EC2 Instance Metadata

When running AWS SDK commands on an instance launched by EC2, the ~/.aws/credentials file is not required. Instead, the effective credentials for that instance can be retrieved from a private web service at http://169.254.169.254${AWS_CONTAINER_CREDENTIALS_RELATIVE_URI}.

I can't get SOPS to work like this. I always receive the following error...

Group 0: FAILED 
    - | Error decrypting key: SharedCredsLoad: failed to load shared 
      | credentials file 
      | caused by: open /root/.aws/credentials: no such file or 
      | directory 

This is coming within a terminal session where AWS CLI commands seem to works fine. For example, this will work even though /root/.aws/credentials file is not present.

> aws kms list-keys

I think it's a standard part of the AWS SDK. Do I need to do something to enable this behavior for SOPS?

What I'm trying to do is get an AWS CodeBuild instance to build my project. To do this, it needs to decrypt the configuration data file.

Start by examining how SOPS loads AWS credentials and compare that behavior with the AWS CLI in an EC2 or CodeBuild environment where ~/.aws/credentials is absent. Reproduce the SharedCredsLoad error, then verify that SOPS can decrypt the configuration data using instance metadata credentials.