Provide the AWS PHP SDK with credentials via Symfony DotEnv

Question

In a Symfony 4.3 application using symfony/dotenv 4.3.11 and aws/aws-sdk-php 3.173.13:

I'd like to authenticate the AWS SDK using credentials provided via environment variables, and I'd like to use the dotenv component to provide those environment variables.

This should be possible: Setting the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables is one way to automatically authenticate the with the aws sdk. And DotEnv should turn your configuration into environment variables.

However, when I set these variables in my .env.local or .env files, I get the following error:

Aws\Exception\CredentialsException: Error retrieving credentials from the instance profile metadata service.

This does not work:

.env.local:

AWS_ACCESS_KEY_ID=XXX
AWS_SECRET_ACCESS_KEY=XXXXXX

$  ./bin/console command-that-uses-aws-sdk

This works:

$ AWS_ACCESS_KEY_ID=XXX AWS_SECRET_ACCESS_KEY=XXXXXX ./bin/console command-that-uses-aws-sdk

Debug info:

I made a symfony command that outputs the environment variables in $_ENV. With AWS_ACCESS_KEY_ID/SECRET in .env.local, sure enough it appears as an environment variable:

...
    [SYMFONY_DOTENV_VARS] => MEQ_ENV,APP_ENV,APP_SECRET,DATABASE_URL,AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_REGION,AWS_ACCOUNT
    [AWS_ACCESS_KEY_ID] => XXX
    [AWS_SECRET_ACCESS_KEY] => XXXXXX
...

simon.ro simon.ro · Accepted Answer · 2021-02-22T20:57:47

The aws php client documentation states:

The SDK uses the getenv() function to look for the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN environment variables.

=> it uses getenv() not $_ENV.

But the Symfony Dotenv component (by default) just populates $_ENV and doesn't call putenv therefore your settings in .env files are not accessible by getenv().

Here are some options:

call Dotenv())->usePutenv(true) (but as symfony states: Beware that putenv() is not thread safe, that's why this setting defaults to false)
call putenv() manually exclusively for the aws setting
Wrap the aws client in your own symfony service and inject the settings from .env

Provide the AWS PHP SDK with credentials via Symfony DotEnv

1 Answers