From eba046d3cbcc845ba4a280718cd5ed24ad140cef Mon Sep 17 00:00:00 2001
From: Will Browne <wbrowne@users.noreply.github.com>
Date: Fri, 13 Nov 2020 10:27:35 +0100
Subject: [PATCH] Auth: Enable more complete credential chain for SigV4 default
 SDK auth option (#29065)

* Force more complete credential chain for default auth option

* simplify

* allow assume role for default
---
 pkg/models/sigv4.go | 43 ++++++++++++++++++++++++-------------------
 1 file changed, 24 insertions(+), 19 deletions(-)

diff --git a/pkg/models/sigv4.go b/pkg/models/sigv4.go
index 72fad32cbf9..d4fe0287172 100644
--- a/pkg/models/sigv4.go
+++ b/pkg/models/sigv4.go
@@ -11,7 +11,6 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/credentials/stscreds"
-	"github.com/aws/aws-sdk-go/aws/defaults"
 	"github.com/aws/aws-sdk-go/aws/session"
 	v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
 	"github.com/aws/aws-sdk-go/private/protocol/rest"
@@ -90,9 +89,30 @@ func (m *SigV4Middleware) signRequest(req *http.Request) (http.Header, error) {
 }
 
 func (m *SigV4Middleware) signer() (*v4.Signer, error) {
-	c, err := m.credentials()
-	if err != nil {
-		return nil, err
+	authType := AuthType(m.Config.AuthType)
+
+	var c *credentials.Credentials
+	switch authType {
+	case Keys:
+		c = credentials.NewStaticCredentials(m.Config.AccessKey, m.Config.SecretKey, "")
+	case Credentials:
+		c = credentials.NewSharedCredentials("", m.Config.Profile)
+	}
+
+	// passing nil credentials will force AWS to allow a more complete credential chain vs the explicit default
+	if c == nil {
+		s, err := session.NewSession(&aws.Config{
+			Region: aws.String(m.Config.Region),
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		if m.Config.AssumeRoleARN != "" {
+			return v4.NewSigner(stscreds.NewCredentials(s, m.Config.AssumeRoleARN)), nil
+		}
+
+		return v4.NewSigner(s.Config.Credentials), nil
 	}
 
 	if m.Config.AssumeRoleARN != "" {
@@ -109,21 +129,6 @@ func (m *SigV4Middleware) signer() (*v4.Signer, error) {
 	return v4.NewSigner(c), nil
 }
 
-func (m *SigV4Middleware) credentials() (*credentials.Credentials, error) {
-	authType := AuthType(m.Config.AuthType)
-
-	switch authType {
-	case Default:
-		return defaults.CredChain(defaults.Config(), defaults.Handlers()), nil
-	case Keys:
-		return credentials.NewStaticCredentials(m.Config.AccessKey, m.Config.SecretKey, ""), nil
-	case Credentials:
-		return credentials.NewSharedCredentials("", m.Config.Profile), nil
-	}
-
-	return nil, fmt.Errorf("unrecognized authType: %s", authType)
-}
-
 func replaceBody(req *http.Request) ([]byte, error) {
 	if req.Body == nil {
 		return []byte{}, nil