Version 0.66.0 not authorized with AWS #9429
Replies: 7 comments 21 replies
-
|
This might be related #9430 |
Beta Was this translation helpful? Give feedback.
-
|
#9322 may be relevant. Since this PR was merged while I was away, I didn't have a chance to review it. |
Beta Was this translation helpful? Give feedback.
-
|
hm... i can't reproduce this error: ➜ ~ docker run -it --rm --entrypoint sh aquasec/trivy:0.66.0
/ # export AWS_ACCESS_KEY_ID=<redacted>
/ # export AWS_SECRET_ACCESS_KEY=<redacted>
/ # export AWS_SESSION_TOKEN=<redacted>
/ # trivy -q --cache-backend memory image <redacted>.amazonaws.com/trivy-test:latest
Report Summary
┌─────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────┬─────────┐
│ Target │ Type │ Vulnerabilities │ Secrets │
├─────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────┼─────────┤
│ <redacted>.amazonaws.com/trivy-test:latest (alpine │ alpine │ 0 │ - │
│ 3.22.1) │ │ │ │
└─────────────────────────────────────────────────────────────────────────────────┴────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)
|
Beta Was this translation helpful? Give feedback.
-
|
@jscancella Can you scan image with |
Beta Was this translation helpful? Give feedback.
-
|
I will give that a try and report back later. However I don't manually export any keys like in your example. Because the job is run in my AWS environment it has always just worked. |
Beta Was this translation helpful? Give feedback.
-
|
Here is the debug output of the credential errors: |
Beta Was this translation helpful? Give feedback.
-
|
We use aws ECR pull through caches in our environment for performance reasons (less bandwidth to internet, less latency, less requests made to public repos) for trivy and the db and java db. In 0.65.0 and earlier, our authenticated environment is able to pull all 3 images. In 0.66.0, now that #9322 has been merged, this now fails. To reproduce, Run trivy, using GitLab with a snippet like the following, to an authenticated AWS ECR repo. Authentication works something like this somewhere in the pipeline: With 0.65.0 this will work! With 0.66.0 this fails with: If we update the script to install docker and the aws-cli ( |
Beta Was this translation helpful? Give feedback.
-
|
@jscancella @chriskellyrelay Thanks for your information and help! |
Beta Was this translation helpful? Give feedback.
-
|
Getting a "not authorized" to pull those, even when authenticated to dockerhub. |
Beta Was this translation helpful? Give feedback.
-
|
what about ghcr.io? |
Beta Was this translation helpful? Give feedback.
-
|
same for me - I am not setup to build go code and after trying for a bit I am just running into a lot of issues. |
Beta Was this translation helpful? Give feedback.
-
|
@jscancella you can use images or binaries from the images above. |
Beta Was this translation helpful? Give feedback.
-
|
sorry, I hadn't refreshed the page. I used that amd-64 image and it works correctly again |
Beta Was this translation helpful? Give feedback.
-
|
created #9437 |
Beta Was this translation helpful? Give feedback.
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
@chriskellyrelay @jscancella @eldondevat I tried to replicate it hard, but no luck. Could you share more details to help us reproduce the issue? Please feel free to mask any sensitive information, such as account numbers or credentials. You don’t have to answer all of the questions below; any additional details you can provide would be greatly appreciated.
|
Beta Was this translation helpful? Give feedback.
-
Command Lines Used
Reproducibility
Execution Environment
AWS Configuration
Network Configuration
IMDS Reachability Checks
Reproduction Steps
|
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
@knqyf263 anything else you need/want? Or is there a work around I can do in the meantime while this is worked on? |
Beta Was this translation helpful? Give feedback.
-
|
Minimal steps to reproduce:
|
Beta Was this translation helpful? Give feedback.
-
|
Correct, this is just me manually running the docker container on a EC2 instance. This all works perfectly in version 0.65.0 and the version that @DmitriyLewen made, so I don't think it is IAM role issues. The screenshot shows it is complaining about being unauthorized I tried setting Debug output: |
Beta Was this translation helpful? Give feedback.
-
I don’t mean it’s an IAM role issue, but since authentication succeeds without any problem with my IAM role settings, I’d like to know what kind of configuration would reproduce this error. |
Beta Was this translation helpful? Give feedback.
-
|
Ok, how do I check what the role settings are? Or to put it another way, is there a screenshot I can provide you that will get you the information you need? |
Beta Was this translation helpful? Give feedback.
-
|
Looks like this is moot - version 0.67.0 works fine |
Beta Was this translation helpful? Give feedback.
-
|
Confirmed here. 0.67.0 works for us as well. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Description
0.65.0 works fine, but when using 0.66.0 I get this error
Desired Behavior
It to continue to work and not give authorization errors
Actual Behavior
Reproduction Steps
Target
Container Image
Scanner
None
Output Format
None
Mode
None
Debug Output
I don't have that abilityOperating System
amazon linux
Version
Checklist
trivy clean --allBeta Was this translation helpful? Give feedback.
All reactions