SQSListener for FIFO queue with Instance profile

[NoCigar]

Hello,

I'm using spring cloud version 2.3.2

I'm having issues with configuring a FIFO compatible sqs client (an AmazonSQSAsyncClient instead of AmazonSQSBufferedAsyncClient) in conjunction with using instance profile credentials.
Using the instance profile config by itself, via app properties instance-profile set to true, and relying on the autoconfigured sqs client it works fine (except the non-compatibility with fifo queues warning), however when I try to register a new AmazonSqsAsync bean that uses an InstanceProfileCredentialsProvider i get the Failed to connect to service endpoint error:

2022-08-30 18:19:00.103  WARN [custom-service,,] 1 --- [           main] i.InstanceMetadataServiceResourceFetcher : Fail to retrieve token
--
com.amazonaws.SdkClientException: Failed to connect to service endpoint:
at com.amazonaws.internal.EC2ResourceFetcher.doReadResource(EC2ResourceFetcher.java:100) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.internal.InstanceMetadataServiceResourceFetcher.getToken(InstanceMetadataServiceResourceFetcher.java:91) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.internal.InstanceMetadataServiceResourceFetcher.readResource(InstanceMetadataServiceResourceFetcher.java:69) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.internal.EC2ResourceFetcher.readResource(EC2ResourceFetcher.java:66) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.auth.InstanceMetadataServiceCredentialsFetcher.getCredentialsEndpoint(InstanceMetadataServiceCredentialsFetcher.java:58) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.auth.InstanceMetadataServiceCredentialsFetcher.getCredentialsResponse(InstanceMetadataServiceCredentialsFetcher.java:46) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.auth.BaseCredentialsFetcher.fetchCredentials(BaseCredentialsFetcher.java:112) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.auth.BaseCredentialsFetcher.getCredentials(BaseCredentialsFetcher.java:68) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.auth.InstanceProfileCredentialsProvider.getCredentials(InstanceProfileCredentialsProvider.java:165) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.getCredentialsFromContext(AmazonHttpClient.java:1257) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.runBeforeRequestHandlers(AmazonHttpClient.java:833) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:783) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:770) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:744) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:704) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:686) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:550) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:530) ~[aws-java-sdk-core-1.11.951.jar!/:na]
at com.amazonaws.services.sqs.AmazonSQSClient.doInvoke(AmazonSQSClient.java:2283) ~[aws-java-sdk-sqs-1.11.951.jar!/:na]
at com.amazonaws.services.sqs.AmazonSQSClient.invoke(AmazonSQSClient.java:2250) ~[aws-java-sdk-sqs-1.11.951.jar!/:na]
at com.amazonaws.services.sqs.AmazonSQSClient.invoke(AmazonSQSClient.java:2239) ~[aws-java-sdk-sqs-1.11.951.jar!/:na]
 

Depending on how I tinker with the configuration sometimes i get an explicit message about failing to retrieve the token (as above) and sometimes just the regular Failed to connect to service endpoint: with no prior token message.

Here's my current config:

@Configuration
public class SqsConfig {

    @Bean
    AmazonSQSAsync amazonSQS() {
        return AmazonSQSAsyncClientBuilder.standard()
                .withCredentials(new InstanceProfileCredentialsProvider(true))
                .withRegion(Regions.US_EAST_1)
                .build();
    }

    @Bean
    public QueueMessageHandlerFactory queueMessageHandlerFactory(
            final ObjectMapper mapper, final AmazonSQSAsync amazonSQSAsync) {
        final QueueMessageHandlerFactory queueHandlerFactory =
                new QueueMessageHandlerFactory();
        queueHandlerFactory.setAmazonSqs(amazonSQSAsync);
        queueHandlerFactory.setArgumentResolvers(Collections.singletonList(
                new NotificationMessageArgumentResolver(jackson2MessageConverter(mapper))
        ));
        return queueHandlerFactory;
    }

    private MessageConverter jackson2MessageConverter(final ObjectMapper mapper) {

        final MappingJackson2MessageConverter
                converter = new MappingJackson2MessageConverter();
        converter.setStrictContentTypeMatch(false);
        converter.setObjectMapper(mapper);
        return converter;
    }
}

and the relevant application.yml fragment:

cloud:
  aws:
    credentials:
      instance-profile: on
    region:
      static: ${AWS_REGION:us-east-1}

Any and all help would be greatly appreciated,

Thank you

[maciejwalkowiak]

By default, when autoconfiguration is used & instance profile is turned on in application.properties, following credentials provider is configured EC2ContainerCredentialsProviderWrapper (see https://github.com/awspring/spring-cloud-aws/blob/2.3.x/spring-cloud-aws-autoconfigure/src/main/java/io/awspring/cloud/autoconfigure/context/ContextCredentialsAutoConfiguration.java#L104).

So to replicate the behavior from autoconfiguration, use this one instead of InstanceProfileCredentialsProvider.

[NoCigar]

Thank you, it worked! For anyone wondering what's the exact solution:

@Bean
AmazonSQSAsync amazonSQS() {
        return AmazonSQSAsyncClientBuilder.standard()
                .withCredentials(new EC2ContainerCredentialsProviderWrapper())
                .withRegion(Regions.US_EAST_1)
                .build();
    }

and you need to remove
instance-profile: true
entry from application.yml/application.properties if you happen to have it.

[maciejwalkowiak]

Fantastic! :)