I'm having a problem with my AWS credentials. I used the credentials file that I created on ~/.aws/credentials just as it is written on the AWS doc. However, apache just can't read it.

First, I was getting this error:

Error retrieving credentials from the instance profile metadata server. When you are not running inside of Amazon EC2, you must provide your AWS access key ID and secret access key in the "key" and "secret" options when creating a client or provide an instantiated Aws\Common\Credentials CredentialsInterface object.

Then I tried some solutions that I found on internet. For example, I tried to check my HOME variable. It was /home/ubuntu. I tried also to move my credentials file to the /var/www directory even if it is not my web server directory. Nothing worked. I was still getting the same error.

As a second solution, I saw that we could call directly the CredentialsProvider and indicate the directory on the client.


The error changed but I couldn't make it work:

Cannot read credentials from /.aws/credentials

I saw also that we could use the default provider of the CredentialsProvider instead of indicating a path.


I tried and I keep getting the same error:

Cannot read credentials from /.aws/credentials

Just in case you need this information, I'm using aws/aws-sdk-php (3.2.5). The service I'm trying to use is the AWS Elastic Transcoder. My EC2 instance is an Ubuntu 14.04. It runs a Symfony application deployed using Capifony.

Before I try on this production server, I tried it in a development server where it works perfectly only with the ~/.aws/credentials file. This development server is exactly a copy of the production server. However, it doesn't use Capifony for the deployment. It is just a normal git clone of the project. And it has only one EBS volume while the production server has one for the OS and one for the application.

Ah! And I also checked if the permissions/owners of the credentials file were the same on both servers and they are the same. I tried a 777 to see if it could change something but nothing.

Does anybody have an idea?

  • It seems the SDK is lloking the credentials directly into the instanceProvider, change it to default. $provider = CredentialProvider::defaultProvider(); – Conti Sep 19 '16 at 14:18

I also got 'Cannot read credentials from /.aws/credentials' error. The solution is given in the error message.

/.aws/credentials is a file and directory directly off the root directory / and this is where the SDK is looking for it. The user that Apache runs under (user apache on centos7) does not have its own home and so there is no ~/home.

Some warning about this should be in the aws docs!

Create your credentials file exactly as /.aws/credentials and not ~/user/.aws/credentials

Works perfectly.

If you have set selinux to enforcing then you will need to alter the security context of ./aws recursively to match that of httpd. Otherwise apache will not be able to read the credentials file.

sudo chcon -Rv --type=httpd_sys_content_t /.aws

$ ls -Z /.aws/credentials -rwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 /.aws/credentials

| improve this answer | |
  • This was what solved my issue. Trying to configure the credentials file for PHP, it wasn't clear where the ~ or HOME folder would be for the httpd/Apache service. One I created it off the root, it worked. – Thyamine Dec 12 '17 at 20:46
  • The HOME environment variable, if you can inspect it, seems to be what the AWS SDK is looking at to determine where to find the .aws directory. – qid Aug 23 '19 at 16:56

If you are running from an EC2 instance, a best practice is to use IAM roles instead of storing your credentials. Go to IAM > roles > create roles, create your role and attach the policy with necessary permissions to this role (I can help on this if you need). Then create an EC2 machine, and when you are on "Step 3: Configure Instance Details", attach this role your machine. From now, you won't need to store any credential to your machine, every call to the aws API will be signed "automatically".

if you want to attach a role to an existing machine, you have to make an AMI from the machine and create a new VM from this AMI, with the role attached.

What I do is that I always attach at least an empty role to my VMs, so that if needed I can attach later on a policy to this role and allow my machine to call the APIs.

| improve this answer | |
  • thank you for your answer but I think I didn't explained it well. I need the credentials to use the services via PHP. This is the link: docs.aws.amazon.com/aws-sdk-php/v3/guide/guide/credentials.html – ana-lu Aug 10 '15 at 8:50
  • Not sure I understand well, but to me the question is not "are you using php or python", as long as there is an SDK in your language. The question is: are you using this php code from an EC2 instance? if yes, then attaching an IAM role to your instance will allow you to use the php SDK without storing any credentials, e.g: $client = new DynamoDbClient([ 'region' => 'us-west-2', 'version' => 'latest' ]);. Please have a look at this part of your link: docs.aws.amazon.com/aws-sdk-php/v2/guide/… – Tom Aug 11 '15 at 7:28

f this can help someone, I managed to make my .ini file work, doing this way:

$profile = 'default';
$path = '/mnt/app/www/.aws/credentials/default.ini';
$provider = CredentialProvider::ini($profile, $path);
$provider = CredentialProvider::memoize($provider);
$client = ElasticTranscoderClient::factory(array(
    'region'  => 'eu-west-1',
    'version' => '2012-09-25',
    'credentials' => $provider

The CredentialProvider is explained on this doc:


I still don't understand why my application can't read the file on the home directory (~/.aws/credentials/default.ini) on one server but in the other it does.

If someone knows something about it, please let me know.

| improve this answer | |
  • if you are out of ideas and don't want to use IAM roles, you could also try to disable selinux (setenforce permissive)... just to check :) – Tom Aug 14 '15 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.