docker/buildx
1
0
Fork 0
mirror of https://gitea.com/Lydanne/buildx.git synced 2025-05-18 09:17:49 +08:00
Code Issues Packages Projects Releases 1 Wiki Activity

Fix AWS Authentication when mixing static creds and IAM profile

Browse Source 
When the user supply static creds, we must not enrich them with a
session token which is unrelated.

Signed-off-by: Bertrand Paquet <bertrand.paquet@gmail.com>
This commit is contained in:
Bertrand Paquet 2023-05-19 15:37:14 +02:00 committed by Justin Chadwell
parent 167cd16acb
commit adc6349b28
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
util/buildflags/cache.go
View File

@ -88,6 +88,12 @@ func addAwsCredentials(ci *controllerapi.CacheOptionsEntry) {
if ci.Type != "s3" { if ci.Type != "s3" {
return return
} }
_, okAccessKeyID := ci.Attrs["access_key_id"]
_, okSecretAccessKey := ci.Attrs["secret_access_key"]
// If the user provides access_key_id, secret_access_key, do not override the session token.
if okAccessKeyID && okSecretAccessKey {
return
}
ctx := context.TODO() ctx := context.TODO()
awsConfig, err := awsconfig.LoadDefaultConfig(ctx) awsConfig, err := awsconfig.LoadDefaultConfig(ctx)
if err != nil { if err != nil {
@ -97,10 +103,10 @@ func addAwsCredentials(ci *controllerapi.CacheOptionsEntry) {
if err != nil { if err != nil {
return return
} }
if _, ok := ci.Attrs["access_key_id"]; !ok && credentials.AccessKeyID != "" { if !okAccessKeyID && credentials.AccessKeyID != "" {
ci.Attrs["access_key_id"] = credentials.AccessKeyID ci.Attrs["access_key_id"] = credentials.AccessKeyID
} }
if _, ok := ci.Attrs["secret_access_key"]; !ok && credentials.SecretAccessKey != "" { if !okSecretAccessKey && credentials.SecretAccessKey != "" {
ci.Attrs["secret_access_key"] = credentials.SecretAccessKey ci.Attrs["secret_access_key"] = credentials.SecretAccessKey
} }
if _, ok := ci.Attrs["session_token"]; !ok && credentials.SessionToken != "" { if _, ok := ci.Attrs["session_token"]; !ok && credentials.SessionToken != "" {