-
Notifications
You must be signed in to change notification settings - Fork 54
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
NoCredentialProviders: no valid providers in chain exception #35
Comments
Hi @yury-sannikov - Are you still having this issue? I'm so far unable to reproduce this but am still working on it. |
@yury-sannikov I noticed two things in your compose file:
Edit: I have been told that the "ro" is for read only. Derp. |
Hey! @yury-sannikov Do you still have the issue? |
I have the same issue, my configuration is similar to what @yury-sannikov, My ec2-local-instance is loging something like this: If I go inside the container, I can list all files inside /home/.aws I didn't have a chance to test outside the proxy to see if it is related. |
My team is experiencing the same issue with AWS SSO, only the local-container-endpoints process cannot parse the profile correctly with the Currently, I am attempting to update the compiled AWS SDK version with the binary here but am not successful at resolving the issue (even with a fully update SDK, and the same behavior remains) |
After recompiling with Debug logging enabled, we never get past this point in the temp credential processing. I'll be digging deeper to understand how the internal session is being configured as it appears the failure is within this internal handling. |
UPDATE: In my case it seems this might have been a transient issue. After reboot it seemed to work (I thought that only happened to macOS & Windows !?!?). I'll update here again if this is not the case. Am on ArchLinux with everything up-to-date, though there were no udpates to any of the tooling involved in this. Similar issue here. I have the following in the docker-compose:
When I try to curl that endpoint from within the
If I take out the
Other possibly relevant state of the
|
UPDATE: I wasn't curling with the /creds. Removing the "/v3" from the metadata URI and adding the relative URI (/creds or /role/role_name) did the trick for me. Seeing the same issue here. When I curl http://169.254.170.2/v3 from the ecs-container-endpoints container though, I get |
@jskrt This was happening for me with Docker Desktop for Mac version 3.x. Downgraded to 2.3.0.4 and curl http://169.254.170.2/v3 works |
I am getting the same issue HTTP 500 - NoCredentialProviders: no valid providers in chain\ncaused by: EnvAccessKeyNotFound: failed to find credentials in the environment.\nSharedCredsLoad: failed to load profile, spm-dev.\nEC2RoleRequestError: no EC2 instance role found\ncaused by: RequestError: send request failed\ncaused by: Get http://169.254.169.254/latest/meta-data/iam/security-credentials/: dial tcp 169.254.169.254:80: connect: connection refused, with AWS SSO can't work out why |
Found the problem now. This flat does not work with SSO. It only works when I copy the credentials including the session token into the credentials file. Will raise new ticket |
Hi guys, sorry, missed the whole convo. I ended up using the env file and this works for the team. Didn't dig further. |
I am struggling with this exact same error as described in this issue. I would really like to get a response from AWS on this. I am using the example compose file that could not be more simple
Yet when I do anything to utilize AWS services from within that container—such as using the ruby aws-sdk-s3 gem— I get:
and trying to curl the endpoint I receive:
I have attached to the ecs container and double checked that my credentials are mounted in I have tried the V3 endpoint setup, V4 endpoint setup, and even the V2 endpoint setup and all of it results in the same behavior. Please help. |
@AHaymond Can you please add more info. Give us your entire compose file (I don't see the local endpoints container in what you posted).
Which container is this? |
I am utilizing
I am using Docker Desktop for Mac OS 3.1.0 <<< could this be causing an issue? Is it a problem with the VM that Docker Desktop uses? |
I'm using 3.1.0 on Mac OS... so I don't think that's it... Hmmmm.
So this is the issue.. Is your profile named default? If not you need to specify |
Yes it is default. I just tested it on Arch Linux with the same exact setup and had no issues retrieving credentials. |
Interesting... how about trying to set |
set the absolute path and got the same error
|
So local container endpoints works for me, and as you noted, it works on Arch Linux. I don't think there's a bug in the container. There's likely something with your setup on Mac that isn't working. I'm sorry but you'll probably have to figure that out yourself- the above are the only ideas I can think of to try. |
The solution for me was to clone the repo up the version of aws-sdk-go to the latest version, go mod vendor and recompile works perfectly now with SSO. May be this will fix your issue too. |
What I don't quite understand is why this container calls out to the EC2 Instance Metadata Service. That can't really work unless you run it in EC2, or mock that endpoint too.
|
I ran into this today as well. I manged to figure out my issue, hopefully this helps someone. For me it was a misunderstanding of how this container uses credentials from
You can get those values from the sso web portal by clicking the "Command line or programmatic access". Keep in mind you need the |
I like @davidsteed's solution above... seems like the most robust BUT I don't understand why the latest version of the go sdk isn't already incorporated into the container.
Can anyone maintaining this repo answer that please? Another wtg for compatibility with Identity Center/AWS SSO is to parse one of the JSON files under |
This looks promising but not sure how to implement: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html |
@robotparty the goal of this project is to locally simulate task IAM roles. |
looks like the code is updated: https://github.com/awslabs/amazon-ecs-local-container-endpoints/commits/mainline @Lou1415926 Can we get a new release of this package? EDIT: Sorry I see its on Docker Hub: https://hub.docker.com/r/amazon/amazon-ecs-local-container-endpoints/tags Just no release notes. @robotparty can you try out the latest image on docker hub and see if it works for SSO? |
Hi there, can someone please help me understand what I'm doing wrong.
I'm following the docs to make local env setup working.
Here is my override file
I've logged in through SSO and have STS issued credentials.
With this set up I'm making the following request:
As a result, I'm getting the following response:
ecs local container logs has this line:
However, if I uncomment
and rerun docker-compose, everything seems fine.
~/.clokta/fusion.env contains AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN. Those values match the [fusion] section of the ~/.aws/credentials which I'm mapping to the container, except aws_access_key_id key and friends are in the lower case.
Is there something I'm missing in the setup?
The text was updated successfully, but these errors were encountered: