From 9436285224c931b3a0244d5347a981fd4bcbe761 Mon Sep 17 00:00:00 2001 From: Kieran Brown Date: Sun, 26 Apr 2026 00:13:56 +0100 Subject: [PATCH] [13.x] Memoize credentials in SqsConnector MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When a queue config sets `credentials.provider = ecs` (or `instance`), SqsConnector::resolveCredentialProvider returned a raw EcsCredentialProvider or InstanceProfileProvider. The AWS SDK's ClientResolver short-circuits any callable passed as `credentials` (no automatic memoize wrap), and the signer middleware invokes the provider on every signed request — so every SQS API call triggered a fresh HTTP fetch to the EKS Pod Identity Agent / EC2 metadata endpoint. Wrap the resolved provider in CredentialProvider::memoize so credentials are cached in-process for the lifetime of the worker, with the SDK's standard 60-second pre-expiry refresh window. This matches what the SDK's own defaultProvider() does and stops queue workers from saturating the Pod Identity Agent's rate limiter under steady-state polling. Co-Authored-By: Claude Opus 4.7 (1M context) --- src/Illuminate/Queue/Connectors/SqsConnector.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/Illuminate/Queue/Connectors/SqsConnector.php b/src/Illuminate/Queue/Connectors/SqsConnector.php index 70c90873d794..0bce9a654a95 100755 --- a/src/Illuminate/Queue/Connectors/SqsConnector.php +++ b/src/Illuminate/Queue/Connectors/SqsConnector.php @@ -61,13 +61,15 @@ protected function resolveCredentialProvider(array $config) $options = is_array($credentials) ? Arr::except($credentials, ['provider']) : []; - return match ($provider) { + $resolved = match ($provider) { 'ecs' => CredentialProvider::ecsCredentials($options), 'instance' => CredentialProvider::instanceProfile($options), default => throw new InvalidArgumentException( "Invalid credential provider [{$provider}]." ), }; + + return CredentialProvider::memoize($resolved); } /**