Merge branch 'aws-es-connect-when-needed' into 'master'

Only try AWS instance profile creds if needed

See merge request gitlab-org/gitlab-ee!3798

changelogs/unreleased-ee/aws-es-connect-when-needed.yml

+---
+title: Stop authorization attempts with instance profile when static credentials are
+  provided for AWS Elasticsearch
+merge_request:
+author:
+type: fixed

lib/gitlab/elastic/client.rb

@@ -32,13 +32,15 @@ module Gitlab
         # Resolve credentials in order
         # 1.  Static config
         # 2.  ec2 instance profile
-        credentials = [
-          Aws::Credentials.new(config[:aws_access_key], config[:aws_secret_access_key]),
-          Aws::InstanceProfileCredentials.new
-        ]
-        credentials.find do |creds|
-          creds&.set?
-        end
+        static_credentials = Aws::Credentials.new(config[:aws_access_key], config[:aws_secret_access_key])
+
+        return static_credentials if static_credentials&.set?
+
+        # Instantiating this will perform an API call, so only do so if the
+        # static credentials did not work
+        instance_credentials = Aws::InstanceProfileCredentials.new
+
+        instance_credentials if instance_credentials&.set?
       end
     end
   end

spec/lib/gitlab/elastic/client_spec.rb

@@ -28,7 +28,7 @@ describe Gitlab::Elastic::Client do
       .to_return(status: 200, body: creds_response, headers: {})
   end
 
-  describe 'build' do
+  describe '.build' do
     let(:client) { described_class.build(params) }
 
     context 'without credentials' do
@@ -73,10 +73,10 @@ describe Gitlab::Elastic::Client do
     end
   end
 
-  describe 'resolve_aws_credentials' do
+  describe '.resolve_aws_credentials' do
     let(:creds) { described_class.resolve_aws_credentials(params) }
 
-    context 'with AWS IAM static credentials' do
+    context 'when the AWS IAM static credentials are valid' do
       let(:params) do
         {
           url: 'http://example-elastic:9200',
@@ -87,14 +87,13 @@ describe Gitlab::Elastic::Client do
         }
       end
 
-      it 'returns credentials from static credentials' do
-        stub_instance_credentials(creds_fail_response)
-
+      it 'returns credentials from static credentials without making an HTTP request' do
         expect(creds.credentials.access_key_id).to eq '0'
         expect(creds.credentials.secret_access_key).to eq '0'
       end
     end
 
+    context 'when the AWS IAM static credentials are invalid' do
       context 'with AWS ec2 instance profile' do
         let(:params) do
           {
@@ -128,4 +127,5 @@ describe Gitlab::Elastic::Client do
         end
       end
     end
+  end
 end