Open bulebuk opened 1 year ago
I tried to do that and there are my findings so far.
This code in OpenSearchCommunication::IssueRequest
std::shared_ptr< Aws::Auth::DefaultAWSCredentialsProviderChain
credential_provider = Aws::MakeShared<
Aws::Auth::DefaultAWSCredentialsProviderChain >(
ALLOCATION_TAG.c_str());
instead of https://github.com/opensearch-project/sql-odbc/blob/85678a0ace4aa5bc97074425b1d67c3748aa51c6/src/sqlodbc/opensearch_communication.cpp#L431-L434 doesn't work, because
DefaultAWSCredentialsProviderChain
uses only default profileEnvironmentAWSCredentialsProvider
in that chain ignores env variables set (AWS_ACCESS_KEY_ID
and AWS_SECRET_ACCESS_KEY
and AWS_SESSION_TOKEN
) - tested on WindowsPossible fixes for 1:
DefaultAWSCredentialsProviderChain
and allows to define profile name as an argument
I would like to use the ODBC driver on Windows EC2 instances that have an instance profile and IAM role with permissions for OpenSearch. This would eliminate the need to configure or store credentials within the EC2 instance. Unfortunately, this ODBC driver has hard coded the use of the profile credential provider when selecting IAM authentication.
The ODBC driver should switch from using
Aws::Auth::ProfileConfigFileAWSCredentialsProvider
to instead usingAws::Auth::DefaultAWSCredentialsProviderChain
which would use EnvironmentAWSCredentialsProvider, ProfileConfigFileAWSCredentialsProvider, InstanceProfileCredentialsProvider in that order. This would provide functionality with parity to the JDBC driver and most tooling that uses the AWS SDK.