search

roadrunner-server / roadrunner-plugins

📦 Home for the roadrunner plugins
MIT License
25 stars 9 forks source link

[💡FEATURE REQUEST]: Add the ability for SQS plugin to fetch credentials from AWS instead of statically configured empty ones #142

Closed paulermo closed 2 years ago

paulermo commented 2 years ago

SQS plugin while connecting to AWS SQS can use only statically provided in .yaml key & secret. We have pod in AWS EKS which should connect to SQS using IRSA mapping (https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) and can not store keys in config file to authorize pod. RoadRunner overrides creds fetched automatically with empty ones from config.

AWS SDK provides the ability to fetch credentials from different places and such code is used in RR plugin in consumer.go:111: config.LoadDefaultConfig(). The options which are provided to this call config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(...)) lead to the fact that credentials fetched from AWS will be rewritten with empty ones. Same - with the region: LoadDefaultConfig can load Region for example from environment variables and empty conf.Region value rewrites it.

We suggest that RR would use static credentials from .yaml file when they are not empty. In other cases leave LoadDefaultConfig() without static creds. Same with the region.

rustatian commented 2 years ago

Hey @paulermo . Thanks for the FR. For sure, this feature is important for the use-cases like you, thus, this feature is approved.