fix(aws): stop storing credentials in Pulumi provider state#866
Open
apodhrad wants to merge 1 commit into
Open
fix(aws): stop storing credentials in Pulumi provider state#866apodhrad wants to merge 1 commit into
apodhrad wants to merge 1 commit into
Conversation
AWS credentials (access key, secret key, session token) were being set via Pulumi config, which caused them to be persisted in the provider resource state. When destroying a cluster provisioned with an older session token, Pulumi would use the expired credentials from state instead of the fresh ones from the environment, causing destroy to fail with ExpiredToken errors. Let the AWS SDK resolve credentials through its default credential chain (env vars, shared credentials file, IAM roles) instead of explicitly setting them in Pulumi config. Only the region is configured explicitly. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe AWS provider now maps only region configuration to ChangesAWS credential resolution
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/provider/aws/aws.go`:
- Around line 74-80: Add a one-time migration in SetAWSCredentials that removes
persisted aws:accessKey, aws:secretKey, and aws:sessionToken entries via
stack.RemoveConfig before or alongside setting envCredentials. Apply removal
only when those legacy keys exist, while preserving the existing region
configuration and SDK default credential-chain behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 061845ae-f970-4afe-8d3a-1c3a34ac5c50
📒 Files selected for processing (2)
pkg/provider/aws/aws.gopkg/provider/aws/constants/constants.go
💤 Files with no reviewable changes (1)
- pkg/provider/aws/constants/constants.go
Comment on lines
+74
to
+80
| // Only region is set via Pulumi config; credentials (access key, secret key, | ||
| // session token) are resolved by the AWS SDK's default credential chain so | ||
| // that expired tokens stored in the Pulumi provider state never shadow | ||
| // fresh environment credentials on later operations (e.g. destroy). | ||
| var envCredentials = map[string]string{ | ||
| awsConstants.CONFIG_AWS_REGION: "AWS_DEFAULT_REGION", | ||
| awsConstants.CONFIG_AWS_NATIVE_REGION: "AWS_DEFAULT_REGION", | ||
| awsConstants.CONFIG_AWS_ACCESS_KEY: "AWS_ACCESS_KEY_ID", | ||
| awsConstants.CONFIG_AWS_SECRET_KEY: "AWS_SECRET_ACCESS_KEY", | ||
| awsConstants.CONFIG_AWS_SESSION_TOKEN: "AWS_SESSION_TOKEN"} | ||
| awsConstants.CONFIG_AWS_NATIVE_REGION: "AWS_DEFAULT_REGION"} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Repo files matching aws.go/aws provider:"
fd -a 'aws\.go$' . | sed 's#^\./##' | head -100
echo
echo "Outline for pkg/provider/aws/aws.go if present:"
if [ -f pkg/provider/aws/aws.go ]; then
ast-grep outline pkg/provider/aws/aws.go || true
wc -l pkg/provider/aws/aws.go
sed -n '1,180p' pkg/provider/aws/aws.go | cat -n
fi
echo
echo "Search for SetAWSCredentials / envCredentials / credential config references:"
rg -n "SetAWSCredentials|envCredentials|CONFIG_AWS_(ACCESS|SECRET|SESSION|REGION)|accessKey|secretKey|sessionToken|RemoveConfig|SetConfig|GetConfig|StackConfiguration" . --glob '!node_modules' --glob '!dist' --glob '!build' | head -200Repository: redhat-developer/mapt
Length of output: 34564
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
p=Path('pkg/provider/aws/aws.go')
text=p.read_text() if p.exists() else ''
checks={
'has_pkg': p.exists(),
'line_count': len(text.splitlines()),
'has_envCredentials': 'envCredentials' in text,
'has_access_key_mapping': 'aws:accessKey' in text or 'CONFIG_ACCESS_KEY' in text,
'has_secret_key_mapping': 'aws:secretKey' in text or 'CONFIG_SECRET_KEY' in text,
'has_session_token_mapping': 'aws:sessionToken' in text or 'CONFIG_SESSION_TOKEN' in text,
'has_SetAWSCredentials': 'SetAWSCredentials' in text,
'has_remove_config': any(s in text for s in ['DeleteConfig', 'RemoveConfig', 'SetAWSCredentials']),
}
for k,v in checks.items():
print(f'{k}: {v}')
if p.exists():
idx=text.find('var envCredentials')
if idx!=-1:
print('--- envCredentials block ---')
endidx=text.find('}', idx)+1
print(text[idx:endidx])
PYRepository: redhat-developer/mapt
Length of output: 552
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "constants:"
cat -n pkg/provider/aws/constants/constants.go | sed -n '1,40p'
echo
echo "manager stack implementation around credentials:"
rg -n "ProviderCredentials|SetAw|Config" pkg/manager pkg/manager/context -A5 -B5 --glob '!vendor' --glob '!dist' --glob '!build' | head -240
echo
echo "candidate manager stack file:"
fd -a 'stack\.go$|.*\.go$' pkg/manager | sed 's#^\./##' | while read -r f; do
if rg -q "ProviderCredentials|SetConfig|SetAWSCredentials|DestroyStack" "$f"; then
echo "--- $f"
wc -l "$f"
sed -n '1,220p' "$f" | cat -n
fi
done
echo
echo "Pulumi SDK local_workspace config behavior (source-only):"
if [ -d vendor/github.com/pulumi/pulumi/sdk/v3/go/auto ]; then
rg -n "func \\(l \\*LocalWorkspace\\) SetConfig|func SetConfig|RemoveConfig|Save" vendor/github.com/pulumi/pulumi/sdk/v3/go/auto/local_workspace.go -A8 -B4
else
echo "vendor path missing"
fiRepository: redhat-developer/mapt
Length of output: 24577
Clean up legacy AWS credential config in existing stacks.
SetAWSCredentials only writes keys in envCredentials via stack.SetConfig, so it does not remove existing persisted aws:accessKey, aws:secretKey, or aws:sessionToken values. Add a one-time migration that stack.RemoveConfigs those keys for stacks that already store them, otherwise existing stacks can still prefer stale Pulumi provider credentials over the SDK default chain.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pkg/provider/aws/aws.go` around lines 74 - 80, Add a one-time migration in
SetAWSCredentials that removes persisted aws:accessKey, aws:secretKey, and
aws:sessionToken entries via stack.RemoveConfig before or alongside setting
envCredentials. Apply removal only when those legacy keys exist, while
preserving the existing region configuration and SDK default credential-chain
behavior.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AWS credentials (access key, secret key, session token) were being set via Pulumi config, which caused them to be persisted in the provider resource state. When destroying a cluster provisioned with an older session token, Pulumi would use the expired credentials from state instead of the fresh ones from the environment, causing destroy to fail with ExpiredToken errors.
Let the AWS SDK resolve credentials through its default credential chain (env vars, shared credentials file, IAM roles) instead of explicitly setting them in Pulumi config. Only the region is configured explicitly.