Docker Compose中.NET 8应用使用AWS SSO凭证失败排查

环境与配置信息 #

我正在尝试让一个基于.NET 8开发、运行在Docker Compose 3上的服务，通过AWS SSO凭证访问AWS SQS服务。

AWS config 文件配置 #

[default]
region = ap-southeast-2

[sso-session lets-go]
sso_start_url=https://my-org-entrypoint.awsapps.com/start
sso_region=ap-southeast-2
sso_registration_scopes=sso:account:access

[profile non-prod]
sso_session=lets-go
sso_account_id=xxxxxxxxxxxx
sso_role_name=DeveloperAccess

docker-compose.yml 配置 #

name: 'my-product'
services:
  my-service:
    build:
      dockerfile: src/my-app/Dockerfile
    environment:
      - DOTNET_ENVIRONMENT=Development
      - AWS_PROFILE=non-prod
      - AWS_REGION=ap-southeast-2
      - AWS_CONFIG_FILE=/app/.aws/config
      - AWS_SSO_SESSION=lets-go
    volumes:
      - ~/.aws:/app/.aws:ro

操作流程 #

由于Docker镜像以非root用户运行，我最初将.aws文件夹挂载到/app目录，后来也尝试过挂载到/root目录，但两种方式都失败了。具体操作步骤：

• 执行SSO登录：aws sso login --profile non-prod
• 启动容器：docker compose up -d

问题现象 #

容器启动后，日志输出错误信息如下：

[23:49:43 INF] Initiating startup
[23:49:43 INF] Found credentials using the AWS SDK's default credential search
[23:49:45 ERR] Error while initialising queue
  Amazon.Runtime.AmazonServiceException: Unable to get IAM security credentials from EC2 Instance Metadata Service.
    at Amazon.Runtime.DefaultInstanceProfileAWSCredentials.FetchCredentials()
    at Amazon.Runtime.DefaultInstanceProfileAWSCredentials.GetCredentials()
    at Amazon.Runtime.DefaultInstanceProfileAWSCredentials.GetCredentialsAsync()
    at Amazon.Runtime.Internal.CredentialsRetriever.InvokeAsync[T](IExecutionContext executionContext)
    at Amazon.Runtime.Internal.RetryHandler.InvokeAsync[T](IExecutionContext executionContext)
    at Amazon.Runtime.Internal.RetryHandler.InvokeAsync[T](IExecutionContext executionContext)
    at OpenTelemetry.Instrumentation.AWS.Implementation.AWSPropagatorPipelineHandler.InvokeAsync[T](IExecutionContext executionContext)
    at Amazon.Runtime.Internal.CallbackHandler.InvokeAsync[T](IExecutionContext executionContext)
    at OpenTelemetry.Instrumentation.AWS.Implementation.AWSTracingPipelineHandler.InvokeAsync[T](IExecutionContext executionContext)
    at Amazon.Runtime.Internal.CallbackHandler.InvokeAsync[T](IExecutionContext executionContext)
    at Amazon.Runtime.Internal.ErrorCallbackHandler.InvokeAsync[T](IExecutionContext executionContext)
    at Amazon.Runtime.Internal.MetricsHandler.InvokeAsync[T](IExecutionContext executionContext)

我已经进入容器确认过，.aws文件夹确实被正确挂载到了指定位置，但还是出现了上述错误。请问我哪里操作有误？

内容的提问来源于stack exchange，提问作者David Keaveny