aws-sdk-s3 doesn't appear to support the rails 5.2+ way of managing AWS credentials

[TB-Development]

Task

I am migrating an application's hosting from an AWS EC2 instance to a DigitalOcean droplet running a docker container.

Issue

The gem appears to only look for ENV variables or credentials at ~/.aws/credentials. I'm wondering if this is true, can I use the Rails 5.2+ way of managing credentials with this gem?

EDITOR="nano"  bin/rails credentials:edit

into something like:

aws:
  access_key_id: something
  secret_access_key: something
secret_key_base: something

into the file credentials.yml.enc

Trying to use credentials.yml.enc to give credentials to the application throws errors. Even though it appears to be working, as accessing the credentials on the machine spits out a proper response with:

irb(main):003:0> Rails.application.credentials.dig(:aws, :access_key_id)
=> "valid_string"

Current Behaviour

When I attempt to run a function responsible for uploading an AWS::S3::Resource inside of a migration, I get this stack trace:

Caused by:
Aws::Sigv4::Errors::MissingCredentialsError: missing credentials, provide credentials with one of the following options:
  - :access_key_id and :secret_access_key
  - :credentials
  - :credentials_provider
/dealerportalapp/app/services/MigrationMethods.rb:5:in `upload_s3'
/dealerportalapp/db/migrate/20200423191705_create_seeds.rb:27:in `block in change'
/dealerportalapp/db/migrate/20200423191705_create_seeds.rb:21:in `change'
/dealerportalapp/bin/rails:9:in `<top (required)>'
/dealerportalapp/bin/spring:15:in `<top (required)>'
bin/rails:3:in `load'
bin/rails:3:in `<main>'

My storage.yml looks like this:

test:
  service: Disk
  root: <%= Rails.root.join("tmp/storage") %>

local:
  service: Disk
  root: <%= Rails.root.join("storage") %>

amazon:
  service: S3
  access_key_id:  <%= Rails.application.credentials.dig(:aws, :access_key_id) %>
  secret_access_key: <%= Rails.application.credentials.dig(:aws, :secret_access_key) %>
  region: us-east-2
  bucket: <%= Rails.configuration.s3_bucket %>
  endpoint: <%= Rails.configuration.s3_path %>

but still the gem errors and expects something different. What gives?

Solutions

1. I can fix this issue by adding the file ~/.aws/credentials on my machine manually. Though this is not idea for security reasons.

2. I can also fix this by specifying the ENV variables on the docker run command, giving it the ENV variables, like this:

  docker run \
  -e "AWS_ACCESS_KEY_ID=abc" \
  -e "AWS_SECRET_ACCESS_KEY=def" \
  -e "AWS_REGION=us-east-2" \
  -itPd -p 3000:3000 \
  --name my_container  \
  my_image;

Though I want to use the standard rails credentials:edit solution.

Build Environment

aws-sdk-s3 (1.126.0)
Rails 6.0.2
Ruby 2.6.0
Docker version 23.0.5

[mullermp]

Have you looked at https://github.com/aws/aws-sdk-rails?