Don't write a new aws config file when importing

[AndyTitu]

Overview

It seems the aws-vault importer is creating the .aws/config file if it doesn't exist. We should make sure that importers only read.

Type of change

• Created a new plugin
• Improved an existing plugin
• Fixed a bug in an existing plugin
• Improved contributor utilities or experience

How To Test

op plugin init aws and import credentials

Changelog

AWS Shell Plugin importer never creates a .aws/config file if one does not exist already.

[accraw]

Did a functional test to ensure the file is not created and I can still import profiles, both passed.

[arunsathiya]

The overall changes here look good to me -- both code-wise, and functional testing.

[arunsathiya]

One question I have outside of the review is: if a ~/.aws/config file does not exist, the aws-vault functionality (without shell plugin in its way) prompts only for access key ID and secret key, but the two of them alone cannot be used without the region.

I believe that's expected behavior with aws-vault, but the larger question I have on my mind is, we completely skip the aws-vault importer when ~/.aws/config does not exist -- is that expected?

Do you think we should explore a flow that imports credential from aws-vault, if the credential exists, along with region sourced from AWS_REGION envvar, again if it exists?

[AndyTitu]

Do you think we should explore a flow that imports credential from aws-vault, if the credential exists, along with region sourced from AWS_REGION envvar, again if it exists?

Good question! We are already checking for the AWS_DEFAULT_REGION envvar to import an existing region for the disk importer. Since importers are all called together, there is no need to duplicate checking for a region env var inside the aws-vault importer as well.
I agree we could also check the config file for getting a region. We should only check the default profile though, as the information stored in 1Password acts as a default profile -- it is globally used in all other profiles. Each individual profile can then specify its own region inside its section in the config.
I have opened a starter issue for adding this logic in the importer: #302

access key ID and secret key, but the two of them alone cannot be used without the region.

They can be used without a region except for when using MFA, in which case we error out if we can't find a region.