Skip to content

fix(pricing): honor AWS profile and reuse resolved credentials#523

Closed
cesar32az wants to merge 1 commit into
awslabs:mainfrom
cesar32az:fix/aws-profile-pricing-credentials
Closed

fix(pricing): honor AWS profile and reuse resolved credentials#523
cesar32az wants to merge 1 commit into
awslabs:mainfrom
cesar32az:fix/aws-profile-pricing-credentials

Conversation

@cesar32az

Copy link
Copy Markdown

Description

Fixes #477.

When the AWS SDK's default credential chain can't resolve usable credentials for the active profile, pricing lookups fall back to EC2 IMDS and fail on a laptop:

updating on-demand pricing, operation error Pricing: GetProducts, ...
get credentials: failed to refresh cached credentials, no EC2 IMDS role found,
operation error ec2imds: GetMetadata, ... dial tcp 169.254.169.254:80: connect: host is down

This is common with AWS SSO / IAM Identity Center: kubectl works because its kubeconfig exec plugin (aws eks get-token) resolves its own profile, but eks-node-viewer loads a separate SDK config that has no way to select a profile, so it ends at IMDS.

There were two related gaps:

  1. There was no way to tell eks-node-viewer which AWS profile to use — only the ambient AWS_PROFILE env var.
  2. NewPricingClient built a brand-new config via LoadDefaultConfig instead of reusing the credentials already resolved for the EC2 client, so even a correctly-resolved config wasn't propagated to the Pricing API client.

Changes

  • Add a --profile flag (and a profile key for the ~/.eks-node-viewer config file) to select the AWS profile used for pricing/EC2 calls. When empty, the standard credential chain is used (AWS_PROFILE, shared config, etc.), so existing behavior is unchanged.
  • NewPricingClient now copies the already-resolved aws.Config and only overrides the region to a pricing-API-capable one, so the configured profile / SSO session is honored consistently across the EC2 and Pricing clients.
  • Remove the no-op config.WithSharedConfigProfile("") in main.
  • Document the flag and add a troubleshooting entry for the IMDS error in the README.

Testing

  • go build ./cmd/... ./pkg/..., go vet, go test ./cmd/... ./pkg/... all pass. Added pkg/aws/pricing_test.go covering the region mapping and that NewPricingClient doesn't mutate the caller's config.
  • Ran the built binary against a live EKS cluster with --profile <name>: pricing updated from the static baseline to live values with no IMDS/credential errors in the logs.
  • Verified --profile takes precedence over a bogus AWS_PROFILE env var, and that the flag is rejected by the released binary (confirming it's net-new).

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

The pricing provider built a brand-new AWS config via LoadDefaultConfig
inside NewPricingClient, ignoring the credentials already resolved for the
EC2 client. It also had no way to select an AWS profile, so users on AWS
SSO / IAM Identity Center hit "no EC2 IMDS role found" while kubectl (which
resolves its own profile via the kubeconfig exec plugin) worked fine.

- Add a --profile flag (and `profile` config-file key) to select the AWS
  profile; falls back to the standard credential chain (AWS_PROFILE, shared
  config) when empty.
- Drop the no-op WithSharedConfigProfile("") in main.
- NewPricingClient now copies the resolved config and only overrides the
  region to a pricing-API-capable one, so the configured profile / SSO
  session is honored for pricing too.
- Document the flag and the IMDS troubleshooting case in the README.

Fixes #477

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@cesar32az cesar32az requested a review from a team as a code owner June 19, 2026 18:19
@cesar32az

Copy link
Copy Markdown
Author

Closing in favor of #383, which already addresses AWS profile/region resolution for pricing (deriving them from the kube context). Apologies for the duplicate.

@cesar32az cesar32az closed this Jun 19, 2026
@cesar32az cesar32az deleted the fix/aws-profile-pricing-credentials branch June 19, 2026 18:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

BUG: Support for AWS SSO profiles

1 participant