-
|
I've submitted an AWS Support ticket to the CodeBuild service but thinking this is more likely a .NET SDK Team question potentially. We have a AWS CodeBuild Project configured with an IAM Role with the required permissions to interact with some AWS services, in this case a DynamoDB table. We are executing a dotnet-script (CSX) file which utilizes the AWS SDKs including the DynamoDB SDK to perform a PutObject operation against a DynamoDB Table. Typically for apps and services deployed to other AWS compute services like AWS ECS/Fargate or AWS Lambda, our applications are able to just simply instantiate the SDK client(s) for the service(s) and it would follow the standard AWS credential resolution chain and we do not need to provide any explicit hint as to what credentials to be used - and ultimately the associated IAM Service Role would be resolved and utilized for all service calls (for example, However, that does not seem to be the case here with executing our dotnet-script/CSX file in our AWS CodeBuild Project; as we are getting a As a sanity check, we also ran a generic We tried to explicitly instantiate the DynamoDB client with the following: However, this throws: I am able to execute the CSX file from local (with AWS credentials configured locally in the credentials files) and the script successfully resolves them. Lastly, we have previously been able to run full .NET application/executables that leverage the AWS SDKs within CodeBuild Project and it seemed to resolve and utilize the associate IAM Service Role for the CodeBuild Project just fine. Any guidance or pointers with working here would be appreciated! |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 8 replies
-
|
Do you see the error even when not using the If you don't specify credentials when creating the client (e.g. |
Beta Was this translation helpful? Give feedback.
-
|
Yeah, that was my exact expecation as well. When I perform the client intialization with just the region parameter, I get exception with the 4 attempts to resolve the credentials via the credentials resolution change. |
Beta Was this translation helpful? Give feedback.
-
|
I have never used |
Beta Was this translation helpful? Give feedback.
-
|
So I can run the same exact dotnet script/csx file from my local machine, with just my .aws/credential file populated with fresh credentials and they get picked up as expected. My expectation is that their would be parity when running it in CodeBuild. Ill take a closer look if theres any difference between the version of dotnet script I have installed locally and the latest version getting installed at runtime in CodeBuild. I do appreciate your time thinking through this with me! |
Beta Was this translation helpful? Give feedback.
-
|
Confirmed that the version (1.6.0) of From CodeBuild execution logs: From local: The CSX script file being executed - which I've confirmed executes successfully CodeBuild buildspec file: CodeBuild logs when attempting to run script: So reconfirmed the CSX file runs successfully with just my Interestingly if I comment out these two imports: (which were added when attempting to debug this issue with an LLM) and I try and run locally, I get a similar error as in CodeBuild: Thanks again for your time and thoughts on this! |
Beta Was this translation helpful? Give feedback.
-
|
cross posted this on the |
Beta Was this translation helpful? Give feedback.
-
|
In a CodeBuild environment the service does the work of resolving AWS credentials based on the IAM role assigned he role and then sets environment variables like I don't have any experience with csx scripting but what I would look into is something causing the environment variables to disappear/remove when calling into the scripting runtime. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks so much (as always!) @normj for your insight! I went in an added |
Beta Was this translation helpful? Give feedback.
-
|
I created another CSX file (see snippet below) and ran it locally and in CodeBuild - in both cases I got (the expected) output. So it seems like when running the CSX file with IDictionary environmentVariables = Environment.GetEnvironmentVariables();
var sortedKeys = new List<string>();
foreach (DictionaryEntry entry in environmentVariables)
{
sortedKeys.Add((string)entry.Key);
}
sortedKeys.Sort();
foreach (string key in sortedKeys)
{
string value = (string)environmentVariables[key];
Console.WriteLine($"{key}={value}");
}I also tried switching my CodeBuild configuration from: to: And I got the same result, however, it seemed to hang quite a bit longer before throwing the same exception: |
Beta Was this translation helpful? Give feedback.
-
|
AWS Support replied back with solution. So it looks like the environmental variables Happy to confirm that doing exactly this allows the CSX file to execute successfully picking up the credential material from the environmental variables Thanks @normj, @dscpinheiro and @filipw for your time, attention and support! |
Beta Was this translation helpful? Give feedback.
AWS Support replied back with solution. So it looks like the environmental variables
AWS_ACCESS_KEY_IDandAWS_SECRET_ACCESS_KEY(andAWS_SESSION_TOKEN) are not prepopulated at runtime in CodeBuild with the credentials for the associated IAM Role. There is an additional explicit step need to retrieve those temporary credentials via a request to$AWS_CONTAINER_CREDENTIALS_FULL_URIand then setting them.Happy to confirm that doing exactly this allows the CSX file to execute successfully picking up the credential material from the environmental variables
Thanks @normj, @dscpinheiro and @filipw for your time, attention and support!