-
Notifications
You must be signed in to change notification settings - Fork 161
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Mountpoint doesn't work with credential_process in combination with source_profile #927
Comments
Mountpoint uses the Common Runtime (CRT) as its S3 client and I suspect that does not support IAM Roles Anywhere. I'm asking internally and will post back an update when I get it. If CRT does not support it, this will become a feature request to them and later us. |
Can you try using |
The CRT supports |
Hi @arsh. Thank you for your response. Here is the contests of my
Checking the identity:
Listing the buckets:
Trying to mount S3 bucket:
I've noticed that when I remove
|
I'd like to see the logs for this last run. Can you specify a log directory with the
|
@sdauhuchytsrf, can you try setting environment variable |
@dannycjones @arsh here is the output:
|
In that log, I see the following
Can you make sure that
Also from the logs, it looks like it is falling back to IMDS, presumably due to the above failure.
|
@arsh
Edited Also tried to use absolute path |
OK. I'm going to try to reproduce this and report back any findings. |
I was able to reproduce this and I will be talking to the CRT team to understand what is happening. In the meantime, can you try using the profile which declares the |
Actually, can you try the following. Basically, not using
|
Hi @arsh. Thanks for your fast response! I applied the configuration above and get the following error while trying to do
|
Yes, I see that error when using the CLI. However, I do not see that when using Mountpoint. It is likely that Mountpoint (and CRT) isn't doing the right thing is this case (will need to check if it is actually assuming the role). Can you try the same setting using Mountpoint ? |
Unfortunately I still see the same error:
|
Can you also provide the logs of that last run? |
Here they are:
|
Thanks. In the latest log, I see you are no longer getting the
Also, it seems that now this is a legitimate access denied error. Perhaps because it is not assuming the role you intended.
As I said before, I will be bringing this up with the CRT team. |
Signed-off-by: Burak Varlı <[email protected]>
Signed-off-by: Burak Varlı <[email protected]>
* Update mountpoint-s3-crt-sys crate excludes to reduce package size Signed-off-by: Daniel Carl Jones <[email protected]> Signed-off-by: Burak Varlı <[email protected]> * Update CRT submodules to latest releases Signed-off-by: Daniel Carl Jones <[email protected]> Signed-off-by: Burak Varlı <[email protected]> * WIP: Add testing for #927 Signed-off-by: Burak Varlı <[email protected]> * Gate scoped credential test Signed-off-by: Burak Varlı <[email protected]> * Update `test_credential_process_behind_source_profile` to use role Signed-off-by: Burak Varlı <[email protected]> * Remove unused import Signed-off-by: Burak Varlı <[email protected]> * Remove TODOs from CHANGELOG Signed-off-by: Burak Varlı <[email protected]> * Update CRT submodules to latest Signed-off-by: Burak Varlı <[email protected]> * Remove feature gate from `test_credential_process_behind_source_profile` Signed-off-by: Burak Varlı <[email protected]> * Fix Clippy failures Signed-off-by: Burak Varlı <[email protected]> * More Clippy fixes Signed-off-by: Burak Varlı <[email protected]> * Fix formatting Signed-off-by: Burak Varlı <[email protected]> * Update test failure message Co-authored-by: Daniel Carl Jones <[email protected]> Signed-off-by: Burak <[email protected]> --------- Signed-off-by: Daniel Carl Jones <[email protected]> Signed-off-by: Burak Varlı <[email protected]> Signed-off-by: Burak <[email protected]> Co-authored-by: Daniel Carl Jones <[email protected]> Co-authored-by: Daniel Carl Jones <[email protected]>
Mountpoint for Amazon S3 version
mount-s3 1.7.2
AWS Region
eu-central-1
Describe the running environment
Running on non-EC2 instance which uses IAM Roles Anywhere configuration. AWS profile configuration is the following:
aws_signing_helper tool is running in
serve
mode:Exported
AWS_EC2_METADATA_SERVICE_ENDPOINT
env var:Check configuration with AWS CLI to be sure that it works:
Try to mount S3:
Mountpoint options
What happened?
Mountpoint failed to use config file to sign request.
No signing credentials
found error.Relevant log output
The text was updated successfully, but these errors were encountered: