Problem/Motivation
Profile::getTemporaryCredentials() assumes an IAM role via STS AssumeRole whenever an aws_profile is configured with a Role ARN. The AWS call is wrapped in a try/catch that is (presumably) meant to log any failure and gracefully return FALSE, letting getClientArgs() fall back to the SDK's default credential provider chain:
} catch (Exception $e) { \Drupal::logger('aws')->error($e->getMessage()); return FALSE; }
But it's missing the leading \ so is interpreted relative to the current namespace, which doesn't match a class and so never actually catches an exception thrown when the AssumeRole call fails.
Steps to reproduce
- Configure an
aws_profileconfig entity withaws_role_arnset to a role ARN that STS will reject when assumed (e.g. one the environment's ambient AWS identity is not permitted to assume, or simply run this in an environment with no AWS credentials/network access at all, such as a sandbox or CI runner). - Trigger any code path that builds an AWS SDK client from that profile, e.g. via
aws.client_factory(directly, or through anything that consumesAwsClientFactoryTrait): Profile::getClientArgs()sees the role ARN and callsgetTemporaryCredentials(), which callsStsClient::AssumeRole().- The SDK throws
Aws\Exception\CredentialsException(or another exception) because the assume-role call failed.
Expected: the exception is caught, logged via watchdog, and getClientArgs() falls back to CredentialProvider::defaultProvider().
Actual: the exception is not caught (because catch (Exception $e) resolves to the nonexistent Drupal\aws\Entity\Exception) and propagates uncaught, producing a fatal error instead of a graceful fallback.
Proposed resolution
Add the missing \ :)
I actually found this while trying to get the automated tests working, so I figure it makes sense to set up Gitlab CI to verify the fix. Current HEAD (8189f4b) also needs #3569015: Drupal 11 - Route "entity.aws_profile.canonical" does not exist (after saving a profile) for all tests to run green on 11.x
Remaining tasks
- Fix it
- Enable tests
User interface changes
None.
Introduced terminology
None.
API changes
None.
Data model changes
None.
Release notes snippet
Issue fork aws-3609096
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #3
andyf commentedThe three failures in the tests are fixed for me locally by applying 88df227042ba from #3569015: Drupal 11 - Route "entity.aws_profile.canonical" does not exist (after saving a profile). (I'm assuming 2.0.x is for active development, not 3.0.x?)