{"action":"created","issue":{"url":"https://api.github.com/repos/mitchellh/packer/issues/4279","repository_url":"https://api.github.com/repos/mitchellh/packer","labels_url":"https://api.github.com/repos/mitchellh/packer/issues/4279/labels{/name}","comments_url":"https://api.github.com/repos/mitchellh/packer/issues/4279/comments","events_url":"https://api.github.com/repos/mitchellh/packer/issues/4279/events","html_url":"https://github.com/mitchellh/packer/issues/4279","id":195168390,"number":4279,"title":"Packer's use of the aws-sdk-go failing to authenticate","user":{"login":"martinb3","id":103033,"avatar_url":"https://avatars.githubusercontent.com/u/103033?v=3","gravatar_id":"","url":"https://api.github.com/users/martinb3","html_url":"https://github.com/martinb3","followers_url":"https://api.github.com/users/martinb3/followers","following_url":"https://api.github.com/users/martinb3/following{/other_user}","gists_url":"https://api.github.com/users/martinb3/gists{/gist_id}","starred_url":"https://api.github.com/users/martinb3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martinb3/subscriptions","organizations_url":"https://api.github.com/users/martinb3/orgs","repos_url":"https://api.github.com/users/martinb3/repos","events_url":"https://api.github.com/users/martinb3/events{/privacy}","received_events_url":"https://api.github.com/users/martinb3/received_events","type":"User","site_admin":false},"labels":[{"id":126745464,"url":"https://api.github.com/repos/mitchellh/packer/labels/builder/amazon","name":"builder/amazon","color":"d4c5f9","default":false},{"id":33051540,"url":"https://api.github.com/repos/mitchellh/packer/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-12-13T05:53:49Z","updated_at":"2016-12-13T07:27:29Z","closed_at":null,"body":"Hello! We've been trying to use packer inside AWS' new \"CodeBuild\" product, and we're noticing that while the AWS CLI can authenticate successfully to various EC2 APIs, packer cannot. When we run packer, we get:\r\n\r\n> Build 'amazon-ebs' errored: Error querying AMI: NoCredentialProviders: no valid providers in chain. Deprecated.\r\n\r\nSince CodeBuild uses ECS containers, where we've assigned the appropriate IAM roles, our working theory is that packer and/or the Go SDK is failing to pull credentials from `169.254.170.2/$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`. When we manually curl that URL, and parse out credentials and put them in `~/.aws/credentials`, packer begins working.\r\n\r\nAccording to [the SDK docs](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html), this should be happening automatically:\r\n\r\n> If your container instance is using at least version 1.11.0 of the container agent and a supported version of the AWS CLI or SDKs, then the SDK client will see that the AWS_CONTAINER_CREDENTIALS_RELATIVE_URI variable is available, and it will use the provided credentials to make calls to the AWS APIs.\r\n\r\nAnd [from what I can tell](https://github.com/aws/aws-sdk-go/blob/master/aws/defaults/defaults.go), this should be happening in the Go SDK.\r\n\r\n- Packer version: 0.12.0\r\n\r\n- Host platform: Ubuntu 14.04 x64, aws/codebuild/ubuntu-base:14.04 from http://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref.html\r\n\r\n- Debug log output from `PACKER_LOG=1 packer build template.json`.\r\nhttps://gist.github.com/martinb3/ed7e11d33915e7fae49199bf7f479da9\r\n\r\n- The _simplest example template and scripts_ needed to reproduce the bug.\r\n\r\nWe're actually using a very, very simple buildspec.yml:\r\n```\r\nversion: 0.1\r\n\r\nenvironment_variables:\r\n  plaintext:\r\n    PACKER_NO_COLOR: \"1\"\r\n    PACKER_LOG: \"1\"\r\n\r\nphases:\r\n  install:\r\n    commands:\r\n      - wget https://releases.hashicorp.com/packer/0.12.0/packer_0.12.0_linux_amd64.zip\r\n      - unzip packer_0.12.0_linux_amd64.zip\r\n  build:\r\n    commands:\r\n      - ./packer build \"ami-stuff/packer.json\"\r\n```\r\n\r\nThe packer.json file is also very simple:\r\n```\r\n{\r\n  \"builders\": [{\r\n    \"type\": \"amazon-ebs\",\r\n    \"region\": \"us-east-1\",\r\n    \"source_ami\": \"ami-72343365\",\r\n    \"instance_type\": \"t2.micro\",\r\n    \"ssh_username\": \"ubuntu\",\r\n    \"ssh_pty\" : true,\r\n    \"ami_name\": \"ami-builder-demo {{timestamp}}\"\r\n  }],\r\n  \"provisioners\": [{\r\n    \"type\": \"shell\",\r\n    \"inline\": [\r\n      \"sleep 30\",\r\n      \"sudo apt-get update\",\r\n      \"sudo apt-get install apache2 -y\"\r\n    ]\r\n  }]\r\n}\r\n```\r\n\r\nOur workaround has been to setup the credentials file manually:\r\n```\r\ncurl -qL 169.254.170.2/$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI > credentials.json\r\nmkdir -p ~/.aws\r\necho \"[default]\" > ~/.aws/credentials\r\necho \"aws_access_key_id = $(cat credentials.json | jq '.AccessKeyId' | sed s'/\"//g')\" >> ~/.aws/credentials\r\necho \"aws_secret_access_key = $(cat credentials.json | jq '.SecretAccessKey' | sed s'/\"//g')\" >> ~/.aws/credentials\r\necho \"aws_session_token = $(cat credentials.json | jq '.Token' | sed s'/\"//g')\" >> ~/.aws/credentials\r\n```\r\n\r\nThe entire time, even while packer is failing, commands like `aws ec2 describe-instances` work, so we know the CLI and Python SDK are correctly using that URL above to pull credentials, even when packer and/or the Go SDK isn't.\r\n"},"comment":{"url":"https://api.github.com/repos/mitchellh/packer/issues/comments/266666260","html_url":"https://github.com/mitchellh/packer/issues/4279#issuecomment-266666260","issue_url":"https://api.github.com/repos/mitchellh/packer/issues/4279","id":266666260,"user":{"login":"rickard-von-essen","id":557699,"avatar_url":"https://avatars.githubusercontent.com/u/557699?v=3","gravatar_id":"","url":"https://api.github.com/users/rickard-von-essen","html_url":"https://github.com/rickard-von-essen","followers_url":"https://api.github.com/users/rickard-von-essen/followers","following_url":"https://api.github.com/users/rickard-von-essen/following{/other_user}","gists_url":"https://api.github.com/users/rickard-von-essen/gists{/gist_id}","starred_url":"https://api.github.com/users/rickard-von-essen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rickard-von-essen/subscriptions","organizations_url":"https://api.github.com/users/rickard-von-essen/orgs","repos_url":"https://api.github.com/users/rickard-von-essen/repos","events_url":"https://api.github.com/users/rickard-von-essen/events{/privacy}","received_events_url":"https://api.github.com/users/rickard-von-essen/received_events","type":"User","site_admin":false},"created_at":"2016-12-13T07:27:29Z","updated_at":"2016-12-13T07:27:29Z","body":"Yes we currently don't support task-roles. I started to look into fixing this but I don't think it will happen before the holidays. "}}
{"actor":{"display_login":"rickard-von-essen"}}