Default credentials provider chain documentation doesn't look right

[liwadman]

Describe the issue

The default search list doesn't look right based on the botocore code I reviewed, and doesn't quite make sense. e.g. the sso provider would only be brought in if a profile in any location used an sso profile, and the sdk wouldn't do a specific search on existing config files for sso providers. As well the assume role provider is the implimentation of the config files e.g. the assume role provider is what's used with the relevant settings of a config file and the default profile within it.

Passing credentials as parameters in the boto3.client() method

Passing credentials as parameters when creating a Session object

Environment variables

Assume role provider

Assume role with web identity provider

AWS IAM Identity Center credential provider

Shared credential file (~/.aws/credentials)

AWS config file (~/.aws/config)

Boto2 config file (/etc/boto.cfg and ~/.boto)

Instance metadata service on an Amazon EC2 instance that has an IAM role configured.

Links

https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html

[RyanFitzSimmonsAK]

Hi @liwadman, thanks for reaching out. Could you clarify how you think the credentials precedence documentation should be changed? It sounds like you want the SSO provider and assume role provider removed because they are defined in the config file, is that correct?

[liwadman]

There is no possible known location to search for credentials for providers like the AssumeRole and AWS IAM Identity Center credential provider. These can only be defined in profiles.

So the search order is really more like:

1)hard coded credentials
2)env vars
3)the default profile, or profile specified by environment variables
4)Web identity token file
5)container provider
6) IMDS

[RyanFitzSimmonsAK]

After discussing with the SDK team, we've chosen not to change the documentation. The current precedence reflects the order that the SDK individually checks credential providers. Even if several credential providers are defined in a profile, it's worthwhile to give the additional detail of the search order. Thanks for opening this issue.

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.

[liwadman]

The SDK team is missig the point. Those other providers are NOT checked in a sequential order, they're only checked when explicitly configured.

example: with 0 configuration present, how would the AWS SDK discover a configuration to use the identity center configuration?