[MAVEN]-[S3]: How to configure aws region?

[ajax-kovtunov-o]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Mend Renovate hosted app on github.com

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

How to configure aws region for renovate bot?

Configuration

• github
• private s3 maven repository

{
"packageRules": [
      "registryUrls": [
        "s3://ajax-system-maven-repository/snapshots"
      ],
    }
  ],
"hostRules": [
    {
      "hostType": "maven",
      "matchHost": "s3://ajax-system-maven-repository/snapshots",
      "encrypted": {
        "username": "aws-acces-key-id",
        "password": "aws-secret-key"
      }
    }
  ],
"customEnvVariables": {
    "AWS_REGION": "aws-region"
  }
}

The problem is

DEBUG: Unknown S3 download error

I guess that root cause is unconfigured AWS_REGION

Logs (if relevant)

Logs

DEBUG: Unknown S3 download error
{
  "failedUrl": "<my package>"
  "message": "The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint."
}

[rarkins]

Will any region work or needs a specific one?

[rarkins]

Have you tested it locally with Renovate and confirm it definitely works if an AWS_REGION is defined?

[ajax-kovtunov-o]

I haven't tested it locally. Do u mean run renovate docker image locally and try to pass AWS_REGION as env var to the renovate application? I don't.

But I've use github action, it works:

      - name: Self-hosted Renovate
        uses: renovatebot/github-action@v40.1.0
        env:
          LOG_LEVEL: debug
          AWS_REGION: "region"
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

[rarkins]

Looking at the code, it doesn't seem like authentication is supported in hosted mode anyway:

renovate/lib/modules/datasource/maven/util.ts

Lines 106 to 120 in b5b0a74

	export async function downloadS3Protocol(pkgUrl: URL): Promise<string | null> {
	logger.trace({ url: pkgUrl.toString() }, `Attempting to load S3 dependency`);
	try {
	const s3Url = parseS3Url(pkgUrl);
	if (s3Url === null) {
	return null;
	}
	const { Body: res } = await getS3Client().send(new GetObjectCommand(s3Url));
	if (res instanceof Readable) {
	return streamToString(res);
	}
	logger.debug(
	`Expecting Readable response type got '${typeof res}' type instead`,
	);
	} catch (err) {

In self-hosted mode the AWS library would take care of reading in the auth from env

[ajax-kovtunov-o]

Okey, thanks. But maybe it possible to pass env var?

[rarkins]

Renovate has a feature to allow passing of env vars as long as the var or pattern is pre-approved. Because Renovate's backend runs on AWS, it could cause problems to override AWS_ env. Instead it would be better to pass them explicitly from hostRules to the AWS S3 SDK.