AWS access environment variables no longer applied through Run Configuration after updating IDEA to 2025.3 #6197
Description
Describe the bug
After updating IntelliJ IDEA to 2025.3, AWS environment variables no longer seem to be applied to applications through its Run Configuration.
To reproduce
In the Run Configuration for a Kotlin app, configure an AWS Connection. See screenshot below.
Then, start the app. It throws an error with Unable to load credentials from any of the providers in the chain, indicating that the environment variables aren't passed to the application correctly:
Caused by: software.amazon.awssdk.core.exception.SdkClientException: Unable to load credentials from any of the providers in the chain AwsCredentialsProviderChain(credentialsProviders=[SystemPropertyCredentialsProvider(), EnvironmentVariableCredentialsProvider(), WebIdentityTokenCredentialsProvider(), ProfileCredentialsProvider(profileName=default, profileFile=ProfileFile(sections=[profiles, sso-session, services], profiles=[Profile(name=REDACTED-sharedServices, properties=[sso_region, sso_start_url, sso_role_name, region, sso_account_id]), Profile(name=shared-services, properties=[sso_region, sso_start_url, sso_role_name, region, sso_account_id]), Profile(name=staging, properties=[sso_region, aws_access_key_id, sso_start_url, sso_role_name, sso_account_id, aws_secret_access_key]), Profile(name=stagingAdmin, properties=[sso_region, aws_access_key_id, sso_start_url, sso_role_name, sso_account_id, aws_secret_access_key]), Profile(name=production, properties=[sso_region, aws_access_key_id, sso_start_url, sso_role_name, sso_account_id, aws_secret_access_key]), Profile(name=productionAdmin, properties=[sso_region, aws_access_key_id, sso_start_url, sso_role_name, sso_account_id, aws_secret_access_key]), Profile(name=REDACTED properties=[sso_region, sso_start_url, sso_role_name, region, sso_account_id]), Profile(name=REDACTED-dbwrite-Prod, properties=[sso_region, sso_start_url, sso_role_name, region, sso_account_id])])), ContainerCredentialsProvider(), InstanceProfileCredentialsProvider()]) : [SystemPropertyCredentialsProvider(): Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId)., EnvironmentVariableCredentialsProvider(): Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId)., WebIdentityTokenCredentialsProvider(): Either the environment variable AWS_WEB_IDENTITY_TOKEN_FILE or the javaproperty aws.webIdentityTokenFile must be set., ProfileCredentialsProvider(profileName=default, profileFile=ProfileFile(sections=[profiles, sso-session, services], profiles=[Profile(name=REDACTED-sharedServices, properties=[sso_region, sso_start_url, sso_role_name, region, sso_account_id]), Profile(name=shared-services, properties=[sso_region, sso_start_url, sso_role_name, region, sso_account_id]), Profile(name=staging, properties=[sso_region, aws_access_key_id, sso_start_url, sso_role_name, sso_account_id, aws_secret_access_key]), Profile(name=stagingAdmin, properties=[sso_region, aws_access_key_id, sso_start_url, sso_role_name, sso_account_id, aws_secret_access_key]), Profile(name=production, properties=[sso_region, aws_access_key_id, sso_start_url, sso_role_name, sso_account_id, aws_secret_access_key]), Profile(name=productionAdmin, properties=[sso_region, aws_access_key_id, sso_start_url, sso_role_name, sso_account_id, aws_secret_access_key]), Profile(name=REDACTED, properties=[sso_region, sso_start_url, sso_role_name, region, sso_account_id]), Profile(name=REDACTED-dbwrite-Prod, properties=[sso_region, sso_start_url, sso_role_name, region, sso_account_id])])): Profile file contained no credentials for profile 'default': ProfileFile(sections=[profiles, sso-session, services], profiles=[Profile(name=REDACTED-sharedServices, properties=[sso_region, sso_start_url, sso_role_name, region, sso_account_id]), Profile(name=shared-services, properties=[sso_region, sso_start_url, sso_role_name, region, sso_account_id]), Profile(name=staging, properties=[sso_region, aws_access_key_id, sso_start_url, sso_role_name, sso_account_id, aws_secret_access_key]), Profile(name=stagingAdmin, properties=[sso_region, aws_access_key_id, sso_start_url, sso_role_name, sso_account_id, aws_secret_access_key]), Profile(name=production, properties=[sso_region, aws_access_key_id, sso_start_url, sso_role_name, sso_account_id, aws_secret_access_key]), Profile(name=productionAdmin, properties=[sso_region, aws_access_key_id, sso_start_url, sso_role_name, sso_account_id, aws_secret_access_key]), Profile(name=REDACTED, properties=[sso_region, sso_start_url, sso_role_name, region, sso_account_id]), Profile(name=REDACTED-dbwrite-Prod, properties=[sso_region, sso_start_url, sso_role_name, region, sso_account_id])]), ContainerCredentialsProvider(): Cannot fetch credentials from container - neither AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variables are set., InstanceProfileCredentialsProvider(): Failed to load credentials from IMDS.]
Expected behavior
The AWS env variables should be provided to the application, so that it can authenticate against the AWS API.
Screenshots
Your Environment
- OS: macOS 26.0.1
- JetBrains product: IDEA
- JetBrains product version: 2025.3.2
- AWS Toolkit version: 3.102.253
- SAM CLI version: N/A
- JVM/Python version: Java 25
Additional context
This seems to be the same issue that the EnvFile plugin was suffering from in IntelliJ IDEA 2025.2+. A fix for that is here, which might contain some helpful hints for the AWS plugin, assuming that it uses similar logic to inject environment variables into the application.