Problem/Motivation

Profile::getTemporaryCredentials() assumes an IAM role via STS AssumeRole whenever an aws_profile is configured with a Role ARN. The AWS call is wrapped in a try/catch that is (presumably) meant to log any failure and gracefully return FALSE, letting getClientArgs() fall back to the SDK's default credential provider chain:

} catch (Exception $e) {
  \Drupal::logger('aws')->error($e->getMessage());
  return FALSE;
}

But it's missing the leading \ so is interpreted relative to the current namespace, which doesn't match a class and so never actually catches an exception thrown when the AssumeRole call fails.

Steps to reproduce

  1. Configure an aws_profile config entity with aws_role_arn set to a role ARN that STS will reject when assumed (e.g. one the environment's ambient AWS identity is not permitted to assume, or simply run this in an environment with no AWS credentials/network access at all, such as a sandbox or CI runner).
  2. Trigger any code path that builds an AWS SDK client from that profile, e.g. via aws.client_factory (directly, or through anything that consumes AwsClientFactoryTrait):
    1. Profile::getClientArgs() sees the role ARN and calls getTemporaryCredentials(), which calls StsClient::AssumeRole().
    2. The SDK throws Aws\Exception\CredentialsException (or another exception) because the assume-role call failed.

Expected: the exception is caught, logged via watchdog, and getClientArgs() falls back to CredentialProvider::defaultProvider().

Actual: the exception is not caught (because catch (Exception $e) resolves to the nonexistent Drupal\aws\Entity\Exception) and propagates uncaught, producing a fatal error instead of a graceful fallback.

Proposed resolution

Add the missing \ :)

I actually found this while trying to get the automated tests working, so I figure it makes sense to set up Gitlab CI to verify the fix. Current HEAD (8189f4b) also needs #3569015: Drupal 11 - Route "entity.aws_profile.canonical" does not exist (after saving a profile) for all tests to run green on 11.x

Remaining tasks

  • Fix it
  • Enable tests

User interface changes

None.

Introduced terminology

None.

API changes

None.

Data model changes

None.

Release notes snippet

Issue fork aws-3609096

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

andyf created an issue. See original summary.

andyf’s picture

Version: 3.0.x-dev » 2.0.x-dev
Status: Active » Needs review

The three failures in the tests are fixed for me locally by applying 88df227042ba from #3569015: Drupal 11 - Route "entity.aws_profile.canonical" does not exist (after saving a profile). (I'm assuming 2.0.x is for active development, not 3.0.x?)