无法从环境变量（AWS_ACCESS_KEY_ID（或 AWS_ACCESS_KEY）和 AWS_SECRET_KEY（或 AWS_SECRET_ACCESS_KEY））加载 AWS 凭证

Question

I have to make an application with Spring Boot, which accesses S3. They don't want the accessKey and secretKEy to be present anywhere in the code. For this they gave me an arn role but I don't know how to connect without the accessKey and secretKey.

Since they did not want these two parameters in the code, I decided to try putting it in my environment variables (I don't know if this will work for them). The problem comes when still having my environment variables:

(These variables have the correct value only I can't show them)

And then in my Spring Boot app I have the following constructor:

AWSSecurityTokenService stsClient = AWSSecurityTokenServiceClientBuilder.standard()
                .withCredentials(new EnvironmentVariableCredentialsProvider())
                .build();

But with all this, it returns the following error:

Caused by: com.amazonaws.SdkClientException: Unable to load AWS credentials from environment variables (AWS_ACCESS_KEY_ID (or AWS_ACCESS_KEY) and AWS_SECRET_KEY (or AWS_SECRET_ACCESS_KEY))
    at com.amazonaws.auth.EnvironmentVariableCredentialsProvider.getCredentials(EnvironmentVariableCredentialsProvider.java:50)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.getCredentialsFromContext(AmazonHttpClient.java:1213)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.runBeforeRequestHandlers(AmazonHttpClient.java:789)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:739)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:732)
    ....

My intention was to then do this with the role:

AssumeRoleRequest assumeRequest = new 
AssumeRoleRequest().withRoleArn(roleArn).withDurationSeconds(3600)
        .withRoleSessionName(sessionName);
    AssumeRoleResult roleResponse = stsClient.assumeRole(assumeRequest);

    Credentials sessionCredentials = roleResponse.getCredentials();

    BasicSessionCredentials awsCredentials = new BasicSessionCredentials(
            sessionCredentials.getAccessKeyId(),
            sessionCredentials.getSecretAccessKey(),
            sessionCredentials.getSessionToken());

Answer 1

You can assume the role by using STSAssumeRoleSessionCredentialsProvider. The below method uses assume role if provided. If not it will use the credentials from Env varaibales.

 @Value("${cloud.aws.assumeRole}")
    private String assumeRoleARN;

    @Bean
    @Primary
    public AWSCredentialsProvider awsCredentialsProvider() {
        if (StringUtils.isNotEmpty(assumeRoleARN)) {
            log.info("Assuming role {}",assumeRoleARN);
            AWSSecurityTokenService stsClient = AWSSecurityTokenServiceClientBuilder.standard()
                    .withCredentials(new ProfileCredentialsProvider("<<profile_name>>"))
                    .withRegion(US_EAST_1)
                    .build();
            return new STSAssumeRoleSessionCredentialsProvider
                    .Builder(assumeRoleARN, "LocalAssumeRoleSession")
                    .withStsClient(stsClient)
                    .build();
        }
        return DefaultAWSCredentialsProviderChain.getInstance();
    }