AWS EKS 1.24 client is not respecting jenkins-master pod role about aws-secrets-manager-credentials-provider-plugin HOT 5 OPEN

Seems to be duplicate of #172 but that issue was closed and it seems not resolved

from aws-secrets-manager-credentials-provider-plugin.

It looks like the role is injected from the AWS environment. I'm just wondering if somehow AWS might be changing the environment under the hood in some cases, which might change the role used.

If you wanted to debug this, you could potentially set the role to use explicitly in the plugin's configuration:

unclassified:
  awsCredentialsProvider:
    client:
      credentialsProvider:
        assumeRole:
          roleArn: "arn:aws:iam::111111111111:role/foo"
          roleSessionName: "jenkins"

This should hopefully keep it locked into the role you specify.

from aws-secrets-manager-credentials-provider-plugin.

@chriskilding I've tried that - but than I'm getting other error that arn:aws:sts::000000000:assumed-role/eks-node-group-20230123082959723000000001/i-0259469284873172d is not authorized to perform: assume role
I also tried to give needed permissions to node-group role - error message in logs are gone - but I cant see credentials in list

from aws-secrets-manager-credentials-provider-plugin.

When this error occurs, how are you accessing the credentials? (It can make a difference where you do this from.)

E.g. are you viewing the credentials in the Web UI (i.e. the /jenkins/manage/credentials/ screen)? Or does this happen when you access a credential inside a job?

from aws-secrets-manager-credentials-provider-plugin.

@chriskilding I'm trying to access credentials in Web UI first.
But in general I want to use this plugin together with JCasc to create list of secrets and use them in Jobs

from aws-secrets-manager-credentials-provider-plugin.