如何在 aws 中使用 web 识别令牌使用 go sdk 进行身份验证

Question

I am trying to write an example of how to use a web identity token with a container to perform EC2 operations. The container spec contains the service account and has the necessary permission to access the token path and its namespace is a trusted entity in the role.

package main

import (
    "fmt"

    "github.com/aws/aws-sdk-go/aws"
    "github.com/aws/aws-sdk-go/aws/credentials"
    "github.com/aws/aws-sdk-go/aws/credentials/stscreds"
    "github.com/aws/aws-sdk-go/aws/session"
    "github.com/aws/aws-sdk-go/service/ec2"
    "github.com/aws/aws-sdk-go/service/sts"
)

func main() {

    sess, _ := session.NewSession()
    config := aws.NewConfig().WithRegion("us-east-1")

    stsSTS := sts.New(sess)
    roleARN := "arn:aws:iam::1234567:role/s2-p0o5-csi-drivers-ebs-cloud-credentials"

    roleProvider := stscreds.NewWebIdentityRoleProviderWithOptions(stsSTS, roleARN, "gosession", stscreds.FetchTokenPath("/build/token"))

    creds := credentials.NewCredentials(roleProvider)
    credValue, _ := roleProvider.Retrieve()
    fmt.Printf("credValue.AccessKeyID: %v\n", credValue.AccessKeyID)
    fmt.Printf("credValue.SecretAccessKey: %v\n", credValue.SecretAccessKey)
    fmt.Printf("credValue.SessionToken: %v\n", credValue.SessionToken)

    config = config.WithCredentials(creds)

    nodeID := "i-00843f27cfeb0beff"
    svc := ec2.New(sess, config)
    request := &ec2.DescribeInstancesInput{
        InstanceIds: []*string{&nodeID},
    }

    result, _ := svc.DescribeInstances(request)
    fmt.Printf("result: %v\n", result)
}

The value of result get empty. Whereas, i have exported (credValue.AccessKeyID, credValue.SecretAccessKey,credValue.SessionToken) as environment variables and aws cli is giving me output related to describing the instance.

I tried various methods like credentials.NewStaticCredentials() with the credential information, but no luck. Can some help share hint on what is going wrong and correct way of doing it.

Answer 1

使用的 instance-id 应该在该区域中可用，否则它将返回一个带有 err == nil 的空映射。