fix(s3): use AWS SDK default credential chain when explicit keys are absent#1079
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
ct3685
added a commit
that referenced
this pull request
May 20, 2026
## 🚀 Release: Staging to Production **Release Date:** 2026-05-20 ### Changes in this release - fix(csv-parser): use AWS SDK default credential chain when explicit keys absent (#1079) (9b350db) --- *This PR is automatically created/updated when commits are pushed to staging.* *Merging this PR will trigger the release workflow to create a new GitHub release.* Co-authored-by: Cameron Taylor <50385537+ct3685@users.noreply.github.com>
ct3685
changed the title
3 tasks
ct3685
added a commit
that referenced
this pull request
May 20, 2026
…nd ingest util (#1082) ## Problem Three more files had the same `?? ''` S3 credential bug fixed in #1079 — passes empty strings when env vars are absent, breaking IAM/Copilot/ECS deployments. ## Files changed | File | Issue | |------|-------| | `packages-answers/scripts/generateCsv.ts` | Top-level `new S3` with `?? ''` on both keys | | `packages-answers/scripts/initCsvRun.ts` | Top-level `new S3` with `?? ''` on both keys | | `packages-answers/utils/src/ingest/document.ts` | `new S3Client` with explicit credentials passed unconditionally | ## Fix Same pattern as #1079 — only attach `credentials` when both env vars are non-empty; otherwise omit and let the AWS SDK default credential chain handle it (IAM, ECS task roles, Copilot, Render env vars, etc.). ## Test plan - [ ] Verify CSV standalone scripts work in IAM-based env (no explicit S3 keys) - [ ] Verify document ingest works in IAM-based env - [ ] Confirm Render (explicit env vars) still works as before
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Four places in the codebase were building S3 clients with:
```ts
credentials: {
accessKeyId: process.env.S3_STORAGE_ACCESS_KEY_ID ?? '',
secretAccessKey: process.env.S3_STORAGE_SECRET_ACCESS_KEY ?? ''
}
```
Passing an empty string is not the same as omitting
credentials. AWS SDK v3 sees a credential object with an empty AKID and immediately throws:This breaks any deployment that relies on IAM instance roles, ECS task roles, or Copilot-injected credentials rather than explicit env vars.
Fix
Only attach
credentialswhen both env vars are non-empty — otherwise omit them entirely so the AWS SDK falls through to its default credential chain (IAM roles, ECS/Copilot task roles,~/.aws/credentials, etc.).This is the same pattern already used by
chatflow-storage,video-generator,dalle-image,dalle-image-upload, and the logger throughout the repo.Files changed
packages/server/src/services/csv-parser/index.tsnew S3Clientwith?? ''on both keyspackages-answers/scripts/generateCsv.tsnew S3with?? ''on both keyspackages-answers/scripts/initCsvRun.tsnew S3with?? ''on both keyspackages-answers/utils/src/ingest/document.tsnew S3Clientinside function — already had an early-exit guard but still passed potentially-empty strings intocredentialsTest plan
S3_STORAGE_ACCESS_KEY_ID) — CSV upload and processing should succeedS3_STORAGE_ACCESS_KEY_ID/S3_STORAGE_SECRET_ACCESS_KEY— still works as before