React Native对接AWS跨账号凭证获取遇Credentials Missing错误求助

问题根源 #

• React Native中process.env的机制和Node.js完全不同，AWS SDK不会自动从这里读取凭证，手动赋值也无效
• 初始化STS客户端时未传入初始凭证，导致调用assumeRole时无有效凭证可用
• getSplitSecretKey中错误地将credentials放在GetSecretValueCommand的参数里，正确位置是SecretsManagerClient.send的配置项

修复步骤 #

1. 直接给STS客户端传入初始凭证 #

跳过process.env赋值，初始化STS时直接从react-native-config取凭证传入：

const stsClient = new sts.STS({
  region: 'us-east-1',
  credentials: {
    accessKeyId: Config.AWS_ACCESS_KEY_ID,
    secretAccessKey: Config.AWS_SECRET_ACCESS_KEY
  }
});

2. 修正跨账号凭证的使用方式 #

获取到跨账号凭证后，需要在调用SecretsManager时通过send方法的配置项传入：

// 在send方法中指定跨账号凭证
const response = await secretClient.send(
  new GetSecretValueCommand({ SecretId: splitSecretName }),
  { credentials: accessParams }
);

3. 用async/await替代回调优化代码 #

避免用Promise包装回调，直接使用STS客户端的Promise版本方法：

const getCrossAccountCredentials = async () => {
  const timestamp = new Date().getTime();
  const params = {
    RoleArn: 'your-role-arn-here',
    RoleSessionName: `be-descriptibe-here-${timestamp}`,
  };
  const data = await stsClient.assumeRole(params);
  return {
    accessKeyId: data.Credentials.AccessKeyId,
    secretAccessKey: data.Credentials.SecretAccessKey,
    sessionToken: data.Credentials.SessionToken,
  };
};

4. 确认react-native-config端配置生效 #

确保iOS和Android端的配置步骤已完成：

• iOS：在Xcode的Info.plist中添加$(SRCROOT)/../.env到Config字段
• Android：在android/app/build.gradle中添加apply from: project(':react-native-config').projectDir.getPath() + "/dotenv.gradle"

完整修复后代码 #

import 'react-native-url-polyfill/auto';
import 'react-native-get-random-values';
import {
  SecretsManagerClient,
  GetSecretValueCommand,
} from '@aws-sdk/client-secrets-manager';
import * as sts from '@aws-sdk/client-sts';
import Config from 'react-native-config';

const splitSecretName = 'mobile_split_test';
const secretClient = new SecretsManagerClient({
  region: 'us-east-1',
});
const stsClient = new sts.STS({
  region: 'us-east-1',
  credentials: {
    accessKeyId: Config.AWS_ACCESS_KEY_ID,
    secretAccessKey: Config.AWS_SECRET_ACCESS_KEY
  }
});

const main = async () => {
  await getCrossAccountCredentials();
};

const getCrossAccountCredentials = async () => {
  const timestamp = new Date().getTime();
  const params = {
    RoleArn: 'your-role-arn-here',
    RoleSessionName: `be-descriptibe-here-${timestamp}`,
  };
  try {
    const data = await stsClient.assumeRole(params);
    return {
      accessKeyId: data.Credentials.AccessKeyId,
      secretAccessKey: data.Credentials.SecretAccessKey,
      sessionToken: data.Credentials.SessionToken,
    };
  } catch (err) {
    console.log('getCrossAccountCredentailsError', err);
    throw err;
  }
};

export const getSplitSecretKey = async () => {
  try {
    const accessParams = await getCrossAccountCredentials();
    const response = await secretClient.send(
      new GetSecretValueCommand({ SecretId: splitSecretName }),
      { credentials: accessParams }
    );
    console.log('response', response);
    return response.SecretString;
  } catch (error) {
    console.log('getSplitSecretKeyError', error);
    throw error;
  }
};

关键修改说明 #

• 移除无效的process.env赋值，直接给STS客户端传入凭证
• 调整跨账号凭证的传入位置，从命令参数移到send方法配置项
• 用Promise版assumeRole替代回调，简化代码结构
• 统一错误处理逻辑，确保错误能被上层捕获

内容的提问来源于stack exchange，提问作者Nata Vacheishvili