Re-add AWS credential check from cloudwatch output

[adamchainz]

Re-add the check removed in #3583, but this time using the right API call that doesn't require any additional permissions. Fixes #3474.

I tested this by running telegraf locally with my personal credentials, and also running $ aws sts get-caller-identity on an EC2 instance that had an IAM Role/instance profile with zero permissions.

Required for all PRs:

• Signed CLA.
• Associated README.md updated.-
• Has appropriate unit tests.

[adamchainz]

@danielnelson @sbalagopal @arohter please check :)

[danielnelson]

Thank you @adamchainz, I triggered circleci to create packages in case it is helpful for testing:

• amd64 deb
• amd64 rpm

Let me know if anyone needs a different package type.

[adamchainz]

Thanks! I extracted and ran the amd64 binary on my ec2 instance with an instance profile and it started fine:

ubuntu@ip-172-30-0-85:~$ ./usr/bin/telegraf --config test.conf
2017-12-15T05:57:08Z D! Attempting connection to output: cloudwatch
2017-12-15T05:57:09Z D! Successfully connected to output: cloudwatch
2017-12-15T05:57:09Z I! Starting Telegraf v1.6.0~53cb07b9
2017-12-15T05:57:09Z I! Loaded outputs: cloudwatch
2017-12-15T05:57:09Z I! Loaded inputs: inputs.cpu
2017-12-15T05:57:09Z I! Tags enabled: host=ip-172-30-0-85
2017-12-15T05:57:09Z I! Agent Config: Interval:10s, Quiet:false, Hostname:"ip-172-30-0-85", Flush Interval:10s
^C2017-12-15T05:57:13Z I! Hang on, flushing any cached metrics before shutdown
2017-12-15T05:57:13Z D! Output [cloudwatch] buffer fullness: 0 / 10000 metrics.

I then detached the instance profile and ran again, and the connect test failed:

ubuntu@ip-172-30-0-85:~$ ./usr/bin/telegraf --config test.conf
2017-12-15T05:58:37Z D! Attempting connection to output: cloudwatch
2017-12-15T05:58:37Z E! cloudwatch: Cannot use credentials to connect to AWS : NoCredentialProviders: no valid providers in chain. Deprecated.
	For verbose messaging see aws.Config.CredentialsChainVerboseErrors
2017-12-15T05:58:37Z E! Failed to connect to output cloudwatch, retrying in 15s, error was 'NoCredentialProviders: no valid providers in chain. Deprecated.
	For verbose messaging see aws.Config.CredentialsChainVerboseErrors'

[adamchainz]

(using simple test config:

[agent]
  debug = true

[[outputs.cloudwatch]]
  region = "eu-west-1"
  namespace = "InfluxData/Telegraf"

[[inputs.cpu]]

)

[sbalagopal]

I did quick testing using the rpm provided and was working as expected. I tried using the simple configuration that Adam posted above (with minor changes) and with the IAM role, telegraf was able to connect and post metrics to cloudwatch. Thank you for the quick fix! Best regards, Sabarish

…

On Fri, Dec 15, 2017 at 11:30 AM, Adam Johnson ***@***.***> wrote: (using simple test config: [agent] debug = true [[outputs.cloudwatch]] region = "eu-west-1" namespace = "InfluxData/Telegraf" [[inputs.cpu]] ) — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#3587 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ASpAt01DFzuaW85e5yiXxhDpxHSo9lpiks5tAgsIgaJpZM4RCtwz> .

-- Regards, Sabarish

[adamchainz]

👌