langgenius/dify-plugin-daemon
1
0
Fork 0
mirror of https://github.com/langgenius/dify-plugin-daemon.git synced 2026-07-21 17:25:23 -04:00
Code Issues 111 Packages Projects Releases 10 Wiki Activity

Cannot use IAM role credentials from plugin runtime #11

New Issue
Closed
opened 2026-02-16 00:19:02 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 00:19:02 -05:00
Owner
Copy Link
Copy Source

Originally created by @tmokmss on GitHub (Feb 18, 2025).

When dify-web calls API POST console/api/workspaces/current/model-providers/langgenius/bedrock/bedrock (by clicking Save button below), it results in an unknown error.

Image

The reason seems the python process in the plugin-daemon fails to authenticate with AWS APIs using IAM role credentials. These credentials are available via environment variables and the plugin-daemon process itself can access them (c.f. #23), but the local runtime process cannot access them because the environment variables are not propagated.

The behavior results from this code:

https://github.com/langgenius/dify-plugin-daemon/blob/0636968f84e86191af40e1e0ad331abed23f23e7/internal/core/plugin_manager/local_runtime/run.go#L77-L84

e.Env = append(e.Env, effectively erases all the environment variables because e.Env is nil by default. I'm not sure if it is expected or not, but if we want to propagate environment variables, we can write it like the below c.f. in this document.

	// Set Dir before calling cmd.Environ so that it will include an
	// updated PWD variable (on platforms where that is used).
	cmd.Dir = ".."
	cmd.Env = append(cmd.Environ(), "POSIXLY_CORRECT=1")
Originally created by @tmokmss on GitHub (Feb 18, 2025). When dify-web calls API `POST console/api/workspaces/current/model-providers/langgenius/bedrock/bedrock` (by clicking Save button below), it results in an unknown error. ![Image](https://github.com/user-attachments/assets/7101f394-c2a4-426a-aaa5-cde5b9d0f29a) The reason seems the python process in the plugin-daemon fails to authenticate with AWS APIs using IAM role credentials. These credentials are available via environment variables and the plugin-daemon process itself can access them (c.f. #23), but the local runtime process cannot access them because the environment variables are not propagated. The behavior results from this code: https://github.com/langgenius/dify-plugin-daemon/blob/0636968f84e86191af40e1e0ad331abed23f23e7/internal/core/plugin_manager/local_runtime/run.go#L77-L84 `e.Env = append(e.Env,` effectively erases all the environment variables because e.Env is nil by default. I'm not sure if it is expected or not, but if we want to propagate environment variables, we can write it like the below [c.f. in this document](https://pkg.go.dev/os/exec#Command). ```go // Set Dir before calling cmd.Environ so that it will include an // updated PWD variable (on platforms where that is used). cmd.Dir = ".." cmd.Env = append(cmd.Environ(), "POSIXLY_CORRECT=1") ```
yindo closed this issue 2026-02-16 00:19:02 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Windows
bug
cmd
documentation
enhancement
go
good first issue
plugin-daemon
pull-request
Mirrored from GitHub Pull Request
 question
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify-plugin-daemon#11
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?