Application panics at aws_smithy_client::conns::https while getting credentials when running as a task in ECS but not locally

[JoshuaNitschke]

Hi,

I've spent a lot of time troubleshooting this and searching for answers, but I haven't found anything that works. I am a bit loss as to why my app is working locally but not as an ECS Task

My application is a web server running on rocket and interfaces with s3. Locally, everything is working fine, but when I push it into ECS and start a task, the application panics trying to load config.

Here is the output I am able to get using RUST_BACKTRACE=1

0: rust_begin_unwind
at ./rustc/90743e7298aca107ddaa0c202a4d3604e29bfeb6/library/std/src/panicking.rs:575:5
1: core::panicking::panic_fmt
at ./rustc/90743e7298aca107ddaa0c202a4d3604e29bfeb6/library/core/src/panicking.rs:65:14
2: std::sys_common::once::futex::Once::call
3: aws_smithy_client::conns::https
4: aws_config::connector::default_connector
5: aws_config::loader::ConfigLoader::load::{{closure}}
6: web_api::s3_action::{{closure}}
7: <core::future::from_generator::GenFuture<T> as core::future::future::Future>::poll

Docker file is FROM ubuntu:22.04

Locally I am working on Windows 11

Cargo.toml dependencies below:

[dependencies]
async-std = "1.11.0"
base64 = "0.12.3"
chrono = "0.4"
log = "0.4.17"
md5 = "0.7.0"
rocket = { version = "0.5.0-rc.2", features = ["json"] }
serde = { version = "1.0", features = ["derive"] }
serde_json = {version = "1.0"}
fern = "0.5"
uuid = { version = "0.8", features = ["serde", "v4"] }
aws-config = "0.54.1"
aws-sdk-s3 = {version = "0.24.0", features = ["serde", "v4"]}
tokio = { version = "1", features = ["full"] }

I started here:

let config = aws_config::load_from_env().await;

have ended up here, compiling in my keys during build pipeline just to see if it was something odd with the env variables on ECS

    let config = aws_config::from_env()
        .credentials_provider(Credentials::new(
            env!("AWS_ACCESS_KEY_ID"),
            env!("AWS_SECRET_ACCESS_KEY"),
            None,
            None,
            "github secrets",
        ))
        .retry_config(RetryConfig::disabled())
        .load()
        .await;

Thanks for your assistance, apologies in advance if I have missed something super trivial, but the erroring on this could be a lot more clearer as well. :)

[JoshuaNitschke]

answer was to install ca-certificates in the Docker file.

A nice error message instead of a panic! would be nice :) something like "(unable to get local issuer certificate)"

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.