Following v0.2.1, applications using Vault cannot login via AWS Method on EKS

[adrien-f]

Describe the bug

Greetings! Following /~https://github.com/hashicorp/go-secure-stdlib/pull/57/files we started to notice our applications could not connect to Vault via their IAM Role (in an EKS cluster).

I've debugged this to:

In Vault in /~https://github.com/hashicorp/vault/blob/main/api/auth/aws/aws.go#L152-L157 they create the CredentialsConfig like this:

credsConfig := awsutil.CredentialsConfig{
		AccessKey:    os.Getenv("AWS_ACCESS_KEY_ID"),
		SecretKey:    os.Getenv("AWS_SECRET_ACCESS_KEY"),
		SessionToken: os.Getenv("AWS_SESSION_TOKEN"),
		Logger:       logger,
}

Instead of going through NewCredentialsConfig, the struct is created with most fields empty.

This used to be okay because environment variables were then checked in GenerateCredentialChain, like this:

go-secure-stdlib/awsutil/generate_credentials.go

Lines 151 to 162 in cd81001

	roleARN := c.RoleARN
	if roleARN == "" {
	roleARN = os.Getenv("AWS_ROLE_ARN")
	}
	tokenPath := c.WebIdentityTokenFile
	if tokenPath == "" {
	tokenPath = os.Getenv("AWS_WEB_IDENTITY_TOKEN_FILE")
	}
	roleSessionName := c.RoleSessionName
	if roleSessionName == "" {
	roleSessionName = os.Getenv("AWS_ROLE_SESSION_NAME")
	}

But this changed with #57 where this was pushed in the struct initializer, so roleARN is not filled anymore from the environment by default.

To Reproduce
Steps to reproduce the behavior:

1. Try to login in an EKS pod with its IAM role and default environment variables via

	if auth, err = awsauth.NewAWSAuth(awsauth.WithRegion("us-east-1")); err != nil {
		return ErrorAWSSessionDetails(v.driver, nil, err)
	}
	if info, err = (*api.Client).Auth().Login(context.Background(), auth); err != nil {
		return errors.Errorf("unable to login to aws auth method with reason: %v", err)
	}

2. See error

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here.

Let me know if I can provide you with more details 👍