feat(mqconfig): support IAM role auth for SQS MQ provider#996
Open
ambroziepaval wants to merge 2 commits into
Open
feat(mqconfig): support IAM role auth for SQS MQ provider#996ambroziepaval wants to merge 2 commits into
ambroziepaval wants to merge 2 commits into
Conversation
The AWS SQS message-queue provider previously required static IAM user keys (AWS_SQS_ACCESS_KEY_ID / AWS_SQS_SECRET_ACCESS_KEY) and always passed them explicitly to the SDK, which suppressed the default credential chain. This made role-based auth (ECS/EKS task role, EC2 instance profile) impossible. When no static credentials are configured, ToCredentials now returns (nil, nil) and the client builders omit WithCredentialsProvider, letting the AWS SDK default credential chain resolve credentials. IsConfigured selects SQS on region alone so the keys can be omitted. Existing static-key configs are unchanged. Mirrors the GCP Pub/Sub provider's implicit-credential behavior. Refs hookdeck#463 Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
alexluong
reviewed
Jul 21, 2026
alexluong
left a comment
alexluong
left a comment
Collaborator
There was a problem hiding this comment.
Thanks! Overall LGTM with a small comment.
There's also publishmq which has a different AWS SDK path. I think it's probably relevant and something we can apply similar logic. Not a blocker but can you include that in this PR as well?
Comment on lines
+63
to
67
| // IsConfigured selects SQS on Region alone; keys are optional so IAM-role auth | ||
| // can use the AWS SDK default credential chain. | ||
| func (c *AWSSQSConfig) IsConfigured() bool { | ||
| return c.AccessKeyID != "" && c.SecretAccessKey != "" && c.Region != "" | ||
| return c.Region != "" | ||
| } |
Collaborator
There was a problem hiding this comment.
While this is correct, I discovered a config data issue where if only 1 of AWS_SQS_ACCESS_KEY_ID or AWS_SQS_SECRET_ACCESS_KEY is provided, it is accepted and led to a runtime auth error at a later stage even though this is invalid.
I don't think IsConfigured() is the right place but maybe we can apply this validation check at ToQueueConfig()?
Contributor
Author
There was a problem hiding this comment.
Thanks @alexluong! addressed both points:
- added the partial-credential guard in
ToQueueConfig()as suggested so it fails at startup viavalidateMQsinstead of deferring to a runtime error - extended IAM-role support to publishmq. The gap was in the config layer, since it already shared the IAM-ready SDK path. Relaxed the key requirementss, make selection region-only and applied the same partial-credentials check
…lishmq Address PR review feedback on hookdeck#996: - ToQueueConfig now rejects a config with exactly one of AWS_SQS_ACCESS_KEY_ID / AWS_SQS_SECRET_ACCESS_KEY set. Both must be provided together (static credentials) or both omitted (AWS SDK default credential chain). Previously a partial config was accepted and failed with a deferred runtime auth error. The check surfaces at startup via the existing validateMQs flow. - Extend the same IAM-role support to the publish MQ SQS provider (PublishAWSSQSConfig): keys are now optional, hasPublishAWSSQSConfig selects on Region alone, and the partial-credential rule is enforced via a new PublishMQConfig.Validate wired into config validation (validatePublishMQ). Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The AWS SQS message-queue provider previously required static IAM user keys (AWS_SQS_ACCESS_KEY_ID / AWS_SQS_SECRET_ACCESS_KEY) and always passed them explicitly to the SDK, which suppressed the default credential chain. This made role-based auth (ECS/EKS task role, EC2 instance profile) impossible.
When no static credentials are configured, ToCredentials now returns (nil, nil) and the client builders omit WithCredentialsProvider, letting the AWS SDK default credential chain resolve credentials. IsConfigured selects SQS on region alone so the keys can be omitted. Existing static-key configs are unchanged. Mirrors the GCP Pub/Sub provider's implicit-credential behavior.
Refs #463