[TT-15741] Fixed issue with Kinesis not handling IMDS credentials

[LLe27]

Description

Tyk Pump fails to authenticate with AWS Kinesis when using EC2 Instance Metadata Service (IMDS) or IRSA (IAM Roles for Service Accounts) credentials. Analytics records are silently dropped. The root cause is a version skew in the aws-sdk-go-v2 dependency tree — the core SDK module (v1.31.0, Oct 2024) is incompatible with companion modules (config v1.9.0, credentials v1.6.1, sts v1.10.0) that are pinned to 2021 releases. The fix is a go.mod dependency update to align all modules to compatible versions.

Related Issue

TT-15741: Tyk Pump failing to send records to Kinesis due to IMDS credential resolution error

Motivation and Context

How This Has Been Tested

Screenshots (if appropriate)

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist

• Make sure you are requesting to pull a topic/feature/bugfix branch (right side). If pulling from your own
  fork, don't request your master!
• Make sure you are making a pull request against the master branch (left side). Also, you should start
  your branch off our latest master.
• My change requires a change to the documentation.
  • If you've changed APIs, describe what needs to be updated in the documentation.
• I have updated the documentation accordingly.
• Modules and vendor dependencies have been updated; run go mod tidy && go mod vendor
• I have added tests to cover my changes.
• All new and existing tests passed.
• Check your code additions will not fail linting checks:
  • go fmt -s
  • go vet

[probelabs]

This PR fixes a critical authentication issue with the AWS Kinesis pump where it fails to use EC2 Instance Metadata Service (IMDS) or IAM Roles for Service Accounts (IRSA) for credentials. The root cause was an incompatibility between different aws-sdk-go-v2 modules due to outdated versions. The fix consists of updating all aws-sdk-go-v2 dependencies in go.mod to aligned, compatible versions, ensuring proper credential resolution and allowing analytics data to be successfully sent to Kinesis.

Files Changed Analysis

• go.mod & go.sum: These files were modified to update the versions of aws-sdk-go-v2 and its related modules (config, credentials, kinesis, sqs, timestreamwrite). This is a dependency-only change with no modifications to the application's source code.

Architecture & Impact Assessment

• Accomplishment: Resolves a bug that prevented Tyk Pump from authenticating with AWS services (Kinesis, SQS, Timestream) when using modern, role-based authentication methods like IMDS and IRSA.
• Technical Changes: Bumps versions of multiple aws-sdk-go-v2 packages to ensure compatibility and correct functionality of the credential provider chain.
• Affected Components: The primary component fixed is the Kinesis pump. However, the dependency updates also affect other pumps that use the AWS SDK, including SQS and Timestream, likely resolving similar potential authentication issues in them as well.

graph TD
    subgraph Tyk Pump
        A[Kinesis Pump]
        B[SQS Pump]
        C[Timestream Pump]
    end
    subgraph AWS SDK v2
        D[aws-sdk-go-v2]
        E[IMDS/IRSA Credential Provider]
    end
    subgraph AWS Services
        F[Kinesis]
        G[SQS]
        H[Timestream]
    end

    A -- uses --> D
    B -- uses --> D
    C -- uses --> D
    D -- authenticates via --> E
    A -- sends data to --> F
    B -- sends data to --> G
    C -- sends data to --> H

    style D fill:#f9f,stroke:#333,stroke-width:2px
    style E fill:#f9f,stroke:#333,stroke-width:2px

Loading

Scope Discovery & Context Expansion

The change, while targeted at fixing a Kinesis issue, updates the core AWS SDK modules used by other components. The updated dependencies for sqs and timestreamwrite indicate that the SQS and Timestream pumps are also affected. This PR ensures that any part of Tyk Pump leveraging the AWS SDK v2 for authentication will now use the updated, correct credential resolution chain, improving reliability in containerized and EC2 environments.

References

• pumps/kinesis.go: Contains the implementation for the Kinesis pump, which initializes and uses the AWS Kinesis client.
• go.mod: Defines the project dependencies, where the aws-sdk-go-v2 versions were updated.

Metadata

• Review Effort: 2 / 5
• Primary Label: bug

---

Powered by Visor from Probelabs

Last updated: 2026-05-07T20:13:33.296Z | Triggered by: pr_opened | Commit: a565e7b

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

✅ Security Check Passed

No security issues found – changes LGTM.

✅ Performance Check Passed

No performance issues found – changes LGTM.

✅ Security Check Passed

No security issues found – changes LGTM.

\n\n \n\n

✅ Performance Check Passed

No performance issues found – changes LGTM.

\n\n

✅ Quality Check Passed

No quality issues found – changes LGTM.

---

Powered by Visor from Probelabs

Last updated: 2026-05-07T20:13:19.959Z | Triggered by: pr_opened | Commit: a565e7b

💡 TIP: You can chat with Visor using /visor ask <your question>

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud