Using the AWS Credentials File and Credential Profiles

The AWS CLI stores configuration and credentials in plain text files.

The format of the AWS credentials file should look something like the following.

; ~/.aws/credentials
[default]
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

[project1]
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

Each section represents a credential Profile which can be referenced in the Configuration

use AsyncAws\Core\AwsClientFactory;

$client = new AwsClientFactory([
    'profile' => 'project1'
]);

Note: When not defined, AsyncAws will use the profile named default.

The profile can refer to a Role and specify the source of another profile that contains the IAM user credentials with permission to use the role.

; ~/.aws/config:
[profile user1]
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

[profile marketing]
role_arn = arn:aws:iam::123456789012:role/marketing
source_profile = user1

AWS also stores credentials in the config file, which should look like this.

; ~/.aws/config:
[profile default]
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
region=eu-west-1

[profile project2]
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
region=us-west-2

The paths to the credentials and config files can optionally be configured through configuration or environment variables.

export AWS_SHARED_CREDENTIALS_FILE=/path/to/shared_credentials_file
export AWS_CONFIG_FILE=/path/to/config_file

use AsyncAws\Core\AwsClientFactory;

$client = new AwsClientFactory([
    'sharedCredentialsFile' => '/path/to/shared_credentials_file',
    'sharedConfigFile' => '/path/to/config_file',
]);