ListObjects API seems to be taking more time when using STS AssumeRole

[spnshah]

Hello,

In my effort of trying to use the STS AssumeRole service, I am noticing that ListObjects() API seems to be taking a lot longer when using credentials (key/secret/token) obtained from AssumeRole service. I wanted to ask and understand if this behavior has been noticed before or is it just me seeing this because of the way I am using the service.

I will try to explain both the approaches below in detail that I have tried, one of which is seeing a lot more time for ListObjects() API.

Setup:

AWS SDK CPP version: "1.7.29"
CMake specific info:
    Version: cmake version 3.5.2
    -DBUILD_ONLY="core;s3;sts;secretsmanager"
OS information:
    # cat /etc/os-release
        NAME="SLES"
        VERSION="12-SP3"
        VERSION_ID="12.3"
        PRETTY_NAME="SUSE Linux Enterprise Server 12 SP3"

Approach 1: Use of ListObjects() with regular service-account credentials in the form of key and secret.

Set some client configurations

Aws::Client::ClientConfiguration client_config;
We set couple of options here like: region, followRedirects, connect/requestTimeoutMs, scheme, maxConnections and few others.

Create credentials object

Aws::Auth::AWSCredentials creds(Aws::String((const char *) m_key),    // Service account key.
                                Aws::String((const char *) m_secret), // Service account secret.
                                Aws::String((const char *) (m_sessiontok ? m_sessiontok : ""))); // m_sessiontok is NULL.

Create client object

Aws::S3::S3Client *cli;
cli = new Aws::S3::S3Client(creds, client_config, Aws::Client::AWSAuthV4Signer::PayloadSigningPolicy::Never, true /*(or false)*/);

Use ListObjects() to list objects

Aws::S3::Model::ListObjectsRequest objReq;
objReq.WithBucket(m_bucket);
objReq.WithPrefix(m_prefix);

auto start = std::chrono::high_resolution_clock::now();
auto result = s3_client->ListObjects(objReq); // Measuring the time taken by the ListObjects() API.
auto end = std::chrono::high_resolution_clock::now();

auto duration = (std::chrono::duration_cast<std::chrono::milliseconds>(end - start)).count(); // Time in milliseconds.

Approach 2: Obtain STS credentials using the service account credentials we had and then use those to do ListObjects().

Set same client configurations as mentioned above in approach 1 for 'client_config'.

...

Create STS client

Aws::Auth::AWSCredentials creds(Aws::String((const char *) m_key),   // Service account key.
                                Aws::String((const char *) m_secret), // Service account secret.
                                Aws::String((const char *) (m_sessiontok ? m_sessiontok : ""))); // m_sessiontok is NULL.
Aws::STS::STSClient *sts_cli;
sts_cli = new Aws::STS::STSClient(creds, client_config);

Initiate AssumeRole request.

Aws::STS::Model::AssumeRoleRequest assumeRoleReq;
assumeRoleReq.WithRoleArn(roleARN);
assumeRoleReq.WithRoleSessionName(roleSessionName);
assumeRoleReq.WithDurationSeconds(duration);
assumeRoleReq.WithExternalId(externalId);

auto assumeRoleRes = sts_cli->AssumeRole(assumeRoleReq);

// Extract temporary credentials details if above call is successful:
auto tmpCred = assumeRoleRes.GetResult().GetCredentials();

// Create credentials with details from tmpCred:
m_key = tmpCred.GetAccessKeyId().c_str();
m_secret = tmpCred.GetSecretAccessKey().c_str();
m_sessiontok = tmpCred.GetSessionToken().c_str();

Create credentials object as shown in approach 1 using m_key, m_secret and m_sessiontok values from above step. m_sessiontok is not NULL in this case.

...

Create client object as shown in approach 1.

...

Call ListObjects() exactly as shown in approach 1 and measure its time.

...

Observation:

We are noticing that requests are taking significantly longer in approach 2 after obtaining temporary credentials from AssumeRole service. Feel free to update me if there is a better way to use STS AssumeRole via the SDK than what I mentioned above, which may yield better performance of ListObjects().

Let me know if you need more information.

Thanks.

[jmklix]

Can you try updating the version of the sdk that you are using? You are using version: "1.7.29" which is rather old while the latest release is 1.9.286

[spnshah]

Yeah, I will give that a try and update soon. We might not have the flexibility to update the SDK to its latest as I believe some of the minimum requirement isn't satisfied on our existing configuration. Hence, I was checking to see if this mentioned issue is a known thing or not.

Anyways, I will check on latest SDK and get back to you.

Thanks.

[spnshah]

Tried this again with more recent SDK 1.9.307 and still see the performance issue when using STS assumerole.

[spnshah]

@jmklix Did you get a chance to look into this issue, or, the way I described using Assume Role which could cause some delay?