mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-23 06:20:48 +02:00
364e19a493
* remote_storage/s3: use the AWS default credential chain when a source is configured Type s3 forced anonymous credentials whenever no access/secret key was set, so IRSA, container credentials, profiles and env keys were never consulted. Keep anonymous (public bucket) access only when the environment names no AWS credential source. * remote_storage/s3: also recognize shared-config and default-profile env sources * remote_storage/s3: resolve env credentials on their own transport A guarded HTTP client is for the S3 endpoint; the remote credential providers it would also serve reach link-local addresses that guard must not dial. Profiles load shared config, and a test resolves env keys. * remote_storage/s3: clear every detected credential source in the test * remote_storage/s3: resolve the full default chain on the guarded client The eager credential session used NewSession, whose chain covers only env, shared-credentials and ECS/EC2 providers. Web identity and assume-role profiles resolve through shared config, so IRSA never worked when a custom HTTP client was pinned. Enable shared config and carry the configured region so STS can sign assume-role requests. --------- Co-authored-by: Chris Lu <chrislusf@users.noreply.github.com> Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>