fix(aws): use default credential chain

[olegleyz]

Description

The AWS provider currently calls the EC2 instance-role credential provider whenever Topograph-specific credentials are absent. That bypasses the AWS SDK default credential chain, so EKS Pod Identity and IRSA credentials injected into the Topograph pod are ignored and the EC2 node role is used instead.

This change:

• keeps request/config-file credentials as the highest-priority explicit override;
• leaves the credentials provider unset otherwise, allowing the AWS SDK to resolve environment, shared config, web identity, container/Pod Identity, and EC2 IMDS credentials;
• preserves the SDK credentials cache so temporary credentials refresh automatically;
• documents the default chain, EKS Pod Identity setup, and the least-privilege ec2:DescribeInstanceTopology permission.

Tests cover invalid and valid explicit credentials, explicit-over-environment precedence, environment credentials, EKS container credentials with an authorization token file, and refresh after expiration.

Validation

• make qualify
• AWS provider race tests repeated 10 times

AWS integration test

Validated commit 4473a9e on the nkx-slinky-gb300-dev-01 EKS cluster:

1. Deployed an isolated Topograph API using the topograph ServiceAccount and its EKS Pod Identity association with the dedicated aehiqzudem-topograph IAM role.
2. Set AWS_EC2_METADATA_DISABLED=true to prevent fallback to the EC2 node role.
3. Triggered a full topology generation request.

The request used the AWS SDK default credential chain, extracted topology for 35 instances, updated the test ConfigMap, and completed with HTTP 200. No authorization errors occurred.

Checklist

• I am familiar with the Contributing Guidelines.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.
• All commits are signed off per DCO (git commit -s).

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[greptile-apps]

Greptile Summary

This PR fixes the AWS provider credential resolution by removing the hardcoded EC2 instance-role fallback and delegating to the AWS SDK v2 default credential chain instead. This enables EKS Pod Identity, IRSA, and other SDK-supported mechanisms to work correctly when no explicit credentials are supplied.

• provider.go: Replaces the bespoke getCredentials/getCredentialsFromProvider logic (which always fell back to ec2rolecreds.New()) with getCredentialsProvider returning an explicit aws.CredentialsProvider or nil, and a thin loadAWSConfig helper that conditionally passes it to config.LoadDefaultConfig.
• provider_test.go: Adds three new integration-style tests covering explicit-over-environment precedence, environment variable credentials, and EKS container credentials with automatic refresh on expiry.
• docs/providers/aws.md: Updates authentication documentation to describe the SDK default credential chain, EKS Pod Identity setup, and the least-privilege ec2:DescribeInstanceTopology IAM permission.

Confidence Score: 5/5

Safe to merge — the change replaces a narrow hardcoded fallback with the AWS SDK's well-tested default chain, and the new tests exercise the full refresh lifecycle.

The refactor is straightforward and well-tested. Explicit credentials continue to take priority via StaticCredentialsProvider; everything else defers to the SDK. The container-credentials test with an expired-then-refreshed token validates the most complex scenario end-to-end. No logic regressions or behavioural edge cases were identified.

No files require special attention.

Important Files Changed

Filename	Overview
pkg/providers/aws/provider.go	Core credential logic refactored: replaces bespoke EC2 role + env-var fallback chain with AWS SDK default credential chain via config.LoadDefaultConfig; cleanly separates explicit credentials (static provider) from default chain (nil provider); no issues found.
pkg/providers/aws/provider_test.go	Comprehensive test additions: covers invalid credentials, valid explicit credentials, explicit-over-environment precedence, environment credentials, and container/EKS Pod Identity credentials with automatic refresh on expiry; all scenarios well-exercised.
pkg/providers/aws/imds.go	Minor cleanup: removed unused tokenTimeDelay constant and the time import that was only needed by the deleted getCredentialsFromProvider function.
docs/providers/aws.md	Documentation updated to reflect new auth behaviour: least-privilege IAM permission added, env-var credentials moved under the SDK default chain section, EKS Pod Identity setup documented.
CHANGELOG.md	Changelog entry added accurately describing the credential chain fix.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Loader called with cfg.Creds] --> B{len creds == 0?}
    B -- Yes --> C[getCredentialsProvider returns nil\nLog: Using AWS SDK default credential chain]
    B -- No --> D[decodeCredentials]
    D -- Error --> E[Return HTTP 400]
    D -- OK --> F[NewStaticCredentialsProvider\nLog: Using explicit Topograph AWS credentials]
    C --> G[loadAWSConfig\nno WithCredentialsProvider opt]
    F --> H[loadAWSConfig\nwith WithCredentialsProvider opt]
    G --> I[config.LoadDefaultConfig\nAWS SDK default chain]
    H --> I
    I --> J[ec2.NewFromConfig]

    subgraph AWS SDK Default Credential Chain
        K[1. Environment variables\nAWS_ACCESS_KEY_ID etc.]
        L[2. Shared config / credentials file]
        M[3. Web Identity / IRSA]
        N[4. Container / EKS Pod Identity]
        O[5. EC2 IMDS instance role]
        K --> L --> M --> N --> O
    end

    I -.->|when credsProvider is nil| K

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Loader called with cfg.Creds] --> B{len creds == 0?}
    B -- Yes --> C[getCredentialsProvider returns nil\nLog: Using AWS SDK default credential chain]
    B -- No --> D[decodeCredentials]
    D -- Error --> E[Return HTTP 400]
    D -- OK --> F[NewStaticCredentialsProvider\nLog: Using explicit Topograph AWS credentials]
    C --> G[loadAWSConfig\nno WithCredentialsProvider opt]
    F --> H[loadAWSConfig\nwith WithCredentialsProvider opt]
    G --> I[config.LoadDefaultConfig\nAWS SDK default chain]
    H --> I
    I --> J[ec2.NewFromConfig]

    subgraph AWS SDK Default Credential Chain
        K[1. Environment variables\nAWS_ACCESS_KEY_ID etc.]
        L[2. Shared config / credentials file]
        M[3. Web Identity / IRSA]
        N[4. Container / EKS Pod Identity]
        O[5. EC2 IMDS instance role]
        K --> L --> M --> N --> O
    end

    I -.->|when credsProvider is nil| K

Loading

_{Reviews (1): Last reviewed commit: "docs(aws): clarify credential selection" | Re-trigger Greptile}

[dmitsh]

/ok-to-test 4473a9e

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pull-request-403.docs.buildwithfern.com/topograph