Fix https container-credentials endpoints to match other AWS SDKs #3584
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
|
Hi @blairdrummond, Thanks for bringing this to our attention! It does appear we have some drift from the Container credential provider specification we use across SDKs. The initial implementation was one of AWS' earliest ones and predates support for arbitrary HTTPS endpoints. I think we'd be happy to add this but will likely need to make a few minor changes to your implementation to be fully compliant. Would you be alright if I add a couple commits onto this PR so we can get it merged? |
Author
|
Absolutely! Please feel free to add commits @nateprewitt and let me know if there's anything I can assist with 🙏 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Relates to #2515
Description of changes:
I discovered that the Container Credential Provider options behave differently in boto compared to all other AWS SDKs that I've checked. When supplying an
AWS_CONTAINER_CREDENTIALS_FULL_URIendpoint, the other SDKs allow anyhttpsendpoint, whereasbotodoes not allow any URL unless it's one of the special addresses (even if it's HTTPS).The tests in this repo were aware of this behaviour, but I think this code pre-dates most other SDK implementations, which seem to have provided a new convention. I have updated the tests to address this. You can see below the implementations of this behaviour in the other major SDKs
Note on #2515
If using HTTPS on
host.docker.internal, then #2515 would be resolved. This wouldn't be out-of-the-box though without using some CA certs on the client-side. (That might be fine though)