Router does not support using EC2 IAM role for S3 storage provider

[lachlan-smith]

Component(s)

router

Component version

0.121.0

wgc version

0.66.2

controlplane version

n/a

router version

0.121.0

What happened?

Description

When using the routers with the S3 storage provider and deploying to EKS, it is not possible to use the EKS/EC2 node IAM role for authenticating against S3.

This appears to be because of the way the minio-go client is being instantiated, by only providing a static credentials configuration.

When deploying into an EKS cluster, using IAM roles are preferable as kubelet will intercept the calls to the AWS API and handle authentication on your behalf using the IAM role/policy assigned to the EC2 node. More info on how this can be found here https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html

Steps to Reproduce

In the routers config.yaml, configure a storage provider and attempt to load the execution config from it

storage_providers:
  s3:
  - id: "s3"
    endpoint: "s3.amazonaws.com"
    bucket: "my-config-bucket"
    region: "us-east-1"
    secure: true

execution_config:
  storage:
    provider_id: s3
    object_path: "execution-config.json"

Expected Result

The router is able to load the execution configuration from the bucket and start successfully.

Actual Result

The router fails to start and logs an "Access denied" error when trying to load the execution configuration from the S3 bucket.

Environment information

Environment

OS: AWS EKS (Kubernetes 1.29)
Package Manager: npm
Compiler(if manually compiled): n/a

Router configuration

No response

Router execution config

No response

Log output

No response

Additional context

No response

[github-actions]

WunderGraph commits fully to Open Source and we want to make sure that we can help you as fast as possible.
The roadmap is driven by our customers and we have to prioritize issues that are important to them.
You can influence the priority by becoming a customer. Please contact us here.

[lachlan-smith]

I've opened a PR with a fix here #1250

[lachlan-smith]

Resolved with 5d67c4b