FlowiseAI / Flowise

Drag & drop UI to build your customized LLM flow
https://flowiseai.com
Apache License 2.0
29.23k stars 15.08k forks source link

[BUG]AWS IAM role set through IRSA is not used correctly #2782

Open IgorMilavec opened 1 month ago

IgorMilavec commented 1 month ago

Describe the bug We are using Flowise 1.8.3 on EKS (K8s on AWS). The SA is mapped to IAM role through IRSA. As a consequence, these two environment variables are added to the process: AWS_ROLE_ARN=arn:aws:iam::(accountid):role/(rolename) AWS_WEB_IDENTITY_TOKEN_FILE=/var/run/secrets/eks.amazonaws.com/serviceaccount/token If we try to use the AWS ChatBedrock without explicit AWS Credentials, we get an error "Role Arn 'arn:aws:iam::(accountid):role/(rolename)' needs to be assumed with web identity, but no role assumption callback was provided."

To Reproduce Steps to reproduce the behavior: N/A

Expected behavior The IRSA role should be used to access Bedrock and other AWS resources.

Screenshots If applicable, add screenshots to help explain your problem.

Flow If applicable, add exported flow in order to help replicating the problem.

Setup

Additional context Add any other context about the problem here.

HenryHengZJ commented 1 month ago

I think we had similar fix - https://github.com/FlowiseAI/Flowise/pull/2470 for allowing user to access Bedrock through roles.

@danieldabate, with your fix, bedrock should be able to get these env variables and use it no?

danieldabate commented 1 month ago

This is a limitation in langchainjs. There is an open discussion there that you might want to upvote 😀

https://github.com/langchain-ai/langchainjs/discussions/5661