I'm running a Symfony app in EKS, and I'm using SQS with Messenger + this lib.
I'm having small clusters of failures at long intervals with 403 responses from the SQS APIs:
HTTP 403 returned for "https://sqs.eu-central-1.amazonaws.com/".
Code: AccessDenied
Message: Access to the resource https://sqs.eu-central-1.amazonaws.com/ is denied.
Type: Sender
Detail:
I've dig into the logs, and I've found this warning:
php.WARNING: Warning: file_get_contents(/var/run/secrets/eks.amazonaws.com/serviceaccount/token): failed to open stream: No such file or directory {"exception":"[object] (ErrorException(code: 0): Warning: file_get_contents(/var/run/secrets/eks.amazonaws.com/serviceaccount/token): failed to open stream: No such file or directory at /var/www/my-project/vendor/async-aws/core/src/Credentials/WebIdentityProvider.php:92)"} []
So I've traced down the issue to something that happened on the official SDK too: https://github.com/aws/aws-sdk-php/issues/2014
Basically, it's a combination of:
- tokens are short lived
- EKS replaces tokens on-the-fly
- PHP's realpath cache gets in the way...
... so you get brief intervals in which you try to read the old, now missing token.
In the offical SDK, the issue was mitigated by clearing the cache in a precise and ordered way of the following paths:
/var/run/secrets/eks.amazonaws.com/serviceaccount/..data/token
/var/run/secrets/eks.amazonaws.com/serviceaccount/..data
/var/run/secrets/eks.amazonaws.com/serviceaccount/token
in this PR: https://github.com/aws/aws-sdk-php/pull/2043
Can we apply the same logic here too?