fix: timeout risk in usages of lua-resty-aws
#12070
Conversation
dosubot
bot
added
size:M
| @@ -14,8 +14,12 @@ | |||
| -- See the License for the specific language governing permissions and | |||
| -- limitations under the License. | |||
| -- | |||
| require("resty.aws.config") -- to read env vars before initing aws module | |||
There was a problem hiding this comment.
Do you want the default value of false for AWS_EC2_METADATA_DISABLED to cause access to IDMS to be turned off by default unless the user explicitly turns it on?
Can you give a more detailed argument for its use? 🤔
There was a problem hiding this comment.
I added this line mainly as a standard practice. (To read AWS specific ENV vars when APISIX is deployed in AWS environment)
Do you want the default value of false for AWS_EC2_METADATA_DISABLED to cause access to IDMS to be turned off by default unless the user explicitly turns it on?
No, I added this to ensure the IDMS query can be disabled if need be.
There was a problem hiding this comment.
Therefore, it obeys those predefined environment variables anyway, and the initialization process for aws instance is moved to when the AWS API request actually occurs.
IDMS requests don't happen if the plugin configuration contains user-set AK/SK?
There was a problem hiding this comment.
IDMS requests don't happen if the plugin configuration contains user-set AK/SK?
as per my last test, IDMS request happened anyway. Even if configuration contained user-set AK/SK.
There was a problem hiding this comment.
So this will block requests when API calls are incoming, or block the secret manager.
Unless the user explicitly specifies AWS_EC2_METADATA_DISABLED as true to disable IDMS request?
There was a problem hiding this comment.
So this will block requests when API calls are incoming, or block the secret manager.
yes, but only for the first time.
Description
When initializing the lua-resty-aws module, it may send requests to IDMS endpoint which may timeout in non-aws environment or just introduce delays in some cases. Thus it is good to remove the initialisation from the module level.
Also, it is unnecessary to initialise the module for each request. This problem has also been fixed which ensures that if any there are any delays in initialising the module, such delay would occur only once.
Checklist