[extensions/sigv4auth] sigv4auth requires AWS credentials to run 'validate' subcommand

[tredman]

Component(s)

extension/sigv4auth

Describe the issue you're reporting

Hello! I'm trying to invoke validate from a build pipeline so that we do basic validation of the OTEL configs we're pushing out to our users. Recently I added an exporter for Amazon Managed Prometheus, which requires the sigv4auth extension in order to authenticate.

      sigv4auth/amp:
        service: 'aps'
        region: 'us-east-1'

After doing this, validate fails to run with the following error:

Error: extensions::sigv4auth/amp: could not retrieve credential provider: failed to refresh cached credentials, no EC2 IMDS role found, operation error ec2imds: GetMetadata, exceeded maximum number of attempts, 3, request send failed, Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": dial tcp 169.254.169.254:80: connect: host is down
2024/04/07 08:37:16 collector server run finished with error: extensions::sigv4auth/amp: could not retrieve credential provider: failed to refresh cached credentials, no EC2 IMDS role found, operation error ec2imds: GetMetadata, exceeded maximum number of attempts, 3, request send failed, Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": dial tcp 169.254.169.254:80: connect: host is down

Initially I resolved this by authenticating to one of my AWS accounts, but through experimentation I found I can fix this by supplying arbitrary/invalid values for the environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. This seems like something that the validation command should just handle gracefully, perhaps by just initializing the AWS SDK with some kind of mock config.

otelcol-contrib version 0.97.0

[github-actions]

Pinging code owners:

• extension/sigv4auth: @Aneurysm9 @erichsueh3

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[bryan-aguilar]

I believe this is because we try to get the provider during config validation. I'm not sure if credentials validation should be part of validating the configuration. It may make more sense to do this when the extension is created and then return an error from newSigV4Extension. I believe this change would cause the validate to pass when no credentials exist, but fail on collector startup. This would preserve existing behavior.

If someone decides to take this on I think another improvement to make would be removing the private credsProvider field out of the config struct and moving into the sigv4auth struct.

[github-actions]

This issue has been inactive for 60 days. It will be closed in 60 days if there is no activity. To ping code owners by adding a component label, see Adding Labels via Comments, or if you are unsure of which component this issue relates to, please ping @open-telemetry/collector-contrib-triagers. If this issue is still relevant, please ping the code owners or leave a comment explaining why it is still relevant. Otherwise, please close it.

Pinging code owners:

• extension/sigv4auth: @Aneurysm9 @erichsueh3

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[mvillafuertem]

Hi @tredman

When I have to use osis and when I have to use aps? I haven't found any documentation about it...

      sigv4auth:
        service: 'aps'
        region: 'us-east-1'

      sigv4auth:
        service: 'osis'
        region: 'us-east-1'

[tredman]

Hi @tredman

When I have to use osis and when I have to use aps? I haven't found any documentation about it...

      sigv4auth:
        service: 'aps'
        region: 'us-east-1'

      sigv4auth:
        service: 'osis'
        region: 'us-east-1'

This seems unrelated to my issue but osis looks like OpenSearch Ingestion. aps is for Amazon Managed Prometheus

[github-actions]

This issue has been inactive for 60 days. It will be closed in 60 days if there is no activity. To ping code owners by adding a component label, see Adding Labels via Comments, or if you are unsure of which component this issue relates to, please ping @open-telemetry/collector-contrib-triagers. If this issue is still relevant, please ping the code owners or leave a comment explaining why it is still relevant. Otherwise, please close it.

Pinging code owners:

• extension/sigv4auth: @Aneurysm9 @erichsueh3

See Adding Labels via Comments if you do not have permissions to add labels yourself.