aws / aws-msk-iam-auth

Enables developers to use AWS Identity and Access Management (IAM) to connect to their Amazon Managed Streaming for Apache Kafka (Amazon MSK) clusters.
Apache License 2.0
138 stars 65 forks source link

MSKCredentialProvider generates a bad URI if stsRegion is specified #174

Open taer opened 1 month ago

taer commented 1 month ago

This is from 2.1.0 of the java aws-msk-iam-auth module

If you configure the SASL config like this software.amazon.msk.auth.iam.IAMLoginModule required awsRoleArn="$role" awsRoleSessionName="producer" awsStsRegion="$region";

on startup, you'll get this exception

     Caused by: java.lang.NullPointerException: The URI scheme of endpointOverride must not be null.
     at software.amazon.awssdk.utils.Validate.paramNotNull(Validate.java:156)
     at software.amazon.awssdk.core.client.builder.SdkDefaultClientBuilder.endpointOverride(SdkDefaultClientBuilder.java:502)

It looks like the following code is making a URI that the SDK doesn't like

https://github.com/aws/aws-msk-iam-auth/blob/v2.1.0/src/main/java/software/amazon/msk/auth/iam/internals/MSKCredentialProvider.java#L278-L280

        public URI buildEndpointConfiguration(String stsRegion){
            return URI.create("sts." + stsRegion + ".amazonaws.com");
        }

I removed the region to the SASL arg, and it starts up.

taer commented 1 month ago

Looks like this has been semi-addressed in the tip of main

        public URI buildEndpointConfiguration(Region stsRegion) {
            StsEndpointParams params = StsEndpointParams.builder()
                .region(stsRegion)
                .build();

            try {
                return StsEndpointProvider.defaultProvider()
                    .resolveEndpoint(params)
                    .get()
                    .url();
            } catch (InterruptedException | ExecutionException e) {
                throw new RuntimeException(e);
            }
        }

That's at least not the same code.

Could this be released?

sidyag commented 1 month ago

This was fixed in https://github.com/aws/aws-msk-iam-auth/commit/d064c9a84e61e73e0d833f1f560aeee1c02814b2

We plan on releasing by the end of June.