Does anybody know how to stop Pulumi using system ~/.aws/credentials? I have this defined in my Pulumi.yaml but it doesn’t seem to make any difference?

runtime: go

config:
    pulumi:disable-default-providers: ["*"]

    pulumi:tags:
        value:
            pulumi:template: aws-go

I’m also explicitly creating the provider and using credentials from environment variables, if I run

pulumi up

without providing these environment variables pulumi uses system credentials even though default providers should be disabled?

package internal

import (
	"os"

	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

const (
	PROVIDER_NAME = "custom-aws-provider"
)

func InitAwsProvider(ctx *pulumi.Context) error {
	provider, err := aws.NewProvider(ctx, PROVIDER_NAME, NewAwsProviderArgs(), nil)

	if err != nil {
		return err
	}

	ctx.RegisterStackTransformation(
		func(args *pulumi.ResourceTransformationArgs) *pulumi.ResourceTransformationResult {
			return &pulumi.ResourceTransformationResult{
				Props: args.Props,
				Opts:  append(args.Opts, pulumi.Provider(provider)),
			}
		},
	)

	return nil
}

func NewAwsProviderArgs() *aws.ProviderArgs {
	return &aws.ProviderArgs{
		AccessKey: pulumi.String(os.Getenv("AWS_ACCESS_KEY_ID")),
		SecretKey: pulumi.String(os.Getenv("AWS_SECRET_ACCESS_KEY")),
		Region:    pulumi.String(os.Getenv("AWS_REGION")),
	}
}

That's expected behaviour. If you want it to use only the env vars and the env vars aren't set, then you'll need to throw an exception at that time.

Is there no way I can disable use of local credentials entirely?

The loading of local credentials is part of AWS' SDK, so no, you can't do it "inside" the Provider. You can do it in your

NewAwsProviderArgs

function easily.

Okay, no problem. I’ll verify the existence of the environment variables in that function. What is the purpose of

pulumi:disable-default-providers: ["*"]

in such a case?

I recommend this starting point for the credentials question.: https://leebriggs.co.uk/blog/2022/09/05/authenticating-to-aws-the-right-way

Perfect, I’ll take a look. I appreciate the help 👍

pulumi:disable-default-providers: ["*"]

will cause Pulumi to throw an exception any time a resource is constructed without an explicit provider being passed in.

I see! But since I’m passing the provider in manually that prevents the exception assumably?

Yes

Yeah that makes perfect sense, thanks for explaining!