cli: fall back to unsigned S3 reads without credentials - #1808
Open
amacneil wants to merge 6 commits into
Open
Conversation
Without AWS credentials, object_store probed the EC2 metadata service with aggressive retries, hanging for seconds on typical developer machines. Probe IMDS once with a one-second timeout and, if it does not answer, send the request unsigned. Add --no-sign-request to force that. Fixes: #1803 Co-authored-by: adrian <adrian@foxglove.dev>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Lead with the fact that the request was unsigned so the message stays accurate when the user passed --no-sign-request with credentials set. Co-authored-by: adrian <adrian@foxglove.dev>
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Group env helpers before IMDS probe helpers, place should_skip_signature after its callees, and cluster related unit tests the same way. Co-authored-by: adrian <adrian@foxglove.dev>
The flag is global and parses in either position; putting it after `info` matches other examples like `--time-format` and `--allow-remote-scan`. Co-authored-by: adrian <adrian@foxglove.dev>
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Say "object store URLs" and name S3, GCS, and Azure on --no-sign-request so help does not read like the crate name. Co-authored-by: adrian <adrian@foxglove.dev>
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
amacneil
marked this pull request as ready for review
August 13, 2026 17:56
amacneil
requested review from
bennetthardwick,
gasmith and
james-rms
as code owners
August 13, 2026 17:56
Co-authored-by: adrian <adrian@foxglove.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changelog
S3 reads without AWS credentials no longer hang on the EC2 metadata service; the CLI falls back to unsigned requests, and
--no-sign-requestforces unsigned requests to S3, GCS, or Azure.Docs
Updated
website/docs/guides/cli.md(global help text and the Credentials section).Description
Without AWS credential environment variables,
object_storefell through to the EC2 instance metadata service and applied its data-plane retry budget. On a machine that is not using IMDS credentials that produced a multi-second hang and an opaque error naming169.254.169.254.This change:
--no-sign-request(same spelling as the AWS CLI and s5cmd) to force unsigned requests to S3, GCS, or Azure. The flag is global and parses after the subcommand, e.g.mcap info --no-sign-request s3://....AWS_EC2_METADATA_DISABLED=trueand mapsAWS_EC2_METADATA_SERVICE_ENDPOINTontoAWS_METADATA_ENDPOINTso the probe and credential fetch agree.~/.aws/credentialsor SSO).This does not fully address #1803. The reporter's bucket is authenticated and their keys live in
~/.aws/credentials(the Go CLI 0.0.62 read that file;object_storedoes not). Exporting keys withaws configure export-credentialsunblocks them today. A follow-up should read the shared AWS credentials file; that is out of scope here.Region is not required (
object_storedefaults tous-east-1); setAWS_REGIONwhen the bucket is elsewhere.Credential detection for the auto-unsigned path mirrors
AmazonS3Builder::buildin object_store 0.13.2. Re-check that list when bumping object_store; a missed branch would force unsigned on a source that should sign.Testing
AWS_*credentials:mcap infofinishes in well under a few seconds with no IMDS hang (verified against local MinIO).403 Forbiddenand "The request was sent unsigned..." (verified against local MinIO).AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEYset:mcap infosucceeds (verified against local MinIO).mcap info --no-sign-requestwith credentials still set: unsigned 403 guidance; flag wins over keys (verified against local MinIO).Related: #1803