Skip to content

Add support for for AWS_WEB_IDENTITY_TOKEN_FILE

Hi team, I see there are a few other issues where it's requested to update the current version of the AWS SDK (currently pined to v1.4.10 https://gitlab.com/gitlab-org/ci-cd/docker-machine/-/blob/master/Gopkg.lock).

In addition to those, I'm attempting to run a gitlab-runner on EKS with the docker+machine executor configured (as some job workloads require EC2 instances instead of EKS pods, I've a separate runner configured with the kubernetes executor). The difference is instead of using ~/.aws/credentials or passing in AWS_ACCESS_KEY_ID, I'm using their service account annotations as a nicer way of handing out IAM permissions (eks.amazonaws.com/role-arn). Doing it this way populates AWS_WEB_IDENTITY_TOKEN_FILE, which only works with recent versions of their SDK, as noted here https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-minimum-sdk.html

I believe using an IAM instance profile attached to an EC2 instance does the same thing so could definitely benefit from updating the SDK, and making any necessary code changes :)

Edited by Tiago Baptista