https://www.boundaryml.com logo
Powered by
BoundaryML/baml
# contributing
p
Hi, I'm running BAML in EKS and hit a limitation with the aws-bedrock provider. It doesn't support IRSA (IAM Roles for Service Accounts) authentication. IRSA sets 
AWS_WEB_IDENTITY_TOKEN_FILE
+ 
AWS_ROLE_ARN
, but BAML only reads explicit credentials (
AWS_ACCESS_KEY_ID
, etc.). This is the AWS equivalent of the Vertex WIF issue ([#2560](https://github.com/BoundaryML/baml/issues/2560)). I've got a workaround using the AWS SDK to exchange the token for temp credentials and pass them to ClientRegistry, but native support would be cleaner. The Rust aws-config crate already has WebIdentityTokenCredentialsProvider in its default chain, so it might be straightforward to add. Worth opening an issue for this? Happy to provide more details or help contribute a fix.
v
@baml-sam can you take a look at this!
b
Hi, yes, please file an issue for this!
This sounds very doable and we absolutely want to support this; IIRC the reason we don't just use aws-config's env support directly is because we also allow people to specify auth strategies (e.g. 
aws_profile
or 
aws_access_key_id
) from within their 
.baml
files in addition to clientregistry and via env vars
Since you've already confirmed the crate supports it, that answers the main open question
If you can contribute a fix we'd also be happy to take it!
p
Awesome, I've opened an issue [here](https://github.com/BoundaryML/baml/issues/2849) and I'll work on a fix this afternoon!
b
Ping me if you need help!
I'll be at the office for another 5 hours or so; after that I'll still be able to respond just won't necessarily be fast
I would suggest trying to find a way to iterate with IRSA locally, as with all saas-related things local is just faster
It's a bit tricky with us because getting a local build of the FFI into a Docker image is a bit tricky... I'm trying to dig up instructions for you
Aha, here it is - this is a Dockerfile I was using to test local builds against bun/gcp, but the same strategy applies: use a 2-stage Dockerfile to build and then deploy https://cdn.discordapp.com/attachments/1451662811477311638/1451675691371462677/message.txt?ex=694da157&is=694c4fd7&hm=080baa3e3bb547f6283cba81ae1c4f66265c3e8f291a6a32e0d28422ee1c54a3&
p
Hey @baml-sam, [the PR is up](https://github.com/BoundaryML/baml/pull/2856). Turned out the fix was small. The 
DefaultCredentialsChain
builder just needed the region passed to it before 
build()
so the STS 
AssumeRoleWithWebIdentity
call knows which endpoint to hit. I used the Dockerfile approach you suggested to build the patched FFI and deployed it to an EKS cluster with the exact IRSA role that was failing. All tests passed. Let me know if you have any questions or want changes to the PR!
b
Awesome, thanks! Can we remove the tests from this PR? The Rust tests don't seem to exercise the BAML callpath into aws-config, and the TS tests only work if run in EKS, so I'd rather just have this PR set the region and add that comment
p
@baml-sam Removed the tests 👍
2 Views
PreviousNext
Powered by