Problem/Motivation

If an open_basedir restriction is set, AWS SDK throws an execption while trying to read from ~/.aws/config.

Steps to reproduce

Set open_basedir restriction in php.ini, test S3FS configuration.

Proposed resolution

Disable use of shared config files by setting use_aws_shared_config_files = false in AwsClient config.
OR
Provide option in S3FS configuration form to set the path to a custom AWS config file if the user can't or doesn't want to disable or alter the open_basedir restriction. The given path would be set as AWS_CONFIG_FILE enviroment variable.

Remaining tasks

Write patch (and test).

Issue fork s3fs-3227503

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

fsnet created an issue. See original summary.

fsnet’s picture

fsnet commented

Simple fix added: setting $client_config['use_aws_shared_config_files'] = false; in getAmazonS3Client.

fsnet opened merge request !11

fsnet’s picture

fsnet commented
Assigned: fsnet » Unassigned
cmlara’s picture

cmlara
he/him
commented
Status: Active » Needs work

For some reason I'm having trouble causing these errors to show in my logs in lab in quick testing(possibly because I don't have an actual config file based awsconfig or an EC2 instance) but looking at the AWS SDK bug reports it seems reasonable this error could be occurring.

That said I don't think we should make this an always off as it would be taking out large portions of the defaultProvider() which was intentionally added in #3121830: Use CredentialProvider::defaultProvider rather than individual providers.

At first I was thinking that "Custom Credentials File Location" would solve this but looking at the AWS bug reports I don't think it would.

I'm thinking this would need to be a config setting to disable. I don't think we need to add a custom config file path parameter as that could still be handled with the custom credentials file field or setting environment variables at the server level (respecting how defaultProvider() should function)

cmlara’s picture

cmlara
he/him
commented

Loaded up my main lab and I did see the messages finally to confirm.

Modified the MR to have this as a configuration option instead of always enabled.

cmlara’s picture

cmlara
he/him
commented
Status: Needs work » Needs review
fsnet’s picture

fsnet commented

Thank you for the clarification regarding the defaultProvider() and the configuration option!
Works as expected, only had to correct a typo:
if (!empty($client_config['disable_shared_config_files'])) {

fsnet’s picture

fsnet commented
Status: Needs review » Reviewed & tested by the community

  • cmlara committed ca1c69c on 8.x-3.x authored by fsnet 
    Issue #3227503 by fsnet, cmlara: AWS SDK throws exception if...
cmlara’s picture

cmlara
he/him
commented
Status: Reviewed & tested by the community » Fixed

Thank you for catching the typo and providing the initial root cause and fix.
Merged into dev.

  • cmlara committed ca1c69c on 4.0.x authored by fsnet 
    Issue #3227503 by fsnet, cmlara: AWS SDK throws exception if...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.