You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Our SaaS software is multi-tenant - at the start of each request we identify/validate the tenant and add that to the coroutine context, such that the tenant is available downstream.
The coroutine-scoped tenant context used for various low-level tasks - in this case, we also have scoped-down IAM policies; calls to SDK functions go through a credentials provider that will dynamically scope down policies. For example, an S3 policy would be scoped down to only allow "/tenant-id/*", ditto for dynamo, etc.
That all works fine (and has for quite a while). When we use constructs such as the below - SDK call returning a Flow that invokes other SDK calls (the fact that these are dynamo calls isn't material) - the outer call works fine (scoped down policy applied, call is executed), but the inner call fails in the credentials provider as it can't resolve the tenant.
Elements added to the coroutine context are propagated to coroutines created by the SDK.
Current behavior
Coroutine context is not propagated.
Steps to Reproduce
no reproducer available atm; lmk if the overall context is insufficient to identify the issue.
Possible Solution
when launching coroutines inside the SDK propagate context elements.
Context
Unable to use the SDK in situations where there are nested SDK calls.
A possible workaround, with material performance/scalability impacts, is to avoid the nested calls - load all the outer data, then process it (bulk processing vs streaming of results).
AWS SDK for Kotlin version
1.3.x
Platform (JVM/JS/Native)
JVM
Operating system and version
macOS Sonoma / Windows / Linux (all affected)
The text was updated successfully, but these errors were encountered:
Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.
Describe the bug
Our SaaS software is multi-tenant - at the start of each request we identify/validate the tenant and add that to the coroutine context, such that the tenant is available downstream.
The coroutine-scoped tenant context used for various low-level tasks - in this case, we also have scoped-down IAM policies; calls to SDK functions go through a credentials provider that will dynamically scope down policies. For example, an S3 policy would be scoped down to only allow "/tenant-id/*", ditto for dynamo, etc.
That all works fine (and has for quite a while). When we use constructs such as the below - SDK call returning a Flow that invokes other SDK calls (the fact that these are dynamo calls isn't material) - the outer call works fine (scoped down policy applied, call is executed), but the inner call fails in the credentials provider as it can't resolve the tenant.
Expected behavior
Elements added to the coroutine context are propagated to coroutines created by the SDK.
Current behavior
Coroutine context is not propagated.
Steps to Reproduce
no reproducer available atm; lmk if the overall context is insufficient to identify the issue.
Possible Solution
when launching coroutines inside the SDK propagate context elements.
Context
Unable to use the SDK in situations where there are nested SDK calls.
A possible workaround, with material performance/scalability impacts, is to avoid the nested calls - load all the outer data, then process it (bulk processing vs streaming of results).
AWS SDK for Kotlin version
1.3.x
Platform (JVM/JS/Native)
JVM
Operating system and version
macOS Sonoma / Windows / Linux (all affected)
The text was updated successfully, but these errors were encountered: