awsauth: Enable ECS credential provider when AWS_CONTAINER_CREDENTIALS_FULL_URI env var is defined

[jstewmon]

This improves credential provider compatibility with the AWS SDK.

See: https://github.com/aws/aws-sdk-go/blob/16cef773033e77d97f42fa5655c13bace6b9edc7/aws/defaults/defaults.go#L115-L133

[hashicorp-cla]

All committers have signed the CLA.

[bflad]

Hi @jstewmon 👋 Thanks so much for submitting this. At quick glance, this appears like it would be an acceptable change, but to fully disclose that #5 (comment) is likely relevant here as well. 😕 We certainly don't want to leave this pull request lingering just due to our existing lack of testing though.

To that end, could you please provide the relevant environment setup (presumably something like running Terraform on an ECS Cluster) and Terraform AWS Provider configuration so we can verify this particular change has the intended effect? Thank you.

[jstewmon]

Hi @bflad , thanks for taking a look!

The impetus for this PR is another PR that I made for aws-vault: 99designs/aws-vault#375

I've used this technique with the aws cli and other tools built atop aws SDKs in the past, and in the course of testing my changes to aws-vault, I found that it did not work with terraform due to this library not enabling the remote credential provider when AWS_CONTAINER_CREDENTIALS_FULL_URI is defined.

So, one method of testing is with aws-vault built from my feature branch:

git clone git@github.com:jstewmon/aws-vault.git
cd aws-vault
git checkout ecs-server
go mod vendor
go build
./aws-vault add <some profile>
aws-vault exec --ecs-server <some profile> -- terraform plan

TBH, I'm not actually sure when a task run by ECS would use AWS_CONTAINER_CREDENTIALS_FULL_URI vs AWS_CONTAINER_CREDENTIALS_RELATIVE_URI, so I'm hopeful that you'll find my suggestion of testing with aws-vault a viable route. 😅

[bflad]

Just to followup here, this pull request may be superseded by #20. That change will cause the default AWS Go SDK credential handlers (which include handling for this environment variable before attempting EC2 metadata) to automatically be executed before this logic is called. 👍

[jstewmon]

@bflad I haven't had a chance to personally verify it, but it seems that #5 already resolved this issue, at least in some cases. I'm content to close this PR, since the immediate problem I had is resolved and more work is underway to further improves credential provider handling.