failed to refresh cached credentials, static credentials are empty error despite env vars being set

[pantelis-karamolegkos]

I am using the following code to get a config

cfg, err := config.LoadDefaultConfig(ctx,
	config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(
		os.Getenv(awsAccessKeyID),
		os.Getenv(awsSecretAccessKey),
		"",
	)),
	config.WithRegion(awsRegion),
	)
if err != nil {
	return aws.Config{}, err
}

This works OK ( am getting a non-nil cfg back), however when proceeding with:

// Create a new EC2 client
client := ec2.NewFromConfig(cfg)

// call DescribeInstances operation to list EC2 instances
resp, err := client.DescribeInstances(ctx, &ec2.DescribeInstancesInput{})
if err != nil {
	return nil, err
}

The DescribeInstances operation fails with:

operation error EC2: DescribeInstances, get identity: get credentials: failed to refresh cached credentials, static credentials are empty

what am I missing?

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.

[siennathesane]

For those running into a similar issue, it turns out the AWS-provided static credential provider is really simple:

package credentials

import (
	"github.com/aws/aws-sdk-go/aws/awserr"
)

// StaticProviderName provides a name of Static provider
const StaticProviderName = "StaticProvider"

var (
	// ErrStaticCredentialsEmpty is emitted when static credentials are empty.
	ErrStaticCredentialsEmpty = awserr.New("EmptyStaticCreds", "static credentials are empty", nil)
)

// A StaticProvider is a set of credentials which are set programmatically,
// and will never expire.
type StaticProvider struct {
	Value
}

// NewStaticCredentials returns a pointer to a new Credentials object
// wrapping a static credentials value provider. Token is only required
// for temporary security credentials retrieved via STS, otherwise an empty
// string can be passed for this parameter.
func NewStaticCredentials(id, secret, token string) *Credentials {
	return NewCredentials(&StaticProvider{Value: Value{
		AccessKeyID:     id,
		SecretAccessKey: secret,
		SessionToken:    token,
	}})
}

// NewStaticCredentialsFromCreds returns a pointer to a new Credentials object
// wrapping the static credentials value provide. Same as NewStaticCredentials
// but takes the creds Value instead of individual fields
func NewStaticCredentialsFromCreds(creds Value) *Credentials {
	return NewCredentials(&StaticProvider{Value: creds})
}

// Retrieve returns the credentials or error if the credentials are invalid.
func (s *StaticProvider) Retrieve() (Value, error) {
	if s.AccessKeyID == "" || s.SecretAccessKey == "" {
		return Value{ProviderName: StaticProviderName}, ErrStaticCredentialsEmpty
	}

	if len(s.Value.ProviderName) == 0 {
		s.Value.ProviderName = StaticProviderName
	}
	return s.Value, nil
}

// IsExpired returns if the credentials are expired.
//
// For StaticProvider, the credentials never expired.
func (s *StaticProvider) IsExpired() bool {
	return false
}

Basically, if the access or secret keys are empty, it will throw the error static credentials are empty. The cached credentials error is from the config loader receiving empty credentials from the static provider.