Rusoto: Using AWS Credentials to create multiple underlying clients

[Mythra]

:wave: Been quite a bit but I'm running into an issue with one of my specific implementations. Specifically, I need to create an STS Client for 1..N accounts, and then do something with EC2 in the regions I'm configured for (which is also 1..N).

For a rough sketch here's a boiled down version of what the code is trying to do:

fn main() {
  let roles = vec!["arn:aws....", "arn:aws..."];
  let regions = vec!["us-east-1", "us-west-2"];
  roles
    .iter()
    .map(|role_to_assume| {
      let sts = StsClient::new(Region::UsEast1);
      let creds = AutoRefreshingProvider::new(
        StsAssumeRoleSessionCredentialsProvider::new(
          sts,
          role_to_assume.to_string(),
          "my-app-role".to_owned(),
          None, None, None, None
        )
      ).expect("Failed to setup autorefreshing provider!");
      regions
        .iter()
        .map(|region| {
          let ec2 = Ec2Client::new_with(
            HttpClient::new().expect("Failed to create HTTP(s) client!"),
            creds,
            Region::from_str(region).expect("Invalid region specified!")
          );
          // Do some things with ec2....
        });
    }).count();
}

Unfortunately this does not work since Ec2Client wants to take ownership of the credentials provider instead of using a reference (or letting the credentials providers Sts + AutoRefreshing implement copy/clone).

(There's also a bit of "eh this is unideal" by needing to create an StsClient for each account instead of reusing the same one).

It'd be great if we could let Credentials Providers/HttpClients be passed as references to all clients since I imagine they don't truly need ownership, and this is just an ideal form of codegen.

[matthewkmayer]

I'd love a hand with this as our implementation of STS needs some eyes and work on. ❤️

[matthewkmayer]

This also sounds related to https://github.com/rusoto/rusoto/issues/770 . Some day I'll get the time to learn me some async/futures well, but that's not today.

[srijs]

@insanitybit To solve your immediate problem, we have an impl impl<P: ProvideAwsCredentials> ProvideAwsCredentials for Arc<P>, so you should be able to wrap creds into an Arc and just clone it for every region.

Clients actually need to hold onto to the crendential provider, which is why we can't just accept a reference. That said, I can't see any reason why we couldn't make the StsAssumeRoleSessionCredentialsProvider and friends clonable, in most cases that'll boil down to changing from Box to Arc for their internal reference to the StsSessionCredentialsClient (e.g. https://github.com/rusoto/rusoto/blob/master/rusoto/services/sts/src/custom/credential.rs#L182).

[insanitybit]

I think you meant @SecurityInsanity :)

[srijs]

Thanks, apologies to the both of you :)

[copumpkin]

@srijs if it gets cloned, would it share the same underlying temporary credentials across regions or would there be one AssumeRole call per region?