Environment credential_source in shared config does not assume role

[alsmola]

Using aws-sdk-go version 1.16.13

Using go 1.10.2

Issue

When specifying a profile in a shared AWS configuration file with the credential_source value set to Environment, the credentials used are the environment variables as static credentials, rather than the assumed role credentials using the env vars. I've tested that the AWS CLI assumes the role correctly.

Steps to reproduce

Create an AWS configuration file at /home/user/.aws/config.test with the following content:

[profile-test]
credential_source = Environment
role_arn = arn:aws:iam::1234567890:role/role-test

Use the aws-sdk-go with the following code:

sess := session.Must(session.NewSessionWithOptions(session.Options{
    Profile:           "profile-test",
    SharedConfigState: session.SharedConfigEnable,
    SharedConfigFiles: []string{"/home/user/.aws/config.test"},
}))
stsSvc := sts.New(sess)
var params *sts.GetCallerIdentityInput
resp, _ := stsSvc.GetCallerIdentity(params)
log.Printf("ARN: %s\n", *resp.Arn)

The resulting IAM ARN is the user associated with the environment variables, not the role-test IAM role.

A small change to https://github.com/aws/aws-sdk-go/blob/master/aws/session/session.go#L497-L499 fixes the behavior and makes it consistent with the Ec2Metadata credential_source behavior.

cfgCp := *cfg
cfgCp.Credentials = credentials.NewStaticCredentialsFromCreds(envCfg.Creds)
cfg.Credentials = assumeRoleCredentials(cfgCp, handlers, sharedCfg, sessOpts)

[diehlaws]

Hi @alsmola, thanks for reaching out to us about this. I'm able to reproduce the behavior you're describing on my end, and can confirm that modifying the credSourceEnvironment case in session.go as described fixes this behavior. I will bring this up to be added in our next sprint so we can correct this behavior, and will update the issue once this is fixed.

[lorengordon]

Any updates on this one? Thought I'd be able to use this feature in go-based utilities (terraform), and was surprised to find myself getting Unauthorized responses.