feat(letsencrypt): Add AWS profile support for Route 53 DNS challenge#4285
feat(letsencrypt): Add AWS profile support for Route 53 DNS challenge#4285jsamuel1 wants to merge 6 commits intohome-assistant:masterfrom
Conversation
Allow boto3 to use its default credential chain when aws_access_key_id and aws_secret_access_key are not provided. This enables users with EC2 instance profiles, IAM Roles Anywhere, or other AWS credential sources to use dns-route53 without hardcoding credentials. Backward compatible - existing configurations with explicit credentials continue to work unchanged.
- Add aws_profile option to config schema for IAM Roles Anywhere support - Update run script to use AWS_PROFILE when configured - Prioritize: aws_profile > aws_access_key_id > default credential chain - Update documentation with three authentication options
- Add aws_profile option to config schema for IAM Roles Anywhere support - Update run script to use AWS_PROFILE when configured - Auto-detect /share/.aws/config for credential_process support - Require either aws_profile OR access_key_id+secret_access_key (no default chain) - Update documentation with both authentication options
![home-assistant[bot]](https://avatars.githubusercontent.com/in/97978?s=60&v=4){kind=small}
|
Please take a look at the requested changes, and use the Ready for review button when you are done, thanks 👍 |
home-assistant
bot
added
cla-recheck
cla-signed
and removed
cla-recheck
cla-needed
labels
|
Warning Rate limit exceeded@jsamuel1 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 22 minutes and 19 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds AWS Route53 credential options for Let's Encrypt DNS validation: supports either Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @letsencrypt/DOCS.md:
- Line 1288: Replace the bold text "**Option 1: Using AWS Profile (recommended
for IAM Roles Anywhere)**" with a proper markdown heading using sentence-style
capitalization (for example: "## Option 1: Using AWS profile (recommended for
IAM Roles Anywhere)"), and make the identical change for the other occurrence
noted (line 1304) so both use headings instead of bolded text.
🧹 Nitpick comments (2)
letsencrypt/DOCS.md (2)
1302-1302: Clarify that the AWS config file is optional.The current wording "uses the AWS credentials file" could imply it's required. Consider clarifying that the config file at
/share/.aws/configis optional and will be used if present.✍️ Suggested clarity improvement
- This uses the AWS credentials file at `/share/.aws/config` with a `credential_process` for IAM Roles Anywhere. + If present, the AWS config file at `/share/.aws/config` will be used to support `credential_process` for IAM Roles Anywhere.
1319-1319: Consider clarifying precedence when both options are provided.While the note correctly states the requirement, it doesn't clarify what happens if a user provides both
aws_profileAND access keys. The implementation (line 284 in run script) gives precedence toaws_profile, which users might want to know.✍️ Optional precedence clarification
- **Note:** You must provide either `aws_profile` OR both `aws_access_key_id` and `aws_secret_access_key`. + **Note:** You must provide either `aws_profile` OR both `aws_access_key_id` and `aws_secret_access_key`. If both are configured, `aws_profile` takes precedence.
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to data retention organization setting
📒 Files selected for processing (3)
letsencrypt/DOCS.mdletsencrypt/config.yamlletsencrypt/rootfs/etc/services.d/lets-encrypt/run
🧰 Additional context used
📓 Path-based instructions (1)
*/**(html|markdown|md)
⚙️ CodeRabbit configuration file
*/**(html|markdown|md): - For instructional content in documentation, use a direct and authoritative tone. Avoid expressions of politeness such as 'may' or 'please', and ensure the goal of the instruction is fronted.
- Apply the Microsoft Style Guide to ensure documentation maintains clarity and conciseness.
- In step-by-step instructions, front the location phrase in the instructional sentence.
- In step-by-step instructions, front the 'goal' in the instructional sentence.
- In step-by-step instructions, if in doubt what to front, front the 'goal' before the location phrase in the instructional sentence.
- do not hyphenate terms like 'top-right' or 'bottom-left' with 'corner'
*/**(html|markdown|md): - Use bold to mark UI strings.
If "" are used to mark UI strings, replace them by bold.
Be brief in your replies and don't add fluff like "thank you for..." and "Please let me know if"
Use sentence-style capitalization also in headings.
do not comment on HTML used for icons
Avoid flagging inline HTML for embedding videos in future reviews for this repository.
Files:
letsencrypt/config.yamlletsencrypt/DOCS.md
🪛 markdownlint-cli2 (0.18.1)
letsencrypt/DOCS.md
1288-1288: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
1304-1304: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
🔇 Additional comments (3)
letsencrypt/config.yaml (1)
41-41: LGTM! AWS profile configuration added correctly.The new
aws_profilefield follows the existing schema conventions and aligns with the dual authentication approach implemented in the run script.letsencrypt/DOCS.md (1)
1288-1319: Documentation accurately reflects the implementation.The two authentication options are well-documented with clear examples and security guidance. The changes align with the runtime behavior in the run script.
letsencrypt/rootfs/etc/services.d/lets-encrypt/run (1)
284-303: Excellent implementation of mutually exclusive authentication methods.The credential handling logic is well-structured:
- Proper precedence:
aws_profilechecked first, then access keys- Validation:
aws_secret_access_keyrequired whenaws_access_key_idis provided- Clear error handling: Exit with informative message if neither method is configured
- Security: No sensitive values logged
- Optional config file support: Correctly checks for and uses
/share/.aws/configwhen presentThe implementation enforces the "no implicit default credential chain" requirement mentioned in the PR objectives.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @letsencrypt/DOCS.md:
- Line 1288: Remove the leading spaces before the Markdown headings so they
start at column 1; specifically edit the headings "### Option 1: Using AWS
profile (recommended for IAM Roles Anywhere)" and the heading at line 1304 so
the `###` markers have no indentation, ensuring compliance with MD023.
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
letsencrypt/DOCS.md
🧰 Additional context used
📓 Path-based instructions (1)
*/**(html|markdown|md)
⚙️ CodeRabbit configuration file
*/**(html|markdown|md): - For instructional content in documentation, use a direct and authoritative tone. Avoid expressions of politeness such as 'may' or 'please', and ensure the goal of the instruction is fronted.
- Apply the Microsoft Style Guide to ensure documentation maintains clarity and conciseness.
- In step-by-step instructions, front the location phrase in the instructional sentence.
- In step-by-step instructions, front the 'goal' in the instructional sentence.
- In step-by-step instructions, if in doubt what to front, front the 'goal' before the location phrase in the instructional sentence.
- do not hyphenate terms like 'top-right' or 'bottom-left' with 'corner'
*/**(html|markdown|md): - Use bold to mark UI strings.
If "" are used to mark UI strings, replace them by bold.
Be brief in your replies and don't add fluff like "thank you for..." and "Please let me know if"
Use sentence-style capitalization also in headings.
do not comment on HTML used for icons
Avoid flagging inline HTML for embedding videos in future reviews for this repository.
Files:
letsencrypt/DOCS.md
🪛 markdownlint-cli2 (0.18.1)
letsencrypt/DOCS.md
1288-1288: Headings must start at the beginning of the line
(MD023, heading-start-left)
1304-1304: Headings must start at the beginning of the line
(MD023, heading-start-left)
🔇 Additional comments (1)
letsencrypt/DOCS.md (1)
1288-1319: Documentation for Route53 AWS authentication options is clear and complete.The updated Route53 section properly documents both authentication methods (AWS profile via
aws_profileand access keys), includes practical YAML examples for each, auto-detection of/share/.aws/configfor credential_process, and explicitly states the precedence behavior. This aligns well with the PR objectives and coding guidelines.
sairon
left a comment
sairon
left a comment
There was a problem hiding this comment.
We migrated to certbot-dns-multi in #4407, so this will need rebasing and adjusting for the route53 provider from the Lego library: https://go-acme.github.io/lego/dns/route53/index.html
3 participants
Summary
Add support for AWS named profiles in the Route 53 DNS provider, enabling IAM Roles Anywhere authentication with
credential_process.Changes
aws_profileoption to config schema/share/.aws/configfor credential_process supportaws_profileORaws_access_key_id+aws_secret_access_key(no implicit default credential chain)Use Case
This enables users to authenticate with AWS using X.509 certificates via IAM Roles Anywhere instead of static IAM access keys. Benefits:
Configuration Example
Using AWS Profile (IAM Roles Anywhere):
Using Access Keys (existing behavior):
Testing
Tested on Home Assistant OS (aarch64) with IAM Roles Anywhere and
aws_signing_helpercredential_process.Summary by CodeRabbit
New Features
Documentation
Bug Fixes
✏️ Tip: You can customize this high-level summary in your review settings.