fix: AWS credential fallback robust against AWS_PROFILE set to missing profile

[Kellen275]

The diff is perhaps more easily viewed when compared with the v0.43.7 release (before we began addressing #1094)

git diff v0.43.7 pkg/awsclicompat/session.go

I have intentionally kept the session_test.go file identical to that of #1104 as well as the profileEnvMu definition just to minimize changes.

[yxxhero]

@Kellen275 please fix DCO

[yxxhero]

@Kellen275 should I merge this?

[Kellen275]

@yxxhero perhaps we can toss Copilot on to review? This MR effectively reverts #1098 and then builds upon the solution presented in #1104

I would be more comfortable deferring to you/your team with regards to what the expected behavior should be in the Go tests.

[Copilot]

Pull request overview

Improves vals AWS config/session creation so that when an explicit profile is provided but the profile is missing, it can still fall back to the AWS SDK v2 default credential chain even if AWS_PROFILE / AWS_DEFAULT_PROFILE are set to the same missing profile.

Changes:

• Adds a missing-profile fallback path that temporarily suppresses AWS_PROFILE / AWS_DEFAULT_PROFILE under a mutex and retries config loading without an explicit profile.
• Keeps explicit profile taking precedence, with FORCE_AWS_PROFILE=true as the secondary profile-selection mechanism.

[Copilot]

errcheck is enabled in this repo, and the calls to os.Unsetenv/os.Setenv here ignore the returned error values. This will be reported by golangci-lint (errcheck) and fail CI. Please either handle and return these errors for the initial Unsetenv calls, and use _ = os.Setenv/_ = os.Unsetenv (or equivalent) in the deferred restore where you can’t return an error, mirroring patterns used elsewhere (e.g. tfstate provider).

Suggested change

	os.Unsetenv("AWS_PROFILE")
	}
	if savedDefaultProfile != "" {
	os.Unsetenv("AWS_DEFAULT_PROFILE")
	}
	// Restore environment variables after the recursive call completes
	defer func() {
	if savedProfile != "" {
	os.Setenv("AWS_PROFILE", savedProfile)
	}
	if savedDefaultProfile != "" {
	os.Setenv("AWS_DEFAULT_PROFILE", savedDefaultProfile)
	if err := os.Unsetenv("AWS_PROFILE"); err != nil {
	profileEnvMu.Unlock()
	return aws.Config{}, err
	}
	}
	if savedDefaultProfile != "" {
	if err := os.Unsetenv("AWS_DEFAULT_PROFILE"); err != nil {
	if savedProfile != "" {
	_ = os.Setenv("AWS_PROFILE", savedProfile)
	}
	profileEnvMu.Unlock()
	return aws.Config{}, err
	}
	}
	// Restore environment variables after the recursive call completes
	defer func() {
	if savedProfile != "" {
	_ = os.Setenv("AWS_PROFILE", savedProfile)
	}
	if savedDefaultProfile != "" {
	_ = os.Setenv("AWS_DEFAULT_PROFILE", savedDefaultProfile)

[Kellen275]

The comment from @copilot should be addressed now