mirror of
https://github.com/grafana/grafana.git
synced 2026-03-13 15:29:48 +08:00
08bdf00c50
Plugins: Forward AWS SDK credential chain env vars to external plugins
Fixes broken AWS authentication (assume role, SigV4) for external plugins
(Redshift, Athena, Amazon Prometheus, OpenSearch) in Grafana 12.4.0.
In v12.4.0, commit f041563df3 changed plugin env var handling so external
plugins no longer receive host environment variables by default. This breaks
the AWS SDK credential chain in container environments (EKS IRSA, ECS Fargate)
which rely on vars like AWS_ROLE_ARN, AWS_WEB_IDENTITY_TOKEN_FILE, and
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.
Forward 8 critical AWS SDK credential chain env vars from the host to plugins
already in [aws] forward_settings_to_plugins. This is scoped to trusted AWS
plugins only, more targeted than PR #118870's global approach.
Includes test coverage for forwarding, non-forwarding, and selective env var
filtering.
Fixes #119235, #119603, opensearch-datasource#1012
This directory contains the code for the Grafana backend.
The contributor documentation for Grafana's backend is in /contribute/backend/README.md.