java - 如何使用 AWS Java SDK 设置 AWS 容器凭证

Question

我想使用ContainerCredentialsProvider(CredentialsEndpointProvider)而不是 ContainerCredentialsProvider()，因为后者已被弃用。

目前，我正在使用已弃用的构造函数 ContainerCredentialsProvider()，如下所示:

AWSSimpleSystemsManagement ssm = 
    AWSSimpleSystemsManagementClientBuilder
        .standard()
        .withRegion(region)
        .withCredentials(new ContainerCredentialsProvider())
        .build();

CredentialsEndpointProvider 是一个抽象类。我需要在我的 docker 中使用类似 ECSCredentialsEndPointProvider 的东西，但我不确定该怎么做。感谢您的帮助。

Answer 1

我知道这有点晚了，但希望这能帮助像我这样的人，即使在 2020 年也遇到了这个问题:)

使用您的代码示例，您应该尝试一下

AWSSimpleSystemsManagement ssm = 
    AWSSimpleSystemsManagementClientBuilder
        .standard()
        .withRegion(region)
        .withCredentials(new EC2ContainerCredentialsProviderWrapper())
        .build();

EC2ContainerCredentialsProviderWrapper实现 AWSCredentialsProvider，从 Amazon Container (e.g. EC2) Credentials 加载凭证，按以下顺序解析:

1. If environment variable "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI" isset (typically on EC2) it is used to hit the metadata service at thefollowing endpoint: http://169.254.170.2
2. If environment variable "AWS_CONTAINER_CREDENTIALS_FULL_URI" is set it is used to hit a metadata service at that URI.Optionally an authorization token can be included in the "Authorization" header of the request by setting the "AWS_CONTAINER_AUTHORIZATION_TOKEN" environment variable.
3. If neither of the above environment variables are specified credentials are attempted to be loaded from Amazon EC2 Instance Metadata Service using the InstanceProfileCredentialsProvider.

这类似于弃用 ContainerCredentialsProvider() :

By default, the URI path is retrieved from the environment variable "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI" in the container's environment.

---

更新:如果您不确定将使用哪种机制或希望与环境变量、系统属性、配置文件凭据和容器凭据兼容，您可以使用 DefaultAWSCredentialsProviderChain这将确保尝试所有选项(正如@Imran 在评论中指出的那样):

AWSSimpleSystemsManagement ssm = 
    AWSSimpleSystemsManagementClientBuilder
        .standard()
        .withRegion(region)
        .withCredentials(new DefaultAWSCredentialsProviderChain())
        .build();

例如，1.11 SDK 的实现如下所示(它基本上会尝试所有选项，直到找到一个可行的选项):

public DefaultAWSCredentialsProviderChain() {
    super(new EnvironmentVariableCredentialsProvider(),
          new SystemPropertiesCredentialsProvider(),
          new ProfileCredentialsProvider(),
          new EC2ContainerCredentialsProviderWrapper());
}

这样您就可以与可能引入另一种身份验证类型的新版本兼容，或者如果一个选项被弃用。