shreemaan-abhishek commented on PR #13249: URL: https://github.com/apache/apisix/pull/13249#issuecomment-5060994453
Hello @elsodiop The bedrock provider doesn't do its own secret resolution, and neither does any other plugin: since #13312 the whole plugin conf is resolved centrally in plugin.filter (apisix/plugin.lua:97) before any plugin handler runs, so auth.aws is already plain text when it reaches the SigV4 signer. What your error shows is that the reference failed to resolve: secret.lua falls back to the literal string when a fetch fails (refs[k] = fetch(v, use_cache) or v), so the raw URI ends up in the credential scope. Could you confirm - your APISIX version - and that the /apisix/secrets/aws/<id> resource exists and its credentials can read that secret? Separately, this did surface a real problem: when resolution fails on the cached path there is no error log at all, so the misconfiguration is invisible. I'll open a fix for that. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
