From e2ddb96079669a306fbd8e900f613fde3ee88596 Mon Sep 17 00:00:00 2001 From: Sergio Villegas Date: Fri, 4 Sep 2026 13:56:15 +0200 Subject: [PATCH] fix(amazon): use session.NewSession so IRSA credentials are resolved session.New() routes through deprecatedNewSession, which pins the credential chain to EnvProvider, SharedCredentialsProvider and RemoteCredProvider. That chain has no web identity provider, so a pod running with IRSA on EKS fails with "NoCredentialProviders: no valid providers in chain" even when AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE are correctly injected. session.NewSession() resolves credentials through resolveCredentials, which handles the web identity case explicitly. --- amazon.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/amazon.go b/amazon.go index 731cc08..4fa7463 100644 --- a/amazon.go +++ b/amazon.go @@ -50,7 +50,7 @@ func NewAmazonS3Backend(bucket string, prefix string, region string, endpoint st } client = &http.Client{Transport: tr} } - service := s3.New(session.New(), &aws.Config{ + service := s3.New(session.Must(session.NewSession()), &aws.Config{ HTTPClient: client, Region: aws.String(region), Endpoint: aws.String(endpoint), @@ -84,7 +84,7 @@ func NewAmazonS3BackendWithOptions(bucket string, prefix string, region string, if options != nil && options.S3ForcePathStyle != nil { s3ForcePathStyle = *options.S3ForcePathStyle } - service := s3.New(session.New(), &aws.Config{ + service := s3.New(session.Must(session.NewSession()), &aws.Config{ HTTPClient: client, Region: aws.String(region), Endpoint: aws.String(endpoint), @@ -111,7 +111,7 @@ func NewAmazonS3BackendWithCredentials(bucket string, prefix string, region stri } client = &http.Client{Transport: tr} } - service := s3.New(session.New(), &aws.Config{ + service := s3.New(session.Must(session.NewSession()), &aws.Config{ HTTPClient: client, Credentials: credentials, Region: aws.String(region),