Skip to content

UID2-4739: use DefaultCredentialsProvider for S3 clients in CloudStorageS3 #613

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sophia-chen-ttd wants to merge 2 commits into
base: main
Choose a base branch
from
Open

UID2-4739: use DefaultCredentialsProvider for S3 clients in CloudStorageS3 #613

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ca6cca8
UID2-4739: use DefaultCredentialsProvider for S3 clients in CloudStor…
sophia-chen-ttd Jun 3, 2026
bfb5d23
UID2-4739: add regression test for CloudStorageS3 constructor NPE fix
sophia-chen-ttd Jun 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 4 additions & 10 deletions src/main/java/com/uid2/shared/cloud/CloudStorageS3.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@

import software.amazon.awssdk.core.exception.SdkClientException;
import software.amazon.awssdk.auth.credentials.AwsBasicCredentials;
import software.amazon.awssdk.auth.credentials.DefaultCredentialsProvider;
import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider;
import software.amazon.awssdk.auth.credentials.WebIdentityTokenFileCredentialsProvider;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.s3.S3Client;
import software.amazon.awssdk.services.s3.model.*;
Expand Down Expand Up @@ -74,15 +74,9 @@ public CloudStorageS3(String accessKeyId, String secretAccessKey, String region,
}

public CloudStorageS3(String region, String bucket, String s3Endpoint) {
// In theory `new InstanceProfileCredentialsProvider()` or even omitting credentials provider should work,
// but for some unknown reason it doesn't. The credential it provides look realistic, but are not valid.
// After a lot of experimentation and help of Abu Abraham and Isaac Wilson the only working solution we've
// found was to explicitly extract env vars populated by the service account from the role and to
// manually set it on the credentials provider.
WebIdentityTokenFileCredentialsProvider credentialsProvider = WebIdentityTokenFileCredentialsProvider.builder()
.roleArn(System.getenv("AWS_ROLE_ARN"))
.webIdentityTokenFile(Paths.get(System.getenv("AWS_WEB_IDENTITY_TOKEN_FILE")))
.build();
// DefaultCredentialsProvider supports IRSA (WebIdentityTokenFile), EKS Pod Identity,
Comment thread
sophia-chen-ttd marked this conversation as resolved.
// instance profile, and all other standard AWS credential mechanisms automatically.
DefaultCredentialsProvider credentialsProvider = DefaultCredentialsProvider.create();
Comment thread
sophia-chen-ttd marked this conversation as resolved.
Comment thread
sophia-chen-ttd marked this conversation as resolved.

if (s3Endpoint.isEmpty()) {
this.s3 = S3Client.builder()
Expand Down
15 changes: 15 additions & 0 deletions src/test/java/com/uid2/shared/cloud/CloudStorageS3Test.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
package com.uid2.shared.cloud;

import org.junit.jupiter.api.Test;

import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;

public class CloudStorageS3Test {

@Test
void constructorDoesNotNpeWhenCredentialEnvVarsAbsent() {
// Old WebIdentityTokenFileCredentialsProvider called Paths.get(System.getenv("AWS_WEB_IDENTITY_TOKEN_FILE")),
// which NPE'd when the env var was unset. DefaultCredentialsProvider must not throw at construction time.
assertDoesNotThrow(() -> new CloudStorageS3("us-east-1", "test-bucket", "http://localhost:9999"));
}
}
Loading