Plugin uses instance role instead of pod role about aws-secrets-manager-credentials-provider-plugin HOT 5 CLOSED

@parveshmourya sorry, super delayed answer.
Nope, it didn't work but maybe it was I'm not experienced with Jenkins plugins. Finally we decided to follow a different method to gather secrets from AWS Secret Manager and I didn't have time to back to this.
I didn't test the new version but if it's working I think we can close this issue.

from aws-secrets-manager-credentials-provider-plugin.

The plugin instantiates a standard instance of the AWS Java SDK client; the only override to its behaviour is to change the EndpointConfiguration if you've set this in Jenkins config.

By default the SDK's authentication strategy is DefaultAWSCredentialsProviderChain:

AWS credentials provider chain that looks for credentials in this order:

• Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (RECOMMENDED since they are recognized by all the AWS SDKs and CLI except for .NET), or AWS_ACCESS_KEY and AWS_SECRET_KEY (only recognized by Java SDK)
• Java System Properties - aws.accessKeyId and aws.secretKey
• Web Identity Token credentials from the environment or container
• Credential profiles file at the default location (~/.aws/credentials) shared by all AWS SDKs and the AWS CLI
• Credentials delivered through the Amazon EC2 container service if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI" environment variable is set and security manager has permission to access the variable,
• Instance profile credentials delivered through the Amazon EC2 metadata service

I would recommend running the AWS CLI in your container environment to do some Secrets Manager calls - with all the same env vars as you've given Jenkins - and see which IAM role it uses.

from aws-secrets-manager-credentials-provider-plugin.

AWS CLI works fine, so based in what you said, I think the problem is related to: aws/aws-sdk-java#2136. As far as I see the sdk version used by the plugin is 1.12.131 so it should be ok but it's necessary to add aws-java-sdk-sts to the pom file.
I've never tried to build a plugin but I will try to test it.

from aws-secrets-manager-credentials-provider-plugin.

Nice detective work :) If adding aws-java-sdk-sts to the pom fixes it for you, then I'll be sure to get that included

from aws-secrets-manager-credentials-provider-plugin.

@nahuelcassinarijamf did it work as expected after adding aws-java-sdk-sts to the pom?

from aws-secrets-manager-credentials-provider-plugin.