Support global & regional endpoints #30
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…it tried to parse a elixir dict as set up before
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When running in AWS and we want to use IAM roles for service accounts, we can use the
ExAws.STS.AuthCache.AssumeRoleWebIdentityAdapteradapter, which relies onAWS_WEB_IDENTITY_TOKEN_FILEandAWS_ROLE_ARNto be present. These env vars are, as far as I know, are injected via the identity webhook - https://github.com/aws/amazon-eks-pod-identity-webhook#usage.There are additional settings that can also be configured here, including whether or not to use regional endpoints.
As far as I understand from the existing code, as long as ExAWS is configured with a region, then it will use a regional endpoint - defaulting to
us-east-1. However some regions do not support regional endpoints -https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html#id_credentials_region-endpoints - and it is necessary to understand when to use (or not use) the regional endpoints in favor of the global endpoint.
Containers (or any process that wants to use assume role with web identity) can be configured to have an env variable -
AWS_STS_REGIONAL_ENDPOINTS(see pod identity webhook docs) to depict whether or not to use the regional endpoints.This PR is intended to accomplish 2 items:
Please be aware that I don't have much experience with Elixir nor with ExAWS so there might be scenarios/behaviours that I'm not aware of that need to be addressed in the PR