Default credentials provider chain documentation doesn't look right

[liwadman]

Describe the issue

The default search list doesn't look right based on the botocore code I reviewed, and doesn't quite make sense. e.g. the sso provider would only be brought in if a profile in any location used an sso profile, and the sdk wouldn't do a specific search on existing config files for sso providers. As well the assume role provider is the implimentation of the config files e.g. the assume role provider is what's used with the relevant settings of a config file and the default profile within it.

Passing credentials as parameters in the boto3.client() method

Passing credentials as parameters when creating a Session object

Environment variables

Assume role provider

Assume role with web identity provider

AWS IAM Identity Center credential provider

Shared credential file (~/.aws/credentials)

AWS config file (~/.aws/config)

Boto2 config file (/etc/boto.cfg and ~/.boto)

Instance metadata service on an Amazon EC2 instance that has an IAM role configured.

Links

https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html

[RyanFitzSimmonsAK]

Hi @liwadman, thanks for reaching out. Could you clarify how you think the credentials precedence documentation should be changed? It sounds like you want the SSO provider and assume role provider removed because they are defined in the config file, is that correct?

[liwadman]

There is no possible known location to search for credentials for providers like the AssumeRole and AWS IAM Identity Center credential provider. These can only be defined in profiles.

So the search order is really more like:

1)hard coded credentials
2)env vars
3)the default profile, or profile specified by environment variables
4)Web identity token file
5)container provider
6) IMDS