Add Linting/Warning of AWS-related packages which are not explicitly instantiated with credentials supplied

[etnichols]

Goals

1. Avoid subtle errors in Vercel serverless functions due to AWS_SESSION_TOKEN environment variable taking precedence over AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY variables.
2. Improve the documentation regarding Allowed environment variables

Non-Goals

1. This is not a request to modify existing behavior of the AWS_SESSION_TOKEN environment variable

Background

Overview

Many AWS-related npm packages require credentials to execute (e.g. @aws-sdk/client-s3, @aws-sdk/client-dynamodb). In Node.js, these packages attempt to configure credentials by evaluating the credential provider chain, the first step of which is attempting to evaluating creds from environment variables.

This poses an issue when executing AWS related code within a Vercel serverless function: because a Vercel Serverless function itself makes use of the AWS_SESSION_TOKEN (I assume as part of Serverless function setup), it will sometimes take precedence over user-configured AWS cred environment variables.

A simple example

Consider a simple /api/image/upload endpoint:

import { NextRequest, NextResponse } from 'next/server';
import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';
import { getSignedUrl } from '@aws-sdk/s3-request-presigner';

const s3Client = new S3Client({
  region: 'us-east-1',
});

export async function POST(req: NextRequest) {
  try {
    const { filename, type } = await req.json();

    const command = new PutObjectCommand({
      Bucket: 'my-test-bucket',
      Key: `uploads/${filename}`,
      ContentType: type,
    });

    // Potential point of failure
    const url = await getSignedUrl(s3Client, command, { expiresIn: 60 });

    return NextResponse.json({ url });
  } catch (error: any) {
    console.error('S3 Error:', error);
    return NextResponse.json({ error: error.message }, { status: 500 });
  }
}

Assume the user has appropriately set the necessary AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables through Vercel.

This code will fail due to the presence of the AWS_SESSION_TOKEN environment variable; the other credentials will be ignored and a presigned url will be generated which includes an X-Amz-Security-Token value, derived from the temporary credential.

Solution

To fix this, you must explicitly pass in credentials when instantiating the AWS-related package:

const client = new S3Client({
  region: serverEnv.AWS_S3_REGION,
  credentials: {
    accessKeyId: serverEnv.AWS_ACCESS_KEY_ID,
    secretAccessKey: serverEnv.AWS_SECRET_ACCESS_KEY,
  },
});

This is confirmed via a prior discussion from a user who ran into this exact issue.

Proposal

Proposed Solution(s)

Most robust would be a Vercel build error that throws if an AWS-related package is instantiated without explicitly passing in credentials. This has obvious drawbacks, there are many AWS npm packages out there, but it's a finite list and a linting error is feasible.

An improvement would be further explanation in the docs around the usage of the AWS_SESSION_TOKEN environment variable. The current docs indicate it is an allowed environment variable; is that actually true? I.e. if a user overwrote that environment variable for a specific serverless function, would it disrupt the function's ability to execute?