the gradle job should have access to S3 to GET/PUT etc, it was being denied because it couldn't use its AWS WebToken effectively, only because the STS jar wasn't on the classpath.

So if you add it as a dependency it will work:

classpath 'com.amazonaws:aws-java-sdk-sts:1.11.751'

Warning is:
Unable to load credentials from WebIdentityTokenCredentialsProvider: To use assume role profiles the aws-java-sdk-sts module must be on the class path.

IRSA is a growing pattern with AWS Kubernetes deployments where it uses an OIDC flow to authenticate:

https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/

@artem-emelin
Copy link

artem-emelin commented May 19, 2021

@nhoughto
Could you please clarify where did you add classpath 'com.amazonaws:aws-java-sdk-sts:1.11.751' to (which file/section)?

@nhoughto
Copy link
Author

In my local gradle file, if you added it to the build.gradle of this project it would save other users of the plugin from the same trap

@nhoughto
Copy link
Author

happy to PR if welcome, my other PR been open for a while so not sure if PRs are going to be accepted for not.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants