Authentication appears to be slow

[ulrichsg]

• I've gone though Developer Guide and API reference
• I've checked AWS Forums and StackOverflow for answers

Version of AWS SDK for PHP?
v3.188.1

Version of PHP (php -v)?
7.4

Describe the question
We are observing slow AWS requests when publishing to SNS (~450 ms as opposed to ~45 ms). The pattern depends on the context; in a regular HTTP scenario (where every request is handled by its own process) all calls are slow, but in a daemon only some of them are (the daemon process is restarted every once in a while so it has to acquire a new AWS session then). This leads us to believe that the authentication procedure is what is slowing us down.

The code is running on EKS, and we are using assumeRoleWithWebIdentityCredentialProvider with the token file provided by the Kubernetes ServiceAccount, as described here (including CredentialProvider::memoize()).

We'd be grateful for any tips on how to avoid these slow requests. Thanks in advance.

[SamRemis]

The first step to check this will be to add "debug" => true to your client constructor and see where the latency lies. There will be lines that say "Inclusive step time: [time]" and can tell us which call is taking the most time.

If the resulting log is short enough, feel free to post the whole thing on here, double checking that all private info like passwords is properly redacted; it should be automatically, but better safe than sorry.

If the log is too long, please take a look at the most time consuming steps and post those portions of the log.

Generally it's the actual service authentication call that takes the most time, but if it is happening in the PHP SDK itself, I can take a look at how to improve the latency.

[ulrichsg]

Hi Sam, thanks for replying. I've uploaded a sample log output here: https://gist.github.com/ulrichsg/cd0b17e903bd2b525c7f6fb1797c8d8a Hope it helps.

[emdotem]

Any news? I had to abandon SQS for this reason, the first call is very slow in production..

[ulrichsg]

Are you using CredentialProvider::cache()? That solved the problem for me as it allows using the same set of credentials across multiple processes. I feel like the documentation should highlight this more.

[yenfryherrerafeliz]

Hi @ulrichsg, you could check the following issue since it seems to be related to your issue. There you can find more details about what the problem is and how you can fix it. Specifically this comment state what the solution is.

Please do let me know if you have any questions.

Thanks!

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.