Explicit profile overrides environment variables

botocore/credentials.py

@@ -46,8 +46,8 @@ def create_credential_resolver(session):
  config_file = session.get_config_variable('config_file')
  metadata_timeout = session.get_config_variable('metadata_service_timeout')
  num_attempts = session.get_config_variable('metadata_service_num_attempts')
+
  providers = [
- EnvProvider(),
  SharedCredentialProvider(
  creds_filename=credential_file,
  profile_name=profile_name
@@ -63,6 +63,18 @@ def create_credential_resolver(session):
  num_attempts=num_attempts)
  )
  ]
+
+ # We use ``session.profile`` for EnvProvider rather than
+ # ``profile_name`` because it is ``None`` when unset.
+ if session.profile is None:
+ # No profile has been explicitly set, so we prepend the environment
+ # variable provider. That provider, in turn, may set a profile
+ # or credentials.
+ providers.insert(0, EnvProvider())
+ else:
+ logger.debug('Skipping environment variable credential check'
+ ' because profile name was explicitly set.')
+
  resolver = CredentialResolver(providers=providers)
  return resolver
 
@@ -580,7 +592,7 @@ def load_credentials(self):
  # If we got here, no credentials could be found.
  # This feels like it should be an exception, but historically, ``None``
  # is returned.
- # 
+ #
  # +1
  # -js
  return None

tests/integration/test-credentials

@@ -0,0 +1,7 @@
+[default]
+aws_access_key_id = default
+aws_secret_access_key = default-secret
+
+[test]
+aws_access_key_id = test
+aws_secret_access_key = test-secret

tests/integration/test_credentials.py

@@ -0,0 +1,111 @@
+# Copyright 2015 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"). You
+# may not use this file except in compliance with the License. A copy of
+# the License is located at
+#
+# http://aws.amazon.com/apache2.0/
+#
+# or in the "license" file accompanying this file. This file is
+# distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF
+# ANY KIND, either express or implied. See the License for the specific
+# language governing permissions and limitations under the License.
+
+import os
+import mock
+
+from botocore.session import Session
+from tests import BaseEnvVar
+
+
+class TestCredentialPrecedence(BaseEnvVar):
+ def setUp(self):
+ super(TestCredentialPrecedence, self).setUp()
+
+ # Set the config file to something that doesn't exist so
+ # that we don't accidentally load a config.
+ os.environ['AWS_CONFIG_FILE'] = '~/.aws/config-missing'
+
+ def create_session(self, *args, **kwargs):
+ """
+ Create a new session with the given arguments. Additionally,
+ this method will set the credentials file to the test credentials
+ used by the following test cases.
+ """
+ kwargs['session_vars'] = {
+ 'credentials_file': (
+ None, None,
+ os.path.join(os.path.dirname(__file__), 'test-credentials'))
+ }
+
+ return Session(*args, **kwargs)
+
+ def test_access_secret_vs_profile_env(self):
+ # If all three are given, then the access/secret keys should
+ # take precedence.
+ os.environ['AWS_ACCESS_KEY_ID'] = 'env'
+ os.environ['AWS_SECRET_ACCESS_KEY'] = 'env-secret'
+ os.environ['BOTO_DEFAULT_PROFILE'] = 'test'
+
+ s = self.create_session()
+ credentials = s.get_credentials()
+
+ self.assertEqual(credentials.access_key, 'env')
+ self.assertEqual(credentials.secret_key, 'env-secret')
+
+ @mock.patch('botocore.credentials.Credentials')
+ def test_access_secret_vs_profile_code(self, credentials_cls):
+ # If all three are given, then the access/secret keys should
+ # take precedence.
+ s = self.create_session()
+ s.profile = 'test'
+
+ client = s.create_client('s3', aws_access_key_id='code',
+ aws_secret_access_key='code-secret')
+
+ credentials_cls.assert_called_with(
+ access_key='code', secret_key='code-secret', token=mock.ANY)
+
+ def test_profile_env_vs_code(self):
+ # If the profile is set both by the env var and by code,
+ # then the one set by code should take precedence.
+ os.environ['BOTO_DEFAULT_PROFILE'] = 'test'
+ s = self.create_session()
+ s.profile = 'default'
+
+ credentials = s.get_credentials()
+
+ self.assertEqual(credentials.access_key, 'default')
+ self.assertEqual(credentials.secret_key, 'default-secret')
+
+ @mock.patch('botocore.credentials.Credentials')
+ def test_access_secret_env_vs_code(self, credentials_cls):
+ # If the access/secret keys are set both as env vars and via
+ # code, then those set by code should take precedence.
+ os.environ['AWS_ACCESS_KEY_ID'] = 'env'
+ os.environ['AWS_SECRET_ACCESS_KEY'] = 'secret'
+ s = self.create_session()
+
+ client = s.create_client('s3', aws_access_key_id='code',
+ aws_secret_access_key='code-secret')
+
+ credentials_cls.assert_called_with(
+ access_key='code', secret_key='code-secret', token=mock.ANY)
+
+ def test_access_secret_env_vs_profile_code(self):
+ # If access/secret keys are set in the environment, but then a
+ # specific profile is passed via code, then the access/secret
+ # keys defined in that profile should take precedence over
+ # the environment variables. Example:
+ #
+ # ``aws --profile dev s3 ls``
+ #
+ os.environ['AWS_ACCESS_KEY_ID'] = 'env'
+ os.environ['AWS_SECRET_ACCESS_KEY'] = 'env-secret'
+ s = self.create_session()
+ s.profile = 'test'
+
+ credentials = s.get_credentials()
+
+ self.assertEqual(credentials.access_key, 'test')
+ self.assertEqual(credentials.secret_key, 'test-secret')

tests/unit/test_credentials.py

@@ -19,6 +19,7 @@
 from dateutil.tz import tzlocal
 
 from botocore import credentials
+from botocore.credentials import EnvProvider
 import botocore.exceptions
 import botocore.session
 from tests import unittest, BaseEnvVar
@@ -195,7 +196,6 @@ def test_partial_creds_is_an_error(self):
  with self.assertRaises(botocore.exceptions.PartialCredentialsError):
  provider.load()
 
-
 class TestSharedCredentialsProvider(BaseEnvVar):
  def setUp(self):
  super(TestSharedCredentialsProvider, self).setUp()
@@ -577,20 +577,46 @@ def test_provider_unknown(self):
 
 
 class TestCreateCredentialResolver(BaseEnvVar):
- def test_create_credential_resolver(self):
- fake_session = mock.Mock()
- config = {
+ def setUp(self):
+ super(TestCreateCredentialResolver, self).setUp()
+
+ self.session = mock.Mock()
+ self.config = {
  'credentials_file': 'a',
  'legacy_config_file': 'b',
  'config_file': 'c',
  'metadata_service_timeout': 'd',
  'metadata_service_num_attempts': 'e',
  'profile': 'profilename',
  }
- fake_session.get_config_variable = lambda x: config[x]
- resolver = credentials.create_credential_resolver(fake_session)
+ self.session.get_config_variable = lambda x: self.config[x]
+
+ def test_create_credential_resolver(self):
+ resolver = credentials.create_credential_resolver(self.session)
  self.assertIsInstance(resolver, credentials.CredentialResolver)
 
+ def test_explicit_profile_ignores_env_provider(self):
+ self.config['profile'] = 'dev'
+ resolver = credentials.create_credential_resolver(self.session)
+
+ self.assertTrue(
+ all(not isinstance(p, EnvProvider) for p in resolver.providers))
+
+ def test_no_profile_checks_env_provider(self):
+ self.config['profile'] = None
+ self.session.profile = None
+ resolver = credentials.create_credential_resolver(self.session)
+
+ self.assertTrue(
+ any(isinstance(p, EnvProvider) for p in resolver.providers))
+
+ def test_no_profile_env_provider_is_first(self):
+ self.config['profile'] = None
+ self.session.profile = None
+ resolver = credentials.create_credential_resolver(self.session)
+
+ self.assertIsInstance(resolver.providers[0], credentials.EnvProvider)
+
 
 if __name__ == "__main__":
  unittest.main()