awscli should not ignore the AWS_SECRET_ACCESS_KEY env var just because the AWS_ACCESS_KEY_ID env var is not defined
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
### Describe the bug
Not a big deal and not really a bug but I was surprised that env var `AWS_SECRET_ACCESS_KEY` is **ignored**, using `aws_secret_access_key` from ~/.aws/config, unless `AWS_ACCESS_KEY_ID` is also set.
The current behavior seems to contradict the docs which simply say the env var overrides the profile setting.
https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html
> AWS_SECRET_ACCESS_KEY
> Specifies the secret key associated with the access key. This is essentially the "password" for the access key.
> If defined, this environment variable overrides the value for the profile setting aws_secret_access_key. You can't specify the secret access key ID as a command line option.
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Expected Behavior
`AWS_SECRET_ACCESS_KEY=badsecret aws s3api list-buckets` should fail
### Current Behavior
Need to also set `AWS_ACCESS_KEY_ID` to get:
`AWS_ACCESS_KEY_ID= AWS_SECRET_ACCESS_KEY=badsecret aws s3api list-buckets` to fail
### Reproduction Steps
`AWS_SECRET_ACCESS_KEY=badsecret aws s3api list-buckets`
### Possible Solution
Make the env var override regardless of other env var settings.
### Additional Information/Context
_No response_
### CLI version used
aws-cli/2.27.26 Python/3.13.3
### Environment details (OS name and version, etc.)
Darwin/24.5.0 source/arm64
Contributor guide
Assessment
This issue has not been assessed yet.