boto 2.49.0无法加载ECS Fargate任务角色凭证的解决咨询

背景 #

• 基于Python 2.7的遗留应用已完成Docker化，部署至ECS Fargate
• 应用依赖boto 2.49.0（非boto3），无法自动获取AWS凭证：boto默认访问Fargate不存在的实例元数据端点，执行curl测试报错：

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
curl: (7) Couldn't connect to server

具体报错栈 #

执行import boto; boto.connect_s3(debug=2)时触发以下错误：

DEBUG:boto:http://169.254.169.254/latest/meta-data/iam/security-credentials/
2024-06-17 20:51:37,294 boto [ERROR]:Caught exception reading instance data
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/boto/utils.py", line 218, in retry_url
    r = opener.open(req, timeout=timeout)
  File "/usr/lib/python2.7/urllib2.py", line 429, in open
    response = self._open(req, data)
  File "/usr/lib/python2.7/urllib2.py", line 447, in _open
    '_open', req)
  File "/usr/lib/python2.7/urllib2.py", line 407, in _call_chain
    result = func(*args)
  File "/usr/lib/python2.7/urllib2.py", line 1235, in http_open
    return self.do_open(httplib.HTTPConnection, req)
  File "/usr/lib/python2.7/urllib2.py", line 1205, in do_open
    raise URLError(err)
URLError: <urlopen error [Errno 22] Invalid argument>
ERROR:boto:Caught exception reading instance data
2024-06-17 20:51:37,295 boto [ERROR]:Unable to read instance data, giving up

可用凭证获取方式验证 #

ECS任务角色凭证可通过环境变量指定的端点正常获取：

curl 169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
{"RoleArn": ..., "AccessKeyId":...

已尝试的解决方案（存在局限） #

手动获取凭证并设置环境变量，但无法实现凭证自动刷新，且不想使用长期AWS凭证：

output=$(curl 169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI | head -n 1| cut -d $' ' -f2)
export AWS_ACCESS_KEY_ID=$(jq -r .AccessKeyId <<< "$output")
export AWS_SECRET_ACCESS_KEY=$(jq -r .SecretAccessKey <<< "$output")
export AWS_SECURITY_TOKEN=$(jq -r .Token <<< "$output")

疑问 #

是否可以通过配置让boto 2.49.0加载指定端点的凭证？或者有其他无需使用长期凭证、支持自动刷新的替代方案（已考虑过猴子补丁boto2）？

内容的提问来源于stack exchange，提问作者technik