Support on instance role

[calvin-kargo]

Is there any thought on how to integrate instance role with the rest of the module?
how about adding additional attribute on %AWS.Client struct and handle it at AWS.Request module?
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html

[jfacorro]

@calvin-kargo Could you provide more information on what feature it is you are asking for?

[calvin-kargo]

hi @jfacorro , i am asking regarding support of instance role / task role for API request on aws-elixir library,

using instance role is alternative of providing AWS credential for API request (compared to using aws_access_key_id and aws_secret_access_key ) which has the advantage of has lower risk of leakage and no need to do key rotation. Supporting instance role on aws-elixir would help developer use aws-elixir on higher security requirement.

AWS has a page for documenting instance role: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html

ex_aws (another elixir client module for AWS) has support of instance role: https://hexdocs.pm/ex_aws/ExAws.html#module-aws-key-configuration

[jkakar]

@calvin-kargo Have you looked at https://github.com/aws-beam/aws-erlang-metadata? I believe this will do what you need, if I understand your request correctly.

[jfacorro]

@jkakar What was the reasoning behind having the functionality in aws-erlang-metadata in a separate repository instead of including it as part of aws-erlang?

[robertoaloi]

Also, it seems like the aws-erlang-metadata has been forked/changed into https://github.com/aws-beam/aws_credentials.

[jkakar]

@jfacorro I don't actually remember why we chose to create a separate repo/library for that functionality, but it does seem like it'd be valuable to roll it into the aws-erlang and aws-elixir code bases.

[calvin-kargo]

Thanks @jkakar @robertoaloi @jfacorro https://github.com/aws-beam/aws_credentials seems like the correct way,
however i have trouble in setting up aws_credentials, especially on iso8601 depedency, is there erlang/otp/elixir version depedency on using aws_elixir and aws_credential? i am using Elixir 1.10.4 (compiled with Erlang/OTP 22)

# mix.exs
defp deps do
  [
     ...,
     {:aws_credential, git: "https://github.com/aws-beam/aws_credentials"}
  ]
end

calvin@calvin-Lenovo-Yoga-S730-13IWL:~/event_service$ export DEBUG=1 && mix phx.server
warning: found quoted keyword "coveralls" but the quotes are not required. Note that keywords are always atoms, even when quoted. Similar to atoms, keywords made exclusively of Unicode letters, numbers, underscore, and @ do not require quotes
  mix.exs:19

===> Expanded command sequence to be run: []
===> Provider: {default,do}
===> Expanded command sequence to be run: [{default,app_discovery},
                                           {bare,compile}]
===> Provider: {default,app_discovery}
===> Provider: {bare,compile}
===> Uncaught error in rebar_core. Run with DEBUG=1 to see stacktrace or consult rebar3.crashdump
===> Uncaught error: {badmatch,[]}
===> When submitting a bug report, please include the output of `rebar3 report "your command"`
** (Mix) Could not compile dependency :iso8601, "/home/calvin/.mix/rebar3 bare compile --paths="/home/calvin/work/backend/apps/event_service/_build/dev/lib/*/ebin"" command failed. You can recompile this dependency with "mix deps.compile iso8601", update it with "mix deps.update iso8601" or clean it with "mix deps.clean iso8601"
calvin@calvin-Lenovo-Yoga-S730-13IWL:~/work/backend/apps/event_service$ mix -v
Erlang/OTP 23 [erts-11.0.3] [source] [64-bit] [smp:8:8] [ds:8:8:10] [async-threads:1] [hipe]

Mix 1.10.4 (compiled with Erlang/OTP 22)
calvin@calvin-Lenovo-Yoga-S730-13IWL:~/work/backend/apps/event_service$ elixir -v
Erlang/OTP 23 [erts-11.0.3] [source] [64-bit] [smp:8:8] [ds:8:8:10] [async-threads:1] [hipe]

Elixir 1.10.4 (compiled with Erlang/OTP 22)

after aws_credentials installation okay, is this usage correct?

{ok, credentials} = aws_credentials:get_credentials()

client = %AWS.Client{access_key_id: credentials["access_key_id"],
                secret_access_key: credentials["secret_access_key"],
                session_token: credentials["token"],
                region: credentials["region"]}

[jfacorro]

@calvin-kargo AFAIK there shouldn't be any issues when compiling the project. Could you please share the result from running rebar3 --version and the contents of the rebar3.crashdump file?

after aws_credentials installation okay, is this usage correct?

That looks correct.

[calvin-kargo]

@jfacorro Here is rebar version and crash dump (from deps/iso8601)

rebar 3.6.1 on Erlang/OTP 23 Erts 11.0.3

Error: {badmatch,[]}
[]

rebar3_crashdump.zip

[calvin-kargo]

also rebar report

===> Expanded command sequence to be run: [{default,report}]
===> Provider: {default,report}
Rebar3 report
 version 3.6.1
 generated at 2020-08-19T06:31:05+00:00
=================
Please submit this along with your issue at https://github.com/erlang/rebar3/issues (and feel free to edit out private information, if any)
-----------------
Task: bare
Entered as:
  bare compile --paths=/home/calvin/work/backend/apps/event_service/_build/dev/lib/*/ebin
-----------------
Operating System: x86_64-unknown-linux-gnu
ERTS: Erlang/OTP 23 [erts-11.0.3] [source] [64-bit] [smp:8:8] [ds:8:8:10] [async-threads:1] [hipe]
Root Directory: /usr/lib/erlang
Library directory: /usr/lib/erlang/lib
-----------------
Loaded Applications:
bbmustache: 1.5.0
certifi: 2.0.0
cf: 0.2.2
common_test: 1.19
compiler: 7.6.2
crypto: 4.7
cth_readable: 1.4.2
dialyzer: 4.2
edoc: 0.12
erlware_commons: 1.2.0
eunit: 2.5
eunit_formatters: 0.5.0
getopt: 1.0.1
hipe: 4.0
inets: 7.2
kernel: 7.0
providers: 1.7.0
public_key: 1.8
relx: 3.26.0
sasl: 4.0
snmp: 5.6
ssl_verify_fun: 1.1.3
stdlib: 3.13
syntax_tools: 2.3
tools: 3.4

-----------------
Escript path: /home/calvin/.mix/rebar3
Providers:
  app_discovery as clean compile compile cover ct deps dialyzer do edoc escriptize eunit get-deps help install install_deps list lock new path pkgs release relup report shell state tar tree unlock update upgrade upgrade upgrade version xref 

[jfacorro]

It might be an issue with the rebar3 version. The latest stable version is 3.13.2, but 3.6.1 is from around 2 years ago. Could you try upgrading rebar3 and checking the results?

[calvin-kargo]

@jfacorro have updated rebar3, but still getting same error

calvin@calvin-Lenovo-Yoga-S730-13IWL:~/work/backend/apps/event_service$ mix local.rebar
warning: found quoted keyword "coveralls" but the quotes are not required. Note that keywords are always atoms, even when quoted. Similar to atoms, keywords made exclusively of Unicode letters, numbers, underscore, and @ do not require quotes
  mix.exs:19

/home/calvin/.mix/rebar already exists, overwrite? [Yn] Y
* creating /home/calvin/.mix/rebar
/home/calvin/.mix/rebar3 already exists, overwrite? [Yn] Y
* creating /home/calvin/.mix/rebar3
calvin@calvin-Lenovo-Yoga-S730-13IWL:~/work/backend/apps/event_service$ /home/calvin/.mix/rebar3 --version
===> Expanded command sequence to be run: [{default,version}]
===> Provider: {default,version}
rebar 3.13.1 on Erlang/OTP 23 Erts 11.0.3
calvin@calvin-Lenovo-Yoga-S730-13IWL:~/work/backend/apps/event_service$ export DEBUG=1 && mix phx.serverwarning: found quoted keyword "coveralls" but the quotes are not required. Note that keywords are always atoms, even when quoted. Similar to atoms, keywords made exclusively of Unicode letters, numbers, underscore, and @ do not require quotes
  mix.exs:19

===> Expanded command sequence to be run: []
===> Provider: {default,do}
===> Expanded command sequence to be run: [{default,app_discovery},
                                           {bare,compile}]
===> Provider: {default,app_discovery}
===> Provider: {bare,compile}
===> Uncaught error in rebar_core. Run with DEBUG=1 to see stacktrace or consult rebar3.crashdump
===> Uncaught error: {badmatch,[]}
===> When submitting a bug report, please include the output of `rebar3 report "your command"`
** (Mix) Could not compile dependency :iso8601, "/home/calvin/.mix/rebar3 bare compile --paths="/home/calvin/work/backend/apps/event_service/_build/dev/lib/*/ebin"" command failed. You can recompile this dependency with "mix deps.compile iso8601", update it with "mix deps.update iso8601" or clean it with "mix deps.clean iso8601"

[jfacorro]

It looks like mix is using its own rebar3 though based on the command listed in the last line: /home/calvin/.mix/rebar3. Is that rebar3 the one that was upgraded?

It would be useful to have a project where we can reproduce the error, since this looks like a problem with the interaction of mix+rebar3+iso8601.

[axelson]

Are there any examples of integrating https://github.com/aws-beam/aws_credentials with aws-elixir? It's not clear from the readme's.

[djgoku]

Are there any examples of integrating https://github.com/aws-beam/aws_credentials with aws-elixir? It's not clear from the readme's.

I hope this helps.

add deps

      {:aws_credentials, "~> 1.0.3"}

% AWS_PROFILE=j5 iex -S mix
Erlang/OTP 27 [erts-15.2.7] [source] [64-bit] [smp:10:10] [ds:10:10:10] [async-threads:1] [jit]

Interactive Elixir (1.18.4) - press Ctrl+C to exit (type h() ENTER for help)
iex(1)> Application.ensure_all_started(:aws_credentials)
{:ok, []}
iex(2)> credentials = :aws_credentials.get_credentials()
%{
  access_key_id: "AKIAAAAAAAAAAAAAAAAAAAA",
  credential_provider: :aws_credentials_file,
  secret_access_key: "aaaaaaaaaaaaaaaaaa"
}
iex(3)> client = AWS.Client.create(credentials.access_key_id, credentials.secret_access_key, "us-east-1")
#AWS.Client<
  region: "us-east-1",
  service: nil,
  endpoint: nil,
  proto: "https",
  port: 443,
  http_client: {AWS.HTTPClient.Hackney, []},
  json_module: {AWS.JSON, []},
  xml_module: {AWS.XML, []},
  ...
>
iex(4)> AWS.STS.get_caller_identity(client, %{})
{:ok,
 %{
   "GetCallerIdentityResponse" => %{
     "GetCallerIdentityResult" => %{
       "Account" => "123456789",
       "Arn" => "arn:aws:iam::123456789:user/johnny5",
       "UserId" => "AKIAAAAAAAAAAAAAAAA"
     },
     "ResponseMetadata" => %{
       "RequestId" => "dfdfdfdfdfdfdfdfdfdfd"
     }
   }
 },
 %{
   body: "<GetCallerIdentityResponse xmlns=\"https://sts.amazonaws.com/doc/2011-06-15/\">\n  <GetCallerIdentityResult>\n    <Arn>arn:aws:iam::123456789:user/johnny5</Arn>\n    <UserId>AKIAAAAAAAAAAAAAAAA</UserId>\n    <Account>123456789</Account>\n  </GetCallerIdentityResult>\n  <ResponseMetadata>\n    <RequestId>dfdfdfdfdfdfdfdfdfdfd</RequestId>\n  </ResponseMetadata>\n</GetCallerIdentityResponse>\n",
   headers: [
     {"x-amzn-RequestId", "dfdfdfdfdfdfdfdfdfdfd"},
     {"X-Amz-Sts-Extended-Request-Id",
      "dfdfdfdfdfdfdfdffdf"},
     {"Content-Type", "text/xml"},
     {"Content-Length", "404"},
     {"Date", "Sun, 23 Nov 2025 00:28:36 GMT"}
   ],
   status_code: 200
 }}