Issues with profile-based credentials

[BVMiko]

Describe the bug

When using a specific profile (configured the AWS_PROFILE environment variable) and using role_arn for the provided profile, the CredentialProvider doesn't search the ~/.aws/credentials file for the source_profile's credentials. This is different from how it works for both AWS CLI and Python (boto3).

Expected Behavior

I expect that using the AWS_PROFILE=foobar environment variable will properly use STS by pulling the source credentials from ~/.aws/credentials.

Current Behavior

When processing the role_arn, it only searches for the credentials in the ~/.aws/config file, instead of the more appropriate ~/.aws/credentials file.

Reproduction Steps

With the ~/.aws/config:

[default]
region = us-east-1

[profile foobar]
source_profile = default
role_arn = arn:aws:iam::123:role/OrganizationAccessRole
region = us-east-1

And the ~/.aws/credentials file:

[default]
aws_access_key_id = ASIA...
aws_secret_access_key = ...
aws_session_token = ...

Use the AWS_PROFILE=foobar environment variable.

Possible Solution

The code here should first check the ~/.aws/credentials file with:

CredentialProvider::ini($sourceProfileName, null, $config)

and on rejection it should try the ~/.aws/config file as it is doing currently:

CredentialProvider::ini($sourceProfileName, $filename, $config)

Additional Information/Context

No response

SDK version used

3.283.2

Environment details (Version of PHP (php -v)? OS name and version, etc.)

PHP 8.2.11; Ubuntu Linux 22.04

[yenfryherrerafeliz]

Hi @BVMiko, sorry to hear about your issues. I can confirm the reported behavior so that I will add a needs-review label to it so we can address this further.

Test code:

<?php
require '../vendor/autoload.php';

use Aws\S3\S3Client;
use Aws\Credentials\CredentialProvider;

$client = new S3Client([
    'credentials' => CredentialProvider::ini('profile issue-2794', '/PATH/config'),
    'region' => 'us-east-2'
]);
$response = $client->listBuckets();

print_r($response);

/PATH/config

[profile issue-2794]
source_profile=default
role_arn=arn:aws:iam::account:role/Admin
region=us-east-2 

/PATH/credentials

[default]
aws_access_key_id=redacted
aws_secret_access_key=redacted
aws_session_token=redacted

Thanks!