AWS Credential resolution warning.

[ermi-ltd]

Hi,

First up, thanks for taking on this project. It is exceptionally helpful and we appreciate all the work your putting into this.

Summary

Serverless appears to trigger a credential warning from the AWS-SDK in some situations. This may relate to the AWS credentials chain (discussed here: serverless/serverless#9290)

Description

I have started getting the following error when runningsis invoke local:

@aws-sdk/credential-provider-node - defaultProvider::fromEnv WARNING:
    Multiple credential sources detected: 
    Both AWS_PROFILE and the pair AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY static credentials are set.
    This SDK will proceed with the AWS_PROFILE value.
    
    However, a future version may change this behavior to prefer the ENV static credentials.
    Please ensure that your environment only sets either the AWS_PROFILE or the
    AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY pair.

I've been debugging it this morning, and it appears to be coming from somewhere in the Serverless framework. The environment variables have not been set in the terminal running the command.

Expected behaviour

Running serverless commands should not trigger a warning about AWS credentials.

Actual behaviour

The error above it triggered when Serverless is run using the "invoke local" options.

Replication

1. Create a lambda function with a node 22 runtime named "hello"
2. Invoke the function locally sis invoke local -f hello
3. Observer the warning about credentials.

Version:

$ serverless --version
osls version: 3.49.0

I'd appreciate any advice you can offer on how to resolve this issue.

[mnapoli]

Hi, I'm sorry but I'm not clear what the problem is.

Is the warning incorrect?

[ermi-ltd]

Hi,

Apologies for not being clear. Yeah, the error is incorrect.

I've been prodding further today. My development environment has a AWS_PROFILE set for swapping between production and sandbox accounts.

It appears that Serverless is adding the AWS_ACCESS_KEY_ID & AWS_SECRET_ACCESS_KEY variables to the environment when the lambda runs without removing the AWS_PROFILE variable from the environment. I think it's happening in /lib/plugins/aws/invoke.js.

This was supported in older versions of the AWS SDK, but new versions of the SDK trigger a warning.

I've been prodding around to see if I can fix it, but I'm a little out of my depth. I'm happy to put together an example repo if you'd like to try replicating it.

Hope that makes sense. Thanks again for you effort on this fork. It's super appreciated.

[mnapoli]

Ahh OK got it, thanks. I'm fine if someone wants to "fix" that warning on the logic that triggers that warning. I won't have any direct time to involve on this considering it's a minor warning, but open to merging fixes 👍

[ermi-ltd]

Thanks for the speedy replies. I'll have a look and see if I can fix it without breaking something else.

[rageycomma]

I don’t think this is serverless — this behaviour is default with the node credential provider in the aws sdk and I think with good reason as it states? Why are they provided as env vars and a profile if you have local credentials which serverless can read? That’s what AWS_PROFILE is for.

[ermi-ltd]

Hi @rageycomma

Aye. That’s the frustration, we don’t have an access key and secret in the environment variables. We manage all that via AWS_PROFILE.

Serverless is loading them from somewhere based on the AWS_PROFILE we have configured somewhere in the invoke code. It then passes those to the Lamda when it’s running in invoke local.

I can kinda see what it’s trying to do (mimic how credentials are provided in the real AWS lambda environment), but it doesn’t seem to handle profiles correctly.

This only became an issue when a recent version of the AWS SDK started to complain.

Hope that makes some sense.