Skip to content

fix(aws): do not load creds from env vars #2509

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
migmartri merged 2 commits into from
Nov 3, 2025
Merged

fix(aws): do not load creds from env vars #2509

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6186612
fix(aws): do not load creds from env vars
migmartri Nov 3, 2025
5d6475e
fix(aws): do not load creds from env vars
migmartri Nov 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ require (
entgo.io/ent v0.14.4
github.com/adrg/xdg v0.4.0
github.com/aws/aws-sdk-go-v2 v1.39.4
github.com/aws/aws-sdk-go-v2/config v1.31.15
github.com/aws/aws-sdk-go-v2/config v1.31.15 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.18.19
github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.28.6
github.com/aws/aws-sdk-go-v2/service/sso v1.29.8
Expand Down
16 changes: 5 additions & 11 deletions pkg/blobmanager/s3/backend.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,6 @@ import (
"strings"

"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/config"
"github.com/aws/aws-sdk-go-v2/credentials"
"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
"github.com/aws/aws-sdk-go-v2/service/s3"
Expand Down Expand Up @@ -72,16 +71,11 @@ func NewBackend(creds *Credentials) (*Backend, error) {
return nil, fmt.Errorf("failed to parse bucket name: %w", err)
}

// Configure AWS config with v2 SDK
cfg, err := config.LoadDefaultConfig(
context.TODO(),
config.WithRegion(region),
config.WithCredentialsProvider(
credentials.NewStaticCredentialsProvider(creds.AccessKeyID, creds.SecretAccessKey, ""),
),
)
if err != nil {
return nil, fmt.Errorf("failed to load AWS config: %w", err)
// Using AWS config directly instead of using config.LoadDefaultConfig
// to avoid the default credential chain and use only the static credentials
cfg := aws.Config{
Region: region,
Credentials: credentials.NewStaticCredentialsProvider(creds.AccessKeyID, creds.SecretAccessKey, ""),
}

// Create S3 client with custom options if needed
Expand Down
17 changes: 6 additions & 11 deletions pkg/credentials/aws/secretmanager.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
//
// Copyright 2023 The Chainloop Authors.
// Copyright 2023-2025 The Chainloop Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
Expand All @@ -24,7 +24,6 @@ import (
"strings"

"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/config"
awscreds "github.com/aws/aws-sdk-go-v2/credentials"
"github.com/aws/aws-sdk-go-v2/service/secretsmanager"
"github.com/aws/aws-sdk-go-v2/service/sso/types"
Expand Down Expand Up @@ -67,15 +66,11 @@ func NewManager(opts *NewManagerOpts) (*Manager, error) {
logger := servicelogger.ScopedHelper(l, "credentials/aws-secrets-manager")
logger.Infow("msg", "configuring secrets-manager", "region", opts.Region, "role", opts.Role, "prefix", opts.SecretPrefix)

config, err := config.LoadDefaultConfig(
context.TODO(),
config.WithRegion(opts.Region),
config.WithCredentialsProvider(
awscreds.NewStaticCredentialsProvider(opts.AccessKey, opts.SecretKey, ""),
),
)
if err != nil {
return nil, fmt.Errorf("loading AWS config: %w", err)
// Using AWS config directly instead of using config.LoadDefaultConfig
// to avoid the default credential chain and use only the static credentials
config := aws.Config{
Region: opts.Region,
Credentials: awscreds.NewStaticCredentialsProvider(opts.AccessKey, opts.SecretKey, ""),
}

return &Manager{
Expand Down
Loading