AWS Credentials Usage

[amimimor]

What content needs to be created or modified?
All components that utilize AWS services need to be added with a clear note about the correct usage of AWS credentials when defining a component spec for the following scenarios:

1. If any IAM policy is attached the the running daprd container (standalone or as a container Pod), one must not provide AccessKey and SecretKeys, and AccessToken
2. If not using any attached IAM policies, use AccessKey, SecretKey & AccessToken

Describe the solution you'd like

Where should the new material be placed?
any document related to AWS components

The associated pull request from dapr/dapr, dapr/components-contrib, or other Dapr code repos

Additional context
It has been observed several times, by the community and by this author, while using the sns/sqs AWS pubsub component, but this is true with any AWS components, that the AWS Go SDK fails to authorize access when the user passes in accessKey and secretKey in situations where the daprd process had already been granted an IAM policy through the various mechanisms of policy attachments. This results in calls to AWS assets to fail on authorization and crash the boot process of the component.

The AWS library behavior could have been more verbose to its users but it doesn't so it might be tricky for users as they naively don't see a reason why their provided, working access and secret keys fail to allow them using the Dapr AWS components in such cases

[msfussell]

@amimimor - This is a really important clarification to make and I suggest that we get this into the docs at least for now, whilst determining if there is anything that we can do upstream in Component-contrib and also the AWS Go SDK. Would you be able to suggest wording that we can add in a PR, and then we can determine how to roll this out to each of the AWS components.

[amimimor]

Suggestion for wording:

"When running the Dapr sidecar (daprd) with your application on EKS (AWS Kuberentes) and the node/pod you're using had already been attached to an IAM policy defining access to AWS resources, you must not provide AWS access-key and secret-key (as well as tokens) in the definition of the Component spec you're using."

[msfussell]

@hhunter-ms - Would you be able to apply this wording to all AWS components?