Skip to content

[BUG] DefaultCredentialsProvider 顺序是不是有问题 #286

Open

Description

@superhx

public Credential getCredentials() throws TencentCloudSDKException {
Credential cred;
try {
cred = new EnvironmentVariableCredentialsProvider().getCredentials();
return cred;
} catch (TencentCloudSDKException e) {
}
try {
cred = new ProfileCredentialsProvider().getCredentials();
return cred;
} catch (TencentCloudSDKException e) {
}
cred = new CvmRoleCredential();
if (cred.getSecretId() != null && cred.getSecretKey() != null && cred.getToken() != null) {
return cred;
}
cred = new OIDCRoleArnProvider().getCredentials();
return cred;

AWS 的 DefaultCredentialsProvider 顺序是:

  1. JVM system properties
  2. 环境变量
  3. Web Identity Token(EKS IRSA 的 AWS_ROLE_ARN + AWS_WEB_IDENTITY_TOKEN_FILE)
  4. AWS profile
  5. 容器凭证端点(ECS 等)
  6. EC2 Instance Profile(IMDS)

https://github.com/aws/aws-sdk-java-v2/blob/master/core/auth/src/main/java/software/amazon/awssdk/auth/credentials/DefaultCredentialsProvider.java

但是 tencent 的 DefaultCredentialsProvider 的 CvmRoleCredential 是在 OIDCRoleArnProvider 前面的,而且错误后不会兜底。

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions