Spring Boot服务迁移EKS后无法从凭证链获取AWS凭证求助

将多个Spring Boot服务迁移至EKS时，Pod启动失败，报错：

Unable to load credentials from any of the providers in the chain AwsCredentialsProviderChain

已尝试的操作 #

• 实现基于AWS STS Web身份令牌的凭证获取逻辑，代码如下：

@Bean
public AWSCredentialsProvider awsCredentialsProvider() {
    if (System.getenv("AWS_WEB_IDENTITY_TOKEN_FILE") != null) {
        return WebIdentityTokenCredentialsProvider.builder().build();
    }
    return new DefaultAWSCredentialsProviderChain();
}

@Bean
public SqsClient sqsClient(AWSCredentialsProvider awsCredentialsProvider) {
    return SqsClient
            .builder()
            .credentialsProvider(() -> (AwsCredentials) awsCredentialsProvider.getCredentials())
            .region(Region.EU_WEST_1).build();
}

@Bean
public SnsClient snsClient(AWSCredentialsProvider awsCredentialsProvider) {
    return SnsClient
            .builder()
            .credentialsProvider(() -> (AwsCredentials) awsCredentialsProvider.getCredentials())
            .region(Region.EU_WEST_1).build();
}

• 已引入aws-java-sdk-sts Maven依赖
• 服务对应的IAM角色配置正常
• Jenkins构建后自动在K8s清单中为Pod注入AWS_WEB_IDENTITY_TOKEN_FILE环境变量
• 从Pod内可正常向SNS、SQS发送GET/POST请求

1. 修正客户端凭证提供者的使用方式
   代码中手动调用getCredentials()并包装成新提供者的方式，会跳过WebIdentityTokenCredentialsProvider的自动刷新逻辑，导致凭证无法正确加载。直接传入AWSCredentialsProvider实例即可：

   @Bean
   public SqsClient sqsClient(AWSCredentialsProvider awsCredentialsProvider) {
       return SqsClient
               .builder()
               .credentialsProvider(awsCredentialsProvider)
               .region(Region.EU_WEST_1).build();
   }
   
   @Bean
   public SnsClient snsClient(AWSCredentialsProvider awsCredentialsProvider) {
       return SnsClient
               .builder()
               .credentialsProvider(awsCredentialsProvider)
               .region(Region.EU_WEST_1).build();
   }
   

2. 检查环境变量完整性
   WebIdentityTokenCredentialsProvider需要同时依赖AWS_WEB_IDENTITY_TOKEN_FILE和AWS_ROLE_ARN两个环境变量，缺少后者会直接导致凭证加载失败。确认K8s清单中是否已注入AWS_ROLE_ARN，其值应为服务对应的IAM角色ARN。

3. 验证IAM角色信任关系
   确保EKS集群的OIDC提供商已被添加到IAM角色的信任策略中，示例信任策略如下（替换为你的集群信息）：

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "Federated": "arn:aws:iam::你的AWS账号ID:oidc-provider/oidc.eks.区域.amazonaws.com/id/集群OIDC标识符"
         },
         "Action": "sts:AssumeRoleWithWebIdentity",
         "Condition": {
           "StringEquals": {
             "oidc.eks.区域.amazonaws.com/id/集群OIDC标识符:sub": "system:serviceaccount:命名空间:服务账户名"
           }
         }
       }
     ]
   }
   

4. 统一SDK版本避免冲突
   SqsClient/SnsClient属于AWS SDK for Java v2，需确保aws-java-sdk-sts（v1）与v2 SDK版本兼容。建议使用AWS SDK BOM统一管理版本：

   <dependencyManagement>
     <dependencies>
       <dependency>
         <groupId>software.amazon.awssdk</groupId>
         <artifactId>bom</artifactId>
         <version>2.25.0</version> <!-- 使用最新稳定版 -->
         <type>pom</type>
         <scope>import</scope>
       </dependency>
     </dependencies>
   </dependencyManagement>
   

5. 启用SDK日志排查细节
   添加日志配置，打印凭证加载的详细过程，定位具体失败环节：

   logging.level.software.amazon.awssdk.auth.credentials=DEBUG
   logging.level.com.amazonaws.auth=DEBUG
   

内容的提问来源于stack exchange，提问作者Elshan Akbarov