Export AWS Access Credentials If Needed

.example.env

@@ -16,6 +16,7 @@ VEDA_DOMAIN_ALT_HOSTED_ZONE_ID=[OPTIONAL SECOND HOSTED ZONE]
 VEDA_DOMAIN_ALT_HOSTED_ZONE_NAME=[OPTIONAL SECOND DOMAIN]
 
 VEDA_RASTER_ENABLE_MOSAIC_SEARCH=TRUE
-VEDA_RASTER_DATA_ACCESS_ROLE_ARN=[OPTIONAL ARN OF IAM ROLE TO BE ASSUMED BY RASTER API] 
+VEDA_RASTER_DATA_ACCESS_ROLE_ARN=[OPTIONAL ARN OF IAM ROLE TO BE ASSUMED BY RASTER API]
+VEDA_RASTER_EXPORT_ASSUME_ROLE_CREDS_AS_ENVS=False
 
 VEDA_DB_PUBLICLY_ACCESSIBLE=TRUE

docker-compose.yml

@@ -84,6 +84,8 @@ services:
       - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
       # API Config
       - VEDA_RASTER_ENABLE_MOSAIC_SEARCH=TRUE
+      - VEDA_RASTER_EXPORT_ASSUME_ROLE_CREDS_AS_ENVS=TRUE
+
 
     depends_on:
       - database

raster_api/infrastructure/config.py

@@ -59,6 +59,11 @@ class vedaRasterSettings(BaseSettings):
         description="Resource name of role permitting access to specified external S3 buckets",
     )
 
+    export_assume_role_creds_as_envs: Optional[bool] = Field(
+        False,
+        description="enables 'get_gdal_config' flow to export AWS credentials as os env vars",
+    )
+
     aws_request_payer: Optional[str] = Field(
         None,
         description="Set optional global parameter to 'requester' if the requester agrees to pay S3 transfer costs",

raster_api/runtime/src/app.py

@@ -40,7 +40,6 @@
 logging.getLogger("rio-tiler").setLevel(logging.ERROR)
 
 settings = ApiSettings()
-
 templates = Jinja2Templates(directory=str(resources_files(__package__) / "templates"))  # type: ignore
 
 if settings.debug:
@@ -54,6 +53,7 @@
 add_exception_handlers(app, DEFAULT_STATUS_CODES)
 add_exception_handlers(app, MOSAIC_STATUS_CODES)
 
+
 # Custom PgSTAC mosaic tiler
 mosaic = MosaicTilerFactory(
     router_prefix="/mosaic",

raster_api/runtime/src/config.py

@@ -2,6 +2,7 @@
 
 import base64
 import json
+import os
 from typing import Optional
 
 import boto3
@@ -83,6 +84,11 @@ def load_postgres_settings(self) -> "PostgresSettings":
         description="Resource name of role permitting access to specified external S3 buckets",
     )
 
+    export_assume_role_creds_as_envs: Optional[bool] = Field(
+        False,
+        description="enables 'get_gdal_config' flow to export AWS credentials as os env vars",
+    )
+
     def get_gdal_config(self):
         """return default aws session config or assume role data_access_role_arn credentials session"""
         # STS assume data access role for session credentials
@@ -91,6 +97,22 @@ def get_gdal_config(self):
                 data_access_credentials = get_role_credentials(
                     self.data_access_role_arn
                 )
+
+                # hack for issue https://github.com/NASA-IMPACT/veda-backend/issues/192
+                # which forces any nested `rasterio.Env` context managers (which run in separate threads)
+                # to pick up the assume-role `AWS_*` os env vars and re-init from there via:
+                # https://github.com/rasterio/rasterio/blob/main/rasterio/env.py#L204-L205
+                if self.export_assume_role_creds_as_envs:
+                    os.environ["AWS_ACCESS_KEY_ID"] = data_access_credentials[
+                        "AccessKeyId"
+                    ]
+                    os.environ["AWS_SECRET_ACCESS_KEY"] = data_access_credentials[
+                        "SecretAccessKey"
+                    ]
+                    os.environ["AWS_SESSION_TOKEN"] = data_access_credentials[
+                        "SessionToken"
+                    ]
+
                 return {
                     "session": AWSSession(
                         aws_access_key_id=data_access_credentials["AccessKeyId"],