aws / aws/aws-cli

awscli should not ignore the AWS_SECRET_ACCESS_KEY env var just because the AWS_ACCESS_KEY_ID env var is not defined

Open
#9,561 3 comments 0 reactions 0 assignees View on GitHub
bug configuration documentation p3 s3
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

### Describe the bug

Not a big deal and not really a bug but I was surprised that env var `AWS_SECRET_ACCESS_KEY` is **ignored**, using `aws_secret_access_key` from ~/.aws/config, unless `AWS_ACCESS_KEY_ID` is also set.
The current behavior seems to contradict the docs which simply say the env var overrides the profile setting.
https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html
> AWS_SECRET_ACCESS_KEY
> Specifies the secret key associated with the access key. This is essentially the "password" for the access key.
> If defined, this environment variable overrides the value for the profile setting aws_secret_access_key. You can't specify the secret access key ID as a command line option.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Expected Behavior

`AWS_SECRET_ACCESS_KEY=badsecret aws s3api list-buckets` should fail

### Current Behavior

Need to also set `AWS_ACCESS_KEY_ID` to get:
`AWS_ACCESS_KEY_ID= AWS_SECRET_ACCESS_KEY=badsecret aws s3api list-buckets` to fail

### Reproduction Steps

`AWS_SECRET_ACCESS_KEY=badsecret aws s3api list-buckets`

### Possible Solution

Make the env var override regardless of other env var settings.

### Additional Information/Context

_No response_

### CLI version used

aws-cli/2.27.26 Python/3.13.3

### Environment details (OS name and version, etc.)

Darwin/24.5.0 source/arm64

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.