fix(store): resolve and refresh S3 credentials through the AWS default chain - #48
Open
brightsparc wants to merge 4 commits into
Open
fix(store): resolve and refresh S3 credentials through the AWS default chain#48brightsparc wants to merge 4 commits into
brightsparc wants to merge 4 commits into
Conversation
S3Store::new required AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY and failed outright without them, then pinned a static provider, so the default chain was never consulted. A pod holding a projected service-account token could not authenticate at all and the backend demanded a long-lived key instead. GCS already resolves through ADC, so this closes the gap between the two. The env vars now override rather than gate: with both set the behaviour is unchanged, including AWS_SESSION_TOKEN; without them the default chain runs and picks up a web-identity token, an ECS task role or IMDS. DefaultCredentialsChain::build is async, so S3Store::new becomes async. GcsStore::new already is and open_store already awaits it. Both in-tree call sites are updated; note this is a breaking change for any caller outside the workspace. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KaoVaspfci2kQbzQJLTPd7
Require a complete, non-empty explicit key pair or neither key. A partial custom pair must not silently fall back to a different AWS identity. Exercise the real SDK credential chain in isolated child processes against synthetic STS and S3 endpoints. Verify projected-token rotation, refreshing session credentials for SDK and presigned requests, cache reuse, explicit custom-key precedence, and failure without network calls for invalid keys. Document credential selection in the example config. Bucket protocol depth is unchanged: one request per HEAD/GET, no extra bucket probes. STS exchanges occur on credential resolution/refresh only.
A host with no AWS identity used to fail on the first request, after the profile and IMDS lookups timed out, where the explicit-key path had failed at construction with a clear message. Probe the chain once in `new` so misconfiguration surfaces the same way. Also formats the S3 contract constructor. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T6UZ2AaFQ6m7xgdZKRyHEV
brightsparc
added a commit
to introspection-org/walgit
that referenced
this pull request
Sep 12, 2026
Upstream main (tobi#42-tobi#45, tobi#49) plus the Azure and IRSA branches as updated for PRs tobi#50 and tobi#48, plus the store-plugin and notify-transport lines the production image was already built from (a6ce265). The two conflicts were additive: the Event Grid handshake test and its doc note now sit beside the loopback notify-transport test and its bullet. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T6UZ2AaFQ6m7xgdZKRyHEV
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
S3 initialization currently requires a stored access-key pair, so deployments using web identity / IRSA, container roles or instance roles cannot authenticate. This change uses the AWS SDK’s default credential chain when both configured key variables are unset, retaining the provider so temporary credentials can refresh.
Behavior
store.s3.access_key_env/secret_key_envoverrides the default chain and preservesAWS_SESSION_TOKEN.walgit.example.tomldocuments this selection.S3Store::newbecomes async, matchingGcsStore::new: building the SDK default chain is asynchronous. Both existing in-tree callers now await it; direct library callers must also add.await. No new dependency, store-format change or bucket request is introduced. HEAD and GET still each require one bucket request; STS exchanges happen only when resolving/refreshing identity.Regression coverage
New hermetic tests run the real AWS credential chain in child processes with clean environments and local synthetic STS/S3 endpoints. They verify projected-token rotation, short-lived credential refresh, SDK-signed HEAD and presigned GET requests, cached-credential reuse, custom-key precedence, session-token propagation, and rejection of incomplete/empty keys without making network calls. They neither read developer credentials nor contact AWS.
Validation
Validated on macOS arm64 with the repository’s Rust 1.97.1 toolchain:
just web-buildjust warningscargo clippy --locked -p walgit-store --all-targets -- -D warningsjust testjust e2ecargo test --locked -p walgit-server --test simWorkspace
just clippystill fails on the two pre-existing macOScast_losslesswarnings incrates/walgit-wal/src/registry.rs:494–495, unchanged from basee5295e6. Consequently this is not a claim thatjust ciis entirely green on macOS; all other constituent tiers and storage Clippy passed.A real AWS account / IRSA-enabled cluster has not been tested. The mocked STS exchange exercises the production provider path and refresh behavior, but IAM trust policy, workload projection and bucket permissions still need deployment-level verification.