Unable to use IAM role for credentials

[leoneves]

Hello, In my organization we use kubernetes pods with a role inside kubernetes resource yml, that we chose passing: annotations -> iam.amazonaws.com/role.
following my coworkers this works fine using using boto(python).
My trying to use with:
instance_credentials = Aws::InstanceProfileCredentials.new Rails.logger.info(instance_credentials) client = Aws::RDS::Client.new(credentials: instance_credentials) latest_snapshot = client.describe_latest_db_snapshots('prod-payments-smith-encrypted')

But I received the error: /usr/app/vendor/bundle/ruby/3.1.0/gems/aws-sdk-core-3.169.0/lib/aws-sdk-core/plugins/sign.rb:135:in rescue in sign': unable to sign request without credentials set (Aws::Errors::MissingCredentialsError)`

I didn't find any docs about how to use credential with arn_role, I'm trying with this.
I'm doing something wrong?
Anyone can help me with the right way to do this kind of thing?

I printed the credentials that Aws::InstanceProfileCredentials.new returned:
{"message":"#\u003cAws::InstanceProfileCredentials:0x00007f5898b72b20 @retries=1, @endpoint=\"http://xxx.xxx.xxx.xxx\", @port=80, @http_open_timeout=1, @http_read_timeout=1, @http_debug_output=nil, @backoff=#\u003cProc:0x00007f5898b72080 /usr/app/vendor/bundle/ruby/3.1.0/gems/aws-sdk-core-3.169.0/lib/aws-sdk-core/instance_profile_credentials.rb:130 (lambda)\u003e, @token_ttl=21600, @token=nil, @no_refresh_until=nil, @async_refresh=false, @mutex=#\u003cThread::Mutex:0x00007f5898b71fe0\u003e, @before_refresh=nil, @credentials=#\u003cAws::Credentials access_key_id=nil\u003e, @expiration=nil\u003e","@timestamp":"2023-01-24T21:41:18.133+00:00","@version":"1","severity":"INFO","host":"app-1674596400-sh5h4"}

[alextwoods]

Do you have an example of the working boto code?

Looking at the output of the Aws::InstanceProfileCredentials.new I see that the @credentials contains empty credentials (eg access_key_id=nil.

Could you expand more on your setup of kubernetes pods?

Two possible fixes:

1. [recommended] You can try using the default credential resolution chain. Just create a client and don't specify the credentials and the SDK will attempt to resolve them itself from the environment. Eg: client = AWS::RDS::Client.new.
2. Possibly try using the ECSCredentials Provider instead of the InstanceProfileCredentials.