Bump AWS SDK to support sts:AssumeRoleWithWebIdentity

[siwyd]

Description of changes:

In order to support native AWS IAM integration with Kubernetes,
the AWS SDK needs to be bumped to v1.23.13 at least. This PR
bumps the AWS SDK to v1.24.1.

More info: https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/

Action performed: dep ensure -update github.com/aws/aws-sdk-go

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[samuelkarp]

Thanks for the contribution! Would you mind redoing this update on top of the changes made in #182?

[siwyd]

@samuelkarp Redid SDK update and rebased.

[siwyd]

@samuelkarp Any chance of getting this merged some time soon? I'm blocked on getting native AWS IAM support into kaniko until amazon-ecr-credential-helper gets a new release containing an updated SDK (GoogleContainerTools/kaniko#780).

[tomelliff]

@siwyd have you got this working?

I tried building off your fork but the credential helper seems to be failing to get a credential chain when running in EKS with the appropriate service account. Using the AWS CLI in the same pod I can see that the pod can get credentials via the web identity method so it feels like either there's something missing here or I've done something wrong in using the credential helper in this way.

[siwyd]

@tomelliff Yeah, it works for me. I've only used it in combination with kaniko though. Can you try setting these environment variables perhaps?

AWS_EC2_METADATA_DISABLED=true
AWS_SDK_LOAD_CONFIG=true

[patstrom]

What is the status on this?

[siwyd]

@patstrom No idea. All I can do is ping @samuelkarp :)

[samuelkarp]

@siwyd Apologies for the delay and thanks for the contribution! @micahhausler was able to help me test this and it does appear to work.

[siwyd]

@samuelkarp Awesome, thanks! Is it possible to cut a release for this so other tools can incorporate the new binary?

[samuelkarp]

It looks like Kaniko is installing the credential helper through go get, so it should be able to retrieve the master branch and build it. As to a full release: I don't know when I'll have the chance to get one out. (The barrier to cutting releases and publishing binaries is a lot lower than last time since there's now a good amount of automation, but it hasn't gone to zero.)

[siwyd]

@samuelkarp Ah, didn't know, thanks! I'll see if maybe they can cut a new kaniko release.