Skip to content

Resolve local AWS credentials via the full provider chain #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stevethomas wants to merge 2 commits into
base: main
Choose a base branch
from
+19 −2
Open

Resolve local AWS credentials via the full provider chain #39

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b729c60
feat: resolve local AWS credentials via the full provider chain
stevethomas May 23, 2026
34295d5
refactor: scope credential chain to the profile without env mutation
stevethomas May 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 19 additions & 2 deletions src/Concerns/RegistersAws.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,11 +85,28 @@ protected static function awsCredentials(): callable|array|null
}

// otherwise we are using a local env value to point to the correct AWS profile.
if (in_array(Helpers::keyedEnv('AWS_PROFILE'), ['', null, 'default'])) {
$profile = Helpers::keyedEnv('AWS_PROFILE');

if (in_array($profile, ['', null, 'default'])) {
throw new IntegrityCheckException(sprintf('Using the default AWS profile in your credentials file is risky. Name your profile to something specific and update %s in your .env file before proceeding.', Helpers::keyedEnvName('AWS_PROFILE')));
}

return CredentialProvider::ini(Helpers::keyedEnv('AWS_PROFILE'));
// Resolve the named profile through credential_process and static keys in
// both the credentials and config files, so a `credential_process` profile
// (e.g. 1Password-backed short-lived creds) resolves alongside plain static
// keys. Built explicitly rather than via defaultProvider() — which only
// reads the profile from $AWS_PROFILE — so the profile stays scoped without
// mutating the environment. Memoised so credentials resolve once per run.
$configFile = CredentialProvider::getConfigFileName();

return CredentialProvider::memoize(
CredentialProvider::chain(
CredentialProvider::process($profile),
CredentialProvider::ini($profile),
CredentialProvider::process('profile ' . $profile, $configFile),
CredentialProvider::ini('profile ' . $profile, $configFile),
)
);
}

protected static function detectLocalEnvironment(): bool
Expand Down
Loading