search

fog / fog-aws

Module for the 'fog' gem to support Amazon Web Services http://aws.amazon.com/
MIT License
300 stars 352 forks source link

Read credentials from shared credentials file #694

Open afinzel opened 11 months ago

afinzel commented 11 months ago

We are using your gem as it is included in Carrierwave. In AWS SDK, if you don't specify credentials it will try and load them from ~/.aws/credentials. I see you have implemented your own version of that in ~.fog. I can't see that you're using this shared credential file. Would you consider supporting it? details can be seen at https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html (Where are configuration settings stored? section). For now, we will try and use the .fog workaround but it would be great if we could use the same logic that AWS is using so we don't have to keep the details in two places.

geemus commented 11 months ago

I think maybe we implemented the fog credential file prior to this aws option being available, and I hadn't thought about it much since. I would be open to also supporting the aws version, though we should think carefully about precedence in the case that both files exist.

I think the fog credential seems more specific, so my inclination would be toward that taking precedence if they both exist. That being said, if they both exist it should probably at least print a warning as well. Though perhaps it would be safer/better for it to simply raise an error if both exist and ask the user to sort it out. That is a bit more jarring, but I suspect might save some headaches in the longer term.

What do you think?

afinzel commented 11 months ago

Hey, Sorry for the delay. I think that makes sense as it means that anyone currently using a .fog file won't suddenly have credentials change for them if they have both.

geemus commented 11 months ago

No worries, definitely no hurry from my perspective (and I'm pretty slow on things lately too, as I'm on parental leave). I definitely agree that we should avoid it suddenly changing behavior from what already worked. Though if it "automatically" works, maybe that is always going to have cases where that is true. Another option might be that it expects an option to be passed explicitly, something like use_aws_credentials_file: true or similar. That avoids the precedence issue (since you need to flag yourself into this behavior). What do you think?

github-actions[bot] commented 9 months ago

This issue has been marked inactive and will be closed if no further activity occurs.