secrets/aws: disable environment and shared credential providers when using WIF #29982
Conversation
github-actions
bot
added
the
hashicorp-contributed-pr
|
CI Results: |
|
Build Results: |
|
|
||
| // explicitly disable environment and shared credential providers when using Web Identity Token Fetcher | ||
| // enables WIF usage in environments that may use AWS Profiles or environment variables for other use-cases | ||
| opts = append(opts, awsutil.WithEnvironmentCredentials(false), awsutil.WithSharedCredentials(false)) |
There was a problem hiding this comment.
If I am understanding correctly, there will be no change in behavior for AWS WIF flows or any other AWS integration in Vault such as KMS?
There was a problem hiding this comment.
Exactly! This only controls the credential chain that the AWS Secrets Engine generates from its parameters and environment, and would not affect any other credential generations that AWS KMS or HVD use in their workflows. For context, here is the KMS wrapper for AWS generating its own credential chain for its uses, separate from the AWS Secrets Engine
This fix would only block env and shared credential providers if WIF was enabled, otherwise it defaults to the original behavior
Good questions! Adding an acceptance test on the Vault side is a bit tricky, since we would need to confirm that the environment and shared credential providers are not included in the credential chain which I'm not sure is doable on the Vault side. However, there are already existing tests on the |
Description
As of today, WIF is unusable in certain environments that make use of AWS Profiles or environment variables for other purposes, such as using KMS or HVD. This is due to the AWS Secrets Engine picking up the shared credentials in the environment, and adding multiple providers when generating its credential chain.
This PR explicitly disables Shared Credential and Environment Variable Providers if WIF parameters are explicitly set as part of the root AWS Config. If WIF is not being used, environment / shared credentials can be used as expected.