Issues with profile-based credentials

[BVMiko]

Describe the bug

When using a specific profile (configured the AWS_PROFILE environment variable) and using role_arn for the provided profile, the CredentialProvider doesn't search the ~/.aws/credentials file for the source_profile's credentials. This is different from how it works for both AWS CLI and Python (boto3).

Expected Behavior

I expect that using the AWS_PROFILE=foobar environment variable will properly use STS by pulling the source credentials from ~/.aws/credentials.

Current Behavior

When processing the role_arn, it only searches for the credentials in the ~/.aws/config file, instead of the more appropriate ~/.aws/credentials file.

Reproduction Steps

With the ~/.aws/config:

[default]
region = us-east-1

[profile foobar]
source_profile = default
role_arn = arn:aws:iam::123:role/OrganizationAccessRole
region = us-east-1

And the ~/.aws/credentials file:

[default]
aws_access_key_id = ASIA...
aws_secret_access_key = ...
aws_session_token = ...

Use the AWS_PROFILE=foobar environment variable.

Possible Solution

The code here should first check the ~/.aws/credentials file with:

CredentialProvider::ini($sourceProfileName, null, $config)

and on rejection it should try the ~/.aws/config file as it is doing currently:

CredentialProvider::ini($sourceProfileName, $filename, $config)

Additional Information/Context

No response

SDK version used

3.283.2

Environment details (Version of PHP (php -v)? OS name and version, etc.)

PHP 8.2.11; Ubuntu Linux 22.04

[yenfryherrerafeliz]

Hi @BVMiko, sorry to hear about your issues. I can confirm the reported behavior so that I will add a needs-review label to it so we can address this further.

Test code:

<?php
require '../vendor/autoload.php';

use Aws\S3\S3Client;
use Aws\Credentials\CredentialProvider;

$client = new S3Client([
    'credentials' => CredentialProvider::ini('profile issue-2794', '/PATH/config'),
    'region' => 'us-east-2'
]);
$response = $client->listBuckets();

print_r($response);

/PATH/config

[profile issue-2794]
source_profile=default
role_arn=arn:aws:iam::account:role/Admin
region=us-east-2 

/PATH/credentials

[default]
aws_access_key_id=redacted
aws_secret_access_key=redacted
aws_session_token=redacted

Thanks!

[BVMiko]

Hi @yenfryherrerafeliz, I'm just checking to see if there's any chance of this being considered in the near future. I had to set up a pretty messy workaround with my development environment last year, but I'm going through to optimize things recently and was hoping to clean it up.

If there is any chance of it picking up some traction, let me know and I will rebase against the current master branch.