environment_dependency details passed to TilerFactory not being passed through to rio-tiler Reader

[lachlanhurst]

I'm writing a TiTiler server to publish two data sources. They're both STAC, but one is an openly available based S3 catalog (DE Australia) and the other a MinIO hosted catalog requiring authentication. It's implemented using two different routes, /external/stac and /internal/stac. This means I can't use environment variables to set the AWS_NO_SIGN_REQUEST (amongst others) as each route requires a different set of AWS credentials/env vars to work. Hence, I started using the environment_dependency that gets injected into the TilerFactories.

The issue I have is that I always get the following error when attempting to access public data (unsigned) without resorting to setting the environment variable (or it falling back to a credentials file). I'm guessing it extends to any other details I'd need to pass in via the AWSSession.

rasterio._err.CPLE_AWSInvalidCredentialsError: AWS_SECRET_ACCESS_KEY and AWS_NO_SIGN_REQUEST configuration options not defined, and /root/.aws/credentials not filled 

Here's a stripped down example that should reproduce it.

import os from fastapi import FastAPI from rasterio.session import AWSSession from rio_tiler.io import Reader, STACReader from titiler.application.settings import ApiSettings from titiler.core.factory import MultiBaseTilerFactory, TilerFactory from titiler.extensions import ( cogValidateExtension, cogViewerExtension, stacExtension, stacRenderExtension, stacViewerExtension, ) # Assert that AWS_NO_SIGN_REQUEST is not set assert os.getenv("AWS_NO_SIGN_REQUEST") is None, ( "test without the AWS_NO_SIGN_REQUEST environment variable" ) app = FastAPI() api_settings = ApiSettings() def environment_dependency(): aws_session = AWSSession( aws_unsigned=True, ) return {"session": aws_session} cog = TilerFactory( reader=Reader, router_prefix="/cog", add_ogc_maps=True, extensions=[ cogValidateExtension(), cogViewerExtension(), stacExtension(), ], enable_telemetry=False, environment_dependency=environment_dependency, ) app.include_router(cog.router, tags=["Cloud Optimized GeoTIFF"]) stac = MultiBaseTilerFactory( reader=STACReader, router_prefix="/stac", add_ogc_maps=True, extensions=[ stacViewerExtension(), stacRenderExtension(), ], enable_telemetry=False, environment_dependency=environment_dependency, ) app.include_router( stac.router, prefix="/stac", tags=["SpatioTemporal Asset Catalog"], ) 

Then just try to hit one of the endpoints

curl http://127.0.0.1:8000/stac/info.geojson\?url\=https%3A%2F%2Fexplorer.sandbox.dea.ga.gov.au%2Fstac%2Fcollections%2Fga_ls9c_ard_3%2Fitems%2Feb5502d9-3e37-4f2f-9b45-3b6fc07de971 

A similar issues was raised in #1177 , but I have a feeling that was fixed by setting the environment variables and not by passing in the environment_dependency.

What I think is going on

I can see the Rasterio Env is created using the environment_dependency here, and if I check for AWS_NO_SIGN_REQUEST in that env it is set to YES. However a few lines down the rio-tiler Reader info function is called and it creates another Rasterio Env where it's not carrying over the environment_dependency stuff.

I haven't confirmed if AWS_NO_SIGN_REQUEST is or isn't set in this inner Env, so could definitely be wrong about all this.

Workaround

So I noticed that the inner Rasterio Env is created with details that are pulled out of the asset_info here, and figured I may be able to hack something in. I did this by subclassing STACReader to override the _get_asset_info and include the environment_dependency. This works, but does feel a bit dirty.

import os from fastapi import FastAPI from rasterio.session import AWSSession from rio_tiler.io import Reader, STACReader from titiler.application.settings import ApiSettings from titiler.core.factory import MultiBaseTilerFactory, TilerFactory from titiler.extensions import ( cogValidateExtension, cogViewerExtension, stacExtension, stacRenderExtension, stacViewerExtension, ) # Assert that AWS_NO_SIGN_REQUEST is not set assert os.getenv("AWS_NO_SIGN_REQUEST") is None, ( "test without the AWS_NO_SIGN_REQUEST environment variable" ) app = FastAPI() api_settings = ApiSettings() def environment_dependency(): aws_session = AWSSession( aws_unsigned=True, ) return {"session": aws_session} class STACReaderWithSession(STACReader): """Custom STAC Reader with session support.""" def _get_asset_info(self, asset: str): """Get asset info and inject environment dependency.""" asset_info = super()._get_asset_info(asset) asset_info.setdefault("env", {}).update(environment_dependency()) return asset_info # Create a TilerFactory for Cloud-Optimized GeoTIFFs cog = TilerFactory( reader=Reader, router_prefix="/cog", add_ogc_maps=True, extensions=[ cogValidateExtension(), cogViewerExtension(), stacExtension(), ], enable_telemetry=False, environment_dependency=environment_dependency, ) # Register all the COG endpoints automatically app.include_router(cog.router, tags=["Cloud Optimized GeoTIFF"]) stac = MultiBaseTilerFactory( reader=STACReaderWithSession, router_prefix="/stac", add_ogc_maps=True, extensions=[ stacViewerExtension(), stacRenderExtension(), ], enable_telemetry=False, environment_dependency=environment_dependency, ) app.include_router( stac.router, prefix="/stac", tags=["SpatioTemporal Asset Catalog"], ) 

Anyway, thanks for having a look at this. Appreciate it's quite a niche use case.

Environment Information

Have reproduced across a few environments MacOS (arm64), and Linux (x86)

[vincentsarago]

Thanks for the issue @lachlanhurst

The Rasterio/GDAL environment forwarding to readers is super hard to follow and mostly because in the case of the STAC Reader we will distribute the asset reading to sub-threads. I've tried to explain it in #186

I fix a temporary fix is to use "MAX_THREADS=1" to avoid using threads within the STACReader

[lachlanhurst]

Thanks @vincentsarago

I've tried to explain it in #186

I do remember skimming over that one, just didn't understand enough about what was happening. Seems obvious now 😅

I fix a temporary fix is to use "MAX_THREADS=1" to avoid using threads within the STACReader

Yes, RIO_TILER_MAX_THREADS=1 fixed my issue

I am curious though, is this fix likely to have much of a performance impact?

Another solution for my setup is to just run two different TiTilers in different docker containers (to isolate env vars). I didn't do this initially as having just the one TiTiler image simplifies the architecture a little and is probably better for scaling when running multiple TiTiler containers.