Setting both AWS_PROFILE and AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY is now issuing a warning in Javascript SDK

[andrewpatto]

A recent commit

aws/aws-sdk-js-v3@d1105e3

means that now the Javscript SDK prints a warning

Both AWS_PROFILE and the pair AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY static credentials are set.
...

I used granted in a mode where I run assume in an otherwise unconfigured shell to set the AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY variables
and don't use profiles anywhere downstream. I do not have AWS_PROFILE set before running assume.

Is it possible for granted to have a flag to "not set" AWS_PROFILE as part of its env variables export (now that it seems that officially the AWS SDKs are complaining about it)?

[can-sahin-gowago]

Came here to open up this issue. Same.

Running assume -x and I wish it doesn't export AWS_PROFILE env var.

[chrnorm]

Thanks @andrewpatto @can-sahin-gowago, we will need to get this behavior fixed. If you could share a copy of your ~/.aws/config with the affected profile in this issue that would be helpful (I’d like to confirm if you are using the Granted credential process integration or not). Feel free to redact account IDs etc from it.

[andrewpatto]

Thanks for looking into this! This is my ~/.aws/config (redacted). I do not have any ~/.aws/credentials present.

[sso-session mycompany]
sso_start_url = https://mycompany.awsapps.com/start
sso_region = ap-southeast-2
sso_registration_scopes = sso:account:access

[profile mycompany-dev]
sso_session = mycompany
sso_account_id = 000000000000
sso_role_name = AdministratorAccess
region = ap-southeast-2

After doing an assume mycompany-dev (from a shell with no AWS related environment set) - I end up with this set

GRANTED_COMMAND=mycompany-dev
AWS_ACCESS_KEY_ID=Axxxxxxxxxxx5
AWS_SECRET_ACCESS_KEY=fxxxxxxxxxxxE
AWS_SESSION_TOKEN=Ixxxxxxxxxxxxxxxxxxxxxxx=
AWS_PROFILE=mycompany-dev
AWS_REGION=ap-southeast-2
AWS_DEFAULT_REGION=ap-southeast-2
AWS_SESSION_EXPIRATION=2024-10-02T20:09:31+10:00
AWS_CREDENTIAL_EXPIRATION=2024-10-02T20:09:31+10:00
GRANTED_SSO=false

[can-sahin-gowago]

[profile xxxx]
granted_sso_start_url = https://xxxx.awsapps.com/start/
granted_sso_region = eu-central-1
granted_sso_account_id = xxxx
granted_sso_role_name = xxxx
common_fate_generated_from = aws-sso
credential_process = granted credential-process --profile xxxx
duration_seconds = 11111

I do use the credentials process. I get the same env output as the above command. What is causing bug rarely is that (apart from the warning) sometimes I need to --export as well and .aws/credentials expire after a while but aws-cli uses still the AWS_PROFILE (that are expired now) even though my fresh creds are in the shell env via -x