Skip to content

Init hooks: Remove default AWS credentials #11705

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
viren-nadkarni merged 2 commits into from
Nov 12, 2024
Merged

Init hooks: Remove default AWS credentials #11705

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
564a425
Init hooks: Remove default AWS credentials
viren-nadkarni Oct 17, 2024
034383f
Keep discard logic
viren-nadkarni Oct 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions localstack-core/localstack/runtime/init.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,6 @@

from plux import Plugin, PluginManager

from localstack import constants
from localstack.runtime import hooks
from localstack.utils.objects import singleton_factory

Expand Down Expand Up @@ -156,12 +155,7 @@ def run_stage(self, stage: Stage) -> List[Script]:
for script in scripts:
LOG.debug("Running %s script %s", script.stage, script.path)

# Deprecated: To be removed in v4.0 major release.
# Explicit AWS credentials and region will need to be set in the script.
env_original = os.environ.copy()
os.environ["AWS_ACCESS_KEY_ID"] = constants.DEFAULT_AWS_ACCOUNT_ID
os.environ["AWS_SECRET_ACCESS_KEY"] = constants.INTERNAL_AWS_SECRET_ACCESS_KEY
os.environ["AWS_REGION"] = constants.AWS_REGION_US_EAST_1

try:
script.state = State.RUNNING
Expand All @@ -176,13 +170,19 @@ def run_stage(self, stage: Stage) -> List[Script]:
else:
script.state = State.SUCCESSFUL
finally:
# Restore original state of Boto credentials.
for env_var in ("AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"):
# Discard env variables overridden in startup script that may cause side-effects
for env_var in (
"AWS_ACCESS_KEY_ID",
"AWS_SECRET_ACCESS_KEY",
"AWS_SESSION_TOKEN",
"AWS_DEFAULT_REGION",
"AWS_PROFILE",
"AWS_REGION",
):
if env_var in env_original:
os.environ[env_var] = env_original[env_var]
else:
os.environ.pop(env_var, None)

finally:
self.stage_completed[stage] = True

Expand Down