AWS credentials not working - ~/.aws/credentials

Question

I'm having a problem with my AWS credentials. I used the credentials file that I created on ~/.aws/credentials just as it is written on the AWS doc. However, apache just can't read it.

First, I was getting this error:

Error retrieving credentials from the instance profile metadata server. When you are not running inside of Amazon EC2, you must provide your AWS access key ID and secret access key in the "key" and "secret" options when creating a client or provide an instantiated Aws\Common\Credentials CredentialsInterface object.

Then I tried some solutions that I found on internet. For example, I tried to check my HOME variable. It was /home/ubuntu. I tried also to move my credentials file to the /var/www directory even if it is not my web server directory. Nothing worked. I was still getting the same error.

As a second solution, I saw that we could call directly the CredentialsProvider and indicate the directory on the client.

https://forums.aws.amazon.com/thread.jspa?messageID=583216&#583216

The error changed but I couldn't make it work:

Cannot read credentials from /.aws/credentials

I saw also that we could use the default provider of the CredentialsProvider instead of indicating a path.

http://docs.aws.amazon.com/aws-sdk-php/v3/guide/guide/credentials.html#using-credentials-from-environment-variables

I tried and I keep getting the same error:

Cannot read credentials from /.aws/credentials

Just in case you need this information, I'm using aws/aws-sdk-php (3.2.5). The service I'm trying to use is the AWS Elastic Transcoder. My EC2 instance is an Ubuntu 14.04. It runs a Symfony application deployed using Capifony.

Before I try on this production server, I tried it in a development server where it works perfectly only with the ~/.aws/credentials file. This development server is exactly a copy of the production server. However, it doesn't use Capifony for the deployment. It is just a normal git clone of the project. And it has only one EBS volume while the production server has one for the OS and one for the application.

Ah! And I also checked if the permissions/owners of the credentials file were the same on both servers and they are the same. I tried a 777 to see if it could change something but nothing.

Does anybody have an idea?

Answer 1

I also got 'Cannot read credentials from /.aws/credentials' error. The solution is given in the error message.

/.aws/credentials is a file and directory directly off the root directory / and this is where the SDK is looking for it. The user that Apache runs under (user apache on centos7) does not have its own home and so there is no ~/home.

Some warning about this should be in the aws docs!

Create your credentials file exactly as /.aws/credentials and not ~/user/.aws/credentials

Works perfectly.

If you have set selinux to enforcing then you will need to alter the security context of ./aws recursively to match that of httpd. Otherwise apache will not be able to read the credentials file.

sudo chcon -Rv --type=httpd_sys_content_t /.aws

$ ls -Z /.aws/credentials -rwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 /.aws/credentials

Answer 2

If you are running from an EC2 instance, a best practice is to use IAM roles instead of storing your credentials. Go to IAM > roles > create roles, create your role and attach the policy with necessary permissions to this role (I can help on this if you need). Then create an EC2 machine, and when you are on "Step 3: Configure Instance Details", attach this role your machine. From now, you won't need to store any credential to your machine, every call to the aws API will be signed "automatically".

if you want to attach a role to an existing machine, you have to make an AMI from the machine and create a new VM from this AMI, with the role attached.

What I do is that I always attach at least an empty role to my VMs, so that if needed I can attach later on a policy to this role and allow my machine to call the APIs.

Answer 3

f this can help someone, I managed to make my .ini file work, doing this way:

$profile = 'default';
$path = '/mnt/app/www/.aws/credentials/default.ini';
$provider = CredentialProvider::ini($profile, $path);
$provider = CredentialProvider::memoize($provider);
$client = ElasticTranscoderClient::factory(array(
    'region'  => 'eu-west-1',
    'version' => '2012-09-25',
    'credentials' => $provider
));

The CredentialProvider is explained on this doc:

http://docs.aws.amazon.com/aws-sdk-php/v3/guide/guide/credentials.html#ini-provider

I still don't understand why my application can't read the file on the home directory (~/.aws/credentials/default.ini) on one server but in the other it does.

If someone knows something about it, please let me know.