Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for parsing both config and credentials files #2939

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

BVMiko
Copy link

@BVMiko BVMiko commented Jun 7, 2024

Issue #, if available: #2794

Description of changes:
AWS CLI as well as boto3 implementation handle config & credentials files by reading the contents of both and consolidating them into a single associative array, prior to doing any processing. aws-sdk-php, on the other hand, only reads in one file when processing. This causes an issue when using assumed roles while organizing credentials the way recommended in the AWS CLI docs (the "IAM Role" tab here).

The current aws-sdk-php implementation looks like it has set up a workaround to the situation by allowing a specific filename to be passed into several of the functions, so that the developer can choose between the config or credentials file. However this would not work in the aforementioned situation where data is split between both files.

Note that aws-sdk-php does actually have a segment of code which combines the files into a single associative array; however there are a few issues:

  1. It's only used by WebIdentity Credentials; it cannot be used by regular configuration file
  2. It doesn't properly merge sections which exist in both files (as is done in boto3)
  3. It doesn't respect the AWS_CONFIG_FILE environment variable which can be used to override the ~/.aws/config file path. (Note this issue seems to be present in many other locations as well)

This PR has two commits:

  1. The first commit fixes the problem in the most minimal way. It replaces the single-ini-file handler CredentialProvider::loadProfiles() with a call to the multi-ini-file handler CredentialProvider::loadDefaultProfiles(). It also updates the latter to fix the two additional issues mentioned above. There was an additional modification added to handle the legacy filename workaround.
  2. The second commit applies the same fix to TokenProvider / SsoTokenProvider. Additionally it updates the CredentialProvider::ini(), CredentialProvider::process() and CredentialProvider::sso() functions to support a null value for the filename override.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Brian Villemarette added 2 commits June 7, 2024 04:07
…iles; continue to support custom config file override
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant