Ensure proper handling of credentials

[mcopik]

We cache credentials for future access. However, we should:

• [x] Make it by default not to cache them.
• [x] Make sure they don't appear in any logs and outputs.
• [x] Store user account ID in the cache.
• [x] On every launch, when initializing the cloud environment, check the account ID and make sure it matches the one in cache.
• [x] Add example of disabling the feature with jq.
• [x] Update documentation.
• [x] AWS
• [x] Azure
• [x] GCP.

[punitkashyup]

Hi @mcopik , Can I work on this?

[mcopik]

@punitkashyup Absolutely, please feel free to start on the issue :-)

Let me know if you have any questions or concerns - happy to help.

[rahulsurwade08]

Hey @mcopik ,Can you elaborate the issue so that I could understand it further?. Thanks!

[mcopik]

@rahulsurwade08 @punitkashyup We use a cache where we store all information about cloud resources - functions, storage accounts and buckets, permissions, etc. This helps us to deploy experiments as we do not have to retrieve everything on every single launch of sebs.

Currently, we cache credentials together with the cloud config, which is not a good practice. For example, see the class sebs.{platform}.config.Credentials. If you deploy a function, you will be able to examine the JSON files created in cache directory.

We should not cache those credentials. However, we want to avoid the situation when we build the cache, then the user switches between cloud accounts and attempts to use sebs with different credentials and a different account. In such a situation, our cache is not only useless but will also return weird errors. Thus, we should store in the cache the account ID. When we connect to the cloud with uncached credentials, we should check if the account ID matches the one in cache - if not, then we should throw an error that clearly explains to the user that the cache is invalid.