search

HENNGE / aiodynamo

Asynchronous, fast, pythonic DynamoDB Client
https://aiodynamo.readthedocs.io/
Other
69 stars 20 forks source link

ECS Fargate Credentials Compatibility #150

Closed DustinMoriarty closed 1 year ago

DustinMoriarty commented 1 year ago

It appears that the way aiodynamo fetches credentials has fallen out of sync with the latest way that credentials are provided in ECS Fargate.

The library looks for the following environment variables. 

AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
AWS_CONTAINER_CREDENTIALS_FULL_URI

However, this is what I actually see when I print the environment inside of a container.

"ECS_CONTAINER_METADATA_URI": "http://169.254.170.2/v3/58a828415a48478ab518d476a3a52074-450364491"
"ECS_CONTAINER_METADATA_URI_V4": "http://169.254.170.2/v4/58a828415a48478ab518d476a3a52074-450364491"
"HOSTNAME": "ip-10-0-75-52.ec2.internal"
"AWS_EXECUTION_ENV": "AWS_ECS_FARGATE"
"ECS_AGENT_URI": "http://169.254.170.2/api/58a828415a48478ab518d476a3a52074-450364491"

There is no AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI. As a result, Credentials.auto() just fails outright. Given that running on ECS Fargate is probably one of the most common use cases for this library, I assume the goal is for this to work out of the box. I am currently working out exactly how to get it to work with a little customization for a work around on my side. However, any pointers regarding what people are doing now could save me some time tonight as I work out what I need to override.

ojii commented 1 year ago

Interesting, we're running this on ECS Fargate and it appears to work. Do you have an IAM role associated with your fargate task?

DustinMoriarty commented 1 year ago

@ojii : Yes. However... face palm moment ... I forgot about the difference between the taskRole and the taskExecutionRole. Long story short I was looking at some examples within our own codebase that mixed these up in a way that confused what they are for. I thought I only needed the taskExecutionRole, but I guess I was wrong. I guess the taskRole is the one running inside the container and the taskExecutionRole is the one running in the underlying EC2 instance.

Sorry for the confusion. This can be closed. I got a good look at the credentials implementation in the meantime. It is very well designed as is the rest of this package.