Using ES_AWS_FOOBAR under Lambda

[sjparkinson]

If you use this client within Lambda (or any AWS service with a role), you'll find a collision between the role's session token and the Elasticsearch credential's ID and secret.

In signed-fetch, it'll take the ID and secret from one set of credentials, then also use the session token for the role, a different credential. AWS then complains.

I'd suggest we move away from the signed-fetch dependency, implement it ourselves using aws4 in a more simple manner? Or... fix signed-fetch and just use the standard way of defining credentials (doing away with ES_*).

[sjparkinson]

/cc @andygnewman

[aendra-rininsland]

+1 to this. I'm trying to migrate a project that leverages n-es-client to start using Vault and it's become a very non-trivial process. Working on a PR...

[i-like-robots]

For reference here is a signed fetch implementation used in a Lambda (but still using env vars) https://github.com/Financial-Times/n-concept-bump/blob/master/lib/signed-fetch.js