AWS credentials not working - ~/.aws/credentials

Question

I'm having a problem with my AWS credentials. I used the credentials file that I created on ~/.aws/credentials just as it is written on the AWS doc. However, apache just can't read it.

First, I was getting this error:

Error retrieving credentials from the instance profile metadata server. When you are not running inside of Amazon EC2, you must provide your AWS access key ID and secret access key in the "key" and "secret" options when creating a client or provide an instantiated Aws\Common\Credentials CredentialsInterface object.

Then I tried some solutions that I found on internet. For example, I tried to check my HOME variable. It was /home/ubuntu. I tried also to move my credentials file to the /var/www directory even if it is not my web server directory. Nothing worked. I was still getting the same error.

As a second solution, I saw that we could call directly the CredentialsProvider and indicate the directory on the client.

https://forums.aws.amazon.com/thread.jspa?messageID=583216&#583216

The error changed but I couldn't make it work:

Cannot read credentials from /.aws/credentials

I saw also that we could use the default provider of the CredentialsProvider instead of indicating a path.

http://docs.aws.amazon.com/aws-sdk-php/v3/guide/guide/credentials.html#using-credentials-from-environment-variables

I tried and I keep getting the same error:

Cannot read credentials from /.aws/credentials

Just in case you need this information, I'm using aws/aws-sdk-php (3.2.5). The service I'm trying to use is the AWS Elastic Transcoder. My EC2 instance is an Ubuntu 14.04. It runs a Symfony application deployed using Capifony.

Before I try on this production server, I tried it in a development server where it works perfectly only with the ~/.aws/credentials file. This development server is exactly a copy of the production server. However, it doesn't use Capifony for the deployment. It is just a normal git clone of the project. And it has only one EBS volume while the production server has one for the OS and one for the application.

Ah! And I also checked if the permissions/owners of the credentials file were the same on both servers and they are the same. I tried a 777 to see if it could change something but nothing.

Does anybody have an idea?

Solution 1

It sounds like you're doing it wrong. You do not need to deploy credentials to an EC2 instance in order to have that instance interact with other AWS services, and if fact should not ever deploy credentials to an EC2 instance.

Instead, when you create your instance, you associate an IAM role with it. That role has policies that control access to the other AWS services.

You can create an empty role, launch the instance, and then modify the role later. You can't assign a role after the instance has been launched.

You can now add roles to an instance after it has been assigned.

It is still considered a best practice to not deploy actual credentials to an EC2 instance.

Solution 2

If this can help someone, I managed to make my .ini file work, doing this way:

    $profile = 'default';
    $path = '/mnt/app/www/.aws/credentials/default.ini';
    $provider = CredentialProvider::ini($profile, $path);
    $provider = CredentialProvider::memoize($provider);
    $client = ElasticTranscoderClient::factory(array(
        'region'  => 'eu-west-1',
        'version' => '2012-09-25',
        'credentials' => $provider
    ));

The CredentialProvider is explained on this doc:

http://docs.aws.amazon.com/aws-sdk-php/v3/guide/guide/credentials.html#ini-provider

I still don't understand why my application can't read the file on the home directory (~/.aws/credentials/default.ini) on one server but in the other it does.

If someone knows something about it, please let me know.

Solution 3

The SDK reads from a file located at ~/.aws/credentials, but it looks like you're saving a file at ~/.aws/credentials/default.ini. If you move the file, the error you were experiencing should be cleared up.

Comments

[ana-lu]

Hi Chris, thank you for your answer but I think I didn't explained it well. I need the credentials to use the services via PHP. This is the link: docs.aws.amazon.com/aws-sdk-php/v3/guide/guide/credentials.h‌​tml

[chris]

Read further down in that article: "Using IAM roles is the preferred technique for providing credentials to applications running on Amazon EC2." You do not and should not be putting credentials on an EC2 instance.

[giaour]

The SDK will by default look for a file at ~/.aws/credentials. It should be a file with no extension, not a folder.

[thedjaney]

I am doing this but it does not fallback using the instance profile because it trows an error that ~/.aws/credentials does not exist. I was expecting it to use the profiles if they don't exist.

[RaisinBranCrunch]

Wow, sometimes you might want to have it configurable to work from a VM. Not everything is so black and white.