Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix side effect of setting env variables 'AWS_ACCESS_KEY_ID' and 'AWS_SECRET_ACCESS_KEY' #128

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

thomasmarwitz
Copy link

When using the S3FSStore, the environment variables 'AWS_ACCESS_KEY_ID' and 'AWS_SECRET_ACCESS_KEY' are currently set automatically based on the values provided in the url to create the store.

This is a side effect since the credentials are passed explicitly.

Especially in CI, this can be very annoying. Consider this workflow:

  1. AWS credentials are assumed via OpenID Connect, the GH action saves the credentials to the default AWS_* env variables
  2. A test runs that assumes a role with the given credentials.
  3. Inside this test, a minimalkv bucket S3FSStore is created and overwrites the AWS_* env variables
  4. Another test now finds the credentials of the assumed role rather than the original ones that were obtained through OpenID Connect

Env variables 'AWS_ACCESS_KEY_ID' and 'AWS_SECRET_ACCESS_KEY' are no longer set if they are not present in env. Before credentials were passed explicitely, this was necessary for authentication since there was no other mechanism implemented than to set the env variables.
@thomasmarwitz thomasmarwitz force-pushed the remove-side-effects branch 2 times, most recently from 30a30bf to 4a65044 Compare April 17, 2024 11:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants