AWS › AWS CLI & SDKs
How can you use AWS CLI and SDK credential chains to securely manage access across local development, CI/CD pipelines, and production environments?
AdvancedAnswer
AWS CLI and SDKs follow a credential provider chain that checks multiple sources in a defined order, such as environment variables, shared credentials files, and instance or container metadata for assumed roles, which allows the exact same application code to securely authenticate differently depending on where it runs, using a developer's local named profile during development, a CI/CD pipeline's temporary role credentials during deployment, and an EC2 instance role or ECS task role automatically in production, all without hardcoding any credentials.
// No code change needed across environments
// Local: named profile from ~/.aws/credentials
// CI/CD: temporary credentials from OIDC federated role
// Production: EC2 instance role metadataReal-world example A development team writes application code once using the default AWS SDK credential chain, and that same code automatically authenticates using a developer's local profile in development, a GitHub Actions OIDC role in the CI/CD pipeline, and an ECS task role in production, without any environment specific code changes.