Ensure AWS S3 envvars propagate through S3 (#103)

* if aws envvar credentials are provided, block until they've propagated through to S3 * put check in conditional * make bash happy
rapidsai · Jul 25, 2023 · 60e7b24 · 60e7b24
1 parent 7d1c506
commit 60e7b24
Show file tree

Hide file tree

Showing 2 changed files with 38 additions and 34 deletions.
diff --git a/features/src/utils/devcontainer-feature.json b/features/src/utils/devcontainer-feature.json
@@ -1,7 +1,7 @@
 {
   "name": "devcontainer-utils",
   "id": "utils",
-  "version": "23.8.10",
+  "version": "23.8.11",
   "description": "A feature to install RAPIDS devcontainer utility scripts",
   "containerEnv": {
     "BASH_ENV": "/etc/bash.bash_env"

diff --git a/features/src/utils/opt/devcontainer/bin/vault/s3/init.sh b/features/src/utils/opt/devcontainer/bin/vault/s3/init.sh
@@ -20,40 +20,44 @@ init_vault_s3_creds() {
     set -euo pipefail;
 
     if type sccache >/dev/null; then
-        if test -n "${SCCACHE_BUCKET:-}"                  \
-        && grep -qE "^$" <<< "${AWS_ACCESS_KEY_ID:-}"     \
-        && grep -qE "^$" <<< "${AWS_SECRET_ACCESS_KEY:-}" ; then
-            if test -n "${VAULT_HOST:-}"                  ; then
-                # Generate S3 creds if they don't exist (or are expired)
-                if ! devcontainer-utils-vault-s3-creds-test 2>&1 >/dev/null; then
-                    devcontainer-utils-vault-s3-creds-generate;
+        if test -n "${SCCACHE_BUCKET:-}"; then
+            if grep -qE "^$" <<< "${AWS_ACCESS_KEY_ID:-}"     \
+            && grep -qE "^$" <<< "${AWS_SECRET_ACCESS_KEY:-}" ; then
+                if test -n "${VAULT_HOST:-}"                  ; then
+                    # Generate S3 creds if they don't exist (or are expired)
+                    if ! devcontainer-utils-vault-s3-creds-test 2>&1 >/dev/null; then
+                        devcontainer-utils-vault-s3-creds-generate;
+                    fi
+                    # Persist creds in ~/.aws dir
+                    devcontainer-utils-vault-s3-creds-persist <<< "
+                        $(s3_bucket_args)
+                        $(s3_bucket_auth)
+                    ";
+                    # Install a crontab to refresh the credentials
+                    devcontainer-utils-vault-s3-creds-schedule;
+                else
+                    # If credentials have been mounted in, ensure they're used
+                    case $(devcontainer-utils-vault-s3-creds-test; echo $?) in
+                        # bucket is read + write with the current credentials
+                        [0] )
+                            devcontainer-utils-vault-s3-creds-persist <<< "
+                                $(s3_bucket_args)
+                                $(s3_bucket_auth)
+                            ";;
+                        # bucket is read-only and should be accessed without credentials
+                        [2] )
+                            devcontainer-utils-vault-s3-creds-persist <<< "
+                                --no_credentials
+                                $(s3_bucket_args)
+                            ";;
+                          # bucket is inaccessible
+                          * )
+                            devcontainer-utils-vault-s3-creds-persist <<< "--no_bucket --no_region";;
+                    esac
                 fi
-                # Persist creds in ~/.aws dir
-                devcontainer-utils-vault-s3-creds-persist <<< "
-                    $(s3_bucket_args)
-                    $(s3_bucket_auth)
-                ";
-                # Install a crontab to refresh the credentials
-                devcontainer-utils-vault-s3-creds-schedule;
-            else
-                # If credentials have been mounted in, ensure they're used
-                case $(devcontainer-utils-vault-s3-creds-test; echo $?) in
-                    # bucket is read + write with the current credentials
-                    [0] )
-                        devcontainer-utils-vault-s3-creds-persist <<< "
-                            $(s3_bucket_args)
-                            $(s3_bucket_auth)
-                        ";;
-                    # bucket is read-only and should be accessed without credentials
-                    [2] )
-                        devcontainer-utils-vault-s3-creds-persist <<< "
-                            --no_credentials
-                            $(s3_bucket_args)
-                        ";;
-                      # bucket is inaccessible
-                      * )
-                        devcontainer-utils-vault-s3-creds-persist <<< "--no_bucket --no_region";;
-                esac
+            elif devcontainer-utils-vault-s3-creds-propagate; then
+                # Block until the new temporary AWS S3 credentials propagate
+                echo -n "";
             fi
         fi
         . /etc/profile.d/*-devcontainer-utils.sh;