Package functions allow us to override the default credentials found in ~/.aws/credentials with alternative values, but we have no comparable way to merely "blank" or unset those credentials. This creates unexpected behavior and errors that can be difficult to debug. For example, if you have no aws_secret_access_key defined in ~/.aws files, then the following code successfully uploads to this public upload-only AWS bucket as expected:
library("aws.signature")
library("aws.s3")
write.csv(iris, 'iris.csv')
aws.s3::put_object('iris.csv',
bucket = "submissions",
region = "data",
base_url = "ecoforecast.org")
If, however, you have your own secret access key in an ~/.aws directory, the same code will throw a 403 Access Forbidden error, even though the bucket does not require access, because it tries to authenticate anyway with your secret key. Note that attempting to set "AWS_SECRET_ACCESS_KEY" = "" env var to an empty string or passing secret="" to put_object does not help the situation. Here's a fully reproducible minimal example of the error; but note it will overwrite any existing ~/.aws/credentials
library("aws.signature")
library("aws.s3")
write.csv(iris, 'iris.csv')
dir.create("~/.aws")
writeLines(
"[default]
aws_access_key_id = ACCESS_KEY
aws_secret_access_key = SECRET_KEY
aws_session_token = TOKEN",
"~/.aws/credentials")
aws.s3::put_object('iris.csv',
bucket = "submissions",
region = "data",
secret = "",
base_url = "ecoforecast.org")
Would you consider a way to temporarily unset default credentials, such as allowing a blank string or NULL value?
This error is also difficult for users to diagnose and debug. Being able to 'blank' credentials out would probably be useful in other contexts as well. (e.g. I'm not a security expert but in general I could imagine a user wanting finer-grained control of whether or not package functions were touching secure credentials when they weren't needed).
Package functions allow us to override the default credentials found in
~/.aws/credentialswith alternative values, but we have no comparable way to merely "blank" or unset those credentials. This creates unexpected behavior and errors that can be difficult to debug. For example, if you have noaws_secret_access_keydefined in~/.awsfiles, then the following code successfully uploads to this public upload-only AWS bucket as expected:If, however, you have your own secret access key in an
~/.awsdirectory, the same code will throw a 403 Access Forbidden error, even though the bucket does not require access, because it tries to authenticate anyway with your secret key. Note that attempting to set"AWS_SECRET_ACCESS_KEY" = ""env var to an empty string or passingsecret=""toput_objectdoes not help the situation. Here's a fully reproducible minimal example of the error; but note it will overwrite any existing~/.aws/credentialsWould you consider a way to temporarily unset default credentials, such as allowing a blank string or NULL value?
This error is also difficult for users to diagnose and debug. Being able to 'blank' credentials out would probably be useful in other contexts as well. (e.g. I'm not a security expert but in general I could imagine a user wanting finer-grained control of whether or not package functions were touching secure credentials when they weren't needed).