search

tohuwabohu / puppet-duplicity

Puppet module to manage backups based on duplicity.
Apache License 2.0
8 stars 33 forks source link

S3 access key check too strict #48

Closed jochemd closed 7 years ago

jochemd commented 7 years ago

duplicity::profile attempts to check for setting of the environment variables AWS_ACCCESS_KEY_ID andAWS_SECRET_ACCESS_KEY when using an s3 backend. I have noticed 2 issues with that:

  1. I got en error on the check itself, presumably because I haven't set $duply_version but install the standard version from packages. 
    Error while evaluating a Function Call, 'versioncmp' parameter 'a' expects a String value, got Undef at /etc/puppetlabs/code/environments/development/modules/duplicity/manifests/profile.pp:180:59
  2. The check doesn't account for using key-less S3. AWS has a feature where you can assign a role to an EC2 instance and the S3 libraries then take care of all permissions for you. They connect to S3 to retrieve temporary keys that rotate every hour and use them for authentication. No environment variables necessary.

The current code is easy enough to work around, just supply some other environment variable and the check is skipped, but it is not ideal. I am unsure on how to fix it without removing the check completely, which I presume is not something you would want. Maybe an extra $check_aws_keys boolean argument?

tohuwabohu commented 7 years ago

Ah yes ... EC2 instance profiles, that has indeed slipped the radar. Looking at the situation I tend to agree that removing the check would be the best trade-off.

jochemd commented 7 years ago

Proposed patch in #50

tohuwabohu commented 7 years ago

Released as 4.8.0.