Unable to authenticate via aws_iam method

[adoyleplm]

I am unable to authenticate via the aws_iam method, using a slightly altered example from this code's inline comments:

# VAULT_ADDR set in env

irb(main):008:0> vault_token = Vault.auth.aws_iam(role="my_role", credentials_provider=Aws::InstanceProfileCredentials.new, route="my_route")
Vault::MissingTokenError: Missing Vault token! I cannot make requests to Vault without a token. Please
set a Vault token in the client:

    Vault.token = "42d1dee5-eb6e-102c-8d23-cc3ba875da51"

or authenticate with Vault using the Vault CLI:

    $ vault auth ...

or set the environment variable $VAULT_TOKEN to the token value:

    $ export VAULT_TOKEN="..."

Please refer to the documentation for more examples.

	from /usr/local/share/ruby/gems/2.0/gems/vault-0.12.0/lib/vault/client.rb:381:in `error'
	from /usr/local/share/ruby/gems/2.0/gems/vault-0.12.0/lib/vault/client.rb:291:in `request'
	from /usr/local/share/ruby/gems/2.0/gems/vault-0.12.0/lib/vault/client.rb:197:in `post'
	from /usr/local/share/ruby/gems/2.0/gems/vault-0.12.0/lib/vault/api/auth.rb:242:in `aws_iam'
	from (irb):8
	from /usr/bin/irb:12:in `<main>'

I am able to authenticate manually via the Vault CLI with IAM authentication.

Using latest Amazon Linux AMI with default Ruby.

ami-023c8dbf8268fb3ca

Ruby and Gems:

ruby --version
ruby 2.0.0p648 (2015-12-16) [x86_64-linux]

aws-eventstream (1.0.1)
aws-partitions (1.116.0)
aws-sdk-core (3.39.0)
aws-sdk-ec2 (1.59.0)
aws-sigv4 (1.0.3)
vault (0.12.0)

[tduffield]

So I ran into this problem too. I solved it by passing in all the parameters:

Vault.auth.aws_iam("my_role", Aws::InstanceProfileCredentials.new, nil, "https://sts.amazonaws.com", "my_route")

[haritaK1089]

@tduffield I tried passing all parameters but still no luck. Getting the same error. Here is how I'm trying to call it

Vault.auth.aws_iam("my-role", Aws::InstanceProfileCredentials.new, nil, 'https://sts.amazonaws.com/', nil)

Any suggestions where I'm going wrong.

[cwhiting-fusable]

yeah the AWS::InstanceProfileCredentials.new says "unable to sign request without credential set"

[chrisarcand]

Looking at the original issue description, aws_iam uses positional arguments, not keyword arguments. When you write role="my_role", Ruby interprets that as an assignment expression that creates a variable, not as a parameter.

Use positional arguments instead:

Vault.auth.aws_iam(
  "my_role",                                # role
  Aws::InstanceProfileCredentials.new,     # credentials_provider
  nil,                                      # iam_auth_header_value (optional)
  "https://sts.amazonaws.com",             # sts_endpoint (optional)
  nil                                       # route (optional)
)

If you're still getting "unable to sign request without credential set", that's an AWS SDK issue - make sure your EC2 instance has an IAM role attached and the credentials provider can actually fetch credentials.

Closing as this is a very old issue but hey, if you do run into this feel free to reopen.