java - SQS ExpiredToken: The security token included in the request is expired status code: 403 -

-

i have long-running worker process running on ec2 consumes items sqs queue. after time (8-12 hours, reckon) begin getting expired security token errors. expect aws lib handle refresh of credentials automatically seems not case. in anyway handled within client? happens when use defaultcredentialsproviderchain generate access. error not occur when used key , secret. stacktrace below:

com.amazonaws.amazonserviceexception: security token included in request expired (service: amazonsqs; status code: 403; error code: expiredtoken; request id: 6ff6e1a0-d668-5ac5-bcd7-ae30058f25c0)     @ com.amazonaws.http.amazonhttpclient.handleerrorresponse(amazonhttpclient.java:1182)     @ com.amazonaws.http.amazonhttpclient.executeonerequest(amazonhttpclient.java:770)     @ com.amazonaws.http.amazonhttpclient.executehelper(amazonhttpclient.java:489)     @ com.amazonaws.http.amazonhttpclient.execute(amazonhttpclient.java:310)     @ com.amazonaws.services.sqs.amazonsqsclient.invoke(amazonsqsclient.java:2419)     @ com.amazonaws.services.sqs.amazonsqsclient.receivemessage(amazonsqsclient.java:1130)     @ com.amazonaws.services.sqs.amazonsqsasyncclient$24.call(amazonsqsasyncclient.java:1783)     @ com.amazonaws.services.sqs.amazonsqsasyncclient$24.call(amazonsqsasyncclient.java:1779)     @ java.util.concurrent.futuretask.run(futuretask.java:266)     @ java.util.concurrent.threadpoolexecutor.runworker(threadpoolexecutor.java:1142)     @ java.util.concurrent.threadpoolexecutor$worker.run(threadpoolexecutor.java:617)     @ java.lang.thread.run(thread.java:745)

the workaround found renew awscredentials everytime encountered expired token error , reset sqs client.

awscredentials = (new defaultawscredentialsproviderchain).getcredentials sqs = simplesqsclient(awscredentials, regions.us_east_1) queuesqs = sqs.simple(queuename(queuename), true)

note: using wrapper kifi/franz

the aws sdks indeed capable of cycling temporary credentials inherited instance profile, passing explicit awscredentials object in constructor of simplesqsclient believe denying opportunity so.

you didn't explicitly state application inheriting instance role, there enough evidence in post infer case:

  • your application running on ec2.
  • defaultawscredentialsproviderchain's behavior "instance profile credentials delivered through amazon ec2 metadata service" if can find no other credentials.
  • you're seeing behavior when not explicitly passing own known access/secret keys.

the specific behavior automatic credentials refresh described in documentation:

the automatic credentials refresh happens when use default client constructor, creates own instanceprofilecredentialsprovider part of default provider chain, or when pass instanceprofilecredentialsprovider instance directly client constructor. if use method obtain or pass instance profile credentials, responsible checking , refreshing expired credentials.

by passing awscredentials directly instead of awscredentialsprovider, become responsible checking , refreshing expired credentials. on plus side, workaround fine if want keep passing credentials explicitly.

simplesqsclient has constructor work better use case:

new simplesqsclient(     credentialprovider: com.amazonaws.auth.awscredentialsprovider,     region: com.amazonaws.regions.regions,     buffered: boolean )

example:

simplesqsclient sqs = simplesqsclient(new defaultawscredentialsproviderchain(), regions.us_east_1, false)

example, explicitly using instanceprofilecredentialsprovider:

simplesqsclient sqs = simplesqsclient(new instanceprofilecredentialsprovider(), regions.us_east_1, false)

further reading:


Comments

Post a Comment

Popular posts from this blog

java - nested exception is org.hibernate.exception.SQLGrammarException: could not extract ResultSet Hibernate+SpringMVC -

-
i trying fetch records database , having above error this classs appropriate getters , setters public class user { private int id; private string username; private string password; private string email; i have create database , inserted data below configuration <bean id="datasource" class="org.apache.commons.dbcp2.basicdatasource" destroy-method="close"> <property name="driverclassname" value="com.mysql.jdbc.driver"/> <property name="url" value="jdbc:mysql://localhost:3306/usersdb"/> <property name="username" value="root"/> <property name="password" value=""/> </bean> this complete stacktrace severe: servlet.service() servlet [appservlet] in context path [/spring] threw exception [request processing failed; nested exception org.hibernate.exception.sqlgrammarexception: not ...
Read more

sql - Postgresql tables exists, but getting "relation does not exist" when querying -

-
Image
i have postgresql db number of tables. if query: select column_name information_schema.columns table_name="my_table"; i list of columns returned properly. however, when query: select * "my_table"; i error: (programmingerror) relation "my_table" not exist 'select *\n "my_table"\n' {} any thoughts on why can columns, can't query table? goal able query table. you have include schema if isnt public one select * <schema>."my_table" or can change default schema show search_path; set search_path my_schema; check table schema here select * information_schema.columns for example if table on default schema public both works ok select * parroquias_region select * public.parroquias_region but sectors need specify schema select * map_update.sectores_point
Read more

asp.net mvc - breakpoint on javascript in CSHTML? -

-
i have .cshtml file has javascript tag. within script tag have few lines of javascript. first line of javascript refers property in @viewbag. other javascript lines plain script without mvc related references. observation: can place breakpoints (visual studio 2015) on each of these javascript lines. however, breakpoints has white dot in center of breakpoint symbol (red circle) except line @viewbag reference (this particular line not have white dot in center). it seems breakpoint without white dot hit during run-time. question: can explain going on here? white dot mean? why plain red breakpoint line line hitting breakpoint? the visual studio debugger expecting debug actual server-side code within .cshtml file opposed client-side javascript within it. iirc, visual studio allow debug javascript code expected in internet explorer (and possibly edge), other browsers want use either third-party tool or developer tools (f12) within browser. an easy approach take advant...
Read more