Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FEATURE] Support EC2 Instance Authentication #35

Open
bulebuk opened this issue Feb 28, 2023 · 1 comment
Open

[FEATURE] Support EC2 Instance Authentication #35

bulebuk opened this issue Feb 28, 2023 · 1 comment
Labels
enhancement New feature or request

Comments

@bulebuk
Copy link

bulebuk commented Feb 28, 2023

I would like to use the ODBC driver on Windows EC2 instances that have an instance profile and IAM role with permissions for OpenSearch. This would eliminate the need to configure or store credentials within the EC2 instance. Unfortunately, this ODBC driver has hard coded the use of the profile credential provider when selecting IAM authentication.

The ODBC driver should switch from using Aws::Auth::ProfileConfigFileAWSCredentialsProvider to instead using Aws::Auth::DefaultAWSCredentialsProviderChain which would use EnvironmentAWSCredentialsProvider, ProfileConfigFileAWSCredentialsProvider, InstanceProfileCredentialsProvider in that order. This would provide functionality with parity to the JDBC driver and most tooling that uses the AWS SDK.

@Yury-Fridlyand
Copy link
Collaborator

Yury-Fridlyand commented May 13, 2023

I tried to do that and there are my findings so far.
This code in OpenSearchCommunication::IssueRequest

std::shared_ptr< Aws::Auth::DefaultAWSCredentialsProviderChain 
    credential_provider = Aws::MakeShared<
        Aws::Auth::DefaultAWSCredentialsProviderChain >(
        ALLOCATION_TAG.c_str());

instead of

std::shared_ptr< Aws::Auth::ProfileConfigFileAWSCredentialsProvider >
credential_provider = Aws::MakeShared<
Aws::Auth::ProfileConfigFileAWSCredentialsProvider >(
ALLOCATION_TAG.c_str(), ESODBC_PROFILE_NAME.c_str());
doesn't work, because

  1. DefaultAWSCredentialsProviderChain uses only default profile
  2. EnvironmentAWSCredentialsProvider in that chain ignores env variables set (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN) - tested on Windows

Possible fixes for 1:

  1. Make new class which inherits DefaultAWSCredentialsProviderChain and allows to define profile name as an argument
  2. Try to set profile name as an env var: ref

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants