8000 feat: [CI-16855]: Fix S3 authentication to properly handle combined credential methods and role assumption by Ompragash · Pull Request #195 · drone-plugins/drone-s3 · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

feat: [CI-16855]: Fix S3 authentication to properly handle combined credential methods and role assumption #195

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Apr 10, 2025
Merged

feat: [CI-16855]: Fix S3 authentication to properly handle combined credential methods and role assumption #195

merged 2 commits into from
Apr 10, 2025

Conversation

Ompragash
Copy link
Member
@Ompragash Ompragash commented Apr 7, 2025 •
edited
Loading

Summary

The current implementation of the S3 client creation doesn't correctly handle scenarios where both primary credentials (access/secret keys, web identity, or initial role assumption) and secondary role assumption (via UserRoleArn) are used together. This causes authentication failures when users need to authenticate with one method and then assume a different role for S3 operations.

Solution

Refactor createS3Client method to properly chain authentication methods:

  1. First establish primary credentials (static credentials, web identity tokens, or initial role assumption)
  2. Create an authenticated session with those credentials
  3. If UserRoleArn is provided, use that authenticated session to assume the secondary role
  4. Preserve all configuration options (endpoint, path style, region, etc.) when creating the final client

Verification

The solution has been verified to work across all target environments:

IRSA Environment: Successful execution
Regular Kubernetes: Successful execution
Cloud Build: Successful execution

@Ompragash Ompragash marked this pull request as ready for review April 9, 2025 19:34
@Ompragash Ompragash requested a review from jamie-harness April 9, 2025 19:38
@Ompragash Ompragash merged commit 6655f98 into master Apr 10, 2025
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jamie-harness jamie-harness jamie-harness approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@Ompragash @jamie-harness
0