Support Loading AWS Credentials from Config Profiles

[mbamber]

What is the underlying problem you're trying to solve?

When working with OPA I need to supply aws credentials to download a bundle. Today I do this by providing static environment credentials, but these expire regularly and need to be refreshed.

I can currently generate credentials for aws via the ~/.aws/config file using a named profile (e.g. aws sts get-caller-identity --profile my-profile) which is helpful when working with multiple accounts/roles which have different levels of permissions and all expire quickly (within the hour).

I have seen #2786 but this only supports credentials sourced from the ~/.aws/credentials file, not the ~/.aws/config file.

Describe the ideal solution

I would like to be able to supply a profile, similar to #2786, which will source credentials from my ~/.aws/config profiles, instead of my ~/.aws/credentials profiles.

[ashutosh-narkar]

Seems like a good addition to the existing ways to fetch AWS creds. Feel free to contribute if you'd like.

[yatesliang]

I would like to try it.
Before starting I want to make sure that what you need is:
There is a provider that reads and uses the specified profile from a config file you provided (for example ~/.aws/config) to call
get-caller-identity and assume-role to generate a short-term credential.

[mbamber]

I don't think we should need to call assume-role here - the AWS SDKs support loading credentials from this file directly - we would just need to essentially copy their implementation

[stale]

This issue has been automatically marked as inactive because it has not had any activity in the last 30 days. Although currently inactive, the issue could still be considered and actively worked on in the future. More details about the use-case this issue attempts to address, the value provided by completing it or possible solutions to resolve it would help to prioritize the issue.

[efiShtain]

@mbamber
I opened this PR to support SSO credentials (from config file)
#7527

it takes a profile and generate the credentials, but it assumes so
will that help your case ?

[mbamber]

@efiShtain thanks for this! I'm unable to test right now, but I've looked through the pr and it looks great!