Call fromTokenFile credential provider by default in credential-provider-node

[trivikr]

Is your feature request related to a problem? Please describe.

The credential provider which gets credentials using sts:assumeRoleWithWebIdentity call after reading OIDS token from a file on a disk was added in #2147

It isn't called in default Node.js crendential provider chain due to a circular dependency issue.
Details: #1808 (comment)

Describe the solution you'd like

Call fromTokenFile credential provider by default in credential-provider-node

Describe alternatives you've considered

Explicitly calling fromTokenFile while creating client instance.

[ejhayes]

This would be very helpful as this is how the cli works. Right now I'm using EKS Service roles which sets both AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE environment variables. It would be nice if the SDK could pick up these values (just like it does for env vars like AWS_PROFILE for example) rather than having to manually set this:

// current behavior
const client = new S3Client({
    credentials: fromTokenFile({
        roleAssumerWithWebIdentity: getDefaultRoleAssumerWithWebIdentity()
    })
});

// ideal behavior
const client = new S3Client();

@trivikr any idea if this is something that will be added in?

[busla]

In case someone stumbles upon this issue, here is an example of how this could be implemented

import { fromTokenFile } from '@aws-sdk/credential-provider-web-identity'
import { ECRClient } from '@aws-sdk/client-ecr'
import { getDefaultRoleAssumerWithWebIdentity } from '@aws-sdk/client-sts'

export const client = new ECRClient({
  region: process.env.AWS_REGION || 'some-region-name',
  credentialDefaultProvider: () =>
    fromTokenFile({
      webIdentityTokenFile: process.env.AWS_WEB_IDENTITY_TOKEN_FILE,
      roleArn: process.env.AWS_ROLE_ARN,
      roleAssumerWithWebIdentity: getDefaultRoleAssumerWithWebIdentity(),
    }),
  }),
})

Note that credentialDefaultProvider expects a callback

References:

• https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/modules/_aws_sdk_credential_provider_web_identity.html#fromtokenfile
• https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/interfaces/_aws_sdk_middleware_signing.previouslyresolved.html#credentialdefaultprovider

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs and link to relevant comments in this thread.