Aws-codebuild-docker-images: aws-adfs generated token support for codebuild_build.sh via --profile option?

[irishgordo]

Hey there, I really enjoy this project, dig the concept!

Sadly I've been a bit hung up and have been encountering issues overcoming:

agent_1 | [Container] 2019/02/11 20:37:19 Phase context status code: Decrypted Variables Error Message: UnrecognizedClientException: The security token included in the request is invalid.
agent_1 | status code: 400, request id: 5f03ed61-1198-4b5e-a79f-259ac8cdb295
agent_1 | [Container] 2019/02/11 20:37:19 Runtime error (*awserr.requestError: UnrecognizedClientException: The security token included in the request is invalid.
agent_1 | status code: 400, request id: 5f03ed61-1198-4b5e-a79f-259ac8cdb295)

Errors.

I use the https://github.com/venth/aws-adfs (aws-adfs) in order to generate my tokens for work on the CLI.

I have tried to avoid anything being read from ~/.aws/credentials by echo "" > ~/.aws/credentials ONLY after running sts assume-role --role-arn xxxxxx --role-session-name yyyy ; then in the shell assigning AWS_SECRET_ACCESS_KEY=aaaaaa and AWS_SESSION_TOKEN=bbbbbb {filled in with content received from the aws-cli sts assume-role call} - Then calling ./codebuild_build.sh -i aws/codebuild/java:openjdk-8 -a xxxxx -b cccc.yaml -e env.txt -c
Only to encounter the security token being invalid

I have also tried instead of declaring shell variables on the tty session, just crafting a fresh ~/.aws/credentials with a:
[master]
aws_secret_access_key = bbbbbbb
aws_session_token = zzzzzzzz
and re-running the above command with the same result of the security token being invalid

I know when I run the command:
aws ssm get-parameter --name SuperCoolName --profile MyProfile --with-decryption
I do get the appropriate parameter back down, which is great... so via command line it's working

Any info or input would be awesome!
Thanks a ton!

[awszhen]

Hi @djmrr , could you please give us your docker run command? Are you missing AWS_ACCESS_KEY_ID? Thanks!

[irishgordo]

Hey @awszhen thanks for writing back!
I am executing the codebuild_build.sh, I just chmod +x 'd it so that I could have it be executable and call it via: ./codebuild_build.sh
{the command I execute:}

validate-codebuild-buildspecs/codebuild_build.sh -i aws/codebuild/java:openjdk-8 -a validate-codebuild-buildspecs/out/ -b ./buildspec_build_artifact.yaml -e validate-codebuild-buildspecs/env.txt -c

{the docker command it runs:}

docker run -it -v /var/run/docker.sock:/var/run/docker.sock -e "IMAGE_NAME=aws/codebuild/java:openjdk-8" -e "ARTIFACTS=/Users/mike.russell/Projects/bcrbannerwriter/validate-codebuild-buildspecs/out/" -e "SOURCE=/Users/mike.russell/Projects/bcrbannerwriter" -e "BUILDSPEC=/Users/mike.russell/Projects/bcrbannerwriter/buildspec_build_artifact.yaml" -v "/Users/mike.russell/Projects/bcrbannerwriter/validate-codebuild-buildspecs:/LocalBuild/envFile/" -e "ENV_VAR_FILE=env.txt" -e "AWS_CONFIGURATION=/Users/mike.russell/.aws" -e "INITIATOR=mike.russell" amazon/aws-codebuild-local:latest

{the output of it:}

Removing agent-resources_build_1 ... done
Removing agent-resources_agent_1 ... done
Removing network agent-resources_default
Removing volume agent-resources_source_volume
Removing volume agent-resources_user_volume
Creating network "agent-resources_default" with the default driver
Creating volume "agent-resources_source_volume" with local driver
Creating volume "agent-resources_user_volume" with local driver
Creating agent-resources_agent_1 ... done
Creating agent-resources_build_1 ... done
Attaching to agent-resources_agent_1, agent-resources_build_1
agent_1 | [Container] 2019/02/12 17:12:13 Waiting for agent ping
agent_1 | [Container] 2019/02/12 17:12:14 Waiting for DOWNLOAD_SOURCE
agent_1 | [Container] 2019/02/12 17:12:15 Phase is DOWNLOAD_SOURCE
agent_1 | [Container] 2019/02/12 17:12:15 CODEBUILD_SRC_DIR=/codebuild/output/src748988821/src
agent_1 | [Container] 2019/02/12 17:12:15 YAML location is /codebuild/readonly/src/buildspec_build_artifact.yaml
agent_1 | [Container] 2019/02/12 17:12:15 Processing environment variables
agent_1 | [Container] 2019/02/12 17:12:15 Decrypting parameter store environment variables
agent_1 | [Container] 2019/02/12 17:12:15 Phase complete: DOWNLOAD_SOURCE Success: false
agent_1 | [Container] 2019/02/12 17:12:15 Phase context status code: Decrypted Variables Error Message: UnrecognizedClientException: The security token included in the request is invalid.
agent_1 | status code: 400, request id: 91c61e64-e7a6-4246-ac3e-96dc85d46c25
agent_1 | [Container] 2019/02/12 17:12:15 Runtime error (*awserr.requestError: UnrecognizedClientException: The security token included in the request is invalid.
agent_1 | status code: 400, request id: 91c61e64-e7a6-4246-ac3e-96dc85d46c25)
agent-resources_build_1 exited with code 255
Aborting on container exit...

I guess one problem is, the token gets built as another "profile", that's a "master" token, I usually, then switch over to other profiles like: --profile ImportantProfileA or --profile ImportantProfileB ; but I can't build a token based around ImportantProfileA or ImportantProfileB unless I leverage:

aws sts assume-role --profile ImportantProfileA --role-arn AAA:BBB:CCC:XXXXXXX:role/DeveloperRole --role-session-name YYYYYY

I take the output of the sts and rebuild my ~/.aws/credentials like:

[master]
aws_access_key_id = XXXXXXXXXX
aws_secret_access_key = YYYYYYYYYYY
aws_session_token = AAAAAAAAAABBBBBBBBBCCCCCCCCCCCDDDDDDD

[awszhen]

@djmrr , would you please set environment variables for AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN? And then try again? We do not read AWS_SESSION_TOKEN from ~/.aws/credentials. AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN should appear in your docker run command.

[irishgordo]

@awszhen sorry for the super delayed response!

I ended up writing some additional functionality to the codebuild_build.sh script, I added the ability for a user to choose what runtime they want, then pull down both that runtime codebuild-docker-image and the codebuild agent from docker-hub like:

aws_docker_source="https://github.com/aws/aws-codebuild-docker-images.git"
adjust_java_runtime=true
adjust_java_runtime_name="#:ubuntu/java/openjdk-8"
adjust_java_runtime_tag_name="aws/codebuild/java:openjdk-8"
adjust_java_name="java-8"

if $adjust_java_runtime
then
    printf "\n What runtime do you want? (IE: java-8, java-9, java-10, java-11) \n"
    read adjust_java_name
    case $adjust_java_name in
        java-7)
            echo "setting to jdk 7"
            adjust_java_runtime_tag_name="aws/codebuild/java:openjdk-7"
            adjust_java_runtime_name="#:ubuntu/java/openjdk-7"
            ;;
        java-8)
            echo "setting to jdk 8"
            adjust_java_runtime_tag_name="aws/codebuild/java:openjdk-8"
            adjust_java_runtime_name="#:ubuntu/java/openjdk-8"
            ;;
        java-9)
            echo "setting to jdk 9"
            adjust_java_runtime_tag_name="aws/codebuild/java:openjdk-9"
            adjust_java_runtime_name="#:ubuntu/java/openjdk-9"
            ;;
        java-10)
            echo "setting to jdk 10"
            adjust_java_runtime_tag_name="aws/codebuild/java:openjdk-10"
            adjust_java_runtime_name="#:ubuntu/java/openjdk-10"
            ;;
        java-11)
            echo "setting to jdk 11"
            adjust_java_runtime_tag_name="aws/codebuild/java:openjdk-11"
            adjust_java_runtime_name="#:ubuntu/java/openjdk-11"
            ;;
    esac
    echo "Grabbing main codebuild agent, will grab latest if there are updates..."
    docker pull amazon/aws-codebuild-local:latest --disable-content-trust=false
    echo "Grabbing the enivronment image you want for the codebuild runtime..."
    docker build -t $adjust_java_runtime_tag_name $aws_docker_source$adjust_java_runtime_name
fi

Kinda like that way both docker images remain fresh and updated as they're continuously curated to be awesome by all y'all.

I also wanted to do some automated sts assume-role stuff like:

aws-adfs login --profile=master --adfs-host=adfs.something.something --no-ssl-verification
aws sts --profile AWESOME assume-role --role-arn arn:aws:iam::XXXXXXXXXXX:role/DeveloperRole --role-session-name codebuildlocal > stsjson.json
buildtime_aws_access_key_id="$(cat stsjson.json | jq -r '.Credentials' | jq '.AccessKeyId')"
buildtime_aws_secret_access_key="$(cat stsjson.json | jq -r '.Credentials' | jq '.SecretAccessKey')"
buildtime_aws_session_token="$(cat stsjson.json | jq -r '.Credentials' | jq '.SessionToken')"
buildtime_aws_default_region="$(aws configure get region)"
buildtime_aws_region="$(aws configure get region)"
docker_command+=" -e \"AWS_REGION=$buildtime_aws_region\""
docker_command+=" -e \"AWS_SECRET_ACCESS_KEY=$buildtime_aws_secret_access_key\""
docker_command+=" -e \"AWS_ACCESS_KEY_ID=$buildtime_aws_access_key_id\""
docker_command+=" -e \"AWS_SESSION_TOKEN=$buildtime_aws_session_token\""
docker_command+=" -e \"AWS_DEFAULT_REGION=$buildtime_aws_default_region\""
rm stsjson.json

and then this I modified:

docker_command+="\"IMAGE_NAME=$adjust_java_runtime_tag_name\" -e \
    \"ARTIFACTS=$(allOSRealPath $artifact_dir)\" -e \
    \"SOURCE=$source_dir\""

Thanks again for leading me to what I was chasing with making sure the script is really injecting in the AWS docker env vars, with the "-e " stuff on the docker run -t command!

I appreciate all the help!

[awszhen]

@djmrr , marking this as resolved. Please let me know if you have any other questions. Thanks!