Jenkins AWS Credentials 1.33插件无法加载AWS凭证求助

问题背景 #

• 使用AWS Credentials 1.33插件
• AWS IAM已创建含sts:AssumeRole权限的角色，且绑定了带ec2:Describe*权限的策略
• 凭证已存储在Jenkins中（截图：）
• 流水线阶段代码：

stage('Run aws command') {
    steps {
        withCredentials([[$class: 'AmazonWebServicesCredentialsBinding',credentialsId: "f0cf35b9-8967-40a2-b338-33da428fdc04", accessKeyVariable: 'AWS_ACCESS_KEY_ID', secretKeyVariable: 'AWS_SECRET_ACCESS_KEY']]) {
                container('aws-cli') {
                        sh('env')
                        sh('aws sts get-caller-identity')
                }
        }
    }
}

执行错误日志 #

com.amazonaws.SdkClientException: Unable to load AWS credentials from any provider in the chain: [EnvironmentVariableCredentialsProvider: Unable to load AWS credentials from environment variables (AWS_ACCESS_KEY_ID (or AWS_ACCESS_KEY) and AWS_SECRET_KEY (or AWS_SECRET_ACCESS_KEY)), SystemPropertiesCredentialsProvider: Unable to load AWS credentials from Java system properties (aws.accessKeyId and aws.secretKey), WebIdentityTokenCredentialsProvider: You must specify a value for roleArn and roleSessionName, com.amazonaws.auth.profile.ProfileCredentialsProvider@59f986be: profile file cannot be null, com.amazonaws.auth.EC2ContainerCredentialsProviderWrapper@49ac96d0: Failed to connect to service endpoint: ]
at com.amazonaws.auth.AWSCredentialsProviderChain.getCredentials(AWSCredentialsProviderChain.java:136)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.getCredentialsFromContext(AmazonHttpClient.java:1269)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.runBeforeRequestHandlers(AmazonHttpClient.java:845)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:794)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:781)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:755)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:715)
at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:697)
at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:561)
at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:541)
at com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient.doInvoke(AWSSecurityTokenServiceClient.java:1727)
at com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient.invoke(AWSSecurityTokenServiceClient.java:1694)
at com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient.invoke(AWSSecurityTokenServiceClient.java:1683)
at com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient.executeAssumeRole(AWSSecurityTokenServiceClient.java:532)
at com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient.assumeRole(AWSSecurityTokenServiceClient.java:501)
at com.cloudbees.jenkins.plugins.awscredentials.AWSCredentialsImpl.getCredentials(AWSCredentialsImpl.java:161)
at com.cloudbees.jenkins.plugins.awscredentials.AmazonWebServicesCredentialsBinding.bind(AmazonWebServicesCredentialsBinding.java:124)
at org.jenkinsci.plugins.credentialsbinding.impl.BindingStep$Execution2.doStart(BindingStep.java:132)
at org.jenkinsci.plugins.workflow.steps.GeneralNonBlockingStepExecution.lambda$run$0(GeneralNonBlockingStepExecution.java:77)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at java.base/java.lang.Thread.run(Thread.java:829)
Finished: FAILURE

排查与解决步骤 #

1. 匹配凭证类型与绑定方式
   错误栈显示插件在执行assumeRole，说明你存储的大概率是IAM角色凭证而非普通Access Key/Secret Key凭证。AmazonWebServicesCredentialsBinding仅适用于AK/SK类型凭证，角色凭证需使用AmazonWebServicesRoleCredentialsBinding或插件提供的简化语法。

2. 调整流水线代码
   若存储的是IAM角色凭证，修改流水线逻辑为：

   stage('Run aws command') {
       steps {
           withCredentials([[$class: 'AmazonWebServicesRoleCredentialsBinding', 
                             credentialsId: "f0cf35b9-8967-40a2-b338-33da428fdc04",
                             roleArnVariable: 'AWS_ROLE_ARN',
                             roleSessionNameVariable: 'AWS_ROLE_SESSION_NAME']]) {
               container('aws-cli') {
                   sh('printenv')
                   sh('aws sts get-caller-identity --role-arn $AWS_ROLE_ARN --role-session-name $AWS_ROLE_SESSION_NAME')
               }
           }
       }
   }
   

   或使用更简洁的插件内置语法：

   stage('Run aws command') {
       steps {
           aws(credentials: 'f0cf35b9-8967-40a2-b338-33da428fdc04') {
               container('aws-cli') {
                   sh('aws sts get-caller-identity')
               }
           }
       }
   }
   

3. 验证凭证有效性

   • 确认Jenkins中存储的角色ARN是否正确，且Jenkins运行环境（EC2实例、EKS Pod等）的IAM实体（实例角色、服务账户）拥有sts:AssumeRole权限指向该角色。
   • 若使用AK/SK凭证，直接在本地测试aws sts get-caller-identity确认凭证可用。

4. 检查容器环境变量传递
   在容器内执行printenv确认绑定的环境变量是否正常传递。若使用Kubernetes Pod模板，需确保容器配置未阻断环境变量注入。

5. 升级插件版本
   AWS Credentials 1.33版本较旧，升级到最新稳定版可修复已知的凭证绑定兼容性问题。

内容的提问来源于stack exchange，提问作者leotim