Stubbing of requests does not work

[jbcden]

I have a call to:

Aws::S3::Client.new(stub_responses: true)

and I immediately get a WebMock::NetConnectNotAllowedError. Thoughts?

[awood45]

Can you provide a stack trace? I can't reproduce this error on my end.

[jbcden]

Failure/Error: s3 = Aws::S3::Client.new(stub_responses: true)
WebMock::NetConnectNotAllowedError:
Real HTTP connections are disabled. Unregistered request: GET http://169.254.169.254/latest/meta-data/iam/security-credentials/ with headers {'Accept'=>'/', 'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3', 'User-Agent'=>'Ruby'}

   You can stub this request with the following snippet:

stub_request(:get, "http://169.254.169.254/latest/meta-data/iam/security-credentials/").
with(:headers => {'Accept'=>'/', 'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3', 'User-Agent'=>'Ruby'}).
to_return(:status => 200, :body => "", :headers => {})

[awood45]

This looks like a failure when trying to pull from the instance profile credentials, which I'm still not able to recreate. If you can tell me what version of the SDK you're using, that could be helpful. Taking a look in the meantime.

[awood45]

We can see that the stub_responses client is accessing the credential provider chain, which shouldn't happen at all. We're looking in to that.

[trevorrowe]

The Aws::Plugins::StubResponses plugin provides default credentials that should provide default static fake credentials. The issue is that the Aws::Plugins::RequestSigner plugin is providing an instance of the Aws::DefaultCredentialProviderChain and that is being resolved first. The default chain searches for instance profile credentials.

Our tests are not picking them up because we apply the following in our spec helper:

RSpec.configure do |config|
  config.before(:each) do
    # disable instance profile credentials
    path = '/latest/meta-data/iam/security-credentials/'
    stub_request(:get, "http://169.254.169.254#{path}").to_raise(SocketError)
  end
end

The solution is pretty simple. The SDK needs to apply the stub responses plugin after the request signing plugin so that it has precedence on setting the default credentials option.

[jbcden]

@trevorrowe That seems to have fixed most of it. Thanks so much!

[trevorrowe]

I've fixed this in the SDK now. When you set stub_responses: true, it will no longer default to the credential provider chain to load credentials. Instead it will use a set of static fake credentials. This should go out with the next release, some time next week.