# S3 repository credentials should use the default credential provider chain if no credentials are provided

**URL:** <https://discuss.gradle.org/t/s3-repository-credentials-should-use-the-default-credential-provider-chain-if-no-credentials-are-provided/11901>\
**Category:** Bugs\
**Created:** [September 28, 2015, 7:53am UTC](https://discuss.gradle.org/t/s3-repository-credentials-should-use-the-default-credential-provider-chain-if-no-credentials-are-provided/11901 "2015-09-28T07:53:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raniz](https://avatars.discourse-cdn.com/v4/letter/r/90ced4/32.png) [@Raniz](https://discuss.gradle.org/u/Raniz)\
**Post date:** [September 28, 2015, 7:53am UTC](https://discuss.gradle.org/t/s3-repository-credentials-should-use-the-default-credential-provider-chain-if-no-credentials-are-provided/11901/1 "2015-09-28T07:53:40Z")

</div>

Looking through the [source code](https://github.com/gradle/gradle/blob/d5051d82502d104806021364b7b92079a294ba27/subprojects/resources-s3/src/main/java/org/gradle/internal/resource/transport/aws/s3/S3Client.java#L24) it looks like the S3 repository support is using the AWS Java SDK.

As it is right now, if no credentials are provided the credentials passed to _AmazonS3Client_ will be null, instead I suggest that the constructor that takes _ClientConfiguration_ as it’s single argument is used if the credentials are null, then the SDK will use the _DefaultCredentialsProviderChain_ which supports (among other things) profile credentials and instance profile credentials (if building on an EC2 instance).

In essence, the suggestion is that row [61 in S3Client.java](https://github.com/gradle/gradle/blob/d5051d82502d104806021364b7b92079a294ba27/subprojects/resources-s3/src/main/java/org/gradle/internal/resource/transport/aws/s3/S3Client.java#L61) is changed from:

```
AmazonS3Client amazonS3Client = new AmazonS3Client(credentials, createConnectionProperties());

```

to

```
AmazonS3Client amazonS3Client;
if(credentials != null) {
    amazonS3Client = new AmazonS3Client(credentials, createConnectionProperties());
} else {
    amazonS3Client = new AmazonS3Client(createConnectionProperties());
}

```

and that calling code (_S3ConnectorFactory_) supports creating the _S3Client_ with null credentials.

---

<div class="post-metadata">

**Author:** ![Adrian\_Kelly](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/adrian_kelly/32/106_2.png) [@Adrian\_Kelly](https://discuss.gradle.org/u/Adrian_Kelly)\
**Post date:** [September 29, 2015, 3:20pm UTC](https://discuss.gradle.org/t/s3-repository-credentials-should-use-the-default-credential-provider-chain-if-no-credentials-are-provided/11901/2 "2015-09-29T15:20:18Z")

</div>

@Raniz we defiantly want to allow more authentication mechanisms for S3 (and other) repositories and we have a [design spec for it](https://github.com/gradle/gradle/blob/master/design-docs/finding-and-using-credentials.md#candidate-stories). Using the `DefaultCredentialsProviderChain` has come up in discussion in the past but we felt it’s not quite the right approach as we want to give build authors the ability to explicitly specify credentials via the DSL.

---

<div class="post-metadata">

**Author:** ![boneill42](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/boneill42/32/3446_2.png) [@boneill42](https://discuss.gradle.org/u/boneill42)\
**Post date:** [October 27, 2015, 2:35pm UTC](https://discuss.gradle.org/t/s3-repository-credentials-should-use-the-default-credential-provider-chain-if-no-credentials-are-provided/11901/3 "2015-10-27T14:35:35Z")

</div>

I’m +1 for @Raniz’s patch that allows the AWS SDK to use the default credentialing mechanism when no credentials are supplied. (in fact – we just forked gradle to make this patch)

Specifically, we want/need to use instance credentials instead of a specific user key+secret.

Is it worth supporting both the new credentials design and default credentialing?

---

<div class="post-metadata">

**Author:** ![daz](https://sea1.discourse-cdn.com/gradle/user_avatar/discuss.gradle.org/daz/32/2475_2.png) [@daz](https://discuss.gradle.org/u/daz)\
**Post date:** [November 11, 2015, 2:06am UTC](https://discuss.gradle.org/t/s3-repository-credentials-should-use-the-default-credential-provider-chain-if-no-credentials-are-provided/11901/4 "2015-11-11T02:06:39Z")

</div>

We want the user to be explicit about the credentials to use, even if that means stating that they want `InstanceCredentials` to be used.

There is [definitely interest in getting this working](https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!msg/gradle-dev/oK6dkewmUW0/KbX3bYbVCAAJ): but the solution will be more involved than the patch above, and will need to include integration test coverage as well.