From 9d4c912e0e479dc459464cf3559088bb67385655 Mon Sep 17 00:00:00 2001 From: Nick Craig-Wood Date: Sat, 2 May 2026 21:11:50 +0100 Subject: [PATCH] s3: fix STS call per request by caching AssumeRole credentials The stscreds.AssumeRoleProvider from AWS SDK Go v2 does not cache credentials by itself. The SDK only auto-wraps providers with aws.CredentialsCache when they are loaded via config.LoadDefaultConfig; when assigned directly to aws.Config.Credentials it must be wrapped manually, as documented on stscreds.NewAssumeRoleProvider. Without the cache, configurations using role_arn would call AssumeRole once per S3 request, flooding STS and CloudTrail. See: https://forum.rclone.org/t/aws-iam-roles-credentials-arent-cached/53732 --- backend/s3/s3.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/backend/s3/s3.go b/backend/s3/s3.go index eb4e4de57..0d1923673 100644 --- a/backend/s3/s3.go +++ b/backend/s3/s3.go @@ -1522,8 +1522,10 @@ func s3Connection(ctx context.Context, opt *Options, client *http.Client) (s3Cli } } - // Create AssumeRole credentials provider - awsConfig.Credentials = stscreds.NewAssumeRoleProvider(stsClient, opt.RoleARN, assumeRoleOptions) + // Create AssumeRole credentials provider, wrapped in a + // CredentialsCache so we don't call AssumeRole on every + // request. + awsConfig.Credentials = aws.NewCredentialsCache(stscreds.NewAssumeRoleProvider(stsClient, opt.RoleARN, assumeRoleOptions)) } provider = loadProvider(opt.Provider)