Feature Request: AWS SDK v3 credentials support

[LumaKernel]

Is your feature request related to a problem? Please describe.
The AWS's new version of SDK @aws-sdk/* has new feature about credentials, @aws-sdk/credentials-provider .

This is providing credentials in consistent interface (Credentials | CredentialsProvider) for any authentication method. For example, if we want to use Workload Identity Federation in AWS Container (like ECS) environment, we cannot use AwsClient because there is no metadata endpoint. It's also the case for AWS Lambda.

Definition of Credentials:

https://github.com/aws/aws-sdk-js-v3/blob/main/packages/types/src/credentials.ts#L3-L27

Definition of CredentialProvider:

https://github.com/aws/aws-sdk-js-v3/blob/842e39638d994b518d6580dd979031c8be738017/packages/types/src/credentials.ts#L29

Definition of Provider<T>:

https://github.com/aws/aws-sdk-js-v3/blob/842e39638d994b518d6580dd979031c8be738017/packages/types/src/util.ts#L34-L43

Describe the solution you'd like
I made a patch to support Credentials | CredentialsProvider. #1321
This is a refined version of our quick implementation (open source) for connecting from container credentials to firebase-admin through google-auth-library. It's working code in our preview environment. (It's open, if you need more detailed information about this, we can provide. )

Describe alternatives you've considered
N/A

Additional context
N/A

[bojeil-google]

He @LumaKernel, the library supports AWS environment variables for environments where the metadata server is not available: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, etc.
https://github.com/googleapis/google-auth-library-nodejs/blob/main/src/auth/awsclient.ts#L128-L138

[bcoe]

@LumaKernel please let us know if @bojeil-google's suggestion doesn't work for you 👌

[clhuang]

I'd like to reopen this -- the suggestion to use AWS environment variables works in lambda, but it does not work in ECS or EKS environments.

From the comments on #1321:

We also have plans to support pluggable auth where you can have an external plugin provide AWS credentials for the libraries

is there any timeline on when this might be implemented?

[omerlh]

Hey @bcoe and @bojeil-google I am trying something similar on EKS with IRSA, I did the following to plug-in AWS auth:

import type { AwsSecurityCredentials, AwsSecurityCredentialsSupplier, ExternalAccountSupplierContext } from 'google-auth-library';
import { fromNodeProviderChain } from '@aws-sdk/credential-providers';

export const getAwsSecurityCredentialsSupplier = (): AwsSecurityCredentialsSupplier => ({
  getAwsRegion: async (_: ExternalAccountSupplierContext): Promise<string> => 'us-east-1',

  getAwsSecurityCredentials: async (_: ExternalAccountSupplierContext): Promise<AwsSecurityCredentials> => {
    const credentialsProvider = fromNodeProviderChain({});

    const credentials = await credentialsProvider();
    return credentials;
  },
});

But I am getting error I have no idea how to solve

Error code invalid_grant: Received invalid AWS response of type InvalidClientTokenId with error message: The security token included in the request is invalid

Can you please help me figure this out?

[guyelia]

Hey @bcoe and @bojeil-google I am trying something similar on EKS with IRSA, I did the following to plug-in AWS auth:

import type { AwsSecurityCredentials, AwsSecurityCredentialsSupplier, ExternalAccountSupplierContext } from 'google-auth-library';
import { fromNodeProviderChain } from '@aws-sdk/credential-providers';

export const getAwsSecurityCredentialsSupplier = (): AwsSecurityCredentialsSupplier => ({
getAwsRegion: async (_: ExternalAccountSupplierContext): Promise => 'us-east-1',

getAwsSecurityCredentials: async (_: ExternalAccountSupplierContext): Promise => {
const credentialsProvider = fromNodeProviderChain({});

const credentials = await credentialsProvider();
return credentials;

},
});
But I am getting error I have no idea how to solve

Error code invalid_grant: Received invalid AWS response of type InvalidClientTokenId with error message: The security token included in the request is invalid

Can you please help me figure this out?

Same here, same setup with the same issue @bcoe

[IsaiahJTurner]

Root Cause Found: Field Name Casing Issue

I encountered this same issue when implementing Workload Identity Federation for AWS ECS Fargate tasks. After digging into the google-auth-library source code, I found the problem:

The Issue:
The ECS metadata endpoint returns credentials with PascalCase field names:

{
  "AccessKeyId": "...",
  "SecretAccessKey": "...",
  "Token": "..."
}

But google-auth-library's AwsSecurityCredentials interface expects camelCase field names:

interface AwsSecurityCredentials {
  accessKeyId: string;
  secretAccessKey: string;
  token: string;
}

When you pass PascalCase fields, the library silently fails to find them and signs the AWS STS request with undefined values, resulting in the InvalidClientTokenId error.

The Fix:
Transform the field names in your AwsSecurityCredentialsSupplier:

class EcsCredentialsSupplier implements AwsSecurityCredentialsSupplier {
  async getAwsSecurityCredentials(
    context: ExternalAccountSupplierContext,
  ): Promise<AwsSecurityCredentials> {
    const response = await fetch(this.metadataUrl);
    const ecsCredentials = await response.json();

    // Transform ECS credentials (PascalCase) to google-auth-library format (camelCase)
    return {
      accessKeyId: ecsCredentials.AccessKeyId,
      secretAccessKey: ecsCredentials.SecretAccessKey,
      token: ecsCredentials.Token,
    };
  }
}

After this fix, Workload Identity Federation works correctly with ECS task roles. The same issue likely affects EKS and other containerized environments that use AWS metadata endpoints.