Pass the AWS_ROLE_ARN to the config

[shivank2501]

Hello

How do I pass the AWS_ROLE_ARN to the config? The role I am using has permissions to put objects in the bucket.

Values.yaml

privatebin:
image:
repository: privatebin/nginx-fpm-alpine

configs:
conf.php: |-
[main]
fileupload = false
discussion = false
password = false
defaultformatter = "plaintext"
template = "bootstrap-dark"
syntaxhighlightingtheme = "sons-of-obsidian"
languageselection = false
zerobincompatibility = false
debug = false
qrcode = false
burnafterreading = false
[expire]
default = "1day"
[expire_options]
1day = 86400
[formatter_options]
plaintext = "Plain Text"
[traffic]
limit = 0
header = "X_FORWARDED_FOR"
dir = PATH "data"
[purge]
limit = 0
batchsize = 0
dir = PATH "data"
[model]
class = S3Storage
AWS_ROLE_ARN = "role_name"
[model_options]
region = "eu-central-1"
bucket = "test-bucket"
prefix = "privatebin/pastes"

Error:
Could not create paste: Error executing "HeadObject" on "https://test-bucket-eu-central-1.s3.eu-central-1.amazonaws.com/privatebin/pastes/efd1f42ac818444f"; AWS HTTP error: Client error: HEAD https://test-bucket-eu-central-1.s3.eu-central-1.amazonaws.com/privatebin/pastes/efd1f42ac818444f resulted in a 403 Forbidden response (client): 403 Forbidden (Request-ID: KEJHJHRSJ8QCA730) -

[elrido]

I don't use AWS so have no way of validating this - the community member that contributed the S3Storage backend for use with ceph, documented the following:

;[model]
; example of S3 configuration for AWS using its SDK default credential provider chain
; if relying on environment variables, the AWS SDK will look for the following:
; - AWS_ACCESS_KEY_ID
; - AWS_SECRET_ACCESS_KEY
; - AWS_SESSION_TOKEN (if needed)
; for more details, see https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/guide_credentials.html#default-credential-chain
;class = S3Storage
;[model_options]
;region = "eu-central-1"
;version = "latest"
;bucket = "my-bucket"

So it seems you would not be using the AWS_ROLE_ARN mechanism, but must instead inject these other environment variables into the system. We were asked by other community members to enable a number of AWS specific environment variables to get passed through to the php backend, so all of these should be available to the AWS SDK, if injected to the container:

; Amazon Web Services variables used with S3 backend
env[AWS_ACCESS_KEY_ID] = $AWS_ACCESS_KEY_ID
env[AWS_CONTAINER_AUTHORIZATION_TOKEN] = $AWS_CONTAINER_AUTHORIZATION_TOKEN
env[AWS_CONTAINER_CREDENTIALS_FULL_URI] = $AWS_CONTAINER_CREDENTIALS_FULL_URI
env[AWS_CONTAINER_CREDENTIALS_RELATIVE_URI] = $AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
env[AWS_DEFAULT_REGION] = $AWS_DEFAULT_REGION
env[AWS_PROFILE] = $AWS_PROFILE
env[AWS_ROLE_ARN] = $AWS_ROLE_ARN
env[AWS_ROLE_SESSION_NAME] = $AWS_ROLE_SESSION_NAME
env[AWS_SECRET_ACCESS_KEY] = $AWS_SECRET_ACCESS_KEY
env[AWS_SESSION_TOKEN] = $AWS_SESSION_TOKEN
env[AWS_STS_REGIONAL_ENDPOINTS] = $AWS_STS_REGIONAL_ENDPOINTS
env[AWS_WEB_IDENTITY_TOKEN_FILE] = $AWS_WEB_IDENTITY_TOKEN_FILE
env[AWS_SHARED_CREDENTIALS_FILE] = $AWS_SHARED_CREDENTIALS_FILE

So the final puzzle piece that I'm not sure about is if this helm chart will allow you to pass the relevant environment variables into the container or if that is something automatic that the kubernetes service used in AWS does for you.

Hope with these clues and your superior knowledge of the AWS platform allow you to work out or diagnose what is going on. The container image is alpine linux based, so you can exec an ash shell if you need to inspect the environment variables using printenv | grep AWS or such.